Cisco Secure Policy Manager Version 3.1

Q & A Cisco Secure Policy Manager Version 3.1 Q. What are the new features of CSPM 3.1? A. New features of CSPM 3.1 include the following: Windows 2000 Server Windows 2000 Workstation Improved client/server Network object comment Cisco IOS Software releases 12.1(10),12.1(11),12.1(8)E, 12.1(9)E, 12.1(10)E,12.2(5),12.2(4)T Database enhancements Q. What are the key features and benefits of Cisco Secure Policy Manager? A. CSPM s main features and benefits are as follows: Cisco firewall management Easily defines perimeter security policies for Cisco Secure PIX Firewalls and Cisco IOS routers running the firewall feature set. Cisco VPN router management Easily configures intranet/extranet IPSec VPNs based on Cisco PIX Firewalls and Cisco s suite of VPN routers running the Cisco IOS IPSec software. Security policy management Uses network-wide policies to manage Cisco security devices without requiring extensive device knowledge and dependency on the command-line interface (CLI). Notification and reporting system Provides basic auditing tools to monitor, alert, and report Cisco security device and policy activity, thereby keeping the network administrator readily informed of network-wide events. CSPM also complements and interoperates with third-party monitoring, billing, and reporting systems. Windows 2000-based system Provides an easy-to-use Windows-based user interface Network operations CSPM incorporates many network operational features including topology import from CiscoWorks, CLI policy mapping, command diff, admin password aging, and policy query. Q. Is CSPM part of CiscoWorks? A. Yes. CSPM 3.1 is available exclusively in CiscoWorks VPN/Security Management Solution (VMS). Q. Does CSPM 3.1 have a similar look and feel to that of the Cisco PIX Device Manager (PDM)? A. Yes. CSPM 3.1 includes a rule table that is similar to that of Cisco PDM. Customers that are familiar with PDM can migrate easily to CSPM, which has a similar interface. The following graphic is an example of the CSPM 3.1 rule table. All contents are Copyright 1992 2002 All rights reserved. Important Notices and Privacy Statement. Page 1 of 9

Q. Can CSPM 3.1 import security configuration files generated by Cisco PDM? A. Yes. CSPM offers a configuration import tool. This import tool will create and end-to-end global topology of the Cisco PIX and Cisco IOS security network. The configuration import tool will also populate the rule table with the existing security policies configured on the PIX and IOS devices. Because configuration import works on the CLI it does not matter how that CLI was created. CSPM imports security policies from any Cisco PIX Firewall or Cisco IOS router regardless of how the configuration file was originally created. Q. Does CSPM support the Hot Standby Routing Protocol (HSRP) and multihomed servers? A. Yes. CSPM introduces an install-on feature in the rule table for multipath networks. Q. Will CSPM manage the access lists on a Cisco IOS device even if the firewall feature set (CBAC) is not installed? A. Yes. CSPM 3.1 supports native access lists on Cisco IOS Software products. CSPM manages end-to-end security policies in any Cisco network. Q. Does CSPM allow a comment for each rule? A. Yes. CSPM 3.1 supports a comment field for each entry in the rule table. Q. Does CSPM support network object groups and service bundles? A. Yes. CSPM greatly simplifies security policy configuration by aggregating common networks and service protocols into network object and service bundles. Network object groups and services bundles can be used and reused in source, destination, and service fields in the rule table. All contents are Copyright 1992 2002 All rights reserved. Important Notices and Privacy Statement. Page 2 of 9

Q. Will CSPM manage Cisco IOS Software images on the Cisco Catalyst product line? A. No. CSPM does not support the Cisco Catalyst product line. The Router Management Center in CiscoWorks VMS and access control list (ACL) management in CiscoWorks Routed WAN Management Solution (RWAN) support the Cisco Catalyst product line. Q. What does CSPM manage on a firewall? A. CSPM creates the configuration file for each Cisco firewall within a network. CSPM can also monitor syslogs and generate reports for each Cisco firewall. Q. What does CSPM manage on a VPN router? A. CSPM creates configuration files for hub-and-spoke as well as meshed site-to-site VPN routers. CSPM is an excellent choice for centralized management of remote VPN devices while abstracting the Crypto-map and Certificate Authority complexities of VPNs. CSPM can also monitor syslogs and generate reports for VPN routers. Q. What is policy-based management, and how does Cisco Secure Policy Manager support it? A. A policy is a set of high-level business directives that control the deployment of network services. Customers typically establish network policies within their organizations on the basis of established business practices. These policies involve the control of various services such as network availability, performance, and security. The creation, maintenance, and auditing of these policies are essential in order for the organization and its network to operate effectively. Policy-based management is the overall process by which organizations administer these policies. In general, policy-based management encompasses three basic processes: Policy definition Policy includes the creation of network security policies. For example, a network security policy might be to allow all members of the Engineering department to browse the Web and download files via FTP. Policy enforcement Policy enforcement means the automatic translation, validation, and distribution of the defined network security policies. Translation is required so that policies that are independent of the underlying network devices and topology may be constructed. Validation is necessary to ensure that defined network security policies and the resultant configurations do not conflict with one another or with various devices within the network. This process also ensures the distribution of policies to the appropriate network(s). Policy auditing Policy auditing involves the logging, monitoring, and reporting on the status of policies within the network and critical network events. Logging provides a basis for accountability for all device, policy, and user actions on the network. Monitoring of these actions is useful to determine when the network is not being used in accordance with the established network security policies. The reporting function allows a network security administrator to examine actions and events that have occurred on the network. Cisco Secure Policy Manager provides a level of management abstraction between the administrator and the network devices. This layering provides a translation between high-level policies developed for business purposes and the implementation of these policies, in the form of device configurations, within the network. This setup simplifies and organizes the task of consistently enforcing security policy throughout large, distributed networks. All contents are Copyright 1992 2002 All rights reserved. Important Notices and Privacy Statement. Page 3 of 9

Q. What devices can Cisco Secure Policy Manager administer within a network? A. CSPM 3.1 provides policy-based administration of Cisco PIX firewalls as well as Cisco IOS firewalls, VPN routers running the firewall features. More specifically, CSPM 3.1 supports the following devices and software versions: Platform Software Version Supported Cisco PIX Firewall 4.2.4 4.2.5 4.4.x 5.1.2 5.2.1 5.3.x 6.0.x 6.1.x Cisco IOS router 12.0(5)T, 12.0(5)XE5 12.0(7)T 12.1(1), 12.1(1)T, 12.1(1)E, 12.1(1)XC 12.1(2), 12.1(2)T, 12.1(2)XH 12.1(3), 12.1(3)T, 12.1(3)XI 12.1(4), 12.1(4)T, 12.1(4)E 12.1(5), 12.1(5)T 12.1(6), 12.1(6)E, 12.1(7), 12.1(7)E, 12.1(8), 12.1(9), 12.2(1), 12.2(2)T, 12.1(10), 12.1(11),12.1(8)E, 12.1(9)E, 12.1(10)E,12.2(5),12.2(4)T, 12.2(3) 1. Cisco IOS IDS and Cisco PIX IDS are not supported. Q. Does CSPM support Cisco PIX Firewall Version 6.2? A. No. Cisco PIX Firewall Version 6.2 is supported by the CiscoWorks Management Center for PIX Firewalls. Q. Why is IDS not supported in CSPM? A. The award-winning alarm event viewer in CSPM has been incorporated into Cisco s next-generation IDS management platform. This next-generation platform, CiscoWorks Management Center for IDS, is available with CSPM in CiscoWorks VMS. All contents are Copyright 1992 2002 All rights reserved. Important Notices and Privacy Statement. Page 4 of 9

Q. How does CSPM 3.1 improve the client/server model? A. CSPM 3.1 implements the client/server model with Microsoft Terminal Services. Leveraging an optimized, thin client/server solution allows CSPM client users to enjoy greater throughput, reduces latency and more client platform options. Q. Does CSPM 3.1 offer a lite, or restricted, device license version? A. Yes. CSPM 3.1 is a featured component of the CiscoWorks VMS solutions bundle. The VMS bundle contains a restricted 20-device option. A Cisco PIX failover bundle appears as a single device to CSPM. Q. What network topologies does Cisco Secure Policy Manager effectively manage? A. CSPM supports Cisco firewall and VPN router deployments within Internet, intranet, and extranet topologies. For VPN environments, the product supports site-to-site (that is, router-to- router) network topologies only. Remote access (that is, client-to-router) VPN networks are not supported. Q. Does Cisco Secure Policy Manager offer user-based security policy management? A. No, CSPM does not currently provide comprehensive management of user policies (for example, user-based authentication and authorization). However, because Cisco firewalls and routers provide authentication, authorization, and accounting (AAA) support for its users by linking into a Cisco Secure server, CSPM will allow the network administrator to configure these user policies through a simple command interface. Q. Does Cisco Secure Policy Manager provide secure remote management support? A. Yes, CSPM supports secure remote management of Cisco PIX firewalls and Cisco routers that support firewall and VPN capabilities. The CSPM product uses an embedded IPSec solution for secure configuration distribution. Q. Does CSPM offer any offline configuration capabilities? A. Yes, CSPM allows a security administrator to configure network security policies without requiring connectivity to a live, complete, and established network. With the powerful, policy translation functionality of the product, device configurations can be easily and quickly generated for multiple security devices within the network. This process helps IS organizations in staging their networks for new device deployment. CSPM can then be used to distribute these configurations to the appropriate devices or the generated configuration files can be exported and distributed to the devices via other methods, such as Trivial File Transfer Protocol (TFTP). Cisco Secure Policy Manager also has the powerful ability to export the network topology, policy definitions and device configurations to a.cpm file. This.cpm file can be imported to another copy of CSPM which allows easy interaction with the Cisco Technical Assistance Center (TAC) and other support networks. Q. Can Cisco Secure Policy Manager configure authentication services on Cisco firewalls and VPN routers? A. Yes, within VPN environments, the product can configure devices to support either preshared keys or support certificates provided by a certificate authority (CA). CSPM supports authentication services such as TACACS+ or Remote Access Dial-In User Service (RADIUS) within its policy interface. Q. Can the network data gathered by Cisco Secure Policy Manager be exported to other applications? A. Yes, CSPM manages different types of data, and some of this gathered data can be exported. The ability to export the data depends on its data type. The following types of data can be exported: Device file configurations The router and firewall file configurations created as a result of applying policies in the network can be exported and saved in ASCII text format. All contents are Copyright 1992 2002 All rights reserved. Important Notices and Privacy Statement. Page 5 of 9

Audit event data All auditing data collected and stored within the Cisco Secure Policy Manager system may be exported into an ASCII text file on the local machine. Additionally, the system may be configured to dump (or permanently export) all log audit events into an Open Database Connectivity (ODBC)-compliant database. Policy configurations The network topology and policy configuration data contained within the entire policy management system can be saved and exported. This capability allows customers to save and export their policy configurations to other Cisco Secure Policy Manager consoles within their networks, thus reducing configuration time and effort. It also enables customers to send their policy system configurations to a Cisco TAC for troubleshooting and problem resolution. Topology information Network topology can be exported in.xml file format. Q. Can I use Cisco Secure Policy Manager to configure my existing Cisco routers and Cisco PIX firewalls? A. Yes, Cisco Secure Policy Manager enables a network administrator to manage existing Cisco security devices throughout the network. The existing Cisco devices within the network must be manually added to the CSPM system prior to defining and distributing policies to them. Using built-in CSPM wizards simplifies and expedites this process. Upon defining policies with Cisco Secure Policy Manager, the system provides the network administrator with the capability to verify specific device configuration changes needed to enforce the defined policies. This level of verification provides the necessary device configuration details prior to policy distribution and device configuration within the network. Q. Does Cisco Secure Policy Manager offer any reporting capabilities on the security status of my network? A. Yes, Cisco Secure Policy Manager provides Web-based reports in graph and text format on the status of security policies and security events within the network. These reports are quite basic and are generally based upon filtered syslog messages received from the managed devices. The reports included in the product include the following: Policy posture (that is, what policies are applied to the devices? ) Device status Top FTP sites Top Web sites Top users* User activity summary* User activity details* Network service summary Network service details Event summary Event details * User reports are based on IP address. Additionally, several partner applications support Cisco network security devices and provide enhanced auditing and reporting capabilities. These third-party applications include Private-I by Open System Solutions (OSS), Telemate.Net by Telemate, and netforensics by NetCom Systems. All contents are Copyright 1992 2002 All rights reserved. Important Notices and Privacy Statement. Page 6 of 9

Q. Are there different administrator levels within Cisco Secure Policy Manager? A. Yes, the product provides three levels of administration: Full access This level provides read and write access to all policy administration functions within CSPM. This level also allows the user to create other administrator accounts. This level would be appropriate for the network security administrator within a company or department. Only a single network security administrator can have full access rights to the system at any one time. Read only This level provides read-only access to all policy administration functions within CSPM. This level would be appropriate for help-desk personnel or a network security administrator with auditing responsibilities. Report viewing This level provides read-only access to the Web-based reports created with Cisco Secure Policy Manager. This level is appropriate for help-desk personnel or interested managers within the IS staff. Additional administration levels based on functional roles and domain responsibilities will be added in a future product release. Q. On what operating systems does Cisco Secure Policy Manager run? A. Cisco Secure Policy Manager 3.1 runs on Windows 2000 Server and Workstation. Cisco Secure Policy Manager also features a client/server mode in which the graphical user interface (GUI) resides on a separate host than the policy server function - the operating system support is as follows: The policy server component must run on a Windows 2000 Server or Workstation with Service Pack 2 The policy administrator component (that is, the GUI) can run on any platform supported by Windows Terminal Services Q. Does Cisco Secure Policy Manager offer any Web browser-based applications? A. Yes, CSPM provides Web browser-based reports that are accessible using the following Internet browsers: Microsoft Internet Explorer 5.5, 6.0 Netscape Navigator 4.75, 4.77, 4.78 Secure access to the reports within CSPM is also provided via Secure Socket Layer (SSL). Q. Can I use my existing Microsoft or Netscape Web server to run the reports within Cisco Secure Policy Manager? A. No, the Web-based reports within CSPM are currently supported only by the Web server embedded within the policy management system. Q. Does Cisco Secure Policy Manager use a database? A. Yes, CSPM uses a proprietary object-oriented database that has been optimized and secured for use in the policy-based management system. The object schema employed within this database is consistent with the work being done within the Directory-Enabled Networks (DEN) initiative. Q. Does Cisco Secure Policy Manager integrate with any directory services? A. No, CSPM does not currently integrate with any network directories. The Cisco Secure Access Control Server (ACS) does offer a Lightweight Directory Access Protocol (LDAP) proxy, and future product releases will further integrate with Cisco ACSs and support network directories in order to provide enhanced policy management. Q. Does Cisco Secure Policy Manager integrate with any third-party network management systems (NMS)? A. Yes, CSPM allows syslog forwarding to other NMS stations. All contents are Copyright 1992 2002 All rights reserved. Important Notices and Privacy Statement. Page 7 of 9

Q. Does Cisco Secure Policy Manager interoperate with any CA servers? A. Yes, CSPM supports CA servers within a VPN network. CA servers can be added to the network topology so that Cisco devices can identify and communicate with them to acquire a certificate for authentication purposes. Certificate information such as owner, signing authority, serial number, and supported time frame can be discovered for each supported device. CSPM interoperates with, and has been tested with, Entrust, Verisign, and Netscape CA servers. Q. Does Cisco Secure Policy Manager support any industry standards? A. Yes, CSPM supports several industry standards, including: IPSec for secure management communications to Cisco devices (additionally, CSPM can configure IPSec VPN tunnels between firewalls and routers throughout a network) SSL for secure access to the product Web-based reports Microsoft s Cryptography application programming interfaces (APIs) for secure communications between policy servers and policy administrators Syslog for event notification and logging Cisco is committed to open standards, and future releases of Cisco Secure Policy Manager will support additional industry standards, as appropriate. Q. What are the system requirements for Cisco Secure Policy Manager 3.1? A. The system requirements for CSPM are as follows: Recommended Hardware Intel-based Pentium II processor, 800 MHz or better 1 GB RAM 4 GB or more free hard drive space available One or more properly configured network adapters Video display 1024 x 768, with 64k color support CD-ROM and 3.5-in. diskette drive Required Software Microsoft Windows 2000 Server or Workstation with Service Pack 2 Microsoft Internet Explorer 5.5, 6.0 Q. Can I upgrade to Cisco Secure Policy Manager 3.1 from any Cisco products? A. Yes. Customers who purchased Cisco Secure Policy Manager 2.0 UR can upgrade to CiscoWorks VMS with Cisco Secure Policy Manager 3.1 and other components including Cisco Resource Manager Essentials (RME), Host IDS, and VPN Monitor for a reduced price. Q. Where can I get more information on Cisco Secure Policy Manager? A. For more information on Cisco Secure Policy Manager, contact your local Cisco sales representative. You can also find additional product information at http://www.cisco.com/go/policymanager. Also, you can get more information on VMS at: www.cisco.com/go/vms All contents are Copyright 1992 2002 All rights reserved. Important Notices and Privacy Statement. Page 8 of 9

Corporate Headquarters 170 West Tasman Drive San Jose, CA 95134-1706 USA www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 526-4100 European Headquarters Cisco Systems International BV Haarlerbergpark Haarlerbergweg 13-19 1101 CH Amsterdam The Netherlands www-europe.cisco.com Tel: 31 0 20 357 1000 Fax: 31 0 20 357 1100 Americas Headquarters 170 West Tasman Drive San Jose, CA 95134-1706 USA www.cisco.com Tel: 408 526-7660 Fax: 408 527-0883 Asia Pacific Headquarters Capital Tower 168 Robinson Road #22-01 to #29-01 Singapore 068912 www.cisco.com Tel: +65 317 7777 Fax: +65 317 7799 Cisco Systems has more than 200 offices in the following countries and regions. Addresses, phone numbers, and fax numbers are listed on the Cisco Web site at www.cisco.com/go/offices Argentina Australia Austria Belgium Brazil Bulgaria Canada Chile China PRC Colombia Costa Rica Croatia Czech Republic Denmark Dubai, UAE Finland France Germany Greece Hong Kong SAR Hungary India Indonesia Ireland Israel Italy Japan Korea Luxembourg Malaysia Mexico The Netherlands New Zealand Norway Peru Philippines Poland Portugal Puerto Rico Romania Russia Saudi Arabia Scotland Singapore Slovakia Slovenia South Africa Spain Sweden Switzerland Taiwan Thailand Turkey Ukraine United Kingdom United States Venezuela Vietnam Zimbabwe All contents are Copyright 1992 2002, All rights reserved. Cisco, Cisco IOS, Cisco Systems, the Cisco Systems logo, and PIX are registered trademarks of and/or its affiliates in the U.S. and certain other countries. All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0208R) 202970/ETMG 9/02