Contents
Overview OverviewCisco provides multiple options to upload information to the Cisco Technical Assistance Center (TAC) to fit customer’s different operating environments. Some of these options are less secure, leading to certain inherent risks. Each option has limitations that should be considered before deciding on an appropriate upload option. The following table summarizes the available upload options, the availability of file encryption, files size limits, and other relevant limitations.
The preferred and most secure option is to use the TAC Service Request Tool (TSRT) Java client File Upload. Files transferred via this option are encrypted in transit and are size constrained to 256 GB. The communication channel between the customer’s computing device and Cisco is encrypted and the information is also immediately linked to the associated Service Request and stored in an encrypted format. A less preferred and most secure option is using TSRT Non-Java File Upload. Files transferred via this option are encrypted in transit. TSRT Non-Java File Upload is less preferred because the tool is limited to file transfers of 20 MB or less. The communication channel between the customer’s computing device and Cisco is encrypted and the information is also immediately linked to the associated Service Request and stored in an encrypted format. Another option is direct, point-to-point file transfer during a live TAC Cisco WebEx Support Center Session or a TAC Cisco WebEx Meeting Center Session. Cisco WebEx Sessions must be initiated by a Cisco Customer Support Engineer. Files transferred via this option are encrypted in transit and are size constrained to 50 GB. The communication channel between the customer’s computing device and Cisco is encrypted. This option is less preferred as the files are not automatically linked to the Service Request and must be manually added to the Service Request and removed by the account owner. Another option is using file transfer via WebEx Personal Folders. A Cisco Customer Support Engineer will provide instructions on where to upload the file. Files transferred via this option are encrypted in transit and are size constrained to 50 GB. This transfer method does not require a live WebEx Session, so the Cisco Customer Support Engineer will need to be informed once the file is posted to this location. This option is less preferred because the files are not automatically linked to the Service Request and must be manually added to the Service Request and removed by the account owner. If customers cannot use TSRT or a TAC Cisco WebEx session, the least preferred information upload options are via an e-mail message to attach@cisco.com and through the use of File Transfer Protocol (FTP) to ftp.cisco.com/incoming. Files transferred via e-mail are size constrained to 20 MB and files transferred via FTP are size constrained to 50 GB. These options do not inherently secure the communication channel between the customer’s computing device and Cisco, nor is the information stored securely until it is attached to the customer’s Service Request. If either of these alternative options are used, it is incumbent upon the customer to explicitly encrypt the data before it is uploaded. The customer should employ a strong password, and communicate the password used to Service Request Customer Support Engineer owner out-of-band, for example over the telephone or via TSRT case update. TAC Service Request Tool Java Client File UploadTSRT Java client File Upload is the preferred and most secure upload option. This tool allows customers to create and query Service Requests. Customers can query the history and status of the Service Requests that have opened with the Cisco TAC and update those Service Requests while they are open. TSRT Java client File Upload feature also allows customers to upload files. These files are attached to the Service Request and will be used by the Service Request Customer Support Engineer owner to help resolve the issue. Files up to 256 GB in size may be attached to a Service Request. Files are encrypted during upload to Cisco. A Java applet initiates the upload on the client side and encrypts the files while providing the widest interoperability for different browsers and different operating systems. Note: Java Runtime Environment (JRE) 1.6.0_17 or later is required. Download the latest Java update at www.Java.com . Non-Java users can use the TSRT Non-Java File Upload to securely transfer multiple files (totaling 20 MB) to Cisco. The TSRT Non-Java File Upload is documented later in this document. Additional system requirements and limitations are documented at the following link:http://www.cisco.com/web/tsweb/tsrt/system_requirements.html Uploading the File(s)Complete the following steps to upload files using this method: Step 1 Search for the Service Request using TSRT at the following link: Step 2 Accept the Java Applet from Cisco, and navigate to the Upload Options section, as shown in Figure 1. Figure 1. Upload Options
Step 3 Figure 2 shows the screen that will be displayed. Figure 2. File Upload
Select a file to be uploaded by clicking the Browse button and choosing a file from the local directory. Step 4 Select the file type under File Type and enter any additional information in the Comments for TAC field. Step 5 Click the Upload File button to upload the file. Repeat Steps 4 and 5 for each additional file that will be uploaded. A message confirming the upload will be displayed, and a notification will be sent to the Service Request Customer Support Engineer owner. Non Java TSRT File UploadAs mentioned earlier in this document, the TSRT File Upload feature requires Java Runtime Environment (JRE) 1.6.0_17 or later. Non-Java users can use the Non Java File Upload to transfer files to Cisco. Files transferred using this option are encrypted in transit. TSRT without Java is less preferred because the tool is limited to file transfers of 20 MB or less. The communication channel between the customer’s computing device and Cisco is encrypted and the information is also immediately linked to the associated Service Request and stored in an encrypted format. Uploading the File(s) with Non Java File Upload ToolComplete the following steps to upload files using this method: Step 1 Search for the Service Request using TSRT at the following link: Step 2 Navigate to the Upload Options section, as shown in Figure 3. Figure 3. Non Java File Upload Tool
Step 3 Click on the Non Java File Upload Tool link, as shown above Step 4 The following screen will be shown. Use the fields displayed on that page to upload up to three files at one time (totaling 20 MB) to the Service Request. Additional comments describing each file can be added in the Comments for TAC field. Figure 4 shows the screen that will be displayed. Figure 4. Upload New Files
TAC Cisco WebEx Support Center and Meeting Center File TransferAnother option is direct, point-to-point file transfer during a live TAC Cisco WebEx Support Center session or a TAC Cisco WebEx Meeting Center session. Cisco WebEx sessions must be initiated by a Cisco Customer Support Engineer. Files transferred with this option are encrypted in transit and are size-constrained to 50 GB. The communication channel between the customer’s computing device and Cisco is encrypted. This option is less preferred because the files are not automatically linked to the Service Request and must be manually added to the Service Request and removed by the account owner. WebEx Personal Folders File TransferAnother option is using file transfer via WebEx Personal Folders. A Cisco Customer Support Engineer will provide instructions on where to upload the file. Files transferred with this option are encrypted in transit and are size-constrained to 50 GB. This transfer method does not require a live WebEx session, so the Cisco Customer Support Engineer will need to be informed once the file is posted to this location. This option is less preferred because the files are not automatically linked to the Service Request and must be manually added to the Service Request and removed by the account owner. Alternate File Upload OptionsIf the TAC Service Request Tool or a TAC Cisco WebEx session cannot be used to upload files, there are alternate upload methods available. Please note that these alternate upload methods are fundamentally insecure and do not encrypt the file or the communication session used to transport the file between the customer and Cisco. Encrypt FilesThe following examples show how to encrypt files using three of the many available options such as WinZip, Linux tar and openssl commands, and Linux Gzip and GnuPG. A strong encryption cipher such as AES-128 should be used to properly protect the data. If using ZIP, an application that supports AES encryption must be used. Older versions of ZIP applications support a symmetric encryption system that is not secure and should not be used. Encrypting Files Using WinZipFor illustrative purposes, this section shows how to encrypt files using the WinZip application. Other applications should provide the same functionality and perform as well as WinZip. Step 1 Create a ZIP Archive as shown in Figure 5. Figure 5. Creating a ZIP Archive
From the WinZip GUI select New and follow the menu prompts to create an appropriately named, new ZIP archive file. The newly created ZIP archive file will appear as shown in Figure 5. Step 2 Add the file(s) to be uploaded to the ZIP Archive and select the Encrypt added files option as shown in Figure 6. Figure 6. Encrypt Added Files
From the main WinZip window, select Add and then select the file(s) that will be uploaded. The Encrypt added files option must be selected as shown in Figure 6. Step 3 Encrypt the file using the AES encryption cipher and a strong password. Figure 7. Encrypt the File
Selecting Add from the file selection window will open the Encrypt window. An appropriate strong password should be created. This password will be shared with the Service Request Customer Support Engineer owner as discussed later in this document. One of the AES Encryption methods should be selected as shown above. Step 4 Verify that the file is encrypted. Figure 8 shows the screen that will be displayed. Figure 8. Verify Encryption
Selecting OK in the Encrypt window will encrypt the file(s) and display the main WinZip window. Encrypted files are marked with an asterisk following the file name or a lock icon in the Encryption column as shown above. Encrypting Files Using Tar and OpenSSLFor illustrative purposes, this section shows how to encrypt files using the Linux command line tar and openssl commands. Other archive and encryption commands should provide the same functionality and perform just as well under Linux or Unix. Step 1 Create a tar archive of the file and encrypt it through OpenSSL using the AES cipher and a strong password as shown in the example below. The above command output shows the combined tar and openssl command syntax to encrypt the file(s) using the AES cipher. Encrypting Files Using Gzip and GnuPGFor illustrative purposes, this section shows how to encrypt files using the Linux command line Gzip and GnuPG commands. Other archive and encryption commands should provide the same functionality and perform just as well under Linux or Unix. Step 1: Compress the file using Gzip as shown in the example below Step 1 Compress the file using Gzip as shown in the example below The above command output shows using the gzip and gpg command syntax to encrypt the file(s) using the AES cipher. E-mail File Attachment UploadOnce the files are encrypted, if the customer is unable to utilize the TAC Service Request Tool or a TAC Cisco WebEx session, additional information can be added to the Service Request by sending the information via an e-mail message to attach@cisco.com with the Service Request number in the subject line of the message (for example, SUBJECT = SR xxxxxxxxx). Attachments are limited to 20 MB per e-mail update. Attachments submitted using e-mail messages are not encrypted in transit, but are stored in an encrypted format when they are linked to the Service Request. It is incumbent upon the customer to explicitly encrypt the data before transit. Send the file attached to the e-mail message to attach@cisco.com as shown in Figure 9. Figure 9. Send the File
For illustrative purposes, the above output shows a Microsoft Outlook e-mail with an encrypted ZIP file attachment, the correct To address, and a properly formatted Subject. Other email clients should provide the same functionality and perform just as well as Microsoft Outlook. FTP File UploadOnce the files are encrypted, if the customer is unable to utilize the TAC Service Request Tool or a TAC Cisco WebEx session, additional information can be added to the Service Request by uploading it to Cisco via the File Transfer Protocol (FTP). Files transfer using FTP are size-constrained to 50 GB. Files submitted using FTP are not encrypted in transit and are not encrypted at rest on the ftp.cisco.com server. Because of the insecure nature of FTP, this is the least preferred method of file uploading. It is incumbent upon the customer to explicitly encrypt the data before transit. FTP client applications must support passive mode to upload files to ftp.cisco.com. The Cisco Customer Support Engineer will need to be informed once the file is posted to this location. Submitted files are manually linked to the Service Request by the Customer Support Engineer owner. Files are regularly purged from the FTP site and deleted from the FTP server file structure. Step 1 Use the ftp command with the “n” option to connect to ftp.cisco.com as show in the example below. The “n” option prevents the FTP client from attempting an auto-login with the ftp.cisco.com server.
For illustrative purposes, this section shows how to connect to ftp.cisco.com using the Linux command line ftp client. Other command line and GUI ftp clients should provide the same functionality and perform just as well as under Linux or UNIX. Please note that there are several restrictions regarding the use of ftp.cisco.com which are listed in the login banner as shown above. Step 2 Log in as the user anonymous and use a valid e-mail address as the password as shown in the example below. Step 3 Change the ftp.cisco.com directory to incoming. All files to be uploaded to Cisco must be placed in the incoming directory as shown in the example below. Step 4 Switch to BINARY data transfer mode. Because the files to be uploaded have been encrypted, the binary data transfer mode must be selected as shown in the example below. Step 5 Upload the file using the ftp put command as shown in the example below. For illustrative purposes, this example shows how to transfer the encrypted file to ftp.cisco.com/incoming using the Linux command line ftp client. Other command line and GUI ftp clients should provide the same functionality and perform just as well as under Linux or UNIX. Communicate the Password to the TAC Customer Support EngineerIf encrypting attachments, the encrypting password must be shared with the Service Request Customer Support Engineer owner. As a best practice, a method other than that used to upload the file should be used. If an e-mail message or ftp is used to upload the file, the password should be communicated out-of-band by telephone or as a TSRT case update as discussed in the TAC Service Request Tool (TSRT) Java client File Upload section of this document. Customer File RetentionFor the duration a Service Request is open, and for a period up to 18 months following the final closure of a Service Request, all files are instantly accessible from within the Service Request tracking system to authorized Cisco personnel. After a period of 18 months from final closure, the files may be moved to an archival storage instance to conserve space, but they are not purged (deleted) from the Service Request history. At any time, an authorized customer contact can expressly request a specific file be purged from a Service Request. Cisco can then delete that file, and a case note is added to document the party who deleted the file, the time and date stamp, and the name of the deleted file. Once a file is purged in this manner, it cannot be recovered. SummaryAs shown above, multiple options exist for customers to upload information to Cisco TAC to assist in the resolution of Service Requests.Some of these options are less secure, leading to certain inherent risks. Each option has limitations that should be considered before deciding on an appropriate upload option.
Additional InformationAccessing Cisco Technical Services This document is part of Cisco Security Intelligence Operations. This document is provided on an "as is" basis and does not imply any kind of guarantee or warranty, including the warranties of merchantability or fitness for a particular use. Your use of the information on the document or materials linked from the document is at your own risk. Cisco reserves the right to change or update this document at any time.
|
