Enable AutoLink for 10.0.0.0/8

Enable AutoLink for 172.16.0.0/12

Enable AutoLink for 192.168.0.0/16

Whether to automatically include or omit (deselected) these private networks from the maps you create.

Enable AutoLink for 127.0.0.0/8

Whether to automatically include or omit (deselected) the loopback network from the maps you create.

Enable AutoLink for 224.0.0.0/4

Whether to automatically include or omit (deselected) the multicast networks from the maps you create.

Save button

Saves and applies changes.

Reset button

Resets changes to the last saved values.

Restore Defaults button

Resets values to Security Manager defaults.

Max. Versions per Device

Purge Now button

The number of configuration versions you want to retain for each managed device, from 1 to 100. If you reduce the number, you can click Purge Now to immediately delete extra versions. Otherwise, Security Manager deletes the extra versions during its normal cleanup cycle.

TFTP Server for Rollback

The fully-qualified DNS hostname or IP address of the server to use for TFTP file transfers. TFTP is used during rollback for IOS devices when the configuration cannot be updated using the configure replace command, which does not force a system reload. Enter localhost to use the Security Manager server.

By default, a TFTP server is enabled on the Security Manager server. If you specify a remote TFTP server, you must configure that server appropriately to provide TFTP services.

TFTP Root Directory

The root directory for configuration file transfers if you are using the Security Manager server as the TFTP server. Click Browse to select a directory on the Security Manager server.

If you specify a server other than the Security Manager server as the TFTP host, Security Manager always uses the root directory of that TFTP server. You cannot specify a non-root directory for remote TFTP servers.

Save button

Saves and applies changes.

Reset button

Resets changes to the last saved values.

Restore Defaults button

Resets values to Security Manager defaults.

CS-MARS Devices

Displays the CS-MARS servers that are registered with Security Manager.

Add button (+ icon)

Click this button to add a server to the list. The New CS-MARS Device dialog box opens (see New or Edit CS-MARS Device Dialog Box).

Edit button (pencil icon)

Click this button to edit the properties of the selected server. The Edit CS-MARS Device dialog box opens (see New or Edit CS-MARS Device Dialog Box).

Delete button (trash can icon)

Click this button to delete the selected server. When you delete a server, the device properties for all devices that use the server are updated to remove the server connection.

When Launching CS-MARS

Allow User to Save Credentials

The type of credentials Security Manager should use to log into CS-MARS when obtaining event information:

•Prompt users—When the user tries to get event information from CS-MARS, prompt the user to log into CS-MARS. If you select this option, you can also select Allow User to Save Credentials, which gives users the option to save their credentials so they do not have to log into CS-MARS again the next time they request event status.

•Use CS-Manager Credentials—When the user tries to get event information from CS-MARS, log into CS-MARS using the same username and password the user used to log into Security Manager.

Save button

Saves and applies changes.

Reset button

Resets changes to the last saved values.

CS-MARS Hostname/IP

The IP address or fully-qualified DNS host name of the CS-MARS server.

Tip If you add a CS-MARS global controller, do not add any of the local controllers that the global controller monitors. Security Manager will automatically determine the local controller that is monitoring a specific device. Adding global controllers simplifies your CS-MARS configuration.

Username

Password

User Type

The username and password for logging into the server to validate that the CS-MARS server is running the appropriate software version and to obtain other basic information. Security Manager also uses this account to determine which CS-MARS server is monitoring a particular device.

For CS-MARS local controllers, you can enter either a global or local user account. For global controllers, you must enter a global account. Identify the type of account in the User Type field.

Certificate Thumbprint

Retrieve From Device button

The CS-MARS server certificate, a hexadecimal string that is unique to the device. Click Retrieve From Device to have Security Manager retrieve the certificate from the CS-MARS server.

If the certificate is retrieved successfully, it is displayed. After verifying the certificate, click Accept to save it on the Security Manager server. You must have a correct certificate to use the CS-MARS server from Security Manager.

Reset `Do Not Ask' on Warnings button

Click this button to reestablish `Are you sure...?' pop-up warnings. When you perform some actions, you are warned about the consequences and you are given the option to not be warned again. If you selected Do Not Ask Me Again for any of these warnings, clicking this button reenables the warning.

Enable Idle Timeout

Idle Timeout (minutes)

Whether to have the Security Manager client close automatically if you do not use it for the specified period of time. If you select this option, enter the number of minutes that must elapse before closing the client in the Idle Timeout field.

The default is to close the client after 120 minutes of inactivity.

Save button

Saves and applies changes.

Reset button

Resets changes to the last saved values.

Restore Defaults button

Resets values to Security Manager defaults.

Capture Discovery/Deployment Debugging Snapshots to File

Whether Security Manager generates data files about configuration generation, deployment, and discovery as these functions are performed. The temporary data files are stored in the MDC\temp directory in the Security Manager installation folder on the server, and you can use these files for debugging purposes.

Enable this setting if you encounter problems with deployment or discovery.

If you need to send these files to Cisco TAC for debugging, encrypt the files, because they can contain sensitive data such as passwords.

Note Selecting this check box slows down Security Manager response time. Enable this option only in limited circumstances.

Deployment Debug Level

The message severity level for deployment-related actions such as device communication.

Firewall Services Debug Level

The message severity level for firewall-related policies.

IOS Platform Debug Level

The message severity level for Cisco IOS Software platform policies.

PIX Platform Debug Level

The message severity level for PIX platform policies.

VPN Services Debug Level

The message severity level for VPN services policies.

Save button

Saves your changes.

Reset button

Restores all fields to their previous values.

Restore Defaults button

Resets values to Security Manager defaults.

Purge Debugging Files Older Than (days)

The maximum number of days the system should keep debugging files. Debug files are automatically deleted. If you decrease the number of days, you can click Purge Now to immediately delete all debugging files older than the number of days specified.

Default Deployment Method

Directory

The method to use as the default method for deploying configurations to devices:

•Device—Deploys the configuration directly to the device or to the transport mechanism specified for the device. For more information, see Deploying Directly to a Device, page 17-10.

•File—Deploys the configuration file to a directory on the Security Manager server. If you select File, specify the directory to which you want to deploy the configuration file in the Destination column. For more information, see Deploying to a File, page 17-12.

You can override this method when you create deployment jobs.

When Out of Band Changes Detected

How Security Manager should respond when it detects that changes were made directly on the device CLI since a configuration was last deployed to the device. This setting applies only for deployment methods that are configured to obtain the reference configuration from the device (see below for a description of the Reference Configuration settings).

This setting specifies the default action, which you can override when you create deployment jobs. You can choose one of the following:

•Warn (default)—If changes were made to the device manually, Security Manager continues with the deployment, overwrites the changes, and displays a warning notifying you of this action.

•Cancel—If changes were made to the device manually, Security Manager cancels the deployment and displays a warning notifying you of this action.

•Skip—Security Manager does not check for changes and deploys the changes to the device, overwriting any local modifications.

For a more complete discussion of out-of-band change handling, see Understanding How Out-of-Band Changes are Handled, page 17-13.

Deploy to File Reference Configuration

The configuration that Security Manager uses to compare new policies against the previous configuration for the device, if you are deploying the configuration to a file on the Security Manager server.

•Archive (default)—The most recently archived configuration.

•Device—The current running device configuration, which is obtained from the device.

After comparing the configurations, Security Manager generates the correct CLI for deployment.

Deploy to Device Reference Configuration

The configuration that Security Manager uses to compare new policies against the previous configuration for the device, if you are deploying the configuration directly to the device (or to a transport server).

•Archive—The most recently archived configuration.

•Device (default)—The current running device configuration, which is obtained from the device.

After comparing the configurations, Security Manager generates the correct CLI for deployment.

Optimize the Deployment of Access Rules For

How firewall rules are deployed. You can choose one of the following:

•Speed (default)—Increases deployment speed by sending only the delta (difference) between the new and old ACLs. This is the recommended option. By making use of ACL line numbers, this approach selectively adds, updates, or deletes ACEs at specific positions and avoids resending the entire ACL. Because the ACL being edited is still in use, there is a small chance that some traffic might be handled incorrectly between the time an ACE is removed and the time that it is added to a new position. The ACL line number feature is supported by most Cisco IOS, PIX and ASA versions, and became available in FWSM from FWSM 3.1(1).

•Traffic—This approach switches ACLs seamlessly and avoids traffic interruption. However, deployment takes longer and uses more device memory before the temporary ACLs are deleted. First, a temporary copy is made of the ACL that is intended for deployment. This temporary ACL binds to the target interface. Then the old ACL is recreated with its original name but with the content of the new ACL. It also binds to the target interface. At this point, the temporary ACL is deleted.

Firewall Access-List Names

How ACL names are deployed to devices if the access rule does not have a name in Security Manager.

•Reuse existing names—Reuse the ACL name that is configured in the reference configuration (which is usually from the device).

•Reset to CS-Manager generated names—Reset the name to a Security Manager auto-generated ACL name.

Let FWSM Decide When to Compile Access Lists

Whether to have the Firewall Services Module (FWSM) automatically determine when to compile access lists. Selecting this option might increase deployment speed but traffic might be disrupted and the system might become incapable of reporting ACL compilation error messages.

When deselected, Security Manager controls ACL compilation to avoid traffic interruption and to minimize peak memory usage on the device. For more information, see Understanding Access Rules, page 11-17.

---

Caution You should not select this option unless you are experiencing deployment problems and you are an advanced user.

---

Allow Download on Error

Whether deployments to devices should continue even if there are minor device configuration errors.

Remove Unreferenced Object Groups from Device (PIX, ASA, FWSM)

Whether Security Manager should remove object groups that are not being used by other CLI commands from devices during deployment.

Create Object Groups for Policy Objects (PIX, ASA, FWSM)

Create Object Groups for Multiple Sources, Destinations or Services in a Rule (PIX, ASA, FWSM)

Optimize Network Object Groups During Deployment (PIX, ASA, FWSM)

Whether Security Manager should create object groups, such as network objects and service objects, to replace comma-separated values in a rule table cell for PIX, ASA, and FWSM devices. When deselected, Security Manager flattens the object groups to display the IP addresses, sources and destinations, ports, and protocols for these devices.

If you select this option, you can also select these options:

•Create Object Groups for Multiple Sources, Destinations or Services in a Rule (PIX, ASA, FWSM)—Whether to automatically create network objects and service objects to replace comma-separated values in a rule table cell that resulted when multiple rules were combined. The objects are created during deployment. For more information, see Combining Rules, page 11-9.

•Optimize Network Object Groups During Deployment (PIX, ASA, FWSM)—Whether to optimize network object groups by making them more succinct. For more information on optimizing policy objects, see Optimizing Network Object Groups When Deploying Firewall Rules, page 11-15.

Remove Unreferenced Access-lists on Device

Whether to delete any access lists that are not being used by other CLI commands from devices during deployment.

Save Changes Permanently on Device

Whether to save the running configuration to the startup configuration (using the write memory command) after deploying a configuration to a device. This applies to PIX, FWSM, ASA, or Cisco IOS devices. If you deselect this check box, the startup configuration is not changed, which means your configuration changes will be lost if the device reloads for any reason.

Generate ACL Remarks During Deployment

Whether to display ACL warning messages and remarks during deployment.

Preselect Devices with Undeployed Changes

Whether the list of changed devices you see when you create a deployment job has all changed devices preselected. If you deselect this option, users must manually select the devices to include in the deployment job.

Enable Auto Refresh in Deployment Main Panel

Whether the deployment job and schedule status information should be automatically refreshed in the Deployment Manager window. If you deselect this option, you must click the Refresh button to refresh the information manually.

Remove Unreferenced SSL VPN Files on Device

Whether to have Security Manager delete files related to the SSL VPN configuration from the device if the files are no longer referred to by the device's SSL VPN configuration. If you deselect this option, unused files remain on the device after deployment.

Mask Passwords and Keys When Viewing Configs and Transcripts

Mask Passwords and Keys When Deploying to File

The conditions, if any, under which Security Manager will mask the following items so that they cannot be read: passwords for users, enable mode, Telnet, and console; SNMP community strings; keys, including those for TACACS+, Preshared Key, RADIUS server, ISAKMP, failover, web VPN attributes, logging policy attributes, AAA, AUS, OSPF, RIP, NTP, logging FTP server, point-to-point protocol, Storage Key, single sign-on server, load balancing, HTTP/HTTPS proxy, and the IPSEC shared key.

•Mask Passwords and Keys When Viewing Configs and Transcripts—This option affects only the screen display of the credentials, which guards against unauthorized personnel viewing them. If you do not select this option, credentials in full transcripts might still be masked depending on how the device handles them.

•Mask Passwords and Keys When Deploying to File—This option affects the contents of configuration files that are deployed to file, making them undeployable to actual devices. Select this option only if you will never need to actually deploy these configurations to real devices. Selecting this option has no effect on whether credentials are masked when viewed.

Save button

Saves and applies changes.

Reset button

Resets changes to the last saved values.

Restore Defaults button

Resets values to Security Manager defaults.

Device Connection Timeout

The number of seconds that Security Manager has to establish a connection with a device before timing out.

Retry Count

The number of times that Security Manager should try to establish a connection to a device before concluding that the connection cannot be completed. The default value is 3.

Socket Read Timeout

For SSH and Telnet sessions, the maximum number of seconds Security Manager can wait for incoming data before concluding that the connection is lost.

Transport Protocol (IPS)

The default transport protocol for IPS sensors and routers that include the IPS feature. The default is HTTPS.

Transport Protocol (IOS Routers 12.3 and above)

The default transport protocol for routers that run Cisco IOS software release 12.3 and above. The default is HTTPS.

Transport Protocol (Catalyst Switch/7600)

The default transport protocol for Catalyst 6500/7600 devices and all other Catalyst switches, regardless of the Cisco IOS software version running on the devices. The default is SSH.

Transport Protocol (IOS Routers 12.2, 12.1)

The default transport protocol for routers that run Cisco IOS software releases 12.1 and 12.2. The default is Telnet.

Connect to Device Using

The type of credentials Security Manager should use when accessing devices. For more information, see Understanding Device Credentials, page 5-5.

•Security Manager User Login Credentials—Security Manager contacts the device using the credentials that you entered while logging in to Security Manager. The same set of credentials are used for all devices regardless of the credentials configured for each device on the Device Credentials page.

•Security Manager Device Credentials—Security Manager contacts the device using the credentials specified in the Device Properties Credentials page. This is the default.

SSL Certificate Parameters

Device Authentication Certificates (IPS)

Device Authentication Certificates (Router)

PIX/ ASA/ FWSM Device Authentication Certificates

Add Certificate button

How to handle device authentication certificates for SSL (HTTPS) communications. You can configure different behaviors for different types of devices, but the settings have the same meaning:

•Retrieve while adding devices—Security Manager automatically obtains certificates from the devices while you add devices from the network or from an export file.

•Manually add certificates—Security Manager does not automatically accept certificates from the device. Click Add Certificate to open the Add Certificate dialog box (see Add Certificate Dialog Box) where you can manually add the thumbprint before you try to add the device from the network or from an export file. You can also add certificates for devices that you create manually from the Device Properties Credentials page to be successful. For more information, see Manually Adding SSL Certificates for Devices that Use HTTPS Communications, page 5-22.

•Do not use certificate authentication—Security Manager ignores device authentication certificates. This option leaves your system vulnerable to third-party interference with device validation. We recommend that you do not use this option.

Accept Device SSL Certificate after Rollback

For devices that use SSL, whether to obtain the certificate installed on an IPS device, firewall device, FWSM, ASA, or Cisco IOS router from the device when you roll back the configuration on the device.

HTTPS Port Number

The default port number that the device uses for secure communication with Security Manager (as well as other management applications that use these protocols). This value overrides the HTTPS port number that you configure in the HTTP policy for a device.

Note If you configure the local HTTP policy to be a shared policy and assign the HTTP policy to multiple devices, the HTTPS port number setting in the shared policy overrides the port number configured in the Device Properties Credentials page for all devices to which the policy is assigned.

In addition to providing access to the device through the Cisco web browser user interface, the HTTPS port number is used by device management applications, such as the Cisco Router and Security Device Manager (SDM), and monitoring tools, such as IPS Event Viewer (IEV), to communicate with the device.

Note The security appliance can support both SSL VPN connections and HTTPS connections for device manager administrative sessions simultaneously on the same interface. Both HTTPS and SSL VPN use port 443 by default. Therefore, to enable both HTTPS and SSL VPN on the same interface, you must specify a different port number for either HTTPS or WebVPN. An alternative is to configure SSL VPN and HTTPS on different interfaces.

Overwrite SSH Keys

Whether Security Manager can overwrite the SSH key for a device when it changes on the device. For SSH connections, a correct key is required for successful communication.

Deselect this check box with caution, and only if you require a greater level of security. Security Manager does not communicate with the device if keys are changed on the device.

Save button

Saves and applies changes.

Reset button

Resets changes to the last saved values.

Restore Defaults button

Resets values to Security Manager defaults.

Host Name or IP Address

The hostname or IP address of the device for which you are adding the certificate.

Certificate Thumbprint

The certificate thumbprint, which is a string of hexadecimal digits that is unique to the device.

Groups

Displays the device groups and group types.

To rename a group or type, select it and then click it again to make the text editable. Type in the new name and press Enter.

Add Type button

Click this button to create a new group type. The type is added with a default name. Overtype the name and press Enter.

Add Group to Type button

Click this button to add a device group to the selected device group or group type.

Delete button (trash can)

Click this button to delete the selected device group or group type and all device groups that it contains. Deleting a device group or group type does not delete any devices it contains.

Save button

Saves your changes.

Reset button

Restores all fields to their previous values.

RME server address

The IP address or fully-qualified hostname of the RME server.

Connect using https

Whether to connect to the RME server using SSL.

Save button

Saves your changes.

Reset button

Restores all fields to their previous values.

Restore Defaults button

Resets values to Security Manager defaults.

Prepend Device Name when Generating Security Context Names

Whether the name of the device that contains the security context should be added to the front of the security context's name. For example, if a security context is named admin, and it is contained in the device with the display name 10.100.15.16, the name that will appear in the Device selector is 10.100.15.16_admin.

If you do not prepend the device name, the security context name appears in the inventory by itself. Because Security Manager does not place security contexts in a folder related to the parent device, the only way to easily see contexts that are related to a device is to prepend the device name.

If you do not prepend device names, Security Manager adds a numbered suffix to distinguish identically named devices. For example, if the admin context exists in more than one firewall, you will see admin_01, admin_02, and so on, in the Device selector.

Purge Discovery Tasks Older Than

The number of days to save discovery and device-import tasks. Tasks older than the number of days you enter are deleted.

Reuse Policy Objects for Inline Values

Whether to substitute any named policy objects, such as network/host objects already defined in Security Manager, for inline values in the CLI. For more information on policy objects, see Chapter 8, "Managing Policy Objects.".

Allow Device Override for Discovered Policy Objects

For certain types of objects, whether to allow users to override the parent object values at the device level for policy objects that are discovered. If you select this option, if you run policy discovery on a device that has an ACL with the same name as an ACL policy object in Security Manager, the name of the discovered policy object is reused, but a device-level override is created for the object. If you deselect this option, a new policy object is created with a number appended to the name.

For more information, see Understanding Policy Object Overrides for Individual Devices, page 8-9.

On Error, Rollback Discovery for Entire Device

Whether Security Manager should roll back all discovered policies if even one error is encountered for a single policy during policy discovery. When deselected, Security Manager keeps the policies successfully discovered and discards only those policies with errors. For more information on policy discovery, see Discovering Policies, page 6-11.

Auto-Expand Object Groups with Prefixes

Expands object groups with the listed prefixes during the device import process. Separate the prefixes with a comma. This expansion causes the elements of the object group to display as separate items in the discovered policies. For more information, see Expanding Object Groups During Discovery, page 11-16.

Save button

Saves your changes.

Reset button

Resets changes to the previously applied values.

Restore Defaults button

Resets values to Security Manager defaults.

Update Status group

Refresh button

Displays the following items. Click Refresh to update the information.

•Latest Available—The most recent signature and sensor update available on Cisco.com or the local HTTP server when you last checked for updates.

•Latest Downloaded—The most recent signature and sensor update downloaded to Security Manager.

•Latest Applied—The most recent signature and sensor update applied to any device in Security Manager.

•Latest Deployed—The most recent signature and sensor update deployed to any device in Security Manager.

•Last Check On—The time that the last check of Cisco.com was performed.

•Last Download On—The time that the last update was downloaded to Security Manager.

•Last Deployed On—The time that the last update was deployed to any of the devices.

Check for Updates button

Download Latest Updates button

These buttons check for updates, or download signature and sensor updates that have not already been downloaded to the Security Manager server, from the IPS Update server. You must configure an IPS Update server before checking for updates or downloading them (click Edit Settings in the Update Server group).

When you click one of these buttons, a dialog box opens to display the results of the operation. Click Start to have Security Manager log into the IPS Update server, check for updates, and download them if you clicked the Download button. If a Cisco.com download fails, ensure that the account you are using has applied for eligibility to download strong encryption software. For details, see the description of User Name in Edit Update Server Settings Dialog Box.

Tip If you configure a server, and then try to check for updates, and you are told you did not configure a server, click Save at the bottom of the page and try again.

Update Server group

Displays the settings used to access Cisco.com or the local server that contains the IPS update packages. The fields indicate whether the update server is Cisco.com or a locally-configured HTTP server, the name of the local server if you are using one, the user account for logging into the server, and the name of the proxy server, if any. To configure or change the IPS Update server, click Edit Settings to open the Edit Update Server Settings dialog box (see Edit Update Server Settings Dialog Box).

For more information, see Configuring the IPS Update Server, page 19-6

Auto Update Settings group

Contains the settings specific to automatic updates. For more information, see Automating IPS Updates, page 19-8.

Auto Update Mode

Establishes whether, and to what extent, automatic updates are performed. Contains the following options:

•Download, Apply, and Deploy Updates

•Disable Auto Update

•Check for Updates

•Download Updates

•Download and Apply Updates

By default, auto update is disabled. The other options are a combination of one or more of the following options:

•Check for Updates—Security Manager contacts the IPS Update server to check if an update is available and sends e-mail if e-mail notification is configured. No files are downloaded.

•Download Updates—Security Manager downloads the latest updates from the IPS Update server, and sends e-mail notification if e-mail notification is configured.

•Apply Updates—Security Manager modifies the configuration of the devices selected in the Apply Update To list based on the downloaded update packages. You have to separately deploy these updates unless you also select Deploy Updates.

•Deploy Updates—Security Manager starts a deployment job to send the applicable update packages to the devices selected in the Apply Update To list.

Check for Updates

Edit Update Schedule button

The schedule for the actions selected in the Auto Update Mode field. To change the schedule, click Edit Update Schedule and define the schedule in the Edit IPS Updates Schedule dialog box. You can specify that Security Manager perform the updates based on hourly, daily, weekly, or monthly schedules, or specify a one-time event. When entering the start time, use the 24-hour clock and the hh:mm format.

Notify Email

The e-mail address to which notifications of automatic updates are sent. If you enter more than one address, separate the addresses with commas. A notification is sent when an update:

•Is available for download.

•Has been downloaded.

•Has been downloaded and applied.

•Has been downloaded, applied, and deployed.

Apply Update To

Type

Edit Row button

Devices to be Auto Updated

The selector includes the IPS devices that have local signature policies and the shared signature policies that are defined in Security Manager. The columns in the selector indicate whether a local device policy or a shared policy is selected for these types of updates:

•Signature—For auto updating the signature update level.

•Minor—For minor updates and service packs.

•S.P.—For service pack updates.

For shared policies, a partial grey checked box indicates that some, but not all, of the devices that use the policy are selected. If you change the devices assigned to the shared policy between automatic update events, the shared policy is grayed out, and only the old assignments are shown on this page. After the update runs, the assignment list will be synchronized with the shared policy device assignments. To update the device list proactively prior to the next auto update run, select the policy and edit it (to select auto update settings), and the device assignment list will be corrected.

Use the Type field to toggle between viewing local and shared policies. Changing the view does not change your auto update selections.

To select a local or shared policy for auto update, select it in the selector and click the Edit Row button below the selector. This opens the Edit Auto Update Settings dialog box, where you can select the types of updates for the policy. When you select any type of auto update for a policy, the affected devices are listed in the Devices to be Auto Updated list to the right of the selector.

Save button

Saves your changes.

Reset button

Resets changes to the last saved values.

Restore Defaults button

Resets values to Security Manager defaults.

Update From

Whether to get IPS updates from Cisco.com or from a local HTTP/HTTPS server. Your selection changes the fields on the dialog box.

If you select local, you must configure an HTTP or HTTPS server to use as the IPS update server.

IP Address/ Host Name

(Local server only.)

The hostname or IP address of the local IPS update web server.

Web Server Port

(Local server only.)

The port number that your local server listens to for connection requests. The default is 80.

User Name

The username to log into the IPS update server. If you are configuring a local server that does not require a user login, leave this field blank.

If you are specifying a Cisco.com username, the user account on Cisco.com must be eligible for downloading strong encryption software. If you are not certain that the account has the required permissions, use the account to log into Cisco.com and try to download an IPS update file (http://www.cisco.com/cgi-bin/tablebuild.pl/ips5-system). If the account does not have the appropriate permissions, you are prompted to read and accept the required conditions. If you meet the eligibility requirements, you can accept them. Otherwise, talk to your Cisco sales representative for help.

Password

Confirm

The password for the specified username, entered in both fields. If you are configuring a local server that does not require a password, leave these fields blank.

Path to Update Files

(Local server only.)

The path to the IPS update files location on your local server. For example, if update files can be accessed at http://local-server-ip:port/update_files_path/, then enter update_files_path in this field.

Connect Using HTTPS

(Local server only.)

Whether to use SSL when connecting to the local IPS Update server.

Certificate Thumbprint

Displays the certificate thumbprint after it is calculated from the certificate on the local server.

Retrieve From Server

Used to connect to the local server specified in this dialog box, retrieve the certificate from the local server given, and calculate the certificate thumbprint, which is displayed in the Certificate Thumbprint field.

Enable Proxy Server

Whether a proxy server is needed to connect to Cisco.com or to your local server.

IP Address/ Host Name

The hostname or IP address of the proxy server.

You can configure the proxy server to use basic, digest, NT LAN Manager (NTLM) V1, or NTLM V2 authentication. NTLM V2 is the most secure scheme.

Web Server Port

The port number that the proxy server listens to for connection requests. The default is 80.

User Name

The username to log into the proxy server. If the proxy server does not require a user login, leave this field blank.

Password

Confirm

The password for the specified username, entered in both fields. If the proxy server does not require a password, leave these fields blank.

Auto Update

(IPS sensors and shared policies only)

The type of sensor updates to apply to the selected devices or shared policies. You can apply both minor updates and service packs, service packs only, or select None to apply no sensor updates automatically.

Auto Update Signature Update Level

Whether to select the device or policy for automatic signature updates.

Updates Downloaded

A list of the signature or sensor updates available to apply to your IPS devices. These files have been downloaded to the Security Manager server. Use the Type field to toggle the table between these packages:

•Sensor Updates—Displays the filename, the major, minor, and service pack, and patch versions, as well as the supported engine release. You must apply all major sensor updates, however, minor updates are cumulative.

•Signature Updates—Displays the filename, the signature number, and the supported engine release. Signature updates are cumulative; however, applying them as separate packages allows you to separate your work into more manageable units if you intend to tune the updates to match the specific needs of your network.

Tip The engine release controls which devices you can select for sensor updates; you can apply the update only to devices that use the same engine version, regardless of the release version. For example, if your device is running 6.0(5) E3, you can update to 6.1(1) E3 but not to 6.1(1) E2. You also cannot apply a 6.1(1) E3 update to a device running 6.1(1) E2. If you want to update the engine version, select a signature update with the higher engine version, and Security Manager will update the engine level automatically while updating the signatures. For example, if the device has the 6.1(1) E2 version and needs to have the E3 engine package applied, choose the signature package that requires the E3 engine and apply it to the device; doing so applies the engine package automatically to the device while updating the signatures.

Select a package from the table to apply it to your devices or policies. You can select only one package.

Update Details

Lists the filename, description, release number, release date, file size, and required engine level for the package selected in the Updates Downloaded list.

Update Status group

The Update Status group displays the following items.

•Latest Available—The most recent signature and sensor update available on Cisco.com or the local HTTP server when you last checked for updates.

•Latest Downloaded—The most recent signature and sensor update downloaded to Security Manager.

•Latest Applied—The most recent signature and sensor update applied to any device in Security Manager.

•Latest Deployed—The most recent signature and sensor update deployed to any device in Security Manager.

•Last Checked On—The time that the last check of Cisco.com was performed.

•Last Downloaded On—The time that the last update was downloaded to Security Manager.

•Last Deployed On—The time that the last update was deployed to any of the devices.

Check for Updates button

Download Latest Updates button

These buttons check for updates, or download signature and sensor updates that have not already been downloaded to the Security Manager server from the IPS Update server. You must configure an IPS Update server before checking for updates or downloading them. To configure an IPS Update server, select Tools > Security Manager Administration > IPS Updates and click Edit Settings in the Update Server group on the IPS Updates page (for more information, see IPS Updates Page).

When you click one of these buttons, a dialog box opens to display the results of the operation. Click Start to have Security Manager log into the IPS Update server, check for updates, and download them if you clicked the Download button. If a Cisco.com download fails, ensure that the account you are using has applied for eligibility to download strong encryption software. For details, see the description of User Name in Edit Update Server Settings Dialog Box.

Apply Updates to

The list of policies to which you can apply the update. Use the Type field to toggle between local signature policies (representing devices not assigned to any shared signature policy) and shared signature policies. You can make selections in both lists.

Tip IPS devices to which the update does not apply are greyed out. For example, if you are applying a sensor update, you can select only devices that use the same engine version. If you are applying a signature update, the update can have a higher engine version than what is on the device, and Security Manager will update the engine version at the same time as the signature.

To select all applicable devices or shared policies, click Select All. To erase your selection and start over, click Deselect All. These buttons apply only to the displayed list.

Devices Assigned to Selected Policies

The devices assigned to the selected local or shared signature policies. If you select a shared policy, all devices that are using the policy appear in this list, but the devices to which the update does not apply are greyed out.

Next button

Finish button

If you are applying a signature update, you can click Next to view the signatures and edit or tune them before applying the update.

If you are applying a sensor update, or if you do not want to edit or tune signatures, click Finish to apply the update to the selected policies.

Filter

Allows you to filter the information displayed in the table. See Filtering Tables, page 2-16.

Signature List

Displays the new and modified signatures between the signature level of the selected update and the lowest signature level among the selected devices. If the selected devices include both IPS sensors and Cisco IOS IPS devices, the signatures for these devices appear on separate tabs.

Click the link in the ID number to read the description for the signature on Cisco.com. The Status column indicates whether the signature is new or modified (see the visual description of the icons on the wizard page).

To edit a signature, select it in the table and click the Edit button below the table (the pencil icon). For help in understanding the signature, click Help in the dialog box that the Edit button opens.

For details on available signature information, see Signatures Page, page M-1. In the Signature Summary Table, you can also add custom signatures and delete signatures, but you cannot do that on this page of the Apply IPS Update Wizard.

Finish button

Click this button to apply the selected update to the selected devices, and to save the edited or tuned signatures, if any.

CSM tab

The license settings for the Security Manager application. For a description of the fields on this tab, see CSM Tab, Licensing Page.

IPS tab

The license settings for IPS devices managed by Security Manager. For a description of the fields on this tab, see IPS Tab, Licensing Page.

License Information

Displays information about the license registered with the product: the edition, license type, expiration date, the number of licensed devices, the number of devices in use, and the percentage of the device count used.

Install License

The list of installed licenses with their installation dates.

Install a License button

Click this button to install a license file. The dialog box that is opened includes links to Cisco.com, where you can obtain licenses if you have not already obtained them. You must copy license files to a local drive on the Security Manager server before you can install them.

IPS License Table

Displays all of the IPS devices in the device inventory and their license status as of the last time you refreshed the information. Click the Refresh button to obtain the latest information from the devices.

Information includes the serial number for the device, which is used to register for licenses, the license status, and the expiration date of the license. The list shows not only current licenses, but also unlicensed devices, devices with expired licenses, and devices with invalid licenses.

Update Selected via CCO button

Click this button to update the license file for the selected devices by connecting to Cisco.com and retrieving a new license. When you click this button, a dialog box opens listing devices that can be updated from Cisco.com, which might not be all of the devices you selected. Click OK to perform the update. For successful updates, the updated file is automatically applied to the device.

To successfully update the license using this method, you must have a Cisco.com support contract that includes the serial numbers of the selected devices.

Redeploy Selected Licenses button

Click this button to redeploy licenses to the selected devices. Redeploying licenses might be necessary when you have obtained an updated license file and it was not applied to the device successfully during an automatic update.

When you click this button, a dialog box opens listing devices whose licenses you are redeploying. Click OK to perform the update. For successful updates, the updated file is automatically applied to the device.

Update from License File button

Click this button to update licenses by selecting a license file from the Security Manager server. When you click this button, a dialog box opens where you can specify the license files. Click Browse to select the files, which must be on a local drive on the Security Manager server. When you click OK, the updated files are automatically applied to the devices.

Export button

Click this button to export the license list to a comma-separated values (CSV) file. You are prompted to select the folder on the Security Manager server and to specify a file name.

Refresh button

Click this button to refresh the data in the IPS license table.

Download and apply licenses automatically

Check

Whether to automatically download IPS licenses from Cisco.com and apply them to the devices. Specify how frequently Security Manager should check for new licenses in the Check field:

•Daily—Once a day at midnight

•Weekly—Once a week at midnight on Sunday

•Monthly—Once a month at midnight on the first day of the month.

To successfully configure automatic updates, you must have a Cisco.com support contract that includes the serial numbers of your IPS devices.

The results of automatic updates are sent by e-mail to the user configured for IPS Update notifications on the administration settings IPS Update page. For information on setting the e-mail address, see IPS Updates Page.

Progress bar

Indicates what percentage of the license update task on the current device has been completed.

Status

The current state of the update task.

Devices to be updated

The total number of devices being updated during this task.

Devices updated successfully

The number of devices updated without errors.

Devices updated with errors

The number of devices that generated errors during the update.

Device list

The devices that are being updated, including the device name, the status of the update, and summary information about the update. Select a device to see the messages generated during the update for that device in the message list below the summary list.

Messages list

The messages generated during the license update for the selected device. Select a message to see detailed information in the fields to the right of the list.

Description

Additional information about the message selected in the message list.

Action

The steps you should take to resolve the described problem.

Abort button

Aborts the license update task.

Keep Audit Log For

Purge Now button

The maximum number of days to save audit report entries before deleting them. If the number of entries in the log exceeds the number entered in the Purge Audit Log After field, old log entries might be deleted before they reach this age.

If you reduce the number of days, you can click Purge Now to immediately delete the older entries.

Purge Audit Log After (entries)

The maximum number of audit report entries to save. If an entry becomes older than the number of days specified in the Keep Audit Log For field, it is deleted even if the log has fewer than the maximum number of entries.

Keep Operation Log For

The number of days that Security Manager keeps operation logs before deleting them. These logs are used for debugging purposes.

Log Level

The level of information, according to severity, that you would like collected in the operation logs. Each level collects different amounts of data. For example, the Info level yields the most data, and the Severe level collects the least.

Save button

Saves your changes.

Reset button

Resets changes to the previously applied values.

Restore Defaults button

Resets values to Security Manager defaults.

Policies to Manage

Displays the router platform policies that Security Manager manages, organized by category (NAT, Router Interfaces, and Router Platform). By default, all policies are selected. Deselected router platform policies are not managed. Deselecting the check box for a group of policies deselects all policies in that group.

Save button

Saves your changes.

If policies of the selected type are assigned to even one device, an error is displayed if you deselected that policy type. The error message displays the names of the policies that are assigned, the devices to which they are assigned, and the name of the user or activity associated with this action.

If you get this error message, click Cancel and manually remove the assignments in Policy view or Device view, after which you can deselect that policy type and save your changes. If the activities of other users are involved, you need to have these users remove the assignments in question.

Reset button

Resets changes to the previously applied values.

Restore Defaults button

Resets values to Security Manager defaults.

When Redundant Objects Detected

The action you want Security Manager to take when you try to create a policy object that has the same definition as an existing object:

•Ignore—You can freely create objects with identical definitions. Any conflicts are ignored by Security Manager.

•Warn—Security Manager displays a warning if you attempt to create an object that is identical to an existing object. You may proceed to create the object, if you wish.

•Enforce—Security Manager prevents you from creating an object that is identical to an existing object. An error message is displayed.

Default Source Ports

The port range value that is used as the default source port range for service objects. You can choose one of the following:

•Use all ports—Includes all ports from 1 to 65535.

•Use secure ports—Includes all ports from 1024 to 65535.

If you change the default source ports, you must manually redeploy any previously deployed devices that might be affected. These changes might not be reflected in any open activities until you refresh the data.

For more information on objects, see Creating Port List Objects, page 8-72.

Enable AutoComplete

Whether to have Security Manager list matching service and port list names as you type them when you create a service. You can then easily select from names you have already defined. If you deselect AutoComplete, you have to remember the complete service and port list names and type them in yourself.

Save button

Saves your changes.

Reset button

Resets changes to the previously applied values.

Restore Defaults button

Resets values to Security Manager defaults.

Notify Email

The default e-mail address that should receive notifications of rule expiration. Users can override this address when configuring individual rules.

Notify Before Expiration

The default number of days before a rule expires that Security Manager should send the e-mail message. Users can override this value when configuring individual rules.

Sender

The e-mail address that Security Manager will use for sending e-mail notifications.

Email Format

The format of the e-mail message:

•Text—The e-mail is sent in HTML and plain text formats.

•XML—The e-mail is sent using an XML markup. This option might be appropriate if you decide to write a program to automatically process and respond to notifications.

Save button

Saves your changes.

Reset button

Restores all fields to their previous values.

Restore Defaults button

Resets values to Security Manager defaults.

AAA Setup button

Opens Common Services and displays the AAA Mode Setup page. From this page, you can set AAA as your fallback sign-on method. For more information about AAA, click Help from the AAA Mode Setup page.

Certificate Setup button

Opens Common Services and displays the Self-Signed Certificate Setup page. CiscoWorks enables you to create self-signed security certificates, which you can use to enable SSL connections between your client browser and management server. For more information about self-signed certificates, click Help from the Certificate Setup page.

Single Sign On button

Opens Common Services and displays the Single Sign-On Setup page. With Single Sign On (SSO), you can use your browser session to transparently navigate to multiple CiscoWorks servers without having to authenticate to each of them. Communication between multiple CiscoWorks servers is enabled by a trust mode addressed by certificates and shared secrets. For more information about setting up SSO, click Help from the Single Sign-On page.

Local User Setup

Opens Common Services and displays the Local User Setup page, from which you can add and delete users, edit user settings, and assign roles or permissions. For more information, click Help from the Local User Setup page and see the Installation Guide for Cisco Security Manager.

System Identity Setup

Opens Common Services and displays the System Identity Setup page. Communication between multiple CiscoWorks servers is enabled by a trust mode addressed by certificates and shared secrets. System Identity setup helps you to create a trust user on servers that are part of a multi- server setup. For more information about system identity setup, click Help from the System Identity Setup page.

Display Deployment Status

Whether to include the status of deployment jobs that include the device.

Providers table

The providers table lists the Performance Monitor servers that are registered with Security Manager. You can add up to five servers.

Provider

The name of the Performance Monitor server. This name appears in the Inventory Status window on the Status tab for individual devices, indicating the server that provided the status.

Short name

The nickname for the provider name.

Status

Whether Security Manager should actively poll the Performance Monitor server for status. Select Enabled to actively poll the server, or Disabled to suspend polling the server without having to delete the provider entry.

Add button (+ icon)

Click this button to add a provider to the list. The Add Status Provider dialog box opens (see Add or Edit Status Provider Dialog Box).

Edit button (pencil icon)

Click this button to edit the properties of the selected provider. The Edit Status Provider dialog box opens (see Add or Edit Status Provider Dialog Box).

Trash button (trash can icon)

Click this button to delete the selected provider.

Save button

Saves your changes.

Reset button

Resets changes to the last saved values.

Provider name

The name of the service provider, for example, Performance Monitor. You can enter up to 128 characters. Valid characters are: 0-9; uppercase A-Z; lowercase a-z; and the following characters: - _ :. and space.

Server

The IP address or fully-qualified host name of the Performance Monitor server. The host name can be up to 128 characters.

Short Name

The short name for the provider name.

Port

The port number that Security Manager should use to communicate with the Performance Monitor server. The default is 443.

Poll Cycle

The number of minutes the firewall device will wait between polling Performance Monitor for new information. The default is 600 seconds (10 minutes). The minimum time is 60 seconds.

Username

The username for logging in to Performance Monitor.

Password

The password for logging in to Performance Monitor. In the Confirm field, enter the password again.

URN

The uniform resource name for Performance Monitor. URN is the name that identifies the resource on the Internet. URN is part of a URL, for example, /mcp/StatusServlet. The full URL could be:

https://:<server ip> :443/mcp/StatusServlet

where:

•<server ip> is the IP address of Performance Monitor.

•443 is the port number Performance Monitor listens to.

•/mcp/StatusServlet is the URN of the Performance Monitor.

Status

Whether the server is enabled for providing status to Security Manager. If you select Disabled, the server is added to the status providers list, but Security Manager does not poll it for status.

User

The username of the person who's session you might take over.

Session State

The state of the session, whether the user is currently logged in or logged out.

Take over session button

Click this button to take over the selected configuration session, transferring the changes made by the selected user to the currently logged in user. Any changes that have not already been committed are discarded.

If the selected user is logged in at the time changes are taken over, the user receives a warning message, loses the changes in progress, and then is logged out.

Server Name or IP Address

The DNS hostname or IP address of the TMS server.

Username

The username Security Manager should use to log on to the TMS server.

Password

Confirm Password

The password for the username. Enter the password in both fields.

Directory in the TMS Server for Config Files

The directory on the TMS server where deployed configuration files will be downloaded. The root FTP directory (".") is the default FTP location on the TMS server.

Public Key File Location

The location of the public and private key files on the Security Manager server, as copied from the TMS server. Security Manager uses the public key to encrypt data sent to the TMS server. Then the server uses its private key to decrypt the data. Security Manager comes with a default public key that matches the default private key on the server.

Note If needed, you can generate a new pair of public and private keys using the TMS server. If you do this, you need to copy the new public key to the Security Manager server.

Save button

Saves your changes.

Reset button

Resets changes to the last saved values.

Restore Defaults button

Resets values to Security Manager defaults.

DMVPN tab

Lists the policy types for which you can configure default policies for the Dynamic Multipoint VPN technology.

Large Scale DMVPN tab

Lists the policy types for which you can configure default policies for the Large Scale Dynamic Multipoint VPN technology.

Easy VPN tab

Lists the policy types for which you can configure default policies for the Easy VPN technology.

IPsec/GRE tab

Lists the policy types for which you can configure default policies for the IPsec/GRE VPN technology.

GRE Dynamic IP tab

Lists the policy types for which you can configure default policies for the GRE Dynamic IP VPN technology.

Regular IPsec tab

Lists the policy types for which you can configure default policies for regular IPsec VPN technology.

GET VPN

Lists the policy types for which you can configure default policies for the Group Encrypted Transport (GET) VPN technology.

S2S Endpoints tab

The default endpoints for Internal and External endpoints, each of which you can configure to the following:

•All Interfaces

•Internal

•External

•Self

Enable Workflow

Whether to enable Workflow mode. When Workflow mode is enabled, you can select whether to have an approver for activities and deployment jobs.

Require Activity Approval

Whether to require that activities be approved explicitly by an assigned approver. For more information about the differences between working with and without an approver, see Activity Approval, page 7-2.

Require Deployment Approval

Whether to require that deployment jobs be approved explicitly by an assigned approver. For more information about the differences between working with and without an approver, see Understanding Deployment, page 17-1.

Sender

The e-mail address that Security Manager will use for sending e-mail notifications.

Activity Approver

The default e-mail address for the person responsible for approving activities. Users can override this address when submitting an activity for approval. For more information, see Submitting an Activity for Approval, page 7-12.

Job/Schedule Approver

The default e-mail address of the person responsible for approving deployment jobs or schedules. Users can override this address when submitting a job or schedule for approval. For more information, see Submitting Deployment Jobs, page 17-22.

Job Completion Notification

The e-mail address of the person who should receive notification when deployment jobs are completed. Users can override this address when creating a deployment job.

Require Deployment Status Notification

Include Job Deployer

Job Completion Notification

Whether to have e-mail notifications sent whenever the status of a deployment job changes. If you select this option, enter the e-mail addresses that should receive notification in the Job Completion Notification field. Separate multiple addresses with commas.

You can also select Include Job Deployer to include the e-mail address of the person who deployed the job on the notification e-mail message.

Keep Activity for

The number of days that activity information should be kept in the Activity table. The default is 30. You can specify from 1 to 180 days.

Click Purge Now to delete all activities older than the number of days specified.

Keep Job for

The number of days that deployment job information should be kept in the Deployment Job table. The default is 30. You can specify from 1 to 180 days.

Click Purge Now to delete all jobs older than the number of days specified.

Keep job per schedule for

The number of days that deployment job information should be kept in the Deployment Job table for each job schedule. This setting applies only to jobs that were initiated by a schedule. The default is 30. You can specify from 1 to 180 days.

Click Purge Now to delete all jobs older than the number of days specified.

Save button

Saves your changes.

Reset button

Resets changes to the previously applied values.

Restore Defaults button

Resets values to Security Manager defaults.