Quick Start Guide for the VPN/Security Management Solution 2.1
Configuration Basics
Download this chapter
Configuration BasicsConfiguration Basics
give_us_feedback

Table of Contents

Configuration Basics
Configuring PIX MC
 Configuring IDS MC
 Configuring Security Monitor

Configuration Basics

This chapter guides you through a sample set of PIX MC, IDS MC, and Security Monitor configuration tasks. After you complete these tasks, you should understand the basic workflow that is required to plan large-scale deployments of managed devices and the tasks that you must perform to manage those devices.

This chapter assumes that you have bootstrapped at least one PIX Firewall and one IDS Sensor and that you have installed CiscoWorks Common Services, PIX MC, IDS MC, and Security Monitor.

Configuring PIX MC

This section presents the procedures that you must perform to complete the initial configuration of the PIX MC and your PIX Firewall, enable monitoring of syslog messages using Security Monitor, and push the resulting command sets to that device. You must use the PIX MC to perform the procedures in this section and you must perform them in the following order, unless otherwise noted.

Tip As described in the next section, most tasks that you perform are bounded within an activity, which labels all the changes that you make within a high-level, accountable event. You must approve activities before you submit them via a job, which, like an activity, is an accountable event for publishing configuration changes to a device.

1. Importing the PIX Firewall Configuration

2. Defining the Interfaces for a New PIX Firewall

3. Configuring the PIX Firewall to Send Syslog Messages to Security Monitor

4. Updating the Active Configuration on a PIX Firewall

Importing the PIX Firewall Configuration

To import the configuration from your bootstrapped PIX Firewall into your PIX MC, you must first define an activity, which will be used for most of the procedures in this section. Then, you can use the Importing Device Wizard to complete the initial import.

To import the PIX Firewall configuration, follow these steps:

Step 1   Log in to the PIX MC server.

Step 2   Select Workflow > Activity Management.

The Activity Management page appears.

Step 3   Click Add.

The Creating New Activity dialog box appears.


Step 4   Enter the name for this activity in the New Activity Name field, and then press Tab.

An activity name should describe, at a high-level, the goal of the task you want to accomplish, such as Initial Setup of <firewall_hostname>. You can provide a more detailed description in the Initial Activity Comment field.

Step 5   Enter a description of the tasks this activity will include in the Initial Activity Comment field, and then click OK.

By providing a complete description of what you intend to accomplish with a given activity, you provide better audit logs and set the expectations for other administrators who may approve or deploy the generated configurations to the device.

Note    All comments are optional.

The new activity appears in the Activity Management table.

Step 6   Define a group to import the configuration to. Groups organize multiple devices that have related or common configurations. For the purpose of this example, we use the Global group, which is the highest-level group. Typically, you define global common settings at this level, and define lower level groups that apply exceptional or unique settings.

To add a new group, follow these steps:

a. Select Devices > Managing Groups.

The Managing Groups page appears.


b. Select Global, and then click Add.

Note    Structure your groups the way you want before deploying them. After you add a new group, you cannot relocate it under another group.

The Define Group Information page appears.


c. Enter the name of the group in the Group Name field, and then press Tab.

d. Enter a description of this group in the Group Description field, and then click Next.

Note    All descriptions are optional.

The Wizard Summary page appears.

e. Ensure that the information you entered is correct, and then click Finish.

The Managing Groups page appears and your new group is shown under Global.

Step 7   To import the configuration from the PIX Firewall, follow these steps:

a. Select Devices > Importing Devices.

The Importing Devices page appears, and the activity that you created appears in the Activity bar.

b. Click Import on the Importing Devices page.

The Select Target Group page appears, prompting you to select a target group.


c. In Select Import Group select the group you just created, and then click Next.

The Select Import Type page appears.


d. Select the Import configuration from device radio button on the Select Import Type page, and then click Next.

This option specifies that you want PIX MC to connect to and discover the settings on a PIX Firewall.

The Define PIX Firewall Contact Info page appears.


e. In the Contact IP Address field, type the IP address assigned to the outside interface of this PIX Firewall, and then press Tab.

During the bootstrapping procedure, you specified this IP address for the inside interface. The inside interface is the one for which you used the setup command to automatically enable HTTP access. See Bootstrapping PIX Firewalls.

f. Enter the enable password for this PIX Firewall in the Enable Password field, and then click Next.

The Wizard Summary page appears.

g. Verify that the Contact IP Address value is correct in Wizard Summary, and then click Finish.

The Import Configuration Status window appears and reports the status of the import.

Step 8   Click Refresh or wait 60 seconds for it to refresh automatically to view the updated import status.

The import status appears next to the hostname of the PIX Firewall.

Note    After you complete this procedure, follow these guidelines:



Defining the Interfaces for a New PIX Firewall

If you used the procedure presented in Bootstrapping a New PIX Firewall to bootstrap a new PIX Firewall, you must define the remaining interfaces in that device. The setup command only configures the addresses and name associated with the inside interface of the PIX Firewall.

Tip If you imported an existing PIX Firewall, you do not need to complete this procedure unless you wish to change the settings defined for the remaining interfaces.

Before You Begin

To successfully complete this procedure, verify that you have the following information before proceeding with Step 1:

  • The type and slot number of each network interface.
  • The speed (type of physical connection) and maximum transmission unit (MTU) of the network attached to the interface.
  • The name, IP address, and network mask pair to assign to each remaining interface.
Note    To ensure optimal performance, we strongly recommend that you keep the default settings for the inside and outside interface, specifically the names and the default security levels of 100 and 0, respectively.
  • The default gateway IP address and hop metric for each interface.

To define additional interfaces in the PIX Firewall, follow these steps:

Step 1   Select Configure > Settings.

The Settings page appears.

Note    The activity you defined in Importing the PIX Firewall Configuration, appears in the Activity bar.

Step 2   In the TOC, click the Object Selector handle.

Step 3   In the Object Selector, select the hostname of the PIX Firewall for which you imported the device configuration. You may need to expand the Object tree to view the desired object.

The Object Selector closes, and the Scope narrows to the specific PIX Firewall on the Settings page.

Step 4   In the TOC, select Interfaces.

The Interfaces page appears.


Step 5   To add an interface for the new PIX Firewall, follow these steps:

a. Click Add.

The Add Interface Name page appears.


b. Enter the value for the interface type in the Hardware ID field.

Type values are:

  • ethernetn—Identifies an Ethernet interface and the position and occurrence based on type.
  • gb-ethernetn—Identifies a Gigabit Ethernet interface and the position and occurrence based on type.
Note    The n represents the n-1 occurrence of an interface of that specific type. For example, if you have two Ethernet interfaces, the type values must be ethernet0 and ethernet1, which match the slot placement in this case. If you had an Ethernet interface, a GigaBit Ethernet interface, and another Ethernet interface, the type values must be ethernet0, gb-ethernet0, and ethernet1, respectively.

c. Select the Enable check box in the Interface field.

d. Enter the logical name for this interface in the Interface Name field.

We recommend that you use the following interface names, unless you are an expert user:

  • inside—Connects to your internal network. Must be most secure interface. (See Step g.)
  • dmz—Demilitarized zone (Intermediate interface). Also known as a perimeter network.
  • outside—Connects to an external network or public Internet. Must be least secure interface. (See Step g.)

e. Select the speed option that matches this Ethernet interface in the Speed list box.

The following options are available:

  • 10baset—Set for 10-Mbps Ethernet half-duplex communication.
  • 10full—Set for 10-Mbps Ethernet full-duplex communication.
  • 100basetx—Set for 100-Mbps Ethernet half-duplex communication.
  • 100full—Set for 100-Mbps Ethernet full-duplex communication.
  • 1000sxfull—Set for 1000-Mbps Gb Ethernet full-duplex operation.
  • 1000basesx—Set for 1000-Mbps Gb Ethernet half-duplex operation.
  • 1000auto—Set for 1000-Mbps Gb Ethernet to auto-negotiate full-duplex or half -duplex.
  • aui—Set for 10-Mbps Ethernet half-duplex communication with an AUI cable interface.
  • bnc—Set for 10-Mbps Ethernet half-duplex communication with a BNC cable interface.
  • auto—Set Ethernet speed automatically. Use this option only with the Intel 10/100 automatic speed sensing network interface card.
Note    We recommend that you specify the speed of the network interfaces in case your network environment includes switches or other devices that do not handle auto-sensing correctly.

f. Enter the maximum transmission unit in the MTU (bytes) field.

This value depends on the type of network connected to the interface and ranges from 64 to 65,535. The default value for Ethernet networks is 1500.

g. Enter the security level to assign to this interface in the Security Level (0-100) field.

Security level values range between the lowest 0 (outside) and the highest 100 (inside). Because the PIX MC applies a default set of rules to an interface, the remaining security levels matter only if you plan to use dynamic NAT between two or more interfaces. You can define a dynamic NAT rule only for an interface that has a higher security level than the interface on which the traffic goes out, which has the global IP address pool assigned to it. Static NAT rules can be defined between interfaces of any security level.

h. If the selected interface is the outside interface and you want to enable DHCP on the outside interface, allowing the PIX Firewall to contact a DHCP server for the IP address and netmask to dynamically assign to this interface, select the DHCP radio button in the DHCP field.

If you do not want to enable DHCP or if this interface is not the outside interface, select the Static radio button in the DHCP field.

i. Click Next.

If you did not enable DHCP on this interface, the Add Static Address Information page appears. In this case, skip to Step n.


If you did enable DHCP on this interface, the Add DHCP Information page appears. In this case, continue with Step j.


j. To dynamically assign the default route to this interface via DHCP, select the Enable check box in the DHCP Set Route field.

If you do not derive the default route for the outside interface from the provided DHCP information, you must manually define a route (see the "Configuring Routing" section in Using Management Center for PIX Firewalls 1.0 and Auto Update Server 1.0).

k. To enable this interface to repeat the attempt to get a DHCP lease from the DHCP server (in the event the first attempt fails), select the Enable check box in the DHCP Retry field.

l. To specify the maximum number of times that this interface can attempt to get a DHCP lease before failing and generating an error message, type that value in the Retry Count field, and then click Next.

The expected value is a number between 4 and 16.

The Wizard Summary page appears.

m. Skip to Step p.

n. Enter the IP address that you want to statically assign to this interface in the IP Address field, and then press Tab.

o. Enter the bit mask value for the attached network in the Mask field, and then click Next.

The mask value identifies the bit mask for the network that corresponds to the IP address that you specified in the IP Address field. You can express this value in dotted decimal notation (for example, 255.255.255.0) or in CIDR (Classless Inter Domain Routing) notation (for example, /24).

The Wizard Summary page appears.

p. Verify the information presented in the Wizard Summary page, and then click Finish.

The Interfaces page appears, and the interface that you defined appears in the Interfaces table.

Step 6   For each interface installed in the PIX Firewall, repeat Step 5.

Note    You must configure at least the inside interface and the outside interface for the PIX Firewall to function properly.



Configuring the PIX Firewall to Send Syslog Messages to Security Monitor

To generate meaningful reports about the network activity of a PIX Firewall and to monitor the security events associated with that device, you must select the appropriate log level that generates the syslog details required to track session-specific data. From the Syslog page, you can specify that you want to enable logging, specify the log level, and specify the log facility for the selected PIX Firewall.

Note   The log levels generated by the PIX Firewall are listed in the Level list box. This list is ordered to indicate the severity of events recorded; each subsequent (higher level) log level option includes all the events generated by the previous log level in that list.

To configure the syslog settings for a PIX Firewall, follow these steps:

Step 1   Select Configure > Settings.

The Settings page appears.

Note    The activity you defined in Importing the PIX Firewall Configuration, appears in the Activity bar.

Step 2   In the TOC, click the Object Selector handle.

Step 3   In the Object Selector, select the hostname of the PIX Firewall for which you imported the device configuration. You may need to expand the Object tree to view the desired object.

The Object Selector closes, and the Scope narrows to the specific PIX Firewall on the Settings page.

Step 4   In the TOC, click Logging to expand the menu, and then select Syslog.

The Syslog page appears.


Step 5   To specify syslog settings rather than inherit them, deselect the Inherit Settings from check box, and then click OK to close the confirmation message that appears.

The Syslog Setup fields become active.

Step 6   To specify the facility value that you want this PIX Firewall to use when generating syslog data streams, select that value in the Facility list box under Syslog Setup.

The syslog facility is useful when you have a central syslog monitoring system that needs to distinguish among the various network devices that generate syslog data streams. This list box presents a list of values that enable you to uniquely identify the syslog facility for the selected PIX Firewall. This value is included in any syslog messages that are generated by this PIX Firewall.

Step 7   To specify the level of syslog messages that you want this PIX Firewall to generate, select that level in the Level list box under Syslog Setup.

This value identifies the syslog logging level generated by the PIX Firewall. You can specify one of the following values for this box:

  • Disabled—Disables the generation of syslog messages. This value is the default value.
  • Emergencies—(level 0) Generates syslog messages that identify system instabilities.
  • Alerts—(level 1) Generates syslog messages that identify system integrity issues that require immediate administrative action. Includes all emergency messages.
  • Critical—(level 2) Generates syslog messages that identify critical system issues. Includes all emergency and alert messages.
  • Errors—(level 3) Generates syslog messages that identify system errors during operation. Includes all emergency, alert, and critical messages.
  • Warnings—(level 4) Generates syslog messages that identify system warnings, such as the device may be configured incorrectly. Includes all emergency, alert, critical, and error messages.
  • Notifications—(level 5) Generates syslog messages that identify normal operations that are typically considered significant events. Includes all emergency, alert, critical, error, and warning messages.
  • Informational—(level 6) Generates syslog messages that identify system information that is typical of day-to-day activity, such as network session records. Includes all emergency, alert, critical, error, warning, and notification messages.
  • Debugging—(level 7) Generates syslog messages that assist you in debugging. It also generates logs that identify the commands issued during FTP sessions and the URLs requested during HTTP sessions. Includes all emergency, alert, critical, error, warning, notification, and information messages.
Note    This setting directly affects what level of reports you can generate about the network activity for this PIX Firewall. We recommend that you select Informational or Debugging to ensure that all report data is available.

Step 8   To specify that a generation timestamp be included in each syslog message, select the Enable attach timestamp check box.

By default, this option is deselected, which is disabled.

Step 9   Enter the maximum size for the log queue in the Log Queue Size field.

This value specifies how large the queue on the PIX Firewall can grow before the oldest unsent messages in the queue are discarded to make room for new messages. This setting applies only when the syslog server is busy.

Note    A zero value means an unlimited number of messages can be queued (subject to available block memory).

Step 10   Click Apply to save the settings you have specified under Syslog Setup.

Step 11   Click Add in the table.

The Enter Syslog Server page appears.


Step 12   To direct the PIX Firewall to send its syslog messages to the CiscoWorks2000 Server, follow these steps:

a. Select the inside interface in the Interface Name list box.

Note    This procedure assumes that your CiscoWorks2000 Server resides on the network attached to the inside interface.

b. In the IP Address field, enter the IP address of the CiscoWorks2000 Server on which the Security Monitor resides.

c. Select the UDP radio button (User Datagram Protocol).

d. Ensure that 514 is in the Port field.

e. Click Next.

The Wizard Summary page appears.

f. Click Finish.

The new logging rule appears in the Syslog Setup list box.




Updating the Active Configuration on a PIX Firewall

You can update the configuration on a PIX Firewall by approving an activity and defining a job that includes the approved activity that you want to deploy to the device. Configuration files are generated as part of the job and an audit trail tracks the changes made to the configuration of a specific device. After you create and approve the job, you can update the PIX Firewall by deploying the job directly to the device. This procedure takes you through the tasks required to approve an activity, and to create, approve, and deploy a job to the PIX Firewall.

To update the configuration on a PIX Firewall, follow these steps:

Step 1   To approve an activity, follow these steps:

a. Select Workflow > Activity Management.

The Activity Management page appears.

b. Select the activity on which you have been working in the Activity Management table, and then click Approve.

The Submitting Activity dialog box appears.

c. Enter a comment in the Activity Submit Comment field, and then click OK.

Describe what you accomplish, the issues you encounter or resolve, exceptional considerations for deployment, user case numbers, and so on, within the scope of the selected activity. By doing so, you ensure better audit logs and clearly define expectations for those administrators who deploy the resulting configuration changes to the PIX Firewall.

The Review Device Generation List page appears.

d. Verify that the PIX Firewall that you expect to change as a result of submitting this activity is listed on this page, and then click Next.

The Wizard Summary page lists the number of devices for which configuration files will be generated.

e. Verify that the list of changes to be made as a part of this activity is correct, and then click Finish.

The Command Generation Status dialog box appears.


Click Refresh to update the status, or wait 60 seconds for it to refresh.

f. Click X in the upper right corner of the window to close the Command Generation Status dialog box.

The Activity Management page appears, and the State field for the activity updates from the Edit_open to Approved state.

Step 2   To create and approve a job, follow these steps:

a. Select Workflow > Job Management.

The Job Management page appears.

b. Click Add.

The Job Name page appears.


c. Enter the name for this job in the Name field, and then press Tab.

A job name should describe, at a high-level, the goal of the task you want to accomplish, such as Roll out interfaces and syslog settings for <firewall_hostname>. You can provide a more detailed description in the Description field.

d. In the Description field, enter a description of the tasks this job includes, and then click Next.

By providing a complete description of what you intend to accomplish with a given job, you provide better audit logs and set the expectations for other administrators who may approve or deploy the job.

The Select Activities page appears.


e. Select the check box next to the approved activity, and then click Next.

The Select Devices page appears.


f. Select the hostname of the PIX Firewall in the Select Devices object tree, and then click Next.

The Review Devices page appears.


g. Select the hostname of the PIX Firewall in the Review Devices table, and then click Deploy Type.

Tip You can select the PIX Firewall, and then click View Config to study the commands that will be deployed to the device.

The Select Deployment Type dialog box appears.


h. Select the Direct to device radio button, and then click OK.

The Select Deployment Type dialog box closes.

i. Click Next.

The Job State Change page appears.


j. Verify that the Submit on Finish check box is selected, enter any important information in the Comment field, and then click Next.

The Wizard Summary page appears.

k. Click Finish.

The Job Management page appears, and the State field changes to Approved.

Step 3   To deploy the commands to the PIX Firewall, follow these steps:

a. Select the job that you just defined, and then click Deploy.

The Deploying dialog box appears.


b. Enter any important information in the Job Deploy Comment field, and then click OK.

The State field changes to Deploying. To check the status of this deployment, click Refresh periodically. When the deployment completes, the State field changes to Deployed.




Configuring IDS MC

This section describes how to add a sensor to IDS MC and to configure IDS MC to use Security Monitor. It also describes how to update the active configuration of a sensor.

This section contains the following topics:

Setting up Sensors and Sensor Groups

IDS MC uses a hierarchy of groups and sensors. A group can contain sensors, other groups, or a combination of sensors and other groups. When you start IDS MC, you always have at least one active, defined group—the Global group. The IDS MC hierarchy can contain many levels of groups and sensors, just as a folder in Windows 2000 can contain many levels of folders and files. Figure 3-1 illustrates an example of the IDS MC hierarchy.


Figure 3-1   The IDS MC Hierarchy Consisting of the Global Group, Groups, and Sensors


Notice the presence of the Global group in Figure 3-1.

The IDS MC hierarchy of groups and sensors enables you to configure more than one sensor at a time by configuring an entire group of sensors. Configuring more than one sensor at a time in this way is possible because a sensor can acquire settings from its parent group. A sensor must acquire settings from its parent group if a parent defines those settings as mandatory. A child cannot override the values for such settings. For more information about configuring your sensors, see Using Management Center for IDS Sensors 1.0.

This section describes how to add sensors, subgroups, and groups to your IDS MC hierarchy.

Adding Sensors to a Sensor Group

You can add a sensor to any sensor group, including the Global group.

To add a sensor to a sensor group, follow these steps:

Step 1   Select Devices > Sensor.

The Sensor page appears.


Step 2   In the Groups list box, select the group you want to add a sensor to.

Step 3   Click Add.

The first of two Sensor Identification pages appears.


Step 4   In the first of two Sensor Identification pages, enter the IP address and the NAT address (if used) of the sensor. Next, enter the sensor name.

Next, enter the user ID and password for Secure Shell (SSH) communications between your host and the sensor:

  • When you are using a sensor appliance, the user ID is netrangr, and the password is one that you assign.
  • When you are using an IDSM, the user ID is ciscoids, and the password is one that you assign.

If you want to use existing SSH keys, select the check box associated with that option. For more information about SSH keys, see Using Management Center for IDS Sensors 1.0.

If you want to retrieve sensor settings from the sensor itself, select the Discover Settings check box; otherwise, click Next.

Note    If you choose to discover settings, you may have to wait from 30 seconds to several minutes, depending upon the size and complexity of your network and its traffic.

The second of two Sensor Identification pages appears.


Step 5   In the second of two Sensor Identification pages, use the list box to enter the version number of the sensor software you are using and a comment (optional). Next, enter the postoffice settings of the sensor: Host ID (typically the last octet of the IP address of the sensor), Org Name (all lowercase letters and no spaces), and Org ID (default value 100).

Within a postoffice domain, no sensor or sensor group can have the same Org ID/Host ID pair as another sensor or sensor group.

Note    You should use only lowercase letters to define organization names. Additionally, do not include spaces within the organization name. The host name and organization name are case sensitive with respect to how postoffice processes audit events on the local host. Host names and organization names are not passed between different postoffice clients, only the Host ID and Org ID values.

Step 6   Click Finish.

The Sensor page appears, updated with a record of the sensor you just added.





Creating Sensor Subgroups

You can add a subgroup to any sensor group, including the Global group.

To create a sensor subgroup, follow these steps:

Step 1   Select Devices > Sensor Group.

The Sensor Group page appears.


Step 2   From the Group Name list box, select the name of the sensor group that you want to add a subgroup to.

Step 3   Click Create Subgroup.

The Add Group page appears.


Step 4   In the Group Name box, enter the name of the subgroup you want to add. Next, select the Default (use parent values) radio button, or select the Copy settings from group radio button and select the name of the group from the list box.

Step 5   Click OK.

The Sensor Group page appears, showing the sensor group that you just added.





Configuring a Sensor to Use Security Monitor

To use Security Monitor to monitor a sensor, you must select the Configure Sensor to Use Monitoring Center check box on the Enter Sensor Information page of the add sensor wizard. Figure 3-2 shows the Configure Sensor to Use Monitoring Center check box.


Figure 3-2   Configure Sensor to Use Monitoring Center Check Box Selected


For the complete procedure for adding a sensor, see Adding Sensors to a Sensor Group.

Updating the Active Configuration of a Sensor

To update the active configuration of a sensor, you must generate, approve, and deploy a new configuration file. The new configuration file replaces the existing configuration. This section contains the following procedures:

For more information about generating, approving, and deploying configuration files, see Using Management Center for IDS Sensors 1.0.

Generating Configuration Files

This procedure describes how to generate configuration files. It applies to sensors for which you have saved proposed configuration changes to the database but for which the configuration files have not been generated.

You must have a user account with adequate privileges to generate configuration files.

You cannot generate a configuration file for proposed configuration changes until you save them to the database. You can review proposed configuration changes to determine whether or not you have saved them; for more information, see Using Management Center for Security1.0.

Note   Unless you specify otherwise, IDS MC automatically approves configurations when you generate them.

To generate a configuration file, follow these steps:

Step 1   Select Workflow > Generate.

The Generate page appears.


Step 2   To generate a configuration file for a particular record of configuration settings, select the corresponding check box, and then click Generate.

Step 3   You can verify that you generated the configuration file as planned; for more information, see Using Management Center for IDS Sensors 1.0.




Approving Configurations

This procedure describes how to approve, view, and delete proposed configurations.

You must have a user account with adequate privileges to approve configurations.

To approve configurations, follow these steps:

Step 1   Select Workflow > Approve.

The Approve page appears.


Step 2   To approve a configuration, select the corresponding check box, and then click Approve.

Note    Unless you specify otherwise, IDS MC automatically approves configurations when you generate them. To specify manual approval, select Admin > System Configuration, and then select Configuration File Management in the TOC.

Step 3   You can also view or delete configurations from the Approve page by clicking View or Delete, respectively.




Deploying Configuration Files

This procedure describes how to deploy approved configuration files to sensors.

You must have a user account with adequate privileges to deploy configuration files.

To deploy a configuration file, follow these steps:

Step 1   Select Workflow > Deploy.

Step 2   In the TOC, select Submit.

The Submit page appears.


Step 3   To submit a configuration file for deployment, select the check box that corresponds with the sensor to deploy, and then click Deploy.

The Select Configurations page appears.

Step 4   To select the configuration file version to be deployed for each of the sensors, select the corresponding check boxes, and then click Next.

The Enter Job Properties page appears.

Step 5   Enter the name of the job in the Job Name field under Schedule Type.

Step 6   To deploy the job immediately, select the Immediate radio button. Then, proceed to Step 8.

Step 7   To deploy the job at a specific date and time, select the Scheduled radio button, and then specify the desired start date and time using drop-down lists to the right of Start Time.

Step 8   Enter the maximum number of deployment attempts that should be tried in the Maximum Number Of Attempts field under Retry Options.

Note   Enter 0 (zero) in the Maximum Number Of Attempts field to specify no retries.

Step 9   Enter the time, in minutes, between retries in the Time Between Attempts field.

Note   The default time is 15 minutes.

Step 10   To overwrite a conflicting configuration on the sensor, ensure that the Overwrite conflicting sensor(s) configuration check box under Failure Options is selected.

Step 11   To require that sensor versions are correct, ensure that the Require correct sensor versions check box under Failure Options is selected.

Step 12   To enable notification on deployment, select the Email report to check box under Notification Options, and then enter the email addresses of the people to be notified in the Email report to: field. Use a comma to separate multiple email addresses.

Step 13   Click Finish.

The Submit page appears.

Step 14   To verify that you have submitted a configuration file for deployment, select Workflow > Deploy, and then select Pending in the TOC.

The Pending page appears.


Step 15   On the Pending page, you can edit a pending deployment or delete it.




Configuring Security Monitor

This section describes basic tasks to help you get started using Security Monitor. For more information, see the following topics:

For more information about Security Monitor, see Using Monitoring Center for Security 1.0.

Importing a Device Configuration

If you use IDS MC to configure your sensors, you can import the device configurations into Security Monitor from the database.

Note   To import a device configuration, Security Monitor and IDS MC must be installed on the same server.

To import a device configuration, follow these steps:

Step 1   Select Devices > Import.

The Import Sensors page appears.

Step 2   Select the check box next to the device for which you want to import configurations. You can select multiple devices. Then, click Import Sensors.

Tip To select all devices in the list, click Select All. To deselect all selected devices, click Deselect All.

The page closes, and the devices are added to the device list on the Devices page.




Receiving Syslog Messages from a PIX Firewall

Security Monitor monitors all traffic on the UDP port you specify and automatically receives all syslog messages, including PIX Firewall messages, from that port. The default port is 514. To specify a different port for syslog messages, see Defining SYSLOG Settings.

Defining SYSLOG Settings

You can specify the UDP port that Security Monitor uses to monitor syslog messages. You can also forward syslog messages to another UDP port.

To define the syslog settings, follow these steps:

Step 1   Select Admin > System Configuration.

Step 2   In the TOC, select SYSLOG Settings.

The SYSLOG Settings page appears.

Step 3   To specify the UDP port that Security Monitor uses to monitor syslog messages, enter the port number in the Listen on UDP Port field.

Step 4   To forward syslog messages to another port, select the Forward to UDP Port check box. Then, enter the port number in the associated field.

Step 5   To save your changes, click Apply.

Security Monitor uses the UDP port you specified to monitor syslog messages. Security Monitor also forwards syslog messages to another UDP port, if specified.




Adding a Device Configuration

Before you can use Security Monitor to monitor a postoffice device, you must add or import the device configuration to Security Monitor. You can import device configurations for sensors that you configured using IDS MC. For more information about importing a device configuration, see Importing a Device Configuration.

Tip You do not have to add syslog devices because Security Monitor monitors all syslog traffic on the UDP port. However, if you want the syslog device name to appear in reports (instead of the device IP address), add the device configuration to Security Monitor.

To add a device configuration, follow these steps:

Step 1   Select the Devices tab.

Step 2   Click Add at the bottom of the Devices page.

The Enter Device Information page appears.

Step 3   In the IP Address field, enter the IP address for the device you are adding.

Step 4   In the Device Name field, enter the device name for the device you are adding. You can use alphanumeric characters and some special characters in the device name, such as a dash. Security Monitor performs error checking and notifies you if the device name contains special characters that are not allowed. The device name cannot contain spaces.

Step 5   Select the device type from the Device Type list box.

Step 6   You can optionally enter any comments about the device in the Description field. The comment cannot exceed 512 characters.

Step 7   If the device uses postoffice, select the Uses Postoffice Settings check box. You can either manually enter the postoffice settings or discover the postoffice settings using Secure Shell (SSH) communications.

a. To manually define the postoffice settings, enter the host ID, organization name, organization ID, port, and heartbeat for the device.

b. To use SSH, select the Discover PostOffice Settings using SSH check box. Then, enter the user ID and password for SSH communications between Security Monitor and the sensor.

  • For a sensor appliance, the user ID is netrangr, and the password is one that you assign.
  • For an IDSM, the user ID is ciscoids, and the password is one that you assign.

To use existing SSH keys, select the Use Existing SSH Keys check box. For more information, see Using Management Center for IDS Sensors 1.0.

Step 8   To add the device, click Apply.

The page closes, and the device is added to the device list on the Devices page.

Step 9   To add another device, repeat Step 2 through Step 8.




Viewing Events

You can use Event Viewer to view real-time and historical events. Events include IDS alerts (generated by network-based and host-based sensors, IOS and PIX devices), syslog messages, and audit logs. This section contains the following topics:

For a more detailed discussion of Event Viewer, see Using Monitoring Center for Security 1.0.

Learn More About Event Viewer

Sensors and other network devices can continually forward events to Monitoring Center for Security (Security Monitor). These events are stored in the Security Monitor database. Event Viewer allows you to view the events stored in the Security Monitor database. You can view real-time events as they are forwarded to Security Monitor, and you can also view historical events stored in the database.

Note   Event Viewer is not the same as the Windows Administrative Tool also known as Event Viewer.

The following list contains examples of events that can be viewed in Event Viewer:

  • An attempt by a hacker to break into a computer's IDS Messages (IDS Alerts)
  • General security-related messages (Security Summaries)
  • A status message from a program or a computer (Audit Logs)

Event Viewer queries the database at regular intervals to extract the latest events. You can specify the query interval on the Event Viewer Preferences panel. For more information, see Using Monitoring Center for Security 1.0.

You can access Event Viewer by selecting Monitor > Event Viewer.

Event Viewer Display

Event Viewer combines the functionality of a spreadsheet (such as Lotus 1-2-3 or Microsoft Excel) with that of a hierarchical, drill-down directory (such as Windows Explorer) to create a collection of event records called a drillsheet (a drilldown spreadsheet). The drillsheet displays groups of similar event records on a single row of a grid, enabling you to detect patterns in the data.

Event Viewer contains a grid pane that organizes and displays event records. Event Viewer can read real-time events and historical events from the database. You can configure the grid pane in a variety of ways to display information about alarms detected by the sensor. For example, you can delete unwanted columns and expand and collapse cells.

Starting Event Viewer

Before you start Event Viewer, you must specify which events you want to display.

Note   The event start and stop times are calculated using the time at which events are stored in the database, not the time that the events were generated by the sensor. Usually, the two times are close, if not identical. Storage and generation times differ greatly only if there are communications problems that postpone sending events from the sensor to the database.

To start Event Viewer, follow these steps:

Step 1   Select Monitor > Event Viewer.

The Launch Event Viewer page appears.

Step 2   To select which event type appears in Event Viewer, select an option from the Event Type list box.

Step 3   Select an option in the Event Start Time section to specify the oldest events that appear in Event Viewer.

  • Select At Earliest to view events starting with the oldest stored in the database.
  • Select At Time to specify an exact date and time from which you want to start displaying events.

Step 4   Select an option in the Event Stop Time section to specify the most recent events that appear in Event Viewer.

  • Select Don't Stop for real-time event analysis.
  • Select At Time to specify an exact date and time up to which you want to display events.

Step 5   To start Event Viewer, click Launch Event Viewer.

Event Viewer appears.

Tip To start another Event Viewer window from the current Event Viewer window, choose File > New > Window in Windows Explorer or File > New > Navigator Window in Netscape Navigator.



Generating Reports in Security Monitor

This section describes how to generate reports. In Security Monitor, you can generate audit and alarm reports. When you generate a report, you can run it immediately or you can schedule it to run at a later time. Scheduled reports can run one time in the future or at regular intervals. You can generate a report by selecting Reports > Generate.

Learn More About the Types of Reports

You can generate the following alarm reports in Security Monitor:

  • Security Alarm Source Report—Summarizes alarms received on the syslog port by the source of the events. For example, if Security Monitor receives alarms from a PIX Firewall, use this report to view the alarm information. Filterable by Event Level, Source IP Address, and Time/Date.
  • Security Alarm Detailed Report—Provides detailed information for each security alarm received. Filterable by Event Level, Source IP Address, and Time/Date.
  • IDS Top Sources Report—Reports the specified number of source IP addresses that have generated the most events during a specified time period. Filterable by Date/Time, Top n, where n is the number of sources, Destination Direction, Destination IP Address, Signature or Signature Category, Sensor, and Event Level.
  • IDS Top Source/Destination Pairs Report—Reports the specified number of source/destination pairs (that is, connections or sessions) that have generated the most alarms during a specified time period. Filterable by Date/Time, Top n, where n is the number of source/destination pairs, Signature or Signature Category, Sensor, Event Level, Source Direction, Destination Direction, Source Address, and Destination Address.
  • IDS Top Destinations Report—Reports the specified number of destination IP addresses that have been targeted for attack during a specified time period. Filterable by Date/Time, Top n, where n is the number of destinations, Source Direction, Source Address, Signature or Signature Category, Sensor, and Event Level.
  • IDS Top Alarms Report—Reports the specified number of top alarms, by signature name, that have been generated during a specified time period. Filterable by Date/Time, Top n, where n is the number of alarms, Source Direction, Destination Direction, Source Address, Destination Address, Signature or Signature Category, Sensor, Event Level, and Signature or Signature Category.
  • IDS Summary Report—Provides a summary of event information for an organization during a specified time period. Filterable by Date/Time, Organization, Source Direction, Destination Direction, Signature or Signature Category, and Event Level.
  • IDS Alarm Source/Destination Pair Report—Reports logged alarms based on the source/destination IP address pairs (that is, connections or sessions). Filterable by Date/Time, Signature or Signature Category, Sensor, Event Level, Alarm Count, Source Direction, Destination Direction, Source Address, and Destination Address.
  • IDS Alarm Source Report—Reports alarms based on the source IP address that generated the alarm. Filterable by Date/Time, Destination Direction, Destination Address, Signature or Signature Category, Sensor, Event Level, Alarm Count, Source Direction, and Source Address.
  • IDS Alarm Report—Reports logged alarms based on signature names. Filterable by Date/Time, Source Direction, Destination Direction, Source Address, Destination Address, Sensor, Event Level, Event Count, and Signature or Signature Category.
  • IDS Alarm Destination Report—Reports alarms based on the destination IP address that generated the alarm. Filterable by Date/Time, Source Direction, Source Address, Signature or Signature Category, Sensor, Event Level, Event Count, Destination Direction, and Destination Address.
  • IDS Alarms by Sensor Report—Reports logged alarms based on the sensor (Host ID) that detected the event. Filterable by Date/Time, Source Direction, Destination Direction, Source Address, Destination Address, Signature or Signature Category, Sensor, Event Level, and Event Count.
  • IDS Alarms by Hour Report—Reports alarms in one hour intervals over the time specified by the user. Filterable by Date/Time, Source Direction, Destination Direction, Source Address, Destination Address, Signature or Signature Category, Sensor, Event Level, and Event Count.
  • IDS Alarms by Day Report—Reports alarms in one day intervals over the time specified by the user. Filterable by Date/Time, Source Direction, Destination Direction, Source Address, Destination Address, Signature or Signature Category, Sensor, Event Level, and Event Count.
  • 24 Hour Metrics Report—Reports all alarm traffic from the most recent 24 hours in 15 minute intervals. There are no filters for this report.

You can also generate the same audit reports in Security Monitor that you can generate in IDS MC. The following audit report types are available:

  • Subsystem Report—Reports audit records ordered by IDS subsystem, which includes systems from IDS MC and Security Monitor as well as systems common to each. Filterable by Event Severity, Date/Time, and Subsystem.
  • Sensor Version Import Report—Reports the audit records that are generated when the version identifier of IDS sensor devices are imported into IDS MC. These records indicate success or failure of the import operation. Filterable by Device, Event Severity, and Date/Time.
  • Sensor Configuration Import Report—Reports the audit records that are generated when you import IDS sensor configurations into IDS MC. You can The resulting records can be used to determine success or failure in device configuration import tasks. Filterable by Device, Event Severity, and Date/Time.
  • Sensor Configuration Deployment Report—Reports records related to IDS sensor configurations deployed to devices using IDS MC. These records indicate successful deployment or provide error messages where appropriate for deployment operations. Filterable by Device, Event Severity, and Date/Time.
  • Console Notification Report—Reports the console notification records generated by the notification subsystem. Filterable by Event Severity and Date/Time.
  • Audit Log Report—Reports audit records by the server and application. Unlike the other report templates its intent is to provide a broad non-task specific view of audit records in the database. Filterable by Task Type, Event Severity, Date/Time, Subsystem, and Applications.

Generating Reports

On the Select Report page, you can select the type of report to generate and define the parameters for the selected report. Based on the scheduling parameters you select, the report runs immediately, at a later time, or at regular intervals.

To generate a report, follow these steps:

Step 1   Select Reports > Generate.

The Select Report page appears.

Step 2   To filter which reports appear in the Available Reports list, select All, Alarms, or Audit from the Report Group list box.

Step 3   Select the report type that you want to generate. Then, click Select.

The Report Filtering page appears.

Step 4   Enter the report parameters for the report type you selected. Then, click Next.

The Schedule Report page appears.

Step 5   Enter a name for the report in the Report Title field.

Step 6   Select the Run Now or Schedule for Later radio button under Schedule Options. If you select Run Now, proceed with Step 7. If you select Schedule for Later, specify the following options:

a. Specify the date and time that you want the report to run in the Start Time list boxes. The date is specified by month, day, and year. The time is specified in hours and minutes. The time zone used to determine the time is to the right of the Start Time list boxes.

b. To run the report at regular intervals, select an option in the Repeat every list box. You can schedule the report to run every day, week, weekday, weekend day, hour, or minute.

Step 7   To send an e-mail notification to someone when the report runs, select the Email report to check box and enter an e-mail address in the adjacent field. Use commas to separate multiple addresses. Then, click Finish.

If you select Run Now, the report runs and you can view the generated report by selecting Reports > View. If you select Schedule for Later, you can view the scheduled report template by selecting Reports > Scheduled.