-
User Guide for Cisco Security Manager 4.1
-
Preface
-
The Basics of Using Security Manager
-
Getting Started with Security Manager
-
Preparing Devices for Management
-
Managing the Device Inventory
-
Managing Activities
-
Managing Policies
-
Managing Policy Objects
-
Managing FlexConfigs
-
Managing Deployment
-
Troubleshooting Device Communication and Deployment
-
Managing the Security Manager Server
-
Configuring Security Manager Administrative Settings
-
-
Firewall Services and NAT
-
Introduction to Firewall Services
-
Managing Firewall AAA Rules
-
Managing Firewall Access Rules
-
Managing Firewall Inspection Rules
-
Managing Firewall Web Filter Rules
-
Managing Firewall Botnet Traffic Filter Rules
-
Managing Zone-based Firewall Rules
-
Managing Transparent Firewall Rules
-
Configuring Network Address Translation
-
-
VPN Configuration
-
Managing Site-to-Site VPNs: The Basics
-
Configuring IKE and IPsec Policies
-
GRE and DM VPNs
-
Easy VPN
-
Group Encrypted Transport (GET) VPNs
-
Managing Remote Access VPNs: The Basics
-
Managing Remote Access VPNs on ASA and PIX 7.0+ Devices
-
Managing Dynamic Access Policies for Remote Access VPNs (ASA and PIX 7.0+ Devices)
-
Managing Remote Access VPNs on IOS and PIX 6.3 Devices
-
Configuring Policy Objects for Remote Access VPNs
-
Using Map View
-
-
IPS Configuration
-
Getting Started with IPS Configuration
-
Managing IPS Device Interfaces
-
Configuring Virtual Sensors
-
Defining IPS Signatures
-
Configuring Event Action Rules
-
Managing IPS Anomaly Detection
-
Configuring Global Correlation
-
Configuring Attack Response Controller for Blocking and Rate Limiting
-
Managing IPS Sensors
-
Configuring IOS IPS Routers
-
-
PIX/ASA/FWSM Device Configuration
-
Managing Firewall Devices
-
Configuring Bridging Policies on Firewall Devices
-
Configuring Device Administration Policies on Firewall Devices
-
Configuring Device Access Settings on Firewall Devices
-
Configuring Failover
-
Configuring Hostname, Resources, User Accounts, and SLAs
-
Configuring Server Access Settings on Firewall Devices
-
Configuring Logging Policies on Firewall Devices
-
Configuring Multicast Policies on Firewall Devices
-
Configuring Routing Policies on Firewall Devices
-
Configuring Security Policies on Firewall Devices
-
Configuring Service Policy Rules on Firewall Devices
-
Configuring Security Contexts on Firewall Devices
-
- Router and Switch Device Configuration
- Monitoring and Diagnostics
-
Index
-
Feedback
Table Of Contents
Configuring Security Manager Administrative Settings
New or Edit CS-MARS Device Dialog Box
Edit Update Server Settings Dialog Box
Edit Auto Update Settings Dialog Box
Verifying IPS Devices for License Update or Redeployment
License Update Status Details Dialog Box
Add or Edit Status Provider Dialog Box
Configuring Security Manager Administrative Settings
Security Manager has default settings for many system functions that you can change if they do not fit the needs of your organization. To view and change these settings, select Tools > Security Manager Administration. You can then select items from the table of contents on the left of the window to view the default settings related to that item.
On most pages, when you change a setting, you must click Save to save your changes. If you make a mistake, you can click Reset to return the values to the previously saved values. You can also click Restore Defaults to return the settings to the Security Manager defaults.
Besides the pages that contain system defaults, the Security Manager Administration window includes items that relate to system administration activities, such as taking over another user's work or obtaining access to pages in Common Services to perform server security tasks.
The following topics describe the settings and actions available on each of the pages available in the Security Manager Administration window:
AutoLink Settings Page
The Security Manager Map view provides a graphical view of your VPN and layer 3 network topology. Using device nodes to represent managed devices and map objects to represent unmanaged objects such as devices, clouds, and networks, you can create topology maps with which to study your network. AutoLink settings enable you to exclude any one of five private or reserved networks from Map view. For example, you might want to exclude any test networks that are not relevant to the management tasks you are using Security Manager to perform.
Navigation Path
Click Tools > Security Manager Administration and select AutoLink from the table of contents.
Related Topics
•
Creating and Managing Layer 3 Links on the Map, page 31-19
•
Field Reference
Configuration Archive Page
Use the Configuration Archive page to define the default settings for the Configuration Archive tool, including how many configuration versions to save and the TFTP server to use for rolling back Cisco IOS software device configurations.
Navigation Path
Click Tools > Security Manager Administration and select Configuration Archive from the table of contents.
Related Topics
•
•
Field Reference
CS-MARS Page
Use the CS-MARS page to register the Cisco Security Monitoring, Analysis and Response System servers that are monitoring your devices with Security Manager. By registering your CS-MARS servers, you can view messages and events captured in CS-MARS based on a device's firewall access rules or IPS signature rules configured in Security Manager. You must register a CS-MARS server before users can see events collected from it.
Tip
Navigation Path
Select Tools > Security Manager Administration and select CS-MARS from the table of contents.
Related Topics
•
Field Reference
Table 11-3 CS-MARS Page
CS-MARS Devices
The CS-MARS servers that are registered with Security Manager.
•
•
•
When Launching CS-MARS
Allow User to Save Credentials
The type of credentials Security Manager should use to log into CS-MARS when obtaining event information:
•
•
Save button
Saves and applies changes.
Reset button
Resets changes to the last saved values.
New or Edit CS-MARS Device Dialog Box
Use the New or Edit CS-MARS Device dialog box to register a CS-MARS server with Security Manager. Users can obtain messages or event status for a device's firewall or IPS policies from the CS-MARS server that is monitoring the device. For more information, see Registering CS-MARS Servers in Security Manager, page 65-23.
Navigation Path
From the CS-MARS Page, click the Add button to add a new server, or select a server and click the Edit button.
Field Reference
Customize Desktop Page
Use the Customize Desktop page to control whether Security Manager applications close automatically after being idle for a specified time, and to reset whether you are prompted to verify your actions in certain circumstances.
Navigation Path
Select Tools > Security Manager Administration and select Customize Desktop from the table of contents.
Field Reference
Debug Options Page
Use the Debug Options page to configure the severity level of messages to include in debugging logs and to determine what other debugging information is collected.
You should change debugging levels only if the Cisco Technical Assistance Center (TAC) asks you to change them. This makes it possible for you to include more detailed information in the CSMDiagnostics.zip file.
After you change the message level for the appropriate subcomponent, redo the actions that are resulting in system problems. After the problems occur, create the CSMDiagnostics.zip file by selecting Tools > Security Manager Diagnostics. You can then reset the debug options to the default levels so that the Security Manager server does not become bogged down collecting extra debug information. For more information about generating the CSMDiagnostics.zip file, see Creating a Diagnostics File for the Cisco Technical Assistance Center, page 10-24.
By default, logs contain messages of the Error severity or worse. The severity levels in order of severity are:
•
•
•
•
•
Navigation Path
Select Tools > Security Manager Administration, then select Debug Options from the table of contents.
Field Reference
Deployment Page
Use the Deployment page to define the default methods by which Security Manager deploys configurations to devices. You can override some of these settings when you create deployment jobs.
Navigation Path
Select Tools > Security Manager Administration and select Deployment from the table of contents.
Related Topics
•
•
Field Reference
Table 11-7 Deployment Page
Purge Debugging Files Older Than (days)
The maximum number of days the system should keep debugging files. Debug files are automatically deleted. If you decrease the number of days, you can click Purge Now to immediately delete all debugging files older than the number of days specified.
Default Deployment Method
Directory
The method to use as the default method for deploying configurations to devices:
•
•
You can override this method when you create deployment jobs.
When Out of Band Changes Detected
How Security Manager should respond when it detects that changes were made directly on the device CLI since a configuration was last deployed to the device. Out of band change detection works correctly only when deploying to device, not to file, and applies only when the deployment method is configured to obtain the reference configuration from the device (see below for a description of the Reference Configuration setting).
This setting specifies the default action, which you can override when you create deployment jobs. You can choose one of the following:
•
•
•
For a more complete discussion of out-of-band change handling, see Understanding How Out-of-Band Changes are Handled, page 8-12.
Deploy to File Reference Configuration
The configuration that Security Manager uses to compare new policies against the previous configuration for the device, if you are deploying the configuration to a file on the Security Manager server.
•
•
After comparing the configurations, Security Manager generates the correct CLI for deployment.
Deploy to Device Reference Configuration
The configuration that Security Manager uses to compare new policies against the previous configuration for the device, if you are deploying the configuration directly to the device (or to a transport server).
•
•
After comparing the configurations, Security Manager generates the correct CLI for deployment.
Optimize the Deployment of Access Rules For
(IPv4 and IPv6 access rules.)
How firewall rules are deployed. You can choose one of the following:
•
•
Note
Firewall Access-List Names
(IPv4 and IPv6 access rules.)
How ACL names are deployed to devices if the access rule does not have a name in Security Manager.
•
•
Enable ACL Sharing for Firewall Rules
(IPv4 and IPv6 access rules.)
Whether Security Manager should share a single access control list (ACL) for an access rule policy with more than one interface. If you do not select this option, Security Manager creates unique ACLs for every interface to which you apply an IPv4 or IPv6 access rule policy. The sharing of ACLs is done only for ACLs created by access rule policies.
If you select this option, Security Manager evaluates the access rules policy for each interface and deploys the minimum number required to implement your policy while preserving your ACL naming requirements. For example, if you use an interface role to assign the same rules to four interfaces, you specify Reset to CS-Manager generated names for the Firewall Access-List Names property, and you do not specify ACL names for the interfaces in the access control settings policy, only a single ACL is deployed, and each interface uses that ACL.
If you select this option, keep the following in mind:
•
•
•
•
•
Let FWSM Decide When to Compile Access Lists
(IPv4 access rules only.)
Whether to have the Firewall Services Module (FWSM) automatically determine when to compile access lists. Selecting this option might increase deployment speed but traffic might be disrupted and the system might become incapable of reporting ACL compilation error messages. If you select this option, you can use the Optimize the Deployment of Access Rules For Traffic setting to mitigate potential traffic disruptions.
When deselected, Security Manager controls ACL compilation to avoid traffic interruption and to minimize peak memory usage on the device.
Caution
Allow Download on Error
Whether deployments to devices should continue even if there are minor device configuration errors.
Remove Unreferenced Object Groups from Device (PIX, ASA, FWSM, IOS 12.4(20)T+)
(IPv4 and IPv6 objects.)
Whether Security Manager should remove object groups that are not being used by other CLI commands from devices during deployment.
TipCreate Object Groups for Policy Objects (PIX, ASA, FWSM, IOS 12.4(20)T+)
Create Object Groups for Multiple Sources, Destinations or Services in a Rule (PIX, ASA, FWSM, IOS 12.4(20)T+)
Optimize Network Object Groups During Deployment (PIX, ASA, FWSM, IOS 12.4(20)T+)
(IPv4 and IPv6 objects.)
Whether Security Manager should create object groups, such as network objects and service group objects, to replace comma-separated values in a rule table cell for the indicated devices. When deselected, Security Manager flattens the object groups to display the IP addresses, sources and destinations, ports, and protocols for these devices.
TipIf you select this option, you can also select these options:
•
•
Remove Unreferenced Access-lists on Device
(IPv4 and IPv6 access rules.)
Whether to delete any access lists that are not being used by other CLI commands from devices during deployment.
Save Changes Permanently on Device
Whether to save the running configuration to the startup configuration (using the write memory command) after deploying a configuration to a device. This applies to PIX, FWSM, ASA, or Cisco IOS devices. If you deselect this check box, the startup configuration is not changed, which means your configuration changes will be lost if the device reloads for any reason.
Generate ACL Remarks During Deployment
(IPv4 and IPv6 access rules.)
Whether to display ACL warning messages and remarks during deployment.
Preselect Devices with Undeployed Changes
Whether the list of changed devices you see when you create a deployment job has all changed devices preselected. If you deselect this option, users must manually select the devices to include in the deployment job.
Enable Auto Refresh in Deployment Main Panel
Whether the deployment job and schedule status information should be automatically refreshed in the Deployment Manager window. If you deselect this option, you must click the Refresh button to refresh the information manually.
Remove Unreferenced SSL VPN Files on Device
Whether to have Security Manager delete files related to the SSL VPN configuration from the device if the files are no longer referred to by the device's SSL VPN configuration. If you deselect this option, unused files remain on the device after deployment.
Mask Passwords and Keys When Viewing Configs and Transcripts
Mask Passwords and Keys When Deploying to File
The conditions, if any, under which Security Manager will mask the following items so that they cannot be read: passwords for users, enable mode, Telnet, and console; SNMP community strings; keys, including those for TACACS+, Preshared Key, RADIUS server, ISAKMP, failover, web VPN attributes, logging policy attributes, AAA, AUS, OSPF, RIP, NTP, logging FTP server, point-to-point protocol, Storage Key, single sign-on server, load balancing, HTTP/HTTPS proxy, and the IPSEC shared key.
•
•
Save button
Saves and applies changes.
Reset button
Resets changes to the last saved values.
Restore Defaults button
Resets values to Security Manager defaults.
Device Communication Page
Use the Device Communication page to define default settings for communicating with devices. These settings mainly affect device inventory and policy discovery and configuration deployment. You can override the transport settings for individual devices in the device properties for the device.
If you change the transport protocol settings, ensure that your devices are appropriately configured to accept those types of connections.
Navigation Path
Select Tools > Security Manager Administration and select Device Communication from the table of contents.
Related Topics
•
•
•
•
Field Reference
Table 11-8 Device Communication Page
Device Connection Timeout
The number of seconds that Security Manager has to establish a connection with a device before timing out.
Retry Count
The number of times that Security Manager should try to establish a connection to a device before concluding that the connection cannot be completed. The default value is 3.
Socket Read Timeout
For SSH and Telnet sessions, the maximum number of seconds Security Manager can wait for incoming data before concluding that the connection is lost.
Transport Protocol (IPS)
The default transport protocol for IPS sensors and routers that include the IPS feature. The default is HTTPS.
Transport Protocol (IOS Routers 12.3 and above)
The default transport protocol for routers that run Cisco IOS software release 12.3 and above. The default is HTTPS.
Transport Protocol (Catalyst Switch/7600)
The default transport protocol for Catalyst 6500/7600 devices and all other Catalyst switches, regardless of the Cisco IOS software version running on the devices. The default is SSH.
Transport Protocol (IOS Routers 12.2, 12.1)
The default transport protocol for routers that run Cisco IOS software releases 12.1 and 12.2. The default is Telnet.
Connect to Device Using
The type of credentials Security Manager should use when accessing devices. For more information, see Understanding Device Credentials, page 3-4.
•
•
SSL Certificate Parameters
Device Authentication Certificates (IPS)
Device Authentication Certificates (Router)
PIX/ ASA/ FWSM Device Authentication Certificates
Add Certificate button
How to handle device authentication certificates for SSL (HTTPS) communications. You can configure different behaviors for different types of devices, but the settings have the same meaning:
•
•
•
Accept Device SSL Certificate after Rollback
For devices that use SSL, whether to obtain the certificate installed on an IPS device, firewall device, FWSM, ASA, or Cisco IOS router from the device when you roll back the configuration on the device.
HTTPS Port Number
The default port number that the device uses for secure communication with Security Manager (as well as other management applications that use these protocols). This value overrides the HTTPS port number that you configure in the HTTP policy for a device.
Note
In addition to providing access to the device through the Cisco web browser user interface, the HTTPS port number is used by device management applications (such as the Cisco Router and Security Device Manager (SDM)) and monitoring tools to communicate with the device.
Note
Overwrite SSH Keys
Whether Security Manager can overwrite the SSH key for a device when it changes on the device. For SSH connections, a correct key is required for successful communication.
Deselect this check box with caution, and only if you require a greater level of security. Security Manager does not communicate with the device if keys are changed on the device.
Save button
Saves and applies changes.
Reset button
Resets changes to the last saved values.
Restore Defaults button
Resets values to Security Manager defaults.
Add Certificate Dialog Box
Use the Add Certificate dialog box to add device certificates manually for devices that use the SSL transport protocol (firewall devices, FWSMs, ASAs, IPS devices, and Cisco IOS devices). Adding the device certificates manually gives you the highest level of security because then an intruder is prevented from introducing a fraudulent certificate thumbprint. Device certificates are stored in the database to be used for device authentication.
For more information about manually adding SSL certificates, see Manually Adding SSL Certificates for Devices that Use HTTPS Communications, page 9-4.
Navigation Path
Select Tools > Security Manager Administration, select Device Communication from the table of content, and click Add Certificate.
Field Reference
Device Groups Page
Use the Device Groups page to manage the device groups and group types defined in the device inventory.
Navigation Path
Select Tools > Security Manager Administration, then select Device Groups from the table of contents.
Related Topics
•
•
Field Reference
Device OS Management Page
Security Manager includes shortcut commands to access several key features of Resource Manager Essentials (RME). To enable these commands, you must identify the RME server to Security Manager on this page.
Navigation Path
Select Tools > Security Manager Administration and select Device OS Management from the table of contents.
Related Topics
•
•
Field Reference
Discovery Page
Use the Discovery page to define how Security Manager should handle certain types of objects or events during inventory and policy discovery. You can also control how long Security Manager keeps discovery tasks.
Navigation Path
Select Tools > Security Manager Administration and select Discovery from the table of contents.
Field Reference
Table 11-12 Discovery Page
Prepend Device Name when Generating Security Context Names
Whether the name of the device that contains the security context should be added to the front of the security context's name. For example, if a security context is named admin, and it is contained in the device with the display name 10.100.15.16, the name that will appear in the Device selector is 10.100.15.16_admin.
If you do not prepend the device name, the security context name appears in the inventory by itself. Because Security Manager does not place security contexts in a folder related to the parent device, the only way to easily see contexts that are related to a device is to prepend the device name.
If you do not prepend device names, Security Manager adds a numbered suffix to distinguish identically named devices. For example, if the admin context exists in more than one firewall, you will see admin_01, admin_02, and so on, in the Device selector.
Purge Discovery Tasks Older Than
The number of days to save discovery and device-import tasks. Tasks older than the number of days you enter are deleted.
Reuse Policy Objects for Inline Values
Whether to substitute any named policy objects, such as network/host objects already defined in Security Manager, for inline values in the CLI. For more information on policy objects, see Chapter 6, "Managing Policy Objects".
Allow Device Override for Discovered Policy Objects
For certain types of objects, whether to allow users to override the parent object values at the device level for policy objects that are discovered. If you select this option, if you run policy discovery on a device that has an ACL with the same name as an ACL policy object in Security Manager, the name of the discovered policy object is reused, but a device-level override is created for the object. If you deselect this option, a new policy object is created with a number appended to the name.
TipFor more information, see Understanding Policy Object Overrides for Individual Devices, page 6-13.
On Error, Rollback Discovery for Entire Device
Whether Security Manager should roll back all discovered policies if even one error is encountered for a single policy during policy discovery. When deselected, Security Manager keeps the policies successfully discovered and discards only those policies with errors. For more information on policy discovery, see Discovering Policies, page 5-12.
Auto-Expand Object Groups with Prefixes
Expands object groups with the listed prefixes during the device import process. Separate the prefixes with a comma. This expansion causes the elements of the object group to display as separate items in the discovered policies. For more information, see Expanding Object Groups During Discovery, page 12-31.
TipSave button
Saves your changes.
Reset button
Resets changes to the previously applied values.
Restore Defaults button
Resets values to Security Manager defaults.
Event Management Page
Use the Event Management page to enable event management, which allows you to view ASA, FWSM, and IPS events using the Event Viewer. You can also configure settings required for event collection.
The Event Manager service is also required by the Report Manager application, which allows you to view reports that aggregate information collected by the service.
Tip
Navigation Path
Click Tools > Security Manager Administration and select Event Management from the table of contents.
Field Reference
Table 11-13 Event Management Page
Enable Event Management
Whether to enable the Event Manager service, which allows Security Manager to collect event information. If you disable this feature, you cannot use the Event Viewer or Report Manager applications.
TipEvent Data Store Location
The directory to use for collecting event information. This is known as the primary event store. Click Browse to select a directory on the Security Manager server.
If the directory does not yet exist, create it in Windows Explorer. You cannot create the directory from within Security Manager.
TipEvent Data Store Disk Size
The amount of disk space you want to allocate for storing event data, in gigabytes (GB). Events are incrementally deleted (rotated out) from the extended store when it becomes 90% full. Before changing this setting, consider the following:
•
•
Event Syslog Capture Port
The port on which you want to enable syslog event capture. The default is 514.
You must ensure that the Security Manager server, and intervening firewalls, allow incoming traffic on this port for Security Manager to collect the events. Managed devices must be configured to send syslog information to this port on the Security Manager server.
TipEvent Data Pagination Size
The maximum number of events per page each query response can contain. The default is 20000, but you can select a different size from the list of supported values.
Auto Copy Events to Extended Store
Whether you want to define an extended storage location for event storage. Events are copied from the regular event storage location to the extended location so that they remain available for use. When you query for historical events in Event Viewer, events in the extended storage location are automatically retrieved if they are needed.
TipExtended Data Store Location
The location of the extended data store for events. This location can be on directly-attached storage that appears as a drive on the server and that uses DAS protocols. For example, SAN storage attached through fiber channel. CIFS storage is not supported. Click Browse to select the desired drive and directory.
Tips
•
•
Extended Data Store Disk Size
The amount of space you want to allocate to the extended event storage location, in gigabytes (GB). Events are incrementally deleted (rotated out) from the extended store when it becomes 90% full. The size must be equal to or larger than the primary event data storage location.
You can see a visual representation of the amount of space currently used for event data. Open the Event Viewer (Launch > Event Viewer), then from Event Viewer, select Views > Show Event Store Disk Usage.
Error Notification Email IDs
The email addresses that should receive notifications if problems arise with the use of the extended storage location. Separate multiple addresses with commas. For notifications to be sent successfully, you must also configure an SMTP server as described in Configuring an SMTP Server and Default Addresses for E-Mail Notifications, page 1-21.
The message indicates the problem, cause, and recommended action. For example, you get notifications if the extended storage is chronically unreachable, if data copy fails repeatedly, or if a partition was deleted from the primary storage area before it could be copied to the extended storage area (which might happen if the storage is chronically unreachable or if there are persistent copy problems).
Save button
Saves and applies changes.
Most changes require that the Event Manager service briefly stop and then restart. If you change whether the service is enabled, it stops or starts, as appropriate. You are shown a progress indicator.
Reset button
Resets changes to the last saved values.
Restore Defaults button
Resets values to Security Manager defaults.
IPS Updates Page
Use the IPS Updates page to perform administrative tasks associated with keeping your sensors up to date with regard to signatures, minor version updates, and service packs. You can use the IPS Updates page to:
•
•
•
•
Tips
•
•
Navigation Path
Select Tools > Security Manager Administration and select IPS Updates from the table of contents.
Related Topics
•
•
•
•
Field Reference
Table 11-14 IPS Updates Page
Update Status group
Refresh button
Displays the following items. Click Refresh to update the information.
•
•
•
•
•
•
•
Check for Updates button
Download Latest Updates button
These buttons check for updates, or download signature and sensor updates that have not already been downloaded to the Security Manager server, from the IPS Update server. You must configure an IPS Update server before checking for updates or downloading them (click Edit Settings in the Update Server group).
When you click one of these buttons, a dialog box opens to display the results of the operation. Security Manager logs into the IPS Update server, checks for updates, and downloads them if you clicked the Download button. If a Cisco.com download fails, ensure that the account you are using has applied for eligibility to download strong encryption software. For details, see the description of User Name in Edit Update Server Settings Dialog Box.
TipUpdate Server group
Displays the settings used to access Cisco.com or the local server that contains the IPS update packages. The fields indicate whether the update server is Cisco.com or a locally-configured HTTP server, the name of the local server if you are using one, the user account for logging into the server, and the name of the proxy server, if any. To configure or change the IPS Update server, click Edit Settings to open the Edit Update Server Settings dialog box (see Edit Update Server Settings Dialog Box).
For more information, see Configuring the IPS Update Server, page 40-4
Auto Update Settings group
Contains the settings specific to automatic updates. For more information, see Automating IPS Updates, page 40-6.
Auto Update Mode
Establishes whether, and to what extent, automatic updates are performed. Contains the following options:
•
•
•
•
•
By default, auto update is disabled. The other options are a combination of one or more of the following options:
•
•
•
•
Check for Updates
Edit Update Schedule button
The schedule for the actions selected in the Auto Update Mode field. To change the schedule, click Edit Update Schedule and define the schedule in the Edit IPS Updates Schedule dialog box. You can specify that Security Manager perform the updates based on hourly, daily, weekly, or monthly schedules, or specify a one-time event. When entering the start time, use the 24-hour clock and the hh:mm format.
Notify Email
The e-mail address to which notifications of automatic updates are sent. If you enter more than one address, separate the addresses with commas. A notification is sent when an update:
•
•
•
•
Apply Update To
Type
Edit Row button
Devices to be Auto Updated
The selector includes the IPS devices that have local signature policies and the shared signature policies that are defined in Security Manager. The columns in the selector indicate whether a local device policy or a shared policy is selected for these types of updates:
•
•
•
For shared policies, a partial grey checked box indicates that some, but not all, of the devices that use the policy are selected. If you change the devices assigned to the shared policy between automatic update events, the shared policy is grayed out, and only the old assignments are shown on this page. After the update runs, the assignment list will be synchronized with the shared policy device assignments. To update the device list proactively prior to the next auto update run, select the policy and edit it (to select auto update settings), and the device assignment list will be corrected.
Use the Type field to toggle between viewing local and shared policies. Changing the view does not change your auto update selections.
To select a local or shared policy for auto update, select it in the selector and click the Edit Row button below the selector. This opens the Edit Auto Update Settings dialog box, where you can select the types of updates for the policy. When you select any type of auto update for a policy, the affected devices are listed in the Devices to be Auto Updated list to the right of the selector.
Save button
Saves your changes.
Reset button
Resets changes to the last saved values.
Restore Defaults button
Resets values to Security Manager defaults.
Edit Update Server Settings Dialog Box
Use the Edit Update Server Settings dialog box to configure the server to use for obtaining IPS updates. If necessary, you can configure a proxy server for communicating with the update server.
Navigation Path
Select Tools > Security Manager Administration > IPS Updates and click Edit Settings in the Update Server group.
Field Reference
Table 11-15 Edit Update Server Settings Dialog Box
Update From
Whether to get IPS updates from Cisco.com or from a local HTTP/HTTPS server. Your selection changes the fields on the dialog box.
If you select local, you must configure an HTTP or HTTPS server to use as the IPS update server.
IP Address/ Host Name
(Local server only.)
The hostname or IP address of the local IPS update web server.
Web Server Port
(Local server only.)
The port number that your local server listens to for connection requests. The default is 80.
User Name
The username to log into the IPS update server. If you are configuring a local server that does not require a user login, leave this field blank.
If you are specifying a Cisco.com username, the user account on Cisco.com must be eligible for downloading strong encryption software. If you are not certain that the account has the required permissions, use the account to log into Cisco.com and try to download an IPS update file (http://www.cisco.com/cgi-bin/tablebuild.pl/ips5-system). If the account does not have the appropriate permissions, you are prompted to read and accept the required conditions. If you meet the eligibility requirements, you can accept them. Otherwise, talk to your Cisco sales representative for help.
Password
Confirm
The password for the specified username, entered in both fields. If you are configuring a local server that does not require a password, leave these fields blank.
Path to Update Files
(Local server only.)
The path to the IPS update files location on your local server. For example, if update files can be accessed at http://local-server-ip:port/update_files_path/, then enter update_files_path in this field.
Connect Using HTTPS
(Local server only.)
Whether to use SSL when connecting to the local IPS Update server.
Certificate Thumbprint
Displays the certificate thumbprint after it is calculated from the certificate on the local server.
Retrieve From Server
Used to connect to the local server specified in this dialog box, retrieve the certificate from the local server given, and calculate the certificate thumbprint, which is displayed in the Certificate Thumbprint field.
Enable Proxy Server
Whether a proxy server is needed to connect to Cisco.com or to your local server.
IP Address/ Host Name
The hostname or IP address of the proxy server.
You can configure the proxy server to use basic, digest, NT LAN Manager (NTLM) V1, or NTLM V2 authentication. NTLM V2 is the most secure scheme.
Web Server Port
The port number that the proxy server listens to for connection requests. The default is 80.
User Name
The username to log into the proxy server. If the proxy server does not require a user login, leave this field blank.
Password
Confirm
The password for the specified username, entered in both fields. If the proxy server does not require a password, leave these fields blank.
Edit Auto Update Settings Dialog Box
Use the Edit Auto Update Settings dialog box to configure the automatic update options for the device or policy selected in the Apply Update To table on the IPS Updates page. For information on configuring automatic updates, see Automating IPS Updates, page 40-6.
Navigation Path
Select a device or policy on in the Apply Update To table on the IPS Updates page (see IPS Updates Page) and click the Edit Row button.
Field Reference
Licensing Page
Use the Licensing page to manage licenses for the Security Manager application and for IPS devices. For more information, see Managing IPS Licenses, page 40-1.
Navigation Path
Select Tools > Security Manager Administration and select Licensing from the table of contents.
Field Reference
Table 11-17 Licensing Page
CSM tab
The license settings for the Security Manager application. For a description of the fields on this tab, see CSM Tab, Licensing Page.
IPS tab
The license settings for IPS devices managed by Security Manager. For a description of the fields on this tab, see IPS Tab, Licensing Page.
CSM Tab, Licensing Page
Use the CSM tab on the Licensing page to view the list of installed Security Manager licenses and to install new licenses. For more information, see Installing Security Manager License Files, page 10-14.
Navigation Path
Select Tools > Security Manager Administration, select Licensing from the table of contents, and click CSM.
Field Reference
IPS Tab, Licensing Page
Use the IPS tab on the Licensing page to view the list of installed IPS device licenses, to install new or updated licenses, or to redeploy licenses. The license list shows current licenses, unlicensed devices, devices with expired licenses, and devices with invalid licenses.
Navigation Path
Select Tools > Security Manager Administration, select Licensing from the table of contents, and click IPS.
Related Topics
•
•
•
•
•
Field Reference
Verifying IPS Devices for License Update or Redeployment
When you select a device on the Licensing > IPS tab (see IPS Tab, Licensing Page) and try to update the license from Cisco.com (CCO) or redeploy the license, you are first shown a list of devices that will be updated. The name of the dialog box is based on the action you are taking:
•
To successfully update the license using this method, you must have a Cisco.com support contract that includes the serial numbers of the selected devices.
Tip
•
When you click OK, the License Update Status Details dialog box opens so that you can view the status of the license redeployment task. See License Update Status Details Dialog Box.
Navigation Path
To open these dialog boxes, select one or more device on the Tools > Security Manager Administration > Licensing > IPS tab and click Update Selected via CCO or Redeploy Selected Licenses.
Selecting IPS License Files
If you select one or more device on the Tools > Security Manager Administration > Licensing > IPS tab and click Update from License File, you are prompted to select the license file you want to use with the Updating Licenses from File dialog box.
The license file must be stored on a local drive on the Security Manager server. Click Browse to select the license file. You can select multiple license files using Ctrl+click or a range of files using Shift+click. When you have selected the license files you want to use, click OK to apply them to the IPS devices.
License Update Status Details Dialog Box
Use the License Update Status Details dialog box to view the status of an IPS license update task. This dialog box opens whenever you start an update task from the IPS tab of the Licensing page. For more information, see IPS Tab, Licensing Page.
Field Reference
Logs Page
Use the Logs page to configure the default settings for the audit and operations logs. The audit log keeps a record of all state changes that occur in Security Manager.
Navigation Path
Select Tools > Security Manager Administration and select Logs from the table of contents.
Related Topics
•
•
•
Field Reference
Policy Management Page
Use the Policy Management page to select the types of router and firewall policies you will manage in Security Manager. These selections apply to routers and firewall devices, but do not apply to IPS devices. By default, all policies are selected for management.
Unmanaged policies are removed from both Device view and Policy view. Any unmanaged policies, local or shared, are removed from the Security Manager database. The only exception is interface policies, which continue to appear in Security Manager but are marked as read-only policies. For firewall devices, interface and failover settings are considered a unit and are managed or unmanaged together.
For detailed information on managing and unmanaging policy types, including what you should do before and after changing these settings, see Customizing Policy Management for Routers and Firewall Devices, page 5-10.
Caution
Navigation Path
Select Tools > Security Manager Administration and select Policy Management from the table of contents.
Field Reference
Table 11-22 Policy Management Page
Policies to Manage
The policy types are organized in folders, with router and firewall (which includes all ASA, PIX, and FWSM devices) handled separately, and then by category (NAT, Interfaces, and Platform). Select or deselect policy types as desired and click Save. Deselecting the check box for a group of policies deselects all policies in that group. By default, all policies are selected.
Display a warning on all shared policies and imported objects
Whether to add a message to all shared policies and to objects that were imported using the File > Import command. If you select this option, messages appear on the following:
•
•
If you regularly import shared policies, the imported policies and objects replace any same-named policies and objects, so any changes made locally are removed. This message can notify users that policies might be imported and help users identify policy objects that they might not want to edit.
TipSave button
Saves your changes.
If you are unmanaging a policy, you are shown a list of devices that have the policy assigned to them. Security Manager must be able to obtain the required locks to unassign the policy from all devices, or you must manually unassign the policies (or remove the locks) before unmanaging the policy.
If you are managing a previously unmanaged policy, be sure to rediscover all affected devices to bring the existing configurations into Security Manager.
Reset button
Resets changes to the previously applied values.
Restore Defaults button
Resets values to Security Manager defaults.
Policy Objects Page
Use the Policy Objects page to define system defaults related to policy object creation.
Navigation Path
Select Tools > Security Manager Administration and select Policy Objects from the table of contents.
Related Topics
•
•
Field Reference
Table 11-23 Policy Objects Page
When Redundant Objects Detected
The action you want Security Manager to take when you try to create a policy object that has the same definition as an existing object:
•
•
•
Default Source Ports
The port range value that is used as the default source port range for service objects. You can choose one of the following:
•
•
If you change the default source ports, you must manually redeploy any previously deployed devices that might be affected. These changes might not be reflected in any open activities until you refresh the data.
For more information on port list objects, see Configuring Port List Objects, page 6-74.
Enable AutoComplete Dropdown Box
Whether to have Security Manager list matching service and port list names as you type them when you create a service. You can then easily select from names you have already defined. If you deselect AutoComplete, you have to remember the complete service and port list names and type them in yourself.
Save button
Saves your changes.
Reset button
Resets changes to the previously applied values.
Restore Defaults button
Resets values to Security Manager defaults.
Rule Expiration Page
Use the Rule Expiration page to define the default values for policy rule expiration. When you create policies for some types of policy rules (such as access rules), you can set an expiration date for the rule, and Security Manager can notify you by e-mail of the approaching expiration date.
You must configure an SMTP server to enable e-mail notifications. For more information, see Configuring an SMTP Server and Default Addresses for E-Mail Notifications, page 1-21.
Navigation Path
Select Tools > Security Manager Administration and select Rule Expiration from the table of contents.
Field Reference
Server Security Page
Use the Server Security page to open specific pages in the CiscoWorks Common Services application, where you can configure various security features on the Security Manager server. CiscoWorks Common Services controls the basic functions of the Security Manager server, including user access control and system security.
When you log in to Security Manager, your username and password are compared with the account information stored in the CiscoWorks or Cisco Secure Access Control Server (ACS) database, depending on which system you established at installation as your AAA provider. After the authentication of your credentials, you have access according to the role you have been assigned.
For more information on Security Manager roles and privileges, including descriptions of how Common Services roles translate to user functions in Security Manager, see the Installation Guide for Cisco Security Manager.
Navigation Path
Select Tools > Security Manager Administration and select Server Security from the table of contents.
Field Reference
Table 11-25 Server Security Page
AAA Setup button
Opens Common Services and displays the AAA Mode Setup page. From this page, you can set AAA as your fallback sign-on method. For more information about AAA, click Help from the AAA Mode Setup page.
Certificate Setup button
Opens Common Services and displays the Self-Signed Certificate Setup page. CiscoWorks enables you to create self-signed security certificates, which you can use to enable SSL connections between your client browser and management server. For more information about self-signed certificates, click Help from the Certificate Setup page.
Single Sign On button
Opens Common Services and displays the Single Sign-On Setup page. With Single Sign On (SSO), you can use your browser session to transparently navigate to multiple CiscoWorks servers without having to authenticate to each of them. Communication between multiple CiscoWorks servers is enabled by a trust mode addressed by certificates and shared secrets. For more information about setting up SSO, click Help from the Single Sign-On page.
Local User Setup
Opens Common Services and displays the Local User Setup page, from which you can add and delete users, edit user settings, and assign roles or permissions. For more information, click Help from the Local User Setup page and see the Installation Guide for Cisco Security Manager.
System Identity Setup
Opens Common Services and displays the System Identity Setup page. Communication between multiple CiscoWorks servers is enabled by a trust mode addressed by certificates and shared secrets. System Identity setup helps you to create a trust user on servers that are part of a multi- server setup. For more information about system identity setup, click Help from the System Identity Setup page.
Status Page
Use the Status page to select the providers that will provide status to users when they view their inventory status by selecting Tools > Inventory Status. The status is displayed on the Status tab in the Inventory Status window.
By default, Security Manager provides status on deployment to the devices, but you can add Performance Monitor servers if you use them to monitor your network.
Navigation Path
Select Tools > Security Manager Administration and select Status from the table of contents.
Related Topics
•
•
•
Field Reference
Table 11-26 Status Page
Display Deployment Status
Whether to include the status of deployment jobs that include the device.
Providers table
The Performance Monitor servers that are registered with Security Manager. You can add up to five servers.
The provider name appears in the Inventory Status window on the Status tab for individual devices, indicating the server that provided the status. The short name is a nickname.
•
•
•
•
Save button
Saves your changes.
Reset button
Resets changes to the last saved values.
Add or Edit Status Provider Dialog Box
Use the Add or Edit Status Provider dialog box to register a Performance Monitor server with Security Manager. Security Manager can then poll the Performance Monitor servers for event status such as VPN tunnels, device connectivity, and CPU usage threshold. Users can view the status of their devices by selecting Tools > Inventory Status. For more information, see Configuring Status Providers, page 65-16.
Navigation Path
From the Tools > Security Manager Administration > Status page, click the Add (+) button beneath the providers table, or select a provider and click the Edit (pencil) button.
Field Reference
Take Over User Session Page
Use the Take Over User Session page to take over another user's configuration session. A user with administrative privileges can take over the work of another user in non-Workflow mode. Taking over a session is useful when a user is working on devices and policies, causing the devices and policies to be locked, and another user needs access to the same devices and policies. However, when you take over another user's session, your current session is discarded, so make sure that you submit your changes before taking over a session.
The table shows all current configuration sessions, listing the user name and the state of the session, whether the user is currently logged in or logged out. Select the configuration session you want to take over and click Take over session. The session is transferred to you in its current state, including any saved changes the user made during the session.
If the selected user is logged in at the time you take over the session, the user receives a warning message, loses any unsaved changes in progress, and then is logged out.
For more information, see Taking Over Another User's Work, page 10-20.
Navigation Path
Select Tools > Security Manager Administration and select Take Over User Session from the table of contents.
Token Management Page
Use the Token Management page to identify the Token Management System (TMS) server to use for deploying configurations to Cisco IOS routers that use TMS as the communication protocol. Security Manager uses the settings on this page to contact the TMS server.
Security Manager uses FTP to deploy the delta configuration file to the TMS server, from which the configuration file can be downloaded and encrypted onto an eToken.
To use TMS with Cisco IOS routers, you must specify TMS as the transport protocol. You can do this for all routers on the Device Communication page (see Device Communication Page), or for a specific router in its device properties (see General Page, page 3-36). You must also configure the TMS server as an FTP server, otherwise deployment will fail.
Navigation Path
Select Tools > Security Manager Administration and select Token Management from the table of contents.
Related Topics
•
•
Field Reference
VPN Policy Defaults Page
Use the VPN Policy Defaults page to view or assign the default VPN policies that Security Manager uses for each IPsec technology. Before you can select a policy as a default, you must create the policy as a shared policy, submit it to the database and have it approved. You cannot create policies from this page. For detailed information on how to configure these defaults, see Understanding and Configuring VPN Default Policies, page 21-12.
For each tab that relates to a VPN topology, the drop-down lists for each policy type list the existing shared policies that you can select. You can select a policy and click the View Content button to see the definition of that policy. In some cases, you are allowed to make changes, but you cannot save them.
Security Manager uses VPN policy defaults to simplify VPN configuration while ensuring that policy consistency is maintained. Security Manager provides factory default policies for mandatory policies, which provide values for settings that must be configured on the devices in your VPN topology for the VPN to work. Mandatory policies differ depending on the assigned IPsec technology. Factory default policies with their default configurations enable you to deploy to your devices immediately after creating the VPN topology. Default settings are not provided for optional policies. You might want to create shared policies to provide different default settings instead of using the factory default settings.
Navigation Path
Select Tools > Security Manager Administration and select VPN Policy Defaults from the table of contents.
Related Topics
•
Field Reference
Workflow Page
Use the Workflow page to select the workflow mode that Security Manager enforces and to define the default settings for activity and deployment job notifications and logging.
Before changing the workflow mode, read the following topics to understand how the modes differ and the effects of changing the modes:
•
•
•
•
Navigation Path
Click Tools > Security Manager Administration and select Workflow from the table of contents.
Related Topics
•
•
Field Reference
Table 11-30 Workflow Page
Enable Workflow
Whether to enable Workflow mode. When Workflow mode is enabled, you can select whether to have an approver for activities and deployment jobs.
Require Activity Approval
Whether to require that activities be approved explicitly by an assigned approver. For more information about the differences between working with and without an approver, see Activity Approval, page 4-2.
Require Deployment Approval
Whether to require that deployment jobs be approved explicitly by an assigned approver. For more information about the differences between working with and without an approver, see Understanding Deployment, page 8-1.
Sender
The e-mail address that Security Manager will use for sending e-mail notifications.
Activity Approver
The default e-mail address for the person responsible for approving activities. Users can override this address when submitting an activity for approval. For more information, see Submitting an Activity for Approval (Workflow Mode with Activity Approver), page 4-15.
Job/Schedule Approver
The default e-mail address of the person responsible for approving deployment jobs or schedules. Users can override this address when submitting a job or schedule for approval. For more information, see Submitting Deployment Jobs, page 8-36.
Job Completion Notification
The e-mail address of the person who should receive notification when deployment jobs are completed. Users can override this address when creating a deployment job.
Require Deployment Status Notification
Include Job Deployer
Job Completion Notification
Whether to have e-mail notifications sent whenever the status of a deployment job changes. If you select this option, enter the e-mail addresses that should receive notification in the Job Completion Notification field. Separate multiple addresses with commas.
You can also select Include Job Deployer to include the e-mail address of the person who deployed the job on the notification e-mail message.
Keep Activity for
The number of days that activity information should be kept in the Activity table. The default is 30. You can specify from 1 to 180 days.
Click Purge Now to delete all activities older than the number of days specified.
Keep Job for
The number of days that deployment job information should be kept in the Deployment Job table. The default is 30. You can specify from 1 to 180 days.
Click Purge Now to delete all jobs older than the number of days specified.
Keep job per schedule for
The number of days that deployment job information should be kept in the Deployment Job table for each job schedule. This setting applies only to jobs that were initiated by a schedule. The default is 30. You can specify from 1 to 180 days.
Click Purge Now to delete all jobs older than the number of days specified.
Save button
Saves your changes.
Reset button
Resets changes to the previously applied values.
Restore Defaults button
Resets values to Security Manager defaults.
