-
Cisco Virtual Network Management Center GUI Configuration Guide, Release 1.3
-
Preface
-
Overview
-
Cisco VNMC GUI Overview
-
Configuring Primary Authentication
-
Configuring Role-Based Access Control
-
Configuring Trusted Points
-
Configuring VNMC Profiles
-
Configuring VM Managers
-
Configuring Tenants
-
Configuring Security Policies
-
Configuring Device Profiles and Policies
-
Configuring Managed Resources
-
Configuring Backups
-
Index
-
Feedback
Contents
- Configuring Security Policies
- Security Policies
- Security Profile
- Policies
- Configuring Security Profiles
- Adding a Security Profile
- Editing a Security Profile
- Deleting a Security Profile
- Deleting a Security Profile Attribute
- Assigning a Policy
- Unassigning a Policy
- Configuring Security Policy Attributes
- Configuring Object Groups
- Adding an Object Group
- Adding an Object Group Expression
- Editing an Object Group
- Editing an Object Group Expression
- Deleting an Object Group
- Deleting an Object Group Expression
- Configuring a Policy
- Adding a Policy
- Editing a Policy
- Deleting a Rule-Based Policy
- Adding a Rule
- Editing a Rule
- Deleting a Rule
- Deleting a Source or a Destination Condition
- Configuring a Policy Set
- Adding a Policy Set
- Editing a Policy Set
- Deleting a Policy Set
- Configuring Zones
- Adding a vZone
- Editing a vZone
- Deleting a vZone
- Deleting a vZone Condition
- Configuring Security Profile Dictionary
- Adding a Security Profile Dictionary
- Adding a Security Profile Dictionary Attribute
- Editing a Security Profile Dictionary
- Editing a Security Profile Dictionary Attribute
- Deleting a Security Profile Dictionary
- Deleting a Security Profile Dictionary Attribute
Configuring Security Policies
This chapter includes the following sections:
Security Policies
Cisco VNMC security policies provide options to create security profiles and policies. A security profile and policies can be configured at any organizational level.
Security Profile
A Cisco VNMC security profile is a set of custom security attributes and one assigned policy set. The security profile is added to the port profile for the Nexus 1000V VSM. The port profile is assigned to the Nexus 1000V VSM vNic, making the security profile part of the virtual machine (VM). Adding a security profile to the VM allows the addition of custom attributes to the VM. Firewall rules can be written using custom attributes such that traffic between VMs can be allowed to pass or be dropped. You can also add security policies in the same GUI pane where you are adding security profiles.
There is a pre-configured default security profile at root level. The default security profile points to the default policy set. The default security profile can be edited but cannot be deleted.
Policies
A Cisco VNMC supports a number of policies. The policies are as follows:
- Policy set—The policy set contains the policy, the rule, the zone, and the object group. Once the policy set is created, it can be assigned to a security profile. An existing default policy set is automatically assigned at system boot up.
- Policy—A policy contains rules. A policy can contain rules that can be ordered. An existing default policy is automatically assigned at system boot up. The default policy has a default rule that has an action as drop.
- Rule—A rule contains the conditions for regulating traffic. The default policy has a default rule that has an action as drop. Conditions for a rule can be set using the network, custom, and virtual machine attributes.
- Object group—An object group object can be created under an organization node. It defines a collection of condition expressions on a specific system defined or on a custom attribute. An object group can be referred in a policy rule condition when a member or not-member operator is selected. The rule condition referring to the object group evaluates to true if any of the expressions in the object group evaluate to true.
- Security Profile Dictionary—A Cisco VNMC security profile dictionary is a logical collection of security attributes. You define dictionary attributes for use in a security profile. A security profile dictionary is created at the root or tenant node. You can only create one dictionary for a tenant and only one dictionary for the root. The security profile dictionary allows the user to define names of custom attributes. Custom attribute values are specified on security profile objects. Custom attributes can be used to define policy rule conditions. Attributes configured in a root level dictionary can be used by any tenant. Creation of a dictionary below tenant level is not supported.
- Zone—A zone defines a set of virtual machines based on conditions. The zone name is used in the authoring rules.
Security policies are created and then pushed to the Cisco VSG.
Configuring Security Profiles
Adding a Security Profile
Procedure
Editing a Security Profile
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Work pane, click the security profile you want to edit. Step 5 Click the Edit link. Step 6 In the Edit Security Profile dialog box, General tab area, modify the following fields as appropriate:
Name Description Name field
The name of the security profile.
Description field
A user-defined description of the object.
Policy Set drop-down list
A selectable drop-down list of policy sets.
Resolved Policy Set field
A link to edit the resolved policy set.
Table 2 Resolved Policies Area Name Description (Un)assigned Policy column
The link to a dialog box where you can assign or unassign policies.
Source Condition column
Contains the source condition specified.
Destination Condition column
Contains the destination condition specified.
Protocol column
Contains the protocol specified.
Ethertype column
Contains the Ethertype specified.
Action column
Contains the action specified for the rule.
Description column
A description of the component.
Step 7 In the Edit Security Profile dialog box, Attributes tab area, modify the following fields as appropriate: Step 8 Click OK.
Deleting a Security Profile
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand. Step 4 In the Work pane, click the security profile you want to delete. Step 5 Click the Delete link. Step 6 In the Confirm dialog box, click OK.
Deleting a Security Profile Attribute
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand. Step 4 In the Navigation pane, click the security profile that contains the attribute you want to delete. Step 5 In the Work pane, click the Attributes tab. Step 6 Click the attribute you want to delete. Step 7 Click the Delete link. Step 8 In the Confirm dialog box, click OK.
Assigning a Policy
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Navigation pane, click the profile where you want to assign the policy. Step 5 In the Work pane, click the (Un)assign Policy link. Step 6 In the (Un)assign Policy dialog box, move the policy you want assigned to the Assigned list. Step 7 Click OK.
Unassigning a Policy
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Navigation pane, click the profile where you want to unassign the policy. Step 5 In the Work pane, click the (Un)assign Policy link. Step 6 In the (Un)assign Policy dialog box, move the policy you want unassigned to the Available list. Step 7 Click OK.
Configuring Security Policy Attributes
Configuring Object Groups
Adding an Object Group
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand. Step 4 In the Work pane, click the Add Object Group link.
Note Step 5 In the Add Object Group dialog box, complete the following fields:
Name Description Name field
The name of the object group.
This name can be between 1 and 32 identifier characters. You can use alphanumeric characters including hyphen, underscore, dot, and colon. You cannot change this name after it is saved.
Description field
A description of the object group.
This description can be between 1 and 256 identifier characters. You can use alphanumeric characters including hyphens, underscore, dot, and colon. You cannot change this description after it is saved.
Attribute Type drop-down list
The attribute types available to select.
Attribute Name drop-down list
The attribute names available to select.
Add Attribute link
The link opens a dialog box where you can add an attribute.
Resolved Attribute field
The resolved attribute link.
Step 6 Click OK.
Adding an Object Group Expression
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Work pane, click the Add Object Group link.
Note Step 5 In the Add Object Group dialog box, click the Add link: Step 6 In the Add Object Group Expression dialog box, complete the following fields: Step 7 Click OK.
Editing an Object Group
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand. Step 4 In the Work pane, click the object group you want to edit. Step 5 Click the Edit link. Step 6 In the Edit Object Group dialog box General tab area, edit the appropriate fields:
Name Description Name field
The name of the object group.
This field cannot be edited on this tab.
Description field
The description of the object group.
This description can be between 1 and 256 identifier characters. You can use alphanumeric characters including hyphens, underscore, dot, and colon. You cannot change this description after it is saved.
Attribute Type drop-down list
A list that contains attribute types.
Attribute Name drop-down list
A list that contains attribute names
Step 7 Click OK.
Editing an Object Group Expression
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand and click the object group where you want to edit an expression. Step 4 In the Work pane, click the Edit link in the Expression area. Step 5 In the Expressions area, click the expression you want to edit. Step 6 In the Edit Expression dialog box modify the appropriate fields: Step 7 Click OK.
Deleting an Object Group
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Navigation pane, click the Object Groups node. Step 5 In the Work pane, click the object group you want to delete. Step 6 Click the Delete link. Step 7 In the Confirm dialog box, click Yes.
Deleting an Object Group Expression
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Navigation pane, click the object group that contains the expression you want to delete. Step 5 In the Expression area, click the expression you want to delete. Step 6 Click the Delete link. Step 7 In the Confirm dialog box, click Yes.
Configuring a Policy
Adding a Policy
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Work pane, click the Add Policy link. Step 5 In the Add Policy dialog box, complete the following fields:
Name Description Name
The name of the policy.
This name can be between 1 and 32 identifier characters. You can use alphanumeric characters including hyphen, underscore, dot, and colon. You cannot change this name after it is saved.
Description
The description of the policy.
This description can be between 1 and 256 identifier characters. You can use alphanumeric characters including hyphens, underscore, dot, and colon. You cannot change this description after it is saved.
Table 4 Rules Area Name Description Add Rule link
Opens a dialog box that allows you to add a rule.
Up and Down arrows
Changes the priority of the selected policies.
Name column
Contains the rule names.
Source Condition column
Contains the source condition specified
Destination Condition column
Contains the destination condition specified
Protocol column
Contains the protocol specified
Ethertype column
Contains the EtherType specified
Action column
Contains the action specified for the rule.
Description column
Contains a description for the rule.
Step 6 Click OK.
Editing a Policy
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Work pane, click the policy you want to edit. Step 5 Click the Edit link. Step 6 In the Edit Policy dialog box, General tab area, modify the following fields as appropriate:
Table 5 Rules Area Name Description Add Rule link
Opens a dialog box that allows you to add a rule.
Up and Down arrows
Changes the priority of the selected policies.
Name column
Contains the rule names.
Source Condition column
Contains the source condition specified
Destination Condition column
Contains the destination condition specified
Protocol column
Contains the protocol specified
Ethertype column
Contains the EtherType specified
Action column
Contains the action specified for the rule.
Description column
Contains a description for the rule.
Step 7 Click Apply, and then click OK.
Deleting a Rule-Based Policy
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Work pane, click the policy you want to delete. Step 5 Click the Delete link. Step 6 In the Confirm dialog box, click Yes.
Adding a Rule
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand. Step 4 In the Work pane, click the Add Policy link.
Note Step 5 In the Add Policy dialog box, click the Add Rule link. Step 6 In the Add Rule dialog box, complete the following fields:
Name Description Name field
The name of the rule.
This name can be between 1 and 32 identifier characters. You can use alphanumeric characters including hyphen, underscore, dot, and colon. You cannot change this name after it is saved.
Description field
The description of the rule.
This description can be between 1 and 256 identifier characters. You can use alphanumeric characters including hyphens, underscore, dot, and colon. You cannot change this description after it is saved.
Action to Take area
The area in which you manage actions.
- drop radio button—Click to set the action to drop.
- permit radio button—Click to set the action to permit.
- reset radio button—Click to set the action to reset.
You can also check the log check box to enable logging.
Protocol area
The area in which you set the protocol.
Ether Type area
The area in which you set the Ethernet type.
Step 7 In the Source Conditions area, click the Add link to open the Add Source Condition dialog box, and choose the fields as appropriate: Step 8 In the Destination Conditions area, click the Add link to open the Add Destination Condition dialog box, and choose the fields as appropriate: Step 9 Click OK.
Editing a Rule
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand where you want to edit a rule. Step 4 In the Work pane, click the Rule_name you want to edit. Step 5 Click the Edit link. Step 6 In the Edit Rule dialog box General tab area, modify the fields:
Step 7 Click OK. Step 8 In the Policy_name dialog box, click Save.
Deleting a Rule
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Work pane, click the Policy where you want to delete a rule. Step 5 Click the Edit link. Step 6 In the Edit Policy dialog box, click the rule you want to delete. Step 7 Click the Delete link. Step 8 In the Confirm dialog box, click Yes.
Deleting a Source or a Destination Condition
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . In the Navigation pane, click the policy that contains the source or destination condition you want to delete.
Step 4 In the Navigation pane, click the policy that contains the source or destination condition you want to delete. Step 5 In the Work pane, click the Edit Rule link. Step 6 In the Edit Rule dialog box, click the source or a destination condition you want to delete. Step 7 Click the Delete link in the associated area. Step 8 In the Confirm dialog box, click Yes.
Configuring a Policy Set
Adding a Policy Set
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand .
Note Step 4 In the Work pane, click the Add Policy Set link. Step 5 In the Add Policy Set dialog box, General tab area, complete the following fields, and optionally, move policies between the Available and Assigned areas:
Name Description Name field
A name for the component.
This name can be between 1 and 32 identifier characters. You can use alphanumeric characters including hyphen, underscore, dot, and colon. You cannot change this name after it is saved.
Description field
A user-defined description of the component.
This description can be between 1 and 256 identifier characters. You can use alphanumeric characters including hyphens, underscore, dot, and colon. You cannot change this description after it is saved.
Table 10 Policies Area Name Description Add Policy link
Opens a dialog box that allows you to add a policy.
Up and Down arrows
Changes the priority of the selected policies.
Available column
Lists the policies created and available.
Use arrows between the columns to move policies to the Assigned column.
Assigned column
Lists the policies assigned to the policy set.
Use arrows between the columns to move policies to the Available column.
Step 6 In the Add Policy Set dialog box, click OK.
Editing a Policy Set
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Work pane, click the policy set you want to edit. Step 5 Click the Edit link. Step 6 In the Edit Policy Set dialog box, General tab area, modify the following fields as appropriate:
Name Description Name field
A name for the component.
Description field
A user-defined description of the component.
Table 11 Policies Area Name Description Add Policy link
Opens a dialog box that allows you to add a policy.
Up and Down arrows
Changes the priority of the selected policies.
Available column
Lists the policies created and available.
Use arrows between the columns to move policies to the Assigned column.
Assigned column
Lists the policies assigned to the policy set.
Use arrows between the columns to move policies to the Available column.
Step 7 Click OK.
Deleting a Policy Set
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Work pane, click the policy set you want to delete. Step 5 Click the Delete link. Step 6 In the Confirm dialog box, click Yes.
Configuring Zones
Adding a vZone
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand. Step 4 In the Navigation pane, click the vZones node.
Note Step 5 In the Work pane, click the Add vZone link. Step 6 In the Add vZone dialog box, complete the following fields:
Name Description Name field
The name of the vZone.
This name can be between 1 and 32 identifier characters. You can use alphanumeric characters including hyphen, underscore, dot, and colon. You cannot change this name after it is saved.
Description field
The description of the vZone.
This description can be between 1 and 256 identifier characters. You can use alphanumeric characters including hyphens, underscore, dot, and colon. You cannot change this description after it is saved.
Step 7 Click the Add link in the vZone Condition area and complete the following tasks:
Step 8 In the Add vZone dialog box, click OK.
Editing a vZone
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand node. Step 4 In the Navigation pane, click the vZones node. Step 5 In the Work pane, click the vzone you want to edit. Step 6 Click the Edit link. Step 7 In the Edit Zone dialog box General tab area, change the appropriate fields: Step 8 In the Edit Zone dialog box vZone Conditions area, do the following:
Step 9 In the Edit vZone dialog box, click OK.
Deleting a vZone
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Navigation pane, click the node. Step 5 In the Work pane, click the vZone you want to delete. Step 6 Click the Delete link. Step 7 In the Confirm dialog box, click Yes.
Deleting a vZone Condition
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Navigation pane, click the vZone that contains the condition you want to delete. Step 5 In the Work pane, click the Edit link. Step 6 In the Edit vZone dialog box, vZone Condition area, click the condition you want to delete. Step 7 Click the Delete link. Step 8 In the Confirm dialog box, click Yes. Step 9 In the Edit vZone dialog box, click Apply.
Configuring Security Profile Dictionary
Adding a Security Profile Dictionary
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand node. Step 4 In the Work pane, click the Add Security Profile Dictionary link.
Note You can create a security profile dictionary at the root or Tenant level.
Step 5 In the Add Security Profile Dictionary dialog box, complete the following fields as appropriate:
Name Description Name field
The name of the security profile.
This name can be between 1 and 32 identifier characters. You can use alphanumeric characters including hyphen, underscore, dot, and colon. You cannot change this name after it is saved.
Description field
A description of the security profile.
This description can be between 1 and 256 identifier characters. You can use alphanumeric characters including hyphens, underscore, dot, and colon. You cannot change this description after it is saved.
Policy Set drop-down list
A selectable drop-down list of policy sets.
Add Policy Set link
A link to add a policy set.
Resolved Policy Set field
A link to edit the resolved policy set.
Step 6 Click OK.
Adding a Security Profile Dictionary Attribute
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand to view and select the appropriate Security Profile Dictionary_name. Step 4 In the Work pane, click the Edit link to open the Edit Security Profile Dictionary dialog box. Step 5 In the Edit Security Profile Dictionary dialog box, click the Add Attribute link. Step 6 In the Add Attribute dialog box, complete the following fields:
Name Description Name field
The name of the Security Profile Dictionary attribute.
This name can be between 1 and 32 identifier characters. You can use alphanumeric characters including hyphen, underscore, dot, and colon. You cannot change this name after it is saved.
Description field
A description of the Security Profile Dictionary attribute.
This description can be between 1 and 256 identifier characters. You can use alphanumeric characters including hyphens, underscore, dot, and colon. You cannot change this description after it is saved.
Step 7 Click OK.
Editing a Security Profile Dictionary
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand . Step 4 In the Work pane, click the security profile dictionary you want to edit. Step 5 Click the Edit link. Step 6 In the Edit Security Profile Dictionary dialog box, modify the fields as appropriate: Step 7 Click OK.
Editing a Security Profile Dictionary Attribute
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand node. Step 4 In the Work pane, click the security profile dictionary that contains the attribute you want to edit. Step 5 Click the Edit link. Step 6 In the Edit Security Profile Dictionary dialog box, Attributes area, click the attribute you want to edit. Step 7 Click the Edit link. Step 8 In the Edit Attribute dialog box, modify the following fields as appropriate: Step 9 Click OK. Step 10 In the Edit Security Profile Dictionary dialog box, click OK.
Deleting a Security Profile Dictionary
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand node. Step 4 In the Work pane, click the security profile dictionary you want to delete. Step 5 Click the Delete link. Step 6 In the Confirm dialog box, click OK.
Deleting a Security Profile Dictionary Attribute
Procedure
Step 1 In the Navigation pane, click the Policy Management tab. Step 2 In the Navigation pane, click the Security Policies subtab. Step 3 In the Navigation pane, expand. In the Navigation pane, click the dictionary that contains the attribute you want to delete.
Step 4 In the Work pane, click the Edit link. Step 5 In the Edit Security Profile Dictionary dialog box, Attributes area, click the attribute you want to delete. Step 6 Click the Delete link. Step 7 In the Confirm dialog box, click OK.