-
null
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The following topics describe Security Manager administration settings and related dialog boxes:
The Security Manager Map view provides a graphical view of your VPN and Layer 3 network topology. Using device nodes to represent managed devices and map objects to represent unmanaged objects such as devices, clouds, and networks, you can create topology maps with which to study your network. AutoLink settings enable you to exclude any one of five private or reserved networks from Map view. For example, you might want to exclude any test networks that are not relevant to the management tasks you are using Security Manager to perform.
Navigation Path
Click Tools > Security Manager Administration and select AutoLink from the table of contents.
Related Topics
•Displaying Layer 3 Links on the Map, page 3-13
•Displaying Your Network on the Map, page 3-9
Field Reference
Use the Configuration Archive page to define the default settings for the Configuration Archive tool, including how many configuration versions to save and the TFTP server to use for rolling back Cisco IOS software device configurations.
Navigation Path
Click Tools > Security Manager Administration and select Configuration Archive from the table of contents.
Related Topics
•Configuration Archive Window, page N-26
•Rolling Back Configurations, page 17-33
Field Reference
Use the CS-MARS page to register the Cisco Security Monitoring, Analysis and Response System servers that are monitoring your devices with Security Manager. By registering your CS-MARS servers, you can view messages and events captured in CS-MARS based on a device's firewall access rules or IPS signature rules configured in Security Manager. You must register a CS-MARS server before users can see events collected from it.
Tip If you are using CS-MARS global controllers, add them instead of the individual local controllers. By adding global controllers, Security Manager can identify the correct local controller for a device automatically, without you having to add each of the local controllers. This simplifies your CS-MARS configuration in Security Manager.
Navigation Path
Select Tools > Security Manager Administration and select CS-MARS from the table of contents.
Related Topics
•Registering CS-MARS Servers in Security Manager, page 20-23
Field Reference
|
|
---|---|
CS-MARS Devices |
Displays the CS-MARS servers that are registered with Security Manager. |
Add button (+ icon) |
Click this button to add a server to the list. The New CS-MARS Device dialog box opens (see New or Edit CS-MARS Device Dialog Box). |
Edit button (pencil icon) |
Click this button to edit the properties of the selected server. The Edit CS-MARS Device dialog box opens (see New or Edit CS-MARS Device Dialog Box). |
Delete button (trash can icon) |
Click this button to delete the selected server. When you delete a server, the device properties for all devices that use the server are updated to remove the server connection. |
When Launching CS-MARS Allow User to Save Credentials |
The type of credentials Security Manager should use to log into CS-MARS when obtaining event information: •Prompt users—When the user tries to get event information from CS-MARS, prompt the user to log into CS-MARS. If you select this option, you can also select Allow User to Save Credentials, which gives users the option to save their credentials so they do not have to log into CS-MARS again the next time they request event status. •Use CS-Manager Credentials—When the user tries to get event information from CS-MARS, log into CS-MARS using the same username and password the user used to log into Security Manager. |
Save button |
Saves and applies changes. |
Reset button |
Resets changes to the last saved values. |
Use the New or Edit CS-MARS Device dialog box to register a CS-MARS server with Security Manager. Users can obtain messages or event status for a device's firewall or IPS policies from the CS-MARS server that is monitoring the device.
Navigation Path
To open this dialog box, select Tools > Security Manager Administration, then click CS-MARS to open the CS-MARS page. Then, do one of the following:
•Click the Add button to register a new server.
•Select an existing server and click the Edit button to edit the server properties.
Related Topics
•Registering CS-MARS Servers in Security Manager, page 20-23
Field Reference
Use the Customize Desktop page to control whether Security Manager closes automatically after being idle for a specified time, and to reset whether you are prompted to verify your actions in certain circumstances.
Navigation Path
Select Tools > Security Manager Administration and select Customize Desktop from the table of contents.
Field Reference
Use the Debug Options page to configure the severity level of messages to include in debugging logs and to determine what other debugging information is collected.
You should change debugging levels only if the Cisco Technical Assistance Center (TAC) asks you to change them. This makes it possible for you to include more detailed information in the CSMDiagnostics.zip file.
After you change the message level for the appropriate subcomponent, redo the actions that are resulting in system problems. After the problems occur, create the CSMDiagnostics.zip file by selecting Tools > Security Manager Diagnostics. You can then reset the debug options to the default levels so that the Security Manager server does not become bogged down collecting extra debug information. For more information about generating the CSMDiagnostics.zip file, see Creating a Diagnostics File for the Cisco Technical Assistance Center, page 19-16.
By default, logs contain messages of the Error severity or worse. The severity levels in order of severity are:
•Severe—Problems that make the system unusable.
•Error—Problems from which Security Manager cannot recover.
•Warning—Unexpected conditions from which Security Manager can recover.
•Info—Informational messages.
•Debug—Internal status information.
Navigation Path
Select Tools > Security Manager Administration, then select Debug Options from the table of contents.
Field Reference
Use the Deployment page to define the default methods by which Security Manager deploys configurations to devices. You can override some of these settings when you create deployment jobs.
Navigation Path
Select Tools > Security Manager Administration and select Deployment from the table of contents.
Related Topics
•Chapter 17, "Managing Deployment"
•Chapter 8, "Managing Policy Objects"
•Appendix F, "Policy Object Manager User Interface Reference"
Field Reference
|
|
---|---|
Purge Debugging Files Older Than (days) |
The maximum number of days the system should keep debugging files. Debug files are automatically deleted. If you decrease the number of days, you can click Purge Now to immediately delete all debugging files older than the number of days specified. |
Default Deployment Method Directory |
The method to use as the default method for deploying configurations to devices: •Device—Deploys the configuration directly to the device or to the transport mechanism specified for the device. For more information, see Deploying Directly to a Device, page 17-10. •File—Deploys the configuration file to a directory on the Security Manager server. If you select File, specify the directory to which you want to deploy the configuration file in the Destination column. For more information, see Deploying to a File, page 17-12. You can override this method when you create deployment jobs. |
When Out of Band Changes Detected |
How Security Manager should respond when it detects that changes were made directly on the device CLI since a configuration was last deployed to the device. This setting applies only for deployment methods that are configured to obtain the reference configuration from the device (see below for a description of the Reference Configuration settings). This setting specifies the default action, which you can override when you create deployment jobs. You can choose one of the following: •Warn (default)—If changes were made to the device manually, Security Manager continues with the deployment, overwrites the changes, and displays a warning notifying you of this action. •Cancel—If changes were made to the device manually, Security Manager cancels the deployment and displays a warning notifying you of this action. •Skip—Security Manager does not check for changes and deploys the changes to the device, overwriting any local modifications. For a more complete discussion of out-of-band change handling, see Understanding How Out-of-Band Changes are Handled, page 17-13. |
Deploy to File Reference Configuration |
The configuration that Security Manager uses to compare new policies against the previous configuration for the device, if you are deploying the configuration to a file on the Security Manager server. •Archive (default)—The most recently archived configuration. •Device—The current running device configuration, which is obtained from the device. After comparing the configurations, Security Manager generates the correct CLI for deployment. |
Deploy to Device Reference Configuration |
The configuration that Security Manager uses to compare new policies against the previous configuration for the device, if you are deploying the configuration directly to the device (or to a transport server). •Archive—The most recently archived configuration. •Device (default)—The current running device configuration, which is obtained from the device. After comparing the configurations, Security Manager generates the correct CLI for deployment. |
Optimize the Deployment of Access Rules For |
How firewall rules are deployed. You can choose one of the following: •Speed (default)—Increases deployment speed by sending only the delta (difference) between the new and old ACLs. This is the recommended option. By making use of ACL line numbers, this approach selectively adds, updates, or deletes ACEs at specific positions and avoids resending the entire ACL. Because the ACL being edited is still in use, there is a small chance that some traffic might be handled incorrectly between the time an ACE is removed and the time that it is added to a new position. The ACL line number feature is supported by most Cisco IOS, PIX and ASA versions, and became available in FWSM from FWSM 3.1(1). •Traffic—This approach switches ACLs seamlessly and avoids traffic interruption. However, deployment takes longer and uses more device memory before the temporary ACLs are deleted. First, a temporary copy is made of the ACL that is intended for deployment. This temporary ACL binds to the target interface. Then the old ACL is recreated with its original name but with the content of the new ACL. It also binds to the target interface. At this point, the temporary ACL is deleted. |
Firewall Access-List Names |
How ACL names are deployed to devices if the access rule does not have a name in Security Manager. •Reuse existing names—Reuse the ACL name that is configured in the reference configuration (which is usually from the device). •Reset to CS-Manager generated names—Reset the name to a Security Manager auto-generated ACL name. |
Let FWSM Decide When to Compile Access Lists |
Whether to have the Firewall Services Module (FWSM) automatically determine when to compile access lists. Selecting this option might increase deployment speed but traffic might be disrupted and the system might become incapable of reporting ACL compilation error messages. When deselected, Security Manager controls ACL compilation to avoid traffic interruption and to minimize peak memory usage on the device. For more information, see Understanding Access Rules, page 11-17. Caution You should not select this option unless you are experiencing deployment problems and you are an advanced user. |
Allow Download on Error |
Whether deployments to devices should continue even if there are minor device configuration errors. |
Remove Unreferenced Object Groups from Device (PIX, ASA, FWSM) |
Whether Security Manager should remove object groups that are not being used by other CLI commands from devices during deployment. |
Create Object Groups for Policy Objects (PIX, ASA, FWSM) Create Object Groups for Multiple Sources, Destinations or Services in a Rule (PIX, ASA, FWSM) Optimize Network Object Groups During Deployment (PIX, ASA, FWSM) |
Whether Security Manager should create object groups, such as network objects and service objects, to replace comma-separated values in a rule table cell for PIX, ASA, and FWSM devices. When deselected, Security Manager flattens the object groups to display the IP addresses, sources and destinations, ports, and protocols for these devices. If you select this option, you can also select these options: •Create Object Groups for Multiple Sources, Destinations or Services in a Rule (PIX, ASA, FWSM)—Whether to automatically create network objects and service objects to replace comma-separated values in a rule table cell that resulted when multiple rules were combined. The objects are created during deployment. For more information, see Combining Rules, page 11-9. •Optimize Network Object Groups During Deployment (PIX, ASA, FWSM)—Whether to optimize network object groups by making them more succinct. For more information on optimizing policy objects, see Optimizing Network Object Groups When Deploying Firewall Rules, page 11-15. |
Remove Unreferenced Access-lists on Device |
Whether to delete any access lists that are not being used by other CLI commands from devices during deployment. |
Save Changes Permanently on Device |
Whether to save the running configuration to the startup configuration (using the write memory command) after deploying a configuration to a device. This applies to PIX, FWSM, ASA, or Cisco IOS devices. If you deselect this check box, the startup configuration is not changed, which means your configuration changes will be lost if the device reloads for any reason. |
Generate ACL Remarks During Deployment |
Whether to display ACL warning messages and remarks during deployment. |
Preselect Devices with Undeployed Changes |
Whether the list of changed devices you see when you create a deployment job has all changed devices preselected. If you deselect this option, users must manually select the devices to include in the deployment job. |
Enable Auto Refresh in Deployment Main Panel |
Whether the deployment job and schedule status information should be automatically refreshed in the Deployment Manager window. If you deselect this option, you must click the Refresh button to refresh the information manually. |
Remove Unreferenced SSL VPN Files on Device |
Whether to have Security Manager delete files related to the SSL VPN configuration from the device if the files are no longer referred to by the device's SSL VPN configuration. If you deselect this option, unused files remain on the device after deployment. |
Mask Passwords and Keys When Viewing Configs and Transcripts Mask Passwords and Keys When Deploying to File |
The conditions, if any, under which Security Manager will mask the following items so that they cannot be read: passwords for users, enable mode, Telnet, and console; SNMP community strings; keys, including those for TACACS+, Preshared Key, RADIUS server, ISAKMP, failover, web VPN attributes, logging policy attributes, AAA, AUS, OSPF, RIP, NTP, logging FTP server, point-to-point protocol, Storage Key, single sign-on server, load balancing, HTTP/HTTPS proxy, and the IPSEC shared key. •Mask Passwords and Keys When Viewing Configs and Transcripts—This option affects only the screen display of the credentials, which guards against unauthorized personnel viewing them. If you do not select this option, credentials in full transcripts might still be masked depending on how the device handles them. •Mask Passwords and Keys When Deploying to File—This option affects the contents of configuration files that are deployed to file, making them undeployable to actual devices. Select this option only if you will never need to actually deploy these configurations to real devices. Selecting this option has no effect on whether credentials are masked when viewed. |
Save button |
Saves and applies changes. |
Reset button |
Resets changes to the last saved values. |
Restore Defaults button |
Resets values to Security Manager defaults. |
Use the Device Communication page to define default settings for communicating with devices. These settings mainly affect device inventory and policy discovery and configuration deployment. You can override the transport settings for individual devices in the device properties for the device.
If you change the transport protocol settings, ensure that your devices are appropriately configured to accept those types of connections.
Navigation Path
Select Tools > Security Manager Administration and select Device Communication from the table of contents.
Related Topics
•Adding Devices to the Device Inventory, page 5-7
•Chapter 5, "Managing the Device Inventory"
•Chapter 4, "Preparing Devices for Management"
•Viewing or Changing Device Properties, page 5-17
Field Reference
|
|
---|---|
|
|
Device Connection Timeout |
The number of seconds that Security Manager has to establish a connection with a device before timing out. |
Retry Count |
The number of times that Security Manager should try to establish a connection to a device before concluding that the connection cannot be completed. The default value is 3. |
Socket Read Timeout |
For SSH and Telnet sessions, the maximum number of seconds Security Manager can wait for incoming data before concluding that the connection is lost. |
Transport Protocol (IPS) |
The default transport protocol for IPS sensors and routers that include the IPS feature. The default is HTTPS. |
Transport Protocol (IOS Routers 12.3 and above) |
The default transport protocol for routers that run Cisco IOS software release 12.3 and above. The default is HTTPS. |
Transport Protocol (Catalyst Switch/7600) |
The default transport protocol for Catalyst 6500/7600 devices and all other Catalyst switches, regardless of the Cisco IOS software version running on the devices. The default is SSH. |
Transport Protocol (IOS Routers 12.2, 12.1) |
The default transport protocol for routers that run Cisco IOS software releases 12.1 and 12.2. The default is Telnet. |
Connect to Device Using |
The type of credentials Security Manager should use when accessing devices. For more information, see Understanding Device Credentials, page 5-5. •Security Manager User Login Credentials—Security Manager contacts the device using the credentials that you entered while logging in to Security Manager. The same set of credentials are used for all devices regardless of the credentials configured for each device on the Device Credentials page. •Security Manager Device Credentials—Security Manager contacts the device using the credentials specified in the Device Properties Credentials page. This is the default. |
SSL Certificate Parameters |
|
Device Authentication Certificates (IPS) Device Authentication Certificates (Router) PIX/ ASA/ FWSM Device Authentication Certificates Add Certificate button |
How to handle device authentication certificates for SSL (HTTPS) communications. You can configure different behaviors for different types of devices, but the settings have the same meaning: •Retrieve while adding devices—Security Manager automatically obtains certificates from the devices while you add devices from the network or from an export file. •Manually add certificates—Security Manager does not automatically accept certificates from the device. Click Add Certificate to open the Add Certificate dialog box (see Add Certificate Dialog Box) where you can manually add the thumbprint before you try to add the device from the network or from an export file. You can also add certificates for devices that you create manually from the Device Properties Credentials page to be successful. For more information, see Manually Adding SSL Certificates for Devices that Use HTTPS Communications, page 5-22. •Do not use certificate authentication—Security Manager ignores device authentication certificates. This option leaves your system vulnerable to third-party interference with device validation. We recommend that you do not use this option. |
Accept Device SSL Certificate after Rollback |
For devices that use SSL, whether to obtain the certificate installed on an IPS device, firewall device, FWSM, ASA, or Cisco IOS router from the device when you roll back the configuration on the device. |
HTTPS Port Number |
The default port number that the device uses for secure communication with Security Manager (as well as other management applications that use these protocols). This value overrides the HTTPS port number that you configure in the HTTP policy for a device. Note If you configure the local HTTP policy to be a shared policy and assign the HTTP policy to multiple devices, the HTTPS port number setting in the shared policy overrides the port number configured in the Device Properties Credentials page for all devices to which the policy is assigned. In addition to providing access to the device through the Cisco web browser user interface, the HTTPS port number is used by device management applications, such as the Cisco Router and Security Device Manager (SDM), and monitoring tools, such as IPS Event Viewer (IEV), to communicate with the device. Note The security appliance can support both SSL VPN connections and HTTPS connections for device manager administrative sessions simultaneously on the same interface. Both HTTPS and SSL VPN use port 443 by default. Therefore, to enable both HTTPS and SSL VPN on the same interface, you must specify a different port number for either HTTPS or WebVPN. An alternative is to configure SSL VPN and HTTPS on different interfaces. |
Overwrite SSH Keys |
Whether Security Manager can overwrite the SSH key for a device when it changes on the device. For SSH connections, a correct key is required for successful communication. Deselect this check box with caution, and only if you require a greater level of security. Security Manager does not communicate with the device if keys are changed on the device. |
Save button |
Saves and applies changes. |
Reset button |
Resets changes to the last saved values. |
Restore Defaults button |
Resets values to Security Manager defaults. |
Use the Add Certificate dialog box to add device certificates manually for devices that use the SSL transport protocol (firewall devices, FWSMs, ASAs, IPS devices, and Cisco IOS devices). Adding the device certificates manually gives you the highest level of security because then an intruder is prevented from introducing a fraudulent certificate thumbprint. Device certificates are stored in the database to be used for device authentication.
For more information about manually adding SSL certificates, see Manually Adding SSL Certificates for Devices that Use HTTPS Communications, page 5-22.
Navigation Path
Select Tools > Security Manager Administration, select Device Communication from the table of content, and click Add Certificate.
Field Reference
Use the Device Groups page to manage the device groups and group types defined in the device inventory.
Navigation Path
Select Tools > Security Manager Administration, then select Device Groups from the table of contents.
Related Topics
•Understanding Device Grouping, page 5-30
•Working with Device Groups, page 5-29
Field Reference
Security Manager includes shortcut commands to access several key features of Resource Manager Essentials (RME). To enable these commands, you must identify the RME server to Security Manager on this page.
Navigation Path
Select Tools > Security Manager Administration and select Device OS Management from the table of contents.
Related Topics
•Resource Manager Essentials Documentation
•Managing the Device Operating System, page 5-29
Field Reference
Use the Discovery page to define how Security Manager should handle certain types of objects or events during inventory and policy discovery. You can also control how long Security Manager keeps discovery tasks.
Navigation Path
Select Tools > Security Manager Administration and select Discovery from the table of contents.
Related Topics
•Understanding Policies, page 6-1
•Discovering Policies, page 6-11
•Policy Object Manager Window, page F-1
Field Reference
|
|
---|---|
Prepend Device Name when Generating Security Context Names |
Whether the name of the device that contains the security context should be added to the front of the security context's name. For example, if a security context is named admin, and it is contained in the device with the display name 10.100.15.16, the name that will appear in the Device selector is 10.100.15.16_admin. If you do not prepend the device name, the security context name appears in the inventory by itself. Because Security Manager does not place security contexts in a folder related to the parent device, the only way to easily see contexts that are related to a device is to prepend the device name. If you do not prepend device names, Security Manager adds a numbered suffix to distinguish identically named devices. For example, if the admin context exists in more than one firewall, you will see admin_01, admin_02, and so on, in the Device selector. |
Purge Discovery Tasks Older Than |
The number of days to save discovery and device-import tasks. Tasks older than the number of days you enter are deleted. |
Reuse Policy Objects for Inline Values |
Whether to substitute any named policy objects, such as network/host objects already defined in Security Manager, for inline values in the CLI. For more information on policy objects, see Chapter 8, "Managing Policy Objects.". |
Allow Device Override for Discovered Policy Objects |
For certain types of objects, whether to allow users to override the parent object values at the device level for policy objects that are discovered. If you select this option, if you run policy discovery on a device that has an ACL with the same name as an ACL policy object in Security Manager, the name of the discovered policy object is reused, but a device-level override is created for the object. If you deselect this option, a new policy object is created with a number appended to the name. For more information, see Understanding Policy Object Overrides for Individual Devices, page 8-9. |
On Error, Rollback Discovery for Entire Device |
Whether Security Manager should roll back all discovered policies if even one error is encountered for a single policy during policy discovery. When deselected, Security Manager keeps the policies successfully discovered and discards only those policies with errors. For more information on policy discovery, see Discovering Policies, page 6-11. |
Auto-Expand Object Groups with Prefixes |
Expands object groups with the listed prefixes during the device import process. Separate the prefixes with a comma. This expansion causes the elements of the object group to display as separate items in the discovered policies. For more information, see Expanding Object Groups During Discovery, page 11-16. |
Save button |
Saves your changes. |
Reset button |
Resets changes to the previously applied values. |
Restore Defaults button |
Resets values to Security Manager defaults. |
Use the IPS Updates page to perform administrative tasks associated with keeping your sensors up to date with regard to signatures, minor version updates, and service packs. You can use the IPS Updates page to:
•Monitor update status.
•Check the availability of updates and download them.
•Configure an IPS update server.
•Configure automatic update settings.
Tips
–To apply IPS updates manually, select Tools > Apply IPS Update. For more information, see Apply IPS Update Wizard.
–If you later decide that you did not want to apply a signature update, you can revert to the previous update level by selecting the Signatures policy on the device, clicking the View Update Level button, and clicking Revert.
Navigation Path
Select Tools > Security Manager Administration and select IPS Updates from the table of contents.
Related Topics
•Configuring the IPS Update Server, page 19-6
•Checking for IPS Updates and Downloading Them, page 19-7
•Automating IPS Updates, page 19-8
Field Reference
|
|
---|---|
Update Status group Refresh button |
Displays the following items. Click Refresh to update the information. •Latest Available—The most recent signature and sensor update available on Cisco.com or the local HTTP server when you last checked for updates. •Latest Downloaded—The most recent signature and sensor update downloaded to Security Manager. •Latest Applied—The most recent signature and sensor update applied to any device in Security Manager. •Latest Deployed—The most recent signature and sensor update deployed to any device in Security Manager. •Last Check On—The time that the last check of Cisco.com was performed. •Last Download On—The time that the last update was downloaded to Security Manager. •Last Deployed On—The time that the last update was deployed to any of the devices. |
Check for Updates button Download Latest Updates button |
These buttons check for updates, or download signature and sensor updates that have not already been downloaded to the Security Manager server, from the IPS Update server. You must configure an IPS Update server before checking for updates or downloading them (click Edit Settings in the Update Server group). When you click one of these buttons, a dialog box opens to display the results of the operation. Click Start to have Security Manager log into the IPS Update server, check for updates, and download them if you clicked the Download button. If a Cisco.com download fails, ensure that the account you are using has applied for eligibility to download strong encryption software. For details, see the description of User Name in Edit Update Server Settings Dialog Box. |
Update Server group |
Displays the settings used to access Cisco.com or the local server that contains the IPS update packages. The fields indicate whether the update server is Cisco.com or a locally-configured HTTP server, the name of the local server if you are using one, the user account for logging into the server, and the name of the proxy server, if any. To configure or change the IPS Update server, click Edit Settings to open the Edit Update Server Settings dialog box (see Edit Update Server Settings Dialog Box). For more information, see Configuring the IPS Update Server, page 19-6 |
Auto Update Settings group |
Contains the settings specific to automatic updates. For more information, see Automating IPS Updates, page 19-8. |
Auto Update Mode |
Establishes whether, and to what extent, automatic updates are performed. Contains the following options: •Download, Apply, and Deploy Updates •Disable Auto Update •Check for Updates •Download Updates •Download and Apply Updates By default, auto update is disabled. The other options are a combination of one or more of the following options: •Check for Updates—Security Manager contacts the IPS Update server to check if an update is available and sends e-mail if e-mail notification is configured. No files are downloaded. •Download Updates—Security Manager downloads the latest updates from the IPS Update server, and sends e-mail notification if e-mail notification is configured. •Apply Updates—Security Manager modifies the configuration of the devices selected in the Apply Update To list based on the downloaded update packages. You have to separately deploy these updates unless you also select Deploy Updates. •Deploy Updates—Security Manager starts a deployment job to send the applicable update packages to the devices selected in the Apply Update To list. |
Check for Updates Edit Update Schedule button |
The schedule for the actions selected in the Auto Update Mode field. To change the schedule, click Edit Update Schedule and define the schedule in the Edit IPS Updates Schedule dialog box. You can specify that Security Manager perform the updates based on hourly, daily, weekly, or monthly schedules, or specify a one-time event. When entering the start time, use the 24-hour clock and the hh:mm format. |
Notify Email |
The e-mail address to which notifications of automatic updates are sent. If you enter more than one address, separate the addresses with commas. A notification is sent when an update: •Is available for download. •Has been downloaded. •Has been downloaded and applied. •Has been downloaded, applied, and deployed. |
Apply Update To Type Edit Row button Devices to be Auto Updated |
The selector includes the IPS devices that have local signature policies and the shared signature policies that are defined in Security Manager. The columns in the selector indicate whether a local device policy or a shared policy is selected for these types of updates: •Signature—For auto updating the signature update level. •Minor—For minor updates and service packs. •S.P.—For service pack updates. For shared policies, a partial grey checked box indicates that some, but not all, of the devices that use the policy are selected. If you change the devices assigned to the shared policy between automatic update events, the shared policy is grayed out, and only the old assignments are shown on this page. After the update runs, the assignment list will be synchronized with the shared policy device assignments. To update the device list proactively prior to the next auto update run, select the policy and edit it (to select auto update settings), and the device assignment list will be corrected. Use the Type field to toggle between viewing local and shared policies. Changing the view does not change your auto update selections. To select a local or shared policy for auto update, select it in the selector and click the Edit Row button below the selector. This opens the Edit Auto Update Settings dialog box, where you can select the types of updates for the policy. When you select any type of auto update for a policy, the affected devices are listed in the Devices to be Auto Updated list to the right of the selector. |
Save button |
Saves your changes. |
Reset button |
Resets changes to the last saved values. |
Restore Defaults button |
Resets values to Security Manager defaults. |
Use the Edit Update Server Settings dialog box to configure the server to use for obtaining IPS updates. If necessary, you can configure a proxy server for communicating with the update server.
Navigation Path
Select Tools > Security Manager Administration > IPS Updates and click Edit Settings in the Update Server group.
Field Reference
|
|
---|---|
Update From |
Whether to get IPS updates from Cisco.com or from a local HTTP/HTTPS server. Your selection changes the fields on the dialog box. If you select local, you must configure an HTTP or HTTPS server to use as the IPS update server. |
IP Address/ Host Name (Local server only.) |
The hostname or IP address of the local IPS update web server. |
Web Server Port (Local server only.) |
The port number that your local server listens to for connection requests. The default is 80. |
User Name |
The username to log into the IPS update server. If you are configuring a local server that does not require a user login, leave this field blank. If you are specifying a Cisco.com username, the user account on Cisco.com must be eligible for downloading strong encryption software. If you are not certain that the account has the required permissions, use the account to log into Cisco.com and try to download an IPS update file (http://www.cisco.com/cgi-bin/tablebuild.pl/ips5-system). If the account does not have the appropriate permissions, you are prompted to read and accept the required conditions. If you meet the eligibility requirements, you can accept them. Otherwise, talk to your Cisco sales representative for help. |
Password Confirm |
The password for the specified username, entered in both fields. If you are configuring a local server that does not require a password, leave these fields blank. |
Path to Update Files (Local server only.) |
The path to the IPS update files location on your local server. For example, if update files can be accessed at http://local-server-ip:port/update_files_path/, then enter update_files_path in this field. |
Connect Using HTTPS (Local server only.) |
Whether to use SSL when connecting to the local IPS Update server. |
Certificate Thumbprint |
Displays the certificate thumbprint after it is calculated from the certificate on the local server. |
Retrieve From Server |
Used to connect to the local server specified in this dialog box, retrieve the certificate from the local server given, and calculate the certificate thumbprint, which is displayed in the Certificate Thumbprint field. |
|
|
Enable Proxy Server |
Whether a proxy server is needed to connect to Cisco.com or to your local server. |
IP Address/ Host Name |
The hostname or IP address of the proxy server. You can configure the proxy server to use basic, digest, NT LAN Manager (NTLM) V1, or NTLM V2 authentication. NTLM V2 is the most secure scheme. |
Web Server Port |
The port number that the proxy server listens to for connection requests. The default is 80. |
User Name |
The username to log into the proxy server. If the proxy server does not require a user login, leave this field blank. |
Password Confirm |
The password for the specified username, entered in both fields. If the proxy server does not require a password, leave these fields blank. |
Use the Edit Auto Update Settings dialog box to configure the automatic update options for the device or policy selected in the Apply Update To table on the IPS Updates page. For information on configuring automatic updates, see Automating IPS Updates, page 19-8.
Navigation Path
Select a device or policy on in the Apply Update To table on the IPS Updates page (see IPS Updates Page) and click the Edit Row button.
Field Reference
The Apply IPS Update wizard allows you to manually apply image and signature updates to compatible IPS devices. Before you can apply updates, you must configure an IPS Update server on the IPS Updates page (select Tools > Security Manager Administration > IPS Updates). For information on configuring an IPS Update server, see Configuring the IPS Update Server, page 19-6.
Tip You can configure automatic IPS updates on the IPS Updates page so that you do not have to manually apply them. For more information, see Automating IPS Updates, page 19-8.
When applying signature updates, the wizard displays those signatures in the update that are not configured on the target IPS devices. In this view, you can configure the new signatures before they are applied.
When applying image and signature updates, only those devices to which the updates can be applied are available for selection. Inapplicable devices are grayed out. A device can be greyed out even if a signature update applies to it if the required engine upgrade or generic packages are not available. Ensure that all required files have been downloaded from Cisco.com or to the local update server (see Checking for IPS Updates and Downloading Them, page 19-7).
Tip If you later decide that you did not want to apply a signature update, you can revert to the previous update level by selecting the Signatures policy on the device, clicking the View Update Level button, and clicking Revert.
The Apply IPS Update wizard consists of these pages:
•Step 1: Select Update To Apply Page
•Step 2: Select Policies Update Will Be Applied To Page
Navigation Path
Select Tools > Apply IPS Update.
Related Topics
•Manually Applying IPS Updates, page 19-9
•Configuring the IPS Update Server, page 19-6
•Checking for IPS Updates and Downloading Them, page 19-7
•Automating IPS Updates, page 19-8
Use the Select Update to Apply page of the Apply IPS Update wizard to select the signature or sensor update you want to apply to an IPS device.
To update the list of available update packages, do any of the following:
•Click Download Latest Updates.
•Configure automatic downloads on the IPS Updates page (select Tools > Security Manager Administration > IPS Updates). For more information, see IPS Updates Page.
•Manually download the updates to the CSCOpx\MDC\ips\updates folder in the product installation folder (typically Program Files) on the Security Manager server.
Navigation Path
Select Tools > Apply IPS Update. For more information, see Apply IPS Update Wizard.
Field Reference
|
|
---|---|
Updates Downloaded |
A list of the signature or sensor updates available to apply to your IPS devices. These files have been downloaded to the Security Manager server. Use the Type field to toggle the table between these packages: •Sensor Updates—Displays the filename, the major, minor, and service pack, and patch versions, as well as the supported engine release. You must apply all major sensor updates, however, minor updates are cumulative. •Signature Updates—Displays the filename, the signature number, and the supported engine release. Signature updates are cumulative; however, applying them as separate packages allows you to separate your work into more manageable units if you intend to tune the updates to match the specific needs of your network. Select a package from the table to apply it to your devices or policies. You can select only one package. |
Update Details |
Lists the filename, description, release number, release date, file size, and required engine level for the package selected in the Updates Downloaded list. |
Update Status group |
The Update Status group displays the following items. •Latest Available—The most recent signature and sensor update available on Cisco.com or the local HTTP server when you last checked for updates. •Latest Downloaded—The most recent signature and sensor update downloaded to Security Manager. •Latest Applied—The most recent signature and sensor update applied to any device in Security Manager. •Latest Deployed—The most recent signature and sensor update deployed to any device in Security Manager. •Last Checked On—The time that the last check of Cisco.com was performed. •Last Downloaded On—The time that the last update was downloaded to Security Manager. •Last Deployed On—The time that the last update was deployed to any of the devices. |
Check for Updates button Download Latest Updates button |
These buttons check for updates, or download signature and sensor updates that have not already been downloaded to the Security Manager server from the IPS Update server. You must configure an IPS Update server before checking for updates or downloading them. To configure an IPS Update server, select Tools > Security Manager Administration > IPS Updates and click Edit Settings in the Update Server group on the IPS Updates page (for more information, see IPS Updates Page). When you click one of these buttons, a dialog box opens to display the results of the operation. Click Start to have Security Manager log into the IPS Update server, check for updates, and download them if you clicked the Download button. If a Cisco.com download fails, ensure that the account you are using has applied for eligibility to download strong encryption software. For details, see the description of User Name in Edit Update Server Settings Dialog Box. |
Use the Select Policies Update Will Be Applied To page of the Apply IPS Update wizard to select the local or shared policy to which to apply the update. When you select a policy, the devices that use the policy are selected for update.
Navigation Path
Select Tools > Apply IPS Update. For more information, see Apply IPS Update Wizard.
Field Reference
Use the Edit Signatures page of the Apply IPS Update wizard to view or edit signature updates, if desired.
Navigation Path
Select Tools > Apply IPS Update. For more information, see Apply IPS Update Wizard.
Field Reference
|
|
---|---|
Filter |
Allows you to filter the information displayed in the table. See Filtering Tables, page 2-16. |
Signature List |
Displays the new and modified signatures between the signature level of the selected update and the lowest signature level among the selected devices. If the selected devices include both IPS sensors and Cisco IOS IPS devices, the signatures for these devices appear on separate tabs. Click the link in the ID number to read the description for the signature on Cisco.com. The Status column indicates whether the signature is new or modified (see the visual description of the icons on the wizard page). To edit a signature, select it in the table and click the Edit button below the table (the pencil icon). For help in understanding the signature, click Help in the dialog box that the Edit button opens. For details on available signature information, see Signatures Page, page M-1. In the Signature Summary Table, you can also add custom signatures and delete signatures, but you cannot do that on this page of the Apply IPS Update Wizard. |
Finish button |
Click this button to apply the selected update to the selected devices, and to save the edited or tuned signatures, if any. |
Use the Licensing page to manage licenses for the Security Manager application and for IPS devices.
Navigation Path
Select Tools > Security Manager Administration and select Licensing from the table of contents.
Related Topics
Field Reference
|
|
---|---|
CSM tab |
The license settings for the Security Manager application. For a description of the fields on this tab, see CSM Tab, Licensing Page. |
IPS tab |
The license settings for IPS devices managed by Security Manager. For a description of the fields on this tab, see IPS Tab, Licensing Page. |
Use the CSM tab on the Licensing page to view the list of installed Security Manager licenses and to install new licenses.
Navigation Path
Select Tools > Security Manager Administration, select Licensing from the table of contents, and click CSM.
Related Topics
•Installing Security Manager License Files, page 19-3
Field Reference
Use the IPS tab on the Licensing page to view the list of installed IPS device licenses, to install new or updated licenses, or to redeploy licenses. The license list shows current licenses, unlicensed devices, devices with expired licenses, and devices with invalid licenses.
Navigation Path
Select Tools > Security Manager Administration, select Licensing from the table of contents, and click IPS.
Related Topics
•Updating IPS License Files, page 19-4
•Redeploying IPS License Files, page 19-5
•Automating IPS License File Updates, page 19-6
•License Update Status Details Dialog Box
Field Reference
|
|
---|---|
IPS License Table |
Displays all of the IPS devices in the device inventory and their license status as of the last time you refreshed the information. Click the Refresh button to obtain the latest information from the devices. Information includes the serial number for the device, which is used to register for licenses, the license status, and the expiration date of the license. The list shows not only current licenses, but also unlicensed devices, devices with expired licenses, and devices with invalid licenses. |
Update Selected via CCO button |
Click this button to update the license file for the selected devices by connecting to Cisco.com and retrieving a new license. When you click this button, a dialog box opens listing devices that can be updated from Cisco.com, which might not be all of the devices you selected. Click OK to perform the update. For successful updates, the updated file is automatically applied to the device. To successfully update the license using this method, you must have a Cisco.com support contract that includes the serial numbers of the selected devices. |
Redeploy Selected Licenses button |
Click this button to redeploy licenses to the selected devices. Redeploying licenses might be necessary when you have obtained an updated license file and it was not applied to the device successfully during an automatic update. When you click this button, a dialog box opens listing devices whose licenses you are redeploying. Click OK to perform the update. For successful updates, the updated file is automatically applied to the device. |
Update from License File button |
Click this button to update licenses by selecting a license file from the Security Manager server. When you click this button, a dialog box opens where you can specify the license files. Click Browse to select the files, which must be on a local drive on the Security Manager server. When you click OK, the updated files are automatically applied to the devices. |
Export button |
Click this button to export the license list to a comma-separated values (CSV) file. You are prompted to select the folder on the Security Manager server and to specify a file name. |
Refresh button |
Click this button to refresh the data in the IPS license table. |
Download and apply licenses automatically Check |
Whether to automatically download IPS licenses from Cisco.com and apply them to the devices. Specify how frequently Security Manager should check for new licenses in the Check field: •Daily—Once a day at midnight •Weekly—Once a week at midnight on Sunday •Monthly—Once a month at midnight on the first day of the month. To successfully configure automatic updates, you must have a Cisco.com support contract that includes the serial numbers of your IPS devices. The results of automatic updates are sent by e-mail to the user configured for IPS Update notifications on the administration settings IPS Update page. For information on setting the e-mail address, see IPS Updates Page. |
Use the Update Licenses via CCO dialog box to review the IPS devices you selected to update from Cisco.com. The device list displays the IPS devices for which you can update the license from Cisco.com, which might not be all of the devices you selected.
To successfully update the license using this method, you must have a Cisco.com support contract that includes the serial numbers of the selected devices.
When you click OK, the License Update Status Details dialog box (see License Update Status Details Dialog Box) opens so that you can view the status of the update task.
Navigation Path
Select one or more device on the Tools > Security Manager Administration > Licensing > IPS tab and click Update Selected via CCO.
Use the Redeploying Licenses dialog box to review the IPS devices you selected to redeploy licenses to and to start the redeployment. Before you can redeploy a license to a device, you must have already deployed the license. Security Manager uses the file already associated with the IPS device to redeploy the license.
When you click OK, the License Update Status Details dialog box (see License Update Status Details Dialog Box) opens so that you can view the status of the license redeployment task.
Navigation Path
Select one or more device on the Tools > Security Manager Administration > Licensing > IPS tab and click Redeploy Selected Licenses.
Use the Updating Licenses from File dialog box to update IPS device licenses using a license file stored on a local drive on the Security Manager server. Click Browse to select the license file. You can select multiple license files using Ctrl+click or a range of files using Shift+click. When you have selected the license files you want to use, click OK to apply them to the IPS devices.
Navigation Path
Select one or more device on the Tools > Security Manager Administration > Licensing > IPS tab and click Update from License File.
Use the License Update Status Details dialog box to view the status of an IPS license update task. This dialog box opens whenever you start an update task from the IPS tab of the Licensing page. For more information, see IPS Tab, Licensing Page.
Field Reference
Use the Logs page to configure the default settings for the audit and operations logs. The audit log keeps a record of all state changes that occur in Security Manager.
Navigation Path
Select Tools > Security Manager Administration and select Logs from the table of contents.
Related Topics
•Audit Report Window, page E-9
•Understanding Audit Reports, page 19-11
•Generating the Audit Report, page 19-12
Field Reference
Use the Policy Management page to select the types of router policies you will manage in Security Manager. These selections apply only to routers. You cannot select a subset of policy types for FWSM, ASA, PIX, or IPS devices.
For example, by selecting only certain types of policies to manage in Security Manager, you can use Security Manager to manage DHCP and NAT policies on Cisco IOS routers while leaving routing protocol policies, such as EIGRP and RIP, unmanaged. These settings apply globally in Security Manager.
Unmanaged policies are removed from both Device view and Policy view. Any unmanaged policies, local or shared, are removed from the Security Manager database. The only exception is interface policies in the Router Interfaces folder, which continue to appear in the interface but are marked as read-only policies.
You cannot unmanage a policy type if you have configured and assigned policies of that type in Security Manager. You must first remove the assignments and then unassign the policy type. If the configurations defined by those policies have already been deployed, these configurations are left in place on the devices, but the policies are no longer stored in the database and they are not accessible from the Security Manager interface.
Navigation Path
Select Tools > Security Manager Administration and select Policy Management from the table of contents.
Related Topics
•Customizing Policy Management for Routers, page 6-10
•Chapter 13, "Managing Routers"
•Chapter 6, "Managing Policies"
•Chapter 12, "Managing IPS Services"
•Managing Shared Policies in Policy View, page 6-35
•Understanding Policies, page 6-1
Field Reference
Use the Policy Objects page to define system defaults related to policy object creation.
Navigation Path
Select Tools > Security Manager Administration and select Policy Objects from the table of contents.
Related Topics
•Chapter 8, "Managing Policy Objects"
Field Reference
|
|
---|---|
When Redundant Objects Detected |
The action you want Security Manager to take when you try to create a policy object that has the same definition as an existing object: •Ignore—You can freely create objects with identical definitions. Any conflicts are ignored by Security Manager. •Warn—Security Manager displays a warning if you attempt to create an object that is identical to an existing object. You may proceed to create the object, if you wish. •Enforce—Security Manager prevents you from creating an object that is identical to an existing object. An error message is displayed. |
Default Source Ports |
The port range value that is used as the default source port range for service objects. You can choose one of the following: •Use all ports—Includes all ports from 1 to 65535. •Use secure ports—Includes all ports from 1024 to 65535. If you change the default source ports, you must manually redeploy any previously deployed devices that might be affected. These changes might not be reflected in any open activities until you refresh the data. For more information on objects, see Creating Port List Objects, page 8-72. |
Enable AutoComplete |
Whether to have Security Manager list matching service and port list names as you type them when you create a service. You can then easily select from names you have already defined. If you deselect AutoComplete, you have to remember the complete service and port list names and type them in yourself. |
Save button |
Saves your changes. |
Reset button |
Resets changes to the previously applied values. |
Restore Defaults button |
Resets values to Security Manager defaults. |
Use the Rule Expiration page to define the default values for policy rule expiration. When you create policies for some types of policy rules (such as access rules), you can set an expiration date for the rule, and Security Manager can notify you by e-mail of the approaching expiration date.
You must configure an SMTP server to enable e-mail notifications. For more information, see Configuring an SMTP Server and Default Addresses for E-Mail Notifications, page 1-12.
Navigation Path
Select Tools > Security Manager Administration and select Rule Expiration from the table of contents.
Field Reference
Use the Server Security page to open specific pages in the CiscoWorks Common Services application, where you can configure various security features on the Security Manager server. CiscoWorks Common Services controls the basic functions of the Security Manager server, including user access control and system security.
When you log in to Security Manager, your username and password are compared with the account information stored in the CiscoWorks or Cisco Secure Access Control Server (ACS) database, depending on which system you established at installation as your AAA provider. After the authentication of your credentials, you have access according to the role you have been assigned.
For more information on Security Manager roles and privileges, including descriptions of how Common Services roles translate to user functions in Security Manager, see the Installation Guide for Cisco Security Manager.
Navigation Path
Select Tools > Security Manager Administration and select Server Security from the table of contents.
Related Topics
•Installation Guide for Cisco Security Manager
Field Reference
|
|
---|---|
AAA Setup button |
Opens Common Services and displays the AAA Mode Setup page. From this page, you can set AAA as your fallback sign-on method. For more information about AAA, click Help from the AAA Mode Setup page. |
Certificate Setup button |
Opens Common Services and displays the Self-Signed Certificate Setup page. CiscoWorks enables you to create self-signed security certificates, which you can use to enable SSL connections between your client browser and management server. For more information about self-signed certificates, click Help from the Certificate Setup page. |
Single Sign On button |
Opens Common Services and displays the Single Sign-On Setup page. With Single Sign On (SSO), you can use your browser session to transparently navigate to multiple CiscoWorks servers without having to authenticate to each of them. Communication between multiple CiscoWorks servers is enabled by a trust mode addressed by certificates and shared secrets. For more information about setting up SSO, click Help from the Single Sign-On page. |
Local User Setup |
Opens Common Services and displays the Local User Setup page, from which you can add and delete users, edit user settings, and assign roles or permissions. For more information, click Help from the Local User Setup page and see the Installation Guide for Cisco Security Manager. |
System Identity Setup |
Opens Common Services and displays the System Identity Setup page. Communication between multiple CiscoWorks servers is enabled by a trust mode addressed by certificates and shared secrets. System Identity setup helps you to create a trust user on servers that are part of a multi- server setup. For more information about system identity setup, click Help from the System Identity Setup page. |
Use the Status page to select the providers that will provide status to users when they view their inventory status by selecting Tools > Inventory Status. The status is displayed on the Status tab in the Inventory Status window.
By default, Security Manager provides status on deployment to the devices, but you can add Performance Monitor servers if you use them to monitor your network.
Navigation Path
Select Tools > Security Manager Administration and select Status from the table of contents.
Related Topics
•Configuring Status Providers, page 20-11
•Inventory Status Window, page C-39
•Viewing Inventory Status, page 5-25
Field Reference
|
|
---|---|
|
|
Display Deployment Status |
Whether to include the status of deployment jobs that include the device. |
Providers table The providers table lists the Performance Monitor servers that are registered with Security Manager. You can add up to five servers. |
|
Provider |
The name of the Performance Monitor server. This name appears in the Inventory Status window on the Status tab for individual devices, indicating the server that provided the status. |
Short name |
The nickname for the provider name. |
Status |
Whether Security Manager should actively poll the Performance Monitor server for status. Select Enabled to actively poll the server, or Disabled to suspend polling the server without having to delete the provider entry. |
Add button (+ icon) |
Click this button to add a provider to the list. The Add Status Provider dialog box opens (see Add or Edit Status Provider Dialog Box). |
Edit button (pencil icon) |
Click this button to edit the properties of the selected provider. The Edit Status Provider dialog box opens (see Add or Edit Status Provider Dialog Box). |
Trash button (trash can icon) |
Click this button to delete the selected provider. |
Save button |
Saves your changes. |
Reset button |
Resets changes to the last saved values. |
Use the Add or Edit Status Provider dialog box to register a Performance Monitor server with Security Manager. Security Manager can then poll the Performance Monitor servers for event status such as VPN tunnels, device connectivity, and CPU usage threshold. Users can view the status of their devices by selecting Tools > Inventory Status.
Navigation Path
To open this dialog box, select Tools > Security Manager Administration, then click Status to open the Status page. Then, do one of the following:
•Click the Add button to register a new server.
•Select an existing server and click the Edit button to edit the server properties.
Related Topics
•Configuring Status Providers, page 20-11
•Inventory Status Window, page C-39
•Viewing Inventory Status, page 5-25
Field Reference
Use the Take Over User Session page to take over another user's configuration session. A user with administrative privileges can take over the work of another user in non-Workflow mode. Taking over a session is useful when a user is working on devices and policies, causing the devices and policies to be locked, and another user needs access to the same devices and policies.
Navigation Path
Select Tools > Security Manager Administration and select Take Over User Session from the table of contents.
Related Topics
•Taking Over Another User's Work, page 19-13
Field Reference
Use the Token Management page to identify the Token Management System (TMS) server to use for deploying configurations to Cisco IOS routers that use TMS as the communication protocol. Security Manager uses the settings on this page to contact the TMS server.
Security Manager uses FTP to deploy the delta configuration file to the TMS server, from which the configuration file can be downloaded and encrypted onto an eToken.
To use TMS with Cisco IOS routers, you must specify TMS as the transport protocol. You can do this for all routers on the Device Communication page (see Device Communication Page), or for a specific router in its device properties (see General Page, page C-28). You must also configure the TMS server as an FTP server, otherwise deployment will fail.
Navigation Path
Select Tools > Security Manager Administration and select Token Management from the table of contents.
Related Topics
•Deploying Configurations to a Token Management Server, page 17-26
•Understanding Deployment Methods, page 17-10
Field Reference
Use the VPN Policy Defaults page to view or assign the default VPN policies that Security Manager uses for each IPsec technology. Before you can select a policy as a default, you must create the policy as a shared policy. You cannot create policies from this page.
For each tab that relates to a VPN topology, the drop-down lists for each policy type lists the existing shared policies that you can select. You can select a policy and click the View Content button to see the definition of that policy. In some cases, you are allowed to make changes, but you cannot save them.
Security Manager uses VPN policy defaults to simplify VPN configuration while ensuring that policy consistency is maintained. Security Manager provides mandatory policies as factory defaults, which means they are configured on the devices in your VPN topology with predefined values, depending on the assigned IPsec technology. Factory default policies with their default configurations enable you to deploy to your devices immediately after creating the VPN topology. Optional policies are not provided as factory defaults.
Navigation Path
Select Tools > Security Manager Administration and select VPN Policy Defaults from the table of contents.
Related Topics
•Understanding VPN Default Policies, page 9-8
•Assigning Default Policies to Your VPN Topology, page 9-24
•Creating IPSec VPNs Using the Remote Access VPN Configuration wizard (ASA Devices), page 10-12
•Creating IPSec VPNs Using the Remote Access VPN Configuration Wizard (IOS Devices), page 10-10
Field Reference
Use the Workflow page to select the workflow mode that Security Manager enforces and to define the default settings for activity and deployment job notifications and logging.
Before changing the workflow mode, read the following topics to understand how the modes differ and the effects of changing the modes:
•Working in Workflow Mode, page 1-13
•Working in Non-Workflow Mode, page 1-13
•Comparing the Two Workflow Modes, page 1-14
•Changing Workflow Modes, page 1-15
Navigation Path
Click Tools > Security Manager Administration and select Workflow from the table of contents.
Related Topics
•Chapter 7, "Managing Activities"
•Chapter 17, "Managing Deployment"
Field Reference
|
|
---|---|
|
|
Enable Workflow |
Whether to enable Workflow mode. When Workflow mode is enabled, you can select whether to have an approver for activities and deployment jobs. |
Require Activity Approval |
Whether to require that activities be approved explicitly by an assigned approver. For more information about the differences between working with and without an approver, see Activity Approval, page 7-2. |
Require Deployment Approval |
Whether to require that deployment jobs be approved explicitly by an assigned approver. For more information about the differences between working with and without an approver, see Understanding Deployment, page 17-1. |
|
|
Sender |
The e-mail address that Security Manager will use for sending e-mail notifications. |
Activity Approver |
The default e-mail address for the person responsible for approving activities. Users can override this address when submitting an activity for approval. For more information, see Submitting an Activity for Approval, page 7-12. |
Job/Schedule Approver |
The default e-mail address of the person responsible for approving deployment jobs or schedules. Users can override this address when submitting a job or schedule for approval. For more information, see Submitting Deployment Jobs, page 17-22. |
Job Completion Notification |
The e-mail address of the person who should receive notification when deployment jobs are completed. Users can override this address when creating a deployment job. |
Require Deployment Status Notification Include Job Deployer Job Completion Notification |
Whether to have e-mail notifications sent whenever the status of a deployment job changes. If you select this option, enter the e-mail addresses that should receive notification in the Job Completion Notification field. Separate multiple addresses with commas. You can also select Include Job Deployer to include the e-mail address of the person who deployed the job on the notification e-mail message. |
|
|
Keep Activity for |
The number of days that activity information should be kept in the Activity table. The default is 30. You can specify from 1 to 180 days. Click Purge Now to delete all activities older than the number of days specified. |
Keep Job for |
The number of days that deployment job information should be kept in the Deployment Job table. The default is 30. You can specify from 1 to 180 days. Click Purge Now to delete all jobs older than the number of days specified. |
Keep job per schedule for |
The number of days that deployment job information should be kept in the Deployment Job table for each job schedule. This setting applies only to jobs that were initiated by a schedule. The default is 30. You can specify from 1 to 180 days. Click Purge Now to delete all jobs older than the number of days specified. |
Save button |
Saves your changes. |
Reset button |
Resets changes to the previously applied values. |
Restore Defaults button |
Resets values to Security Manager defaults. |