Populating the Network Topology Tree

You can define a number of network objects within the Network Topology tree. This chapter identifies some guidelines for selecting among the different types of network objects, and it provides the basic tasks for creating each of the available network object types. The next chapter provides more detailed tasks for configuring the different device-specific settings that are available as a subset of the network objects described in this chapter.

Note The only network objects that you should define manually are IP ranges, hosts, and policy enablement objects, such as a Cisco Secure Policy Manager, TACACS+, or certificate authority server. For all other network objects, we strongly recommend that you use the Topology Wizard.

Mapping Between Physical Network Objects and Tree Objects

The following table maps between common objects found in your network to objects within Cisco Secure Policy Manager that can be used to represent them.

Tips We encourage you to investigate the possible uses of Cloud nodes. Clouds are not included in the following table because, like IP ranges, they are logical grouping structures to accelerate the definition of the physical network topology.

Table 3-1: Object Map Between Your Term and Cisco Secure Policy Manager

Object on Your Network Maps to Network Object in Network Topology Tree Node Icon

For: Access routers, default gateways, Internet service provider connections, etc.

Use: The Internet node.

For: Cisco Secure Policy
Manager servers (primary or secondary).

Use: You must define the parent network on which the host resides, and then create a new Host node under that network. If you have defined the network correctly, you will be prompted to install the specific host based on the Windows NT computer name. The following icons will appear if you have defined the host node correctly:

Primary Server node

Secondary Server node

For: Certificate authority servers, TACACS+ authentication servers, Radius authentication servers, and syslog servers

Use: A Host node that runs the client/server product type matching the server's role in your network.

For: E-mail servers, web servers, FTP servers, etc.

Use: A Host node.

For: Generic routers or gateways that Cisco Secure Policy
Manager cannot manage

Use: A Router node.

Management options available under Feature Set in the General panel of the node:

IPSec Support. Identifies that router as capable of acting as a hub and/or spoke endpoint in an IPSec tunnel group.

For: Cisco IOS Routers

Use: An IOS Router node.

Management options available under Feature Set in the General panel of the node:

IPSec Support. Identifies that the software image includes the Cisco Secure Integrated VPN Software package, which enables the router to act as a hub and/or spoke endpoint in an IPSec Tunnel Group.

Firewall Feature Set. Identifies that the software image includes the Cisco Secure Integrated Software package (also included in the Cisco Secure Integrated VPN Software package), which enables the router to act as a firewall.

Managed Object. Enables Cisco Secure Policy Manager to manage the other options for this router. This management includes IPSec settings, the routes that guarantee correct traffic flow, and the ACL lists that filter packets based on the defined network policy.

For: Cisco Secure PIX Firewalls

Use: A PIX Firewall node.

Management options available under Feature Set in the General panel of the node:

IPSec Support. Identifies that the software image includes the feature set required for the PIX Firewall to act as a hub and/or spoke endpoint in an IPSec Tunnel Group.

Managed Object. Enables Cisco Secure Policy Manager to manage the other options for this router. This management includes IPSec settings, the routes that guarantee correct traffic flow, and the ACL lists that filter packets based on the defined network policy.

Object on Your Network	Maps to Network Object in Network Topology Tree	Node Icon
For: Access routers, default gateways, Internet service provider connections, etc.	Use: The Internet node.
For: Cisco Secure Policy Manager servers (primary or secondary).	Use: You must define the parent network on which the host resides, and then create a new Host node under that network. If you have defined the network correctly, you will be prompted to install the specific host based on the Windows NT computer name. The following icons will appear if you have defined the host node correctly: Primary Server node Secondary Server node
For: Certificate authority servers, TACACS+ authentication servers, Radius authentication servers, and syslog servers	Use: A Host node that runs the client/server product type matching the server's role in your network.
For: E-mail servers, web servers, FTP servers, etc.	Use: A Host node.
For: Generic routers or gateways that Cisco Secure Policy Manager cannot manage	Use: A Router node. Management options available under Feature Set in the General panel of the node: IPSec Support. Identifies that router as capable of acting as a hub and/or spoke endpoint in an IPSec tunnel group.
For: Cisco IOS Routers	Use: An IOS Router node. Management options available under Feature Set in the General panel of the node: IPSec Support. Identifies that the software image includes the Cisco Secure Integrated VPN Software package, which enables the router to act as a hub and/or spoke endpoint in an IPSec Tunnel Group. Firewall Feature Set. Identifies that the software image includes the Cisco Secure Integrated Software package (also included in the Cisco Secure Integrated VPN Software package), which enables the router to act as a firewall. Managed Object. Enables Cisco Secure Policy Manager to manage the other options for this router. This management includes IPSec settings, the routes that guarantee correct traffic flow, and the ACL lists that filter packets based on the defined network policy.
For: Cisco Secure PIX Firewalls	Use: A PIX Firewall node. Management options available under Feature Set in the General panel of the node: IPSec Support. Identifies that the software image includes the feature set required for the PIX Firewall to act as a hub and/or spoke endpoint in an IPSec Tunnel Group. Managed Object. Enables Cisco Secure Policy Manager to manage the other options for this router. This management includes IPSec settings, the routes that guarantee correct traffic flow, and the ACL lists that filter packets based on the defined network policy.

The remainder of this chapter presents step-by-step procedures for manually defining each network object type. For more information about using the Topology Wizard and detailed descriptions and additional tasks related to these network objects, refer to the online Help system provided with the product.

Internet

The Internet node is a special Cloud node that represents all unknown networks to which your trusted and untrusted networks are connected. It identifies one or more points of connection between your network and your Internet service provider (ISP). Therefore, when you define your network topology, you should view this definition as starting from the connection to your ISP and continuing upstream to the innermost networks. From the Interfaces panel on the Internet node, you can define the networks that form the boundary between your networks and the ISPs, as well as the IP addresses of the default gateways used by your network. To do so, you must define the ISP's upstream gateway interfaces and networks connected to those interfaces. Only one perimeter exists for the Internet node---the untrusted Internet perimeter, which represents all uncontrolled networks, including those networks attached to the downstream interfaces of your outermost Policy Enforcement Points.

Tips When you define your Network Topology, you must define it from the outside to the inside, starting with the access routers of your outermost gateway objects. These access routers often represent your ISPs' access routers. To identify different ISP connections, we recommend that you define a unique interface for each connection.

Specifying Interface Settings of the Internet Node

The first task that you must complete when defining your Network Topology tree is specifying the settings in the Interfaces panel for the Internet node. In the Interfaces panel, you must specify the IP addresses of the default gateways that your outermost gateway objects use to reach all undefined networks. Because the Internet node is a special cloud, this logical gateway object also identifies the default gateways used by any other networks defined under the Network Topology tree to reach the Internet.

You must also specify any cloud networks under the Cloud Networks interface that you require for special cases in your network policy definitions. These cloud networks represent untrusted networks that exist within the larger cloud of the Internet, and they identify networks to/from which you want to control the ability of users on your trusted networks to access services provided by servers residing on those networks.

Note For each IP address that you assign to the Internet Perimeter's interface, you must define the network on which that IP address resides. These networks represent the shared networks between your ISP's and your outermost gateway objects. After you define these networks, you can define a Policy Enforcement Point, such as a PIX Firewall, or some other gateway object below one of these shared networks. However, all such gateway objects must have an IP address assigned to the downstream interface that is connected to these networks.

To specify interface settings of the Internet node, perform the following task:

Step 1 Right-click the Internet icon.

Step 2 To view the Interfaces panel, point to Properties, and then click Interfaces on the shortcut menu.

Result: The Interfaces panel appears in the View pane.

Step 3 To select Interface 1 so that you can rename it, click the Interface 1 icon in the Interfaces panel.

Result: The Name box becomes available under Edit Interface Selection.

Step 4 To give Interface 1 a meaningful name, type that name in the Name box and press Enter.

This interface usually represents that interface residing on an access router that is owned by your ISP. Therefore, a good name for this interface might be something like "ISP Router Interface." If you have multiple ISPs, you must define a unique interface to represent each service provider.

Step 5 To access the shortcut menu, right-click the Interface icon that you just renamed in the Interfaces panel.

Step 6 To define a new network, point to New, and then click Network.

Result: A new node named Network # appears under the selected interface.

Step 7 To name the network, type the new name in the Name box under Edit Network Selection.

Result: The new name appears in the Name box of the selected node.

The name of a network may include up to 256 alphanumeric characters, but it may not include quotation marks (") or semicolons (;).

Step 8 To specify the address assigned to this network, type that address in the Network Address box.

This value identifies the address of a specific network. Typically, this network is shared between you and your ISP. This specific network exists behind a gateway (represented by the Internet node) that is directly connected to that network. This address is used to derive routing rules on a Policy Enforcement Point.

Step 9 To specify the network mask that corresponds to the network address you specified, type that value in the Network Mask box under Edit Network Selection.

This value identifies the mask of the network specified in the Network Address box. A Policy Enforcement Point uses this mask value to determine the appropriate routing rule.

Step 10 To access the shortcut menu, right-click the Interface 1 icon in the Interfaces panel.

Step 11 To define a new default gateway address that corresponds to the network that you just defined, point to New, and then click IP Address.

Result: A new node named 0.0.0.0 appears under the selected interface.

Step 12 To specify the default gateway, type that gateway address in the IP Address box under Edit IP/Range Address Selection.

This address identifies the default gateway that all networks defined under this network node in the Network Topology tree will use to reach the cloud networks, as well as all the unknown networks, that the Internet node represents.

Note These IP addresses represent the default gateways used by your outermost gateway objects, such as your outermost PIX Firewall. However, they are not the addresses assigned to the downstream interfaces of your gateway objects. Instead, these IP addresses represent the addresses assigned to the upstream interfaces of the access routers to which your gateway objects deliver packets.

In addition, these IP addresses must be paired with the networks of which they are members. In other words, for each IP address you define, you must also define the corresponding network on which that IP address resides.

Step 13 If you want to define cloud networks on the Internet node, continue with Step 14. Otherwise, skip to Step 20.

Step 14 To access the shortcut menu, right-click the Cloud Networks icon in the Interfaces panel.

Step 15 To define a new cloud network, point to New, and then click Network.

Result: A new node named Cloud Network # appears under the Cloud Networks interface.

Step 16 To name the cloud network, type the new name in the Name box under Edit Network Selection.

Result: The new name appears in the Name box of the selected node.

The name of a cloud network may include up to 256 alphanumeric characters, but it may not include quotation marks (") or semicolons (;).

Step 17 To specify the address of the cloud network, type that address in the Network Address box under Edit Network Selection.

This address represents a network that exists behind other gateways that you do not intend to define or possibly behind other cloud networks in the list.

Step 18 To specify the network mask of the cloud network, type that mask in the Network Mask box under Edit Network Selection.

Step 19 For each cloud network that you want to define, repeat Steps 14 through 18.

Step 20 To accept your changes and close the selected panel, click OK.

Result: Any networks that you specified in Steps 5 through 9 appear under the Internet node in the Network Topology tree.

Step 21 To save any changes that you have made, click Save on the File menu.

Defining Networks Upstream from the Internet Node

You can define one or more networks under the Internet node. These networks identify those networks that you are connecting to the Internet, or all unknown networks. Typically, these networks represent networks that you share with your ISP. For each network that you define under the Internet node, you must also specify the IP address of the default gateway that all other networks and gateway nodes defined under the Internet node use to reach all unknown networks and the cloud networks defined in the Interfaces panel of the Internet node.

Tips Because Cisco Secure Policy Manager assumes that all gateway objects under the same Internet interface are directly connected to one another, we strongly recommend that you define a new interface for each ISP connection. Each interface represents the upstream interface on an access router of your ISP.

To define a network under the Internet node, perform the following task:

Step 1 To view the Network Topology tree alone, click Network Topology on the Navigator toolbar.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To access the shortcut menu, right-click the Internet icon under which you intend to define new networks.

Step 3 To view the Interfaces panel, point to Properties, and then click Interfaces on the shortcut menu.

Result: The Interfaces panel appears in the View pane.

Step 4 To access the shortcut menu, right-click the Interface 1 icon in the Interfaces panel.

Step 5 To define a network, point to New, and then click Network.

Result: A new node named Network # appears under the Interface 1 interface.

Step 6 To name the network, type the new name in the Name box under Edit Network Selection.

Result: The new name appears in the Name box of the selected node.

The name of a network may include up to 256 alphanumeric characters, but it may not include quotation marks (") or semicolons (;).

Step 7 To specify the address of the network, type that address in the Network Address box under Edit Network Selection.

Step 8 To specify the network mask that corresponds to the network address you specified, type that value in the Network Mask box.

This value identifies the mask of the network specified in the Network Address box. A Policy Enforcement Point uses this mask value to determine the appropriate routing rule.

Step 9 To define a new default gateway address that corresponds to the network that you just defined, right-click the Network icon, point to New, and then click IP Address.

Result: A new node named 0.0.0.0 appears under the selected interface.

Step 10 To specify the default gateway, type that gateway address in the Network Address box under Edit Network Selection.

Step 11 For each network that you want to define, repeat Steps 4 through 10.

Step 12 To accept your changes and close the Interfaces panel, click OK.

Step 13 To save any changes that you have made, click Save on the File menu.

Defining Cloud Networks Within the Internet Node

You can define one or more cloud networks within the Internet node. Cloud networks identify those networks that can be reached through the cloud. The Internet node is a logical grouping structure that identifies the gateway used to reach all unknown networks, as well as any specific cloud networks. The real interfaces defined for the Internet node include the IP addresses of the default gateways that all networks defined in the Network Topology tree use to reach all unknown networks and the cloud networks defined in the Interfaces panel of the Internet node. Cloud networks are organized under a special interface called Cloud Networks.

These cloud networks represent untrusted networks that exist within the larger cloud of the Internet, and they identify networks to/from which you want to control the ability of users on your trusted networks to access services provided by servers residing on those networks. After you define a cloud network, you can reference that network within security policy abstracts, as well as perform a drag-and-drop operation to move the network into the Security Policy Enforcement branch to express how you want to apply security policies to traffic that originates from or is destined to the cloud network.

To define a cloud network on the Internet node, perform the following task:

Step 1 Right-click the Cloud Networks icon under which you want to define a cloud network in the Interfaces panel, point to New, and then click Network.

Result: A new node named Cloud Network # appears under the Cloud Networks interface.

Step 2 To name the cloud network, type the new name in the Name box under Edit Network Selection.

Result: The new name appears in the Name box of the selected node.

The name of a cloud network may include up to 256 alphanumeric characters, but it may not include quotation marks (") or semicolons (;).

Step 3 To specify the address of the cloud network, type that address in the Network Address box under Edit Network Selection.

This address represents a network that exists behind other gateways that you do not intend to define or possibly behind other cloud networks in the list.

Step 4 To specify the network mask of the cloud network, type that mask in the Network Mask box under Edit Network Selection.

Step 5 For each cloud network that you want to define, repeat Steps 1 through 4.

Step 6 To accept your changes and close the selected panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Network

From the panel associated with a network, you can define the address and mask settings for a specific network that is attached to a gateway object, such as a Policy Enforcement Point, a router, a switch, a firewall, or a cloud.

Creating a Network Node

You can manually define a Network node under any Gateway node in the Network Topology tree. Gateway nodes include the Internet, clouds, IOS Routers, PIX Firewalls, and generic routers. Defining a new network is useful when you are defining your entire network topology because it ensures that Cisco Secure Policy Manager derives the correct routing rules required for a Policy Enforcement Point to deliver packets to hosts residing on that network. In addition, you can use a drag-and-drop operation to move Network nodes in the Security Policy Enforcement branch to refine network policy definitions.

To create a Network node, perform the following task:

Step 1 To view the Network Topology tree alone, click Network Topology on the Navigator toolbar.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the gateway under which you want to define a new network, expand the Network Topology tree until you view that gateway node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the gateway icon under which you want to define a new network. The following gateway types exist:

IOS Router
PIX Firewall
Internet
Cloud
Router

Step 4 To create a new network, point to New, and then click Network on the shortcut menu.

Result: A new node named Network # appears under the selected gateway in the Interfaces panel.

Step 5 To name the network, type the new name in the selected box and press Enter.

Result: The new name appears in the Name box of the selected node.

The network name may include up to 256 alphanumeric characters, but it may not include quotation marks (") or semicolons (;).

Tips If you cannot edit the name, right-click the new Network icon, and click Rename on the shortcut menu.

Step 6 To access the shortcut menu, right-click the Network icon for the network that you just created in the Navigator pane.

Step 7 To see the properties associated with the new network, click Properties on the shortcut menu.

Result: The General panel associated with the new network appears in the View pane.

Step 8 To specify the address assigned to this network, type that address in the Network Address box.

This value identifies the address of a specific network. This specific network exists behind a gateway that is directly connected to that network. This address is used to derive routing rules on a Policy Enforcement Point.

Step 9 To specify the network mask that corresponds to the network address you specified, type that value in the Network Mask box.

This value identifies the mask of the network specified in the Network Address box. A Policy Enforcement Point uses this mask value to determine the appropriate routing rule.

Step 10 To accept your changes and close the General panel, click OK.

Step 11 To save any changes that you have made, click Save on the File menu.

Network Shortcut

A network shortcut, similar to other Windows shortcuts, is a reference to an already existing Network node that is defined elsewhere in the Network Topology tree. You can use network shortcuts to help you represent those networks that have upstream perimeters shared by multiple gateway nodes, such as two Policy Enforcement Points. You can define such a shortcut in the Interfaces panel of the gateway object or by using the Topology Wizard.

Creating a Network Shortcut Node Manually

You can manually define a network shortcut by duplicating the exact names of the perimeter and network in the Interfaces panel of a gateway object that has an upstream interface attached to the same network as another gateway object. Before you can define a network shortcut, you must have defined the network (and its associated perimeter) that you want to reference as part of the interface definition of an existing gateway object, such as a cloud, PIX Firewall, IOS Router, or a generic Router.

This task assumes that you are working in the Interfaces panel of a gateway object. It also assumes that you have not yet defined the perimeter that will be shared or that the perimeter is inherited from a downstream gateway object. In other words, it assumes that you have defined the downstream interface settings for this gateway object, but not the interface settings for the upstream interface that is connected to the network to which you want to create a Network Shortcut node.

To define a shortcut to an existing network manually, perform the following task:

Step 1 To define a perimeter, click Perimeter under the Insert New.

Result: A new node named Perimeter # appears in the Interfaces panel.

Step 2 To specify the name of the perimeter that is defined on the gateway object that shares the network with the selected gateway object, type that perimeter's name in the Name box under Edit Perimeter Selection.

You must specify the name of this perimeter exactly as it appears on the gateway object for which you originally defined that perimeter.

Step 3 To define the shared network, click Network under Insert New.

Result: A new node named Network # appears in the Interfaces panel.

Step 4 To specify the name of the shared network, type that name in the Name box under Edit Network Selection.

You must specify the name of this network exactly as it appears on the gateway object for which you originally defined that network.

Step 5 To define the IP address that this gateway object has on the shared network, click IP Address under Insert New.

Result: A new node named 0.0.0.0 appears in the Interfaces panel.

Step 6 To specify the IP address that this gateway object has on the shared network, specify that address in the IP Address box under Edit IP Address Selection.

This address must be a valid address on the specified network.

Step 7 Continue defining the interfaces on the selected gateway object. When you click OK to close the Interfaces panel, a message box appears stating that a physical network with the same network address has been found inside the perimeter that you specified in Step 2. You are prompted to click Yes to create a shortcut (reference) to that network.

Step 8 To create the reference to the existing network, click Yes.

Result: A shortcut to the specified network appears as one of the networks upstream from the selected gateway object.

Cloud

The Cloud node organizes a collection of networks attached to the Cloud Networks interface. Cloud nodes, which are defined under Network nodes, enable you to avoid defining your entire network topology to ensure that routes are defined to reach those networks attached to the Cloud Networks interface and to define exceptions in the global security policy that applies to traffic originating from and/or destined to those other networks. In addition, Cloud nodes enable you to identify gateway objects that can participate in IPSec tunnel groups.

Defining a Cloud Node

You can define a Cloud node that organizes cloud networks from any Network node defined under the Network Topology tree. You can also use the Network Wizard to define a Cloud node. Clouds represent a collection of networks whose exact topology is not known or that you do not want to define.

To define a Cloud node under your Network Topology tree, perform the following task:

Step 1 To view the Network Topology tree alone, click Network Topology on the Navigator toolbar.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the network below which you want to define a Cloud, expand the Network Topology tree until you view that Network node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Network icon under which you intend to define a cloud.

Step 4 To create a new cloud, point to New, and then to Gateway, and then click Cloud on the shortcut menu.

Result: A new node named Cloud # appears under the Network node.

Step 5 To name the cloud, type the new name in the selected Name box and press Enter.

Result: The new name appears in the Name box of the selected node.

The cloud name may include up to 256 alphanumeric characters, but it may not include quotation marks (") or semicolons (;).

Tips If you cannot edit the name, right-click the new Cloud icon, and click Rename on the shortcut menu.

Step 6 You have now defined the Cloud node under a specific network. For instructions on completing your Cloud node definition, refer to the appropriate task section:

Step 7 To save any changes that you have made, click Save on the File menu.

Specifying Interface Settings for a Cloud

After you have defined a Cloud node, the first task that you must complete is specifying the settings in the Interfaces panel for that Cloud node. In the Interfaces panel, you must specify the IP address of the default gateway used to reach any cloud networks that you intend to define. Next, you must specify the cloud networks under the Cloud Networks interface.

Note This procedure assumes that you have just created and named a Cloud node as described in the "Defining a Cloud Node" section. Therefore, we assume that you are on the Cloud node that you have just created and are attempting to complete the requisite settings to pass a system Consistency Check.

To specify interface settings of a Cloud node, perform the following task:

Step 1 To access the shortcut menu, right-click the Cloud icon that you just created.

Step 2 To view the Interfaces panel, point to Properties, and then click Interfaces on the shortcut menu.

Result: The Interfaces panel appears in the View pane.

Step 3 To select the IP address object that represents the default gateway address, click the IP address icon under the downstream interface in the Interfaces panel.

The downstream interface is the interface that is attached to the shared network under which this Cloud node resides.

Step 4 To specify the default gateway, type that gateway address in the IP Address box under Edit IP/Range Address Selection.

This address identifies the gateway that fully defined networks upstream from this Cloud node will use to reach the cloud networks that you intend to define.

Step 5 To access the shortcut menu, right-click the Cloud Networks icon in the Interfaces panel.

Step 6 To define a new cloud network, point to New, and then click Network.

Result: A new node named Cloud Network # appears under the Cloud Networks interface.

Step 7 To name the cloud network, type the new name in the Name box under Edit Network Selection.

Result: The new name appears in the Name box of the selected node.

The name of a cloud network may include up to 256 alphanumeric characters, but it may not include quotation marks (") or semicolons (;).

Step 8 To specify the address of the cloud network, type that address in the Network Address box under Edit Network Selection.

This address represents a network that exists behind other gateways that you do not intend to define or possibly behind other cloud networks in the list.

Step 9 To specify the network mask of the cloud network, type that mask in the Network Mask box under Edit Network Selection.

Step 10 For each cloud network that you want to define, repeat Steps 5 through 9.

Step 11 To accept your changes and close the Interfaces panel, click OK.

Step 12 To save any changes that you have made, click Save on the File menu.

Defining Cloud Networks

After you have defined a Cloud node, you can define one or more cloud networks within that Cloud node. Cloud networks identify those networks that can be reached through the cloud. The Cloud node is a logical grouping structure that identifies the gateway used to reach those cloud networks. At least one interface defined for the Cloud node includes the IP address of a default gateway that is used to reach the cloud networks from other networks defined in the Network Topology tree. Cloud networks are organized under a special interface called Cloud Networks.

To define a cloud network, perform the following task:

Step 1 To view the Network Topology tree alone, click Network Topology on the Navigator toolbar.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the cloud in which you want to define a new cloud network, expand the Network Topology tree until you view that Cloud node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Cloud icon under which you intend to define new cloud networks.

Step 4 To view the Interfaces panel, point to Properties, and then click Interfaces on the shortcut menu.