Configuring the Device-Specific Settings of Network Objects

This section focuses on explaining the device-centric settings that you can define within the Network Topology tree. It also pays special attention to those settings that you must define. The purpose of this section is to help you understand why you must define these settings and to help you focus your energies correctly, because by knowing what you can specify within the Network Topology tree, you also know what you cannot specify, which encourages you to look outside of this tree to accomplish other goals.

Device-specific settings pertain to the proper operation of a network object in your network. Some network objects have relatively few device-specific settings, while others have a large number of settings. We can define six categories of device-specific settings:

• Settings that enable the overload of the address pools used by mapping rules, permitting ICMP echo-reply packets to be passed by all interfaces, and the settings that enable audit trails and alerts to be generated for all inspections

• Configuration settings for generating and labeling syslog data streams generated by the Policy Enforcement Point

• Network service-specific inspection timeout settings and individual settings for enabling the generation of audit trails and alerts for each network service

• Timeout settings for certain services, as well as all sessions, and multiple settings that specify the number of half-open sessions that the IOS Router should manage before it begins tearing down half-open sessions. (These global session management settings provide protection against common denial of service attacks.)

Enabling/Disabling the Policy Distribution Point

You can enable or disable a Policy Distribution Point that resides on a primary or secondary server. If you enable a previously disabled Policy Distribution Point, you can use it to generate and publish device-specific command sets to the Policy Enforcement Points on your network. However, if you disable a Policy Distribution Point, you can no longer use it to generate and publish device-specific command sets to any Policy Enforcement Points on your network. In fact, a disabled Policy Distribution Point is not a valid option for the Policy Distribution Point box in the Enforcement panel of the Policy Enforcement Points that are managed by Cisco Secure Policy Manager.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the primary or secondary server for which you want to enable or disable the Policy Distribution Point residing on that server, expand the Network Topology tree until you view that server node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Primary Server icon or the Secondary Server icon that represents the server on which the Policy Monitor Point is running.

Step 4 To view the Policy Distribution panel, point to Properties, and then click Policy Distribution on the shortcut menu.

Result: The Policy Distribution panel appears in the View pane.

Step 5 To change the availability of the Policy Distribution Point running on this host, select or clear the Disabled box under General Settings.

When this box is selected, the Policy Distribution Point is disabled. When the box is cleared, the Policy Distribution Point can be used to generate and publish command sets to the Policy Enforcement Points residing on your network.

Step 6 To accept your changes and close the Policy Distribution panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Note Maintenance operations for the Policy Monitor, such as archiving event records, are covered in "Maintaining Cisco Secure Policy Manager."

Modifying the IP Address Setting

You can specify the IP address that clients, such as Policy Enforcement Points submitting audit event streams, use to contact the Policy Monitor Point. This feature is useful if you are interested in separating the Cisco Secure Policy Manager services onto different IP addresses so that you can monitor network sessions across Policy Enforcement Points to these services. By assigning separate IP addresses, you can study network sessions to the Policy Monitor Point that occur across a Policy Enforcement Point and develop custom reports that summarize this activity. This feature is also useful if you have multiple IP addresses assigned to the host, but you only have a DNS entry defined for one of the IP addresses.

To modify the IP address used to connect to the Policy Monitor Point, perform the following task:

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the primary or secondary Server for which you want to modify the IP address that clients use to connect to the Policy Monitor Point that resides on that server, expand the Network Topology tree until you view that server node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Primary Server icon or the Secondary Server icon that represents the server on which the Policy Monitor Point is running.

Step 4 To view the Policy Monitor panel, point to Properties, and click Policy Monitor on the shortcut menu.

Result: The Policy Monitor panel appears in the View pane.

Step 5 To change the IP address that clients will use to contact the Policy Monitor Point running on this computer, click the new IP address in the IP Address list under General Settings.

The list of IP addresses available are those IP addresses that are defined for this Primary or Secondary Server node. These addresses are defined in the IP Addresses box in the General panel of the selected Primary or Secondary Server node. By default, the Policy Monitor Point uses the first IP address in the IP Addresses box.

Step 6 To accept your changes and close the Policy Monitor panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Modifying the UDP Port used by the Policy Monitor Point

You can specify a custom UDP port on which the Policy Monitor Point listens for audit streams from the Policy Enforcement Points. This feature is useful if you already have a network service that listens on the default UDP port used by the Policy Monitor Point, which is UDP port 514. To modify the UDP port for the Policy Monitor Point, you must modify the provided network service definition (the Cisco Policy Monitor definition under the Network Services branch of the Tools and Services tree) or define a custom network service. To make the Policy Monitor Point consistent with your new port settings, you must then select that network service in the Policy Monitor panel. This modification ensures that any security polices that you have applied that permit Policy Monitor Point network traffic will continue to operate correctly after you have modified the port value.

Note By changing the Cisco Policy Monitor definition rather than defining a new network service, you can ensure that any applied security policies that permit Policy Monitor Point communications across a Policy Enforcement Point will be updated automatically.

To modify the UDP port used to connect to the Policy Monitor Point, perform the following task:

Result: The Tools and Services tree appears in the Navigator pane.

Step 2 To find the network service for which you want to change the UDP port value, expand the Tools and Services tree, the Network Services branch, and the Cisco Policy Monitor network service.

Step 3 To configure the UDP transport layer of the network service definition, right-click the Cisco Policy Monitor icon in the Navigator pane, and click Properties on the shortcut menu.

Result: The UDP panel appears in the View pane. You can make any changes directly in this panel.

Step 4 To change the UDP port value used by the Cisco Policy Monitor network service, type that new port number in the Port box under Instance Settings.

If you change this port setting from the default value of 514, the Policy Monitor Point automatically detects the change; you will not need to reboot the server for the change to take effect.

Step 5 To accept your changes and close the UDP panel, click OK.

Step 6 To save any changes that you have made, click Save on the File menu.

Selecting the Associated Network Service

From the Policy Monitor panel, you can specify the network service that is associated with the Policy Monitor Point. This network service identifies the UDP port on which the Policy Monitor Point listens for audit streams from remote Policy Enforcement Points. When you specify a network service that uses a different UDP port value than the network service that is currently associated with the Policy Monitor Point, the Policy Monitor Point stops listening to the old port number and starts listening on the new port.

Note Changing the UDP port can result in the loss of data and state. Therefore, any Cisco Secure Policy Manager components that are requesting services at the time you change the port number must reissue their requests once the process starts listening on the new port. Such changes cancel the existing sessions.

To select the network service definition used to connect to the Policy Monitor Point, perform the following task:

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the primary or secondary server for which you want to select the associated network service, expand the Network Topology tree until you view that server node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Primary Server icon or the Secondary Server icon that represents the server on which the Policy Monitor Point is running.

Step 4 To view the Policy Monitor panel, point to Properties, and click Policy Monitor on the shortcut menu.

Result: The Policy Monitor panel appears in the View pane.

Step 5 To select the network service definition used by the Policy Monitor Point running on this host, click that network service in the Associated Network Service box under General Settings.

This network service must be defined under the Network Services branch of the Tools and Services tree. By default, the Policy Monitor Point uses the Cisco Policy Monitor network service, which specifies UDP port 514 to conduct communications. If you change this port setting from the default value of 514, the Policy Monitor Point automatically detects the change; you will not need to reboot the server for the change to take effect.

Caution If you change the network service name from Cisco Policy Monitor, any security policies that you have applied that permit this service to pass through Policy Enforcement Points will need to be updated manually.

Step 6 To accept your changes and close the Policy Monitor panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Redirecting Policy Monitor Point to Publish Syslog Messages

You can specify that you want the Policy Monitor Point to duplicate the syslog data packets that it receives from the Policy Enforcement Points that it monitors. This feature enables both the Policy Monitor Point and a third-party syslog server to study the syslog data streams even though both the Policy Monitor Point and the syslog server reside on the same primary or secondary server. This feature is useful if you use a centralized syslog system to track application and network activity.

To specify that you want the Policy Monitor Point to duplicate and direct syslog messages, perform the following task:

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the primary or secondary server that is running the Policy Monitor Point for which you want to duplicate and redirect syslog messages, expand the Network Topology tree until you view that server node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Primary Server icon or the Secondary Server icon that represents the server on which the Policy Monitor Point is running.

Step 4 To view the Policy Monitor panel, point to Properties, and click Policy Monitor on the shortcut menu.

Result: The Policy Monitor panel appears in the View pane.

Step 5 To specify that you want the syslog messages duplicated and redirected to a specific UDP port on the selected server, type the number of that UDP port in the Redirect Port box under Other.

Modifying the IP Address Setting

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the primary server for which you want to modify the IP address that client applications use to contact the Policy Report Point, expand the Network Topology tree until you view that Primary Server node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Primary Server icon that represents the server on which the Policy Report Point is running.

Step 4 To view the Policy Reports panel, point to Properties, and click Policy Reports on the shortcut menu.

Results: The Policy Reports panel appears in the View pane.

Step 5 To change the IP address on which the Policy Report Point running on this host listens for requests from web browsers, select the new IP address in the IP Address box under General Settings.

The list of IP addresses available are those IP addresses that are defined for the primary server on which the Policy Report Point is running. These addresses are defined in the IP Addresses box in the General panel of the selected server node. By default, the Policy Report Point uses the first IP address in the IP Addresses box.

Step 6 To accept your changes and close the Policy Reports panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Modifying the TCP Port used by the Policy Report Point

Note By changing the Cisco Policy Reporter definition rather than defining a new network service, you can ensure that any applied security policies that permit Policy Report Point communications across a Policy Enforcement Point will be updated automatically.

When you specify a network service that uses a different TCP port value than the network service that is currently associated with the Policy Report Point, the Policy Report Point automatically detects the change; you will not need to reboot the server for the change to take effect.

To modify the TCP port used to connect to the Policy Report Point, perform the following task:

Result: The Tools and Services tree appears in the Navigator pane.

Step 2 To find the network service for which you want to change the TCP port value, expand the Tools and Services tree, the Network Services branch, and the Cisco Policy Reporter network service.

Step 3 To configure the TCP transport layer of the network service definition, right-click the Cisco Policy Reporter icon in the Navigator pane, and click Properties on the shortcut menu.

Result: The TCP panel appears in the View pane. You can make any changes directly in this panel.

Step 4 To change the TCP port value used by the Cisco Policy Reporter network service, type that new port number in the Port box under Instance Settings.

Step 5 To accept your changes and close the TCP panel, click OK.

Note For the change to take effect, you must select the Cisco Policy Reporter in the Associated Network Service box in the Policy Reports panel.

Step 6 To save any changes that you have made, click Save on the File menu.

Selecting the Associated Network Service

To select the network service definition used to connect to the Policy Report Point, perform the following task:

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the primary server for which you want to select the associated network service, expand the Network Topology tree until you view that Primary Server node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Primary Server icon that represents the server on which the Policy Report Point is running.

Step 4 To view the Policy Reports panel, point to Properties, and click Policy Reports on the shortcut menu.

Result: The Policy Reports panel appears in the View pane.

Step 5 To select the network service definition used by the Policy Report Point running on this host, click that network service in the Associated Network Service box.

This network service must be defined under the Network Services branch of the Tools and Services tree. By default, the Policy Report Point uses the Cisco Policy Reporter network service, which specifies TCP port 8080 to conduct communications. If you change this port setting from the default value of 8080, the Policy Report Point automatically detects the change; you will not need to reboot the server for the change to take effect.

Caution If you change the network service name from Cisco Policy Reporter, any security policies that you have applied that permit this service to pass through Policy Enforcement Points will need to be updated manually.

Step 6 To accept your changes and close the Policy Reports panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Modifying the Start Page Setting

To modify the Policy Report Point start page setting, perform the following task:

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the primary server for which you want to modify the starting page for the reporting agent, expand the Network Topology tree until you view that Primary Server node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Primary Server icon that represents the server on which the reporting agent is running.

Step 4 To view the Policy Reports panel, point to Properties, and click Policy Reports on the shortcut menu.

Result: The Policy Reports panel appears in the View pane.

Step 5 To change the HTML page that the reporting agent loads when a web browser requests services from the server, type the new URL in the Starting Page box.

This URL identifies the start page for the HTML reports that the Policy Report Point generates to summarize network service and system event activity.

Step 6 To accept your changes and close the Policy Reports panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Note Maintenance operations for the Policy Database, such as checkpointing, are covered in "Maintaining Cisco Secure Policy Manager."

Modifying the IP Address Setting

You can specify the IP address that the Policy Database uses when listening for requests from other Cisco Secure Policy Manager components. This feature is useful if you are interested in separating Cisco Secure Policy Manager services across different IP addresses so you can monitor network sessions across Policy Enforcement Points between these services and the Policy Database. By assigning separate IP addresses, you can study network sessions with the Policy Database that occur across a Policy Enforcement Point and develop custom reports that summarize this activity.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the primary or secondary server for which you want to modify the IP address at which the Policy Database can be contacted, expand the Network Topology tree until you view that server node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Primary Server icon or the Secondary Server icon that represents the server on which the Policy Database is running.

Step 4 To view the Policy Database panel, point to Properties and click Policy Database on the shortcut menu.

Result: The Policy Database panel appears in the View pane.

Step 5 To change the IP address on which the Policy Database running on this host listens for requests from the GUI client workstations and other Cisco Secure Policy Manager components, click the new IP address in the IP Address list under General Settings.

The IP addresses listed are those IP addresses that are defined for the Primary or Secondary Server node that you selected. These addresses are defined in the IP Addresses box in the General panel of the selected server node. By default, the Policy Database uses the first IP address in the IP Addresses box.

Step 6 To accept your changes and close the Policy Database panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Selecting the Associated Network Service

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the primary or secondary server for which you want to select the associated network service, expand the Network Topology tree until you view that server node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Primary Server icon or the Secondary Server icon that represents the server on which the Policy Database is running.

Step 4 To view the Policy Database panel, point to Properties and click Policy Database on the shortcut menu.

Result: The Policy Database panel appears in the View pane.

Step 5 To select the network service definition used by the Policy Database running on this host, click that network service in the Associated Network Service box.

This network service must be defined under the Network Services branch of the Tools and Services tree. By default, the Policy Database uses the Cisco Policy Database network service, which specifies TCP port 2567, as assigned by IANA, to conduct communications. If you change this port setting from the default value of 2567, you must reboot the primary server for the change to take effect.

Caution If you change the network service name from Cisco Policy Database, any security policies that you have applied that permit this service to pass through Policy Enforcement Points will need to be updated manually.

Step 6 To accept your changes and close the Policy Database panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Changing Communications Port

Result: The Tools and Services tree appears in the Navigator pane.

Step 2 To find the network service for which you want to change the TCP port value, expand the Tools and Services tree, the Network Services branch, and the Cisco Policy Database network service.

Step 3 To configure the TCP transport layer of the network service definition, right-click the Cisco Policy Database icon in the Navigator pane, and click Properties on the shortcut menu.

Result: The TCP panel appears in the View pane. You can make any changes directly in this panel.

Step 4 To change the TCP port value used by the Cisco Policy Database network service, type that new port number in the Port box under Instance Settings.

This port number identifies the TCP port that the Policy Database uses to communicate with other Cisco Secure Policy Manager components. By default, the Policy Database uses TCP port 2567, as assigned by IANA, to conduct these communications.

Step 5 To accept your changes and close the Policy Database panel, click OK.

Note For the change to take effect, you must select Cisco Policy Database in the Associated Network Service box in the Policy Database panel. Then, you must restart the Cisco Controlled Host Component service.

Step 6 To save any changes that you have made, click Save on the File menu.

Exporting a File Key

Caution We strongly recommend that you import this key to a diskette or some other medium that you can lock up securely. At the least, any network shares or hosts containing the key should be secured and have restricted access. Otherwise, the security of the Primary Policy Database, and hence your networks, could be compromised.

Using the GUI client (remote/standalone or otherwise), you can administer more than one Primary Policy Database. To administer more than one Primary Policy Database, you must export the Policy Database key from each Primary Policy Database and import it in to the GUI client that you want to use.

Even though you can administer more than one Primary Policy Database from a single GUI client, only one person at a time, using the full access privilege, can administer each Primary Policy Database. However, no restrictions exist for how many administrators using the read-only privilege can connect to a Primary Policy Database.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the primary server that runs the Primary Policy Database for which you want to export the database key, expand the Network Topology tree until you view the Primary Server node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Primary Server icon that represents the server on which the Primary Policy Database is running.

Step 4 To view the Policy Database panel, point to Properties and click Policy Database on the shortcut menu.

Result: The Policy Database panel appears in the View pane.

Step 5 To export the key, click Export Key under General Settings.

Result: The Export Key To dialog box appears, presenting a tree-based view of your Cisco Secure Policy Manager folder.

Step 6 To specify the location where you want to export the key file, select that destination in the Save in box.

You can create a new folder by clicking Create New Folder, typing a name for the new folder, and pressing Enter.

Step 7 To specify the name for the key file, type that name in the File name box.

Step 8 To export the file to the specified location, click OK.

The new file is created at the specified location.

Restarting the Policy Database

Step 2 To display the Services dialog box, double-click the Services icon in Control Panel.

Result: The Services dialog box appears.

Step 3 To select the Cisco Controlled Host Component service, scroll through the list of services and click the service named Cisco Controlled Host Component.

Step 4 To stop the Cisco Controlled Host Component service, click Stop.

Result: The Services dialog box displays a message prompting you for confirmation to stop the selected service.

Step 5 To confirm that you want to stop the service, click Yes.

Result: The Services dialog box appears while the service is stopped. This action causes all Cisco Secure Policy Manager processes to stop, including the Policy Database service (named fms.exe).

Step 6 To restart the Cisco Controlled Host Component service, click Start.

Result: The Service Control dialog box appears while the service is started. This action restarts all Cisco Secure Policy Manager processes, including the fms.exe service, which is the Policy Database service. After these processes are restarted, normal operation resumes.

Step 7 To close the Services dialog box, click Close on the File menu.

Step 8 To close Control Panel, click Close on the File menu.

While routing rules can be viewed on non-managed gateway objects, such as clouds and routers, such rules are not distributed to those gateway objects by Cisco Secure Policy Manager. Instead, Cisco Secure Policy Manager assumes that you have defined such routing rules on those gateway objects.

Note All static routing rules that have been defined using administrative interfaces other than Cisco Secure Policy Manager are replaced by those routing rules that are defined using Cisco Secure Policy Manager. Therefore, you should be sure to copy your current configuration to a safe location so that you can specify any non-derived static routing rules within Cisco Secure Policy Manager.

You can define new routing rules to optimize network packet delivery and to override a derived routing rule (by selecting the same target as that of a derived routing rule). All rules that you define are MANUAL routing rules.

Note You can only define routing rules on managed gateway objects (Policy Enforcement Points) that exist on your network. In addition, all static routing rules that have been defined using a non-Cisco Secure Policy Manager administrative interface are replaced by those routing rules that have been defined using Cisco Secure Policy Manager.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the PIX Firewall node or IOS Router node for which you want to define a new routing rule, expand the Network Topology tree until you view that gateway object in the Navigator pane.

Step 3 To access the shortcut menu, right-click the gateway object icon for which you want to create a new routing rule.

Step 4 To view the Routes panel, point to Properties, and click Routes on the shortcut menu.

Result: The Routes panel appears in the View pane.

Step 5 To begin defining a new rule, click Insert Route.

Result: A new rule appears as the last item in the Active Routing Rules list with the word "Unknown" selected in the Network box.

Step 6 To select the network, network shortcut, or cloud network to which you want this Policy Enforcement Point to be able to route

• right-click the question mark in the Network box under Active Routing Rules, and click that object in the options list that appears

---or---

• click (specify) to define a custom network (one that is not defined in the Network Topology tree).

The options list displays all network, network shortcut, cloud networks, and IP ranges that are defined in the Network Topology tree. This options list also includes the (specify) option.

Step 7 If you selected an existing object, skip to Step 10. Otherwise continue with Step 8.

Step 8 To manually specify the network address, type the address of the network to which you are routing in the Network Address box under Selected Route.

Because routes to all directly connected networks are automatically derived, this value identifies an address of a network, network shortcut, or cloud network that is not directly connected to the Policy Enforcement Point---it does not belong to an object to which the Policy Enforcement Point's network interfaces are directly connected. This value is also a network that is not defined under the Network Topology tree.

Step 9 To specify the network mask that corresponds to the network specified in the Network Address box, type that value in the Network Mask box.

Step 10 To specify the gateway that is used to reach the object specified in the Network Address box, type the IP address of that gateway in the Gateway box under Active Routing Rules.

This value identifies a gateway that either

• forwards, to another gateway, any network packets destined to the network or host specified in the Network box

---or---

• delivers the network packets to the final destination because the network is directly attached to the gateway.

Step 11 Repeat Steps 5 through 10 for each new rule that you want to create.

Step 12 To save your changes and close the Routes panel, click OK. To discard your changes and close the Routes panel, click Cancel.

Step 13 To save any changes that you have made, click Save on the File menu.

Disabling Generation of Derived Routing Rules

You can disable the generation of derived routing rules for a specific gateway object. When you disable the generation of derived routes, you must define the routing rules for all objects to/from which this gateway object can send/receive network packets; otherwise, this gateway object will not be able to communicate to any networks other than those to which it is directly attached.

The effect of disabling the generation of derived routing rules can reduce the time required by Cisco Secure Policy Manager to perform a Save or a Save and Update operation. While this feature may be used to view only MANUAL routes on a managed gateway object, disabling route generation on unmanaged gateway objects can still reduce the time required to perform a Save or Save and Update operation.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the PIX Firewall node, IOS Router node, Router node, or Cloud node for which you want to disable the generation of derived routing rules, expand the Network Topology tree until you view that gateway object in the Navigator pane.

Step 3 To access the shortcut menu, right-click the gateway object icon for which you want to disable the generation of derived routing rule.

Step 4 To view the Routes panel, point to Properties, and click Routes on the shortcut menu.

Result: The Routes panel appears in the View pane.

Step 5 To disable the generation of derived routing rules, select the Inhibit generation of non-MANUAL rules.

Result: Any derived routing rules, marked Implicit or Derived, are removed from the Routes panel. The only routing rules, based on this gateway object, that Cisco Secure Policy Manager will publish to any Policy Enforcement Points on your network are those MANUAL routing rules that you define in this panel.

Step 6 To save your changes and close the Routes panel, click OK. To discard your changes and close the Routes panel, click Cancel.

Step 7 To save any changes that you have made, click Save on the File menu.

Creating a Static Translation Rule

A Policy Enforcement Point enables you to map an external IP address on the Policy Enforcement Point to an IP address assigned to an internal network object. To define a rule, you must map between an IP address on a particular interface of the Policy Enforcement Point and the network object that you want to translate.

Warning If you expose your internal DNS servers using a static translation rule, you do not benefit from the address hiding feature provided by network address translation. External users can simply request information about your trusted networks from the DNS servers that you expose.

Note To allow communications with an exposed server, you must define and apply a security policy to the Internet node (or an untrusted network) that permits session requests originating on the untrusted networks to reach the internal server.

To create a static translation rule, perform the following task:

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the Policy Enforcement Point for which you want to create a new static translation rule, expand the Network Topology tree until you view that Policy Enforcement Point node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the PIX Firewall icon or IOS Router icon that will enforce the static translation rule that you want to create.

Step 4 To view the Mapping panel, point to Properties, and then click Mapping on the shortcut menu.

Result: The Mapping panel appears in the View pane.

Step 5 To specify that you want to define a static translation rule, click Static Translation (bidirectional remapping) in the Select rule type box.

Result: The list of active static translation rules appears in the Static Translation list.

Step 6 To begin defining a new static translation rule, click Insert Rule.

Result: A new rule named S# is created in the Static Translation list.

Step 7 To specify which network object to translate with this rule, click that network or host in the Translate object box under Static Translation (bidirectional remapping).

The Translate object box displays a list of the network objects that reside under the Policy Enforcement Point node for which you are defining this rule. If you do not see the network object that you want to hide, you must define it within the Network Topology tree.

Caution If you define a static translation rule for a Policy Distribution Point, you can cause a temporary command set publishing problem. The problem results because the connection to the Policy Enforcement Point is broken after the new command set is published to the Policy Enforcement Point because it effectively changes the address of the Cisco Secure Policy Manager host by which the current command set is being published.

In this case, you have two possible solutions to resolve this temporary problem:

• Define a temporary policy that permits the administrative network service from the old Policy Distribution Point address to the administrative network interface on the Policy Enforcement Points that use that Policy Distribution Point. You only need to define the policy to permit the old IP address because the policy that permits the new IP address is automatically generated and applied in the Cisco System Folder. After you have published the command sets, remove the temporary policy and regenerate/publish the command sets.

• Another approach is to use the Prologue option in the Command panel for the affected Policy Enforcement Points to specify that you want to accept administrative connections manually from the old IP address used by the affected Policy Enforcement Points. After you have published the command sets, you can remove the line and republish.

Tips You can lock the Mapping panel by clicking the Lock this view box at the bottom of the panel, and then use a drag-and-drop operation to move a host from the Network Topology tree onto the Translate object box.

Step 8 To specify the interface, or set of interfaces, from which the network or host will be translated, click the interface(s) in the via interface(s) box.

The via interface(s) box displays a list of the interfaces directly attached to the Policy Enforcement Point. However, this list does not contain the interface to which the network or host that you want to translate is attached. You cannot translate a host or network from the interface to which it is attached.

When you translate a network object from an interface, you are declaring that any network object attached to that interface cannot use the real address to access the translated network object. Instead, such network objects must deliver all network traffic to the address specified in the using address box (presumably, the address assigned to the interface to which the network objects are attached). The Policy Enforcement Point acts as a proxy agent between the translated network object and the interface objects by mapping between the two addresses. This mapping occurs for communications that originate either from the translated network object or from an object residing on the interface specified in this field.

Tips To select more than one value from this list, press and hold the Shift key or the Ctrl key while selecting an item in the list. The Shift+Click option enables you to select a sequential set of values. The Ctrl+Click option enables you to select values in any order.

Step 9 To specify the IP address, or starting address of an IP range, that the internal network object's address(es) will be remapped to, type that IP address in the using address box.

This value is the specific alias IP address to which you want to translate the real addresses of the translated object. If the value in the through    with box is also specified, this address identifies the starting address of the IP range that will be used to translate the network object. However, you can define a range of exactly one address. If the Policy Enforcement Point is exposing the network object to users on the Internet, this IP address must be a valid IP address that is registered with the American Registry for Internet Numbers (ARIN).

Step 10 To specify the ending address of the IP range that the internal network object address(es) will be remapped to, type that IP address in the through    with box.

This value identifies the ending alias IP address in an IP address range that will be used for this translation rule. If the Policy Enforcement Point is exposing the network object to users on the Internet, this IP address must be a valid IP address that is registered with ARIN.

Step 11 To specify the network mask value of the IP range that the internal network object address(es) will be remapped to, type that value in the mask box.

This value identifies the mask of the network on which IP address(es) used as aliases are members. It represents the number of bits in the netmask.

Step 12 (PIX Firewall only: Optional) To specify the maximum number of simultaneous connections for this rule, type that value in the MaxC box.

This value is a whole number that represents the maximum number of simultaneous connections that can use this translation rule. The Policy Enforcement Point enforces this value against new session requests. Use 0 (zero) to specify the default value assigned to the Policy Enforcement Point.

Step 13 (PIX Firewall only: Optional) To specify the maximum number of simultaneous embryonic links for this rule, type that value in the EmbL box.

This value is a whole number (smaller than the MaxC value) that represents the maximum number of simultaneous embryonic links that can use this translation rule. The Policy Enforcement Point enforces this value against new session requests by restricting the number of session requests that have not completed the handshake. This feature enables you to guard against TCP_SYN attacks. Use 0 (zero) to specify the default value assigned to the Policy Enforcement Point.

Step 14 For each new rule that you want to create, repeat Steps 6 through 13.

Step 15 To accept your changes and close the Mapping panel, click OK.

Step 16 To save any changes that you have made, click Save on the File menu.

Creating a New Address Hiding Rule

You can define the address translation rules that the selected Policy Enforcement Point uses for inter-interface communications (transferring network packets between two interfaces). To define a rule, you map one or more external IP addresses (exposed) to an internal network address of any class. Thus, you can hide that internal network's actual address from networks that exist on other interfaces.

Note You cannot hide a network's address from computers on that network. Also, any address translation rules that you defined during installation are included in the list of active address translation rules shown in this panel.

Caution Before you can hide a network address, the Policy Enforcement Point must have a route defined to access that network. These routes can be implicitly defined by the routes attached to the network interfaces installed on the Policy Enforcement Point, or you can explicitly define a route for that network.

To create a new address translation rule, perform the following task:

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the Policy Enforcement Point for which you want to create a new address hiding rule, expand the Network Topology tree until you view that Policy Enforcement Point node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the PIX Firewall icon or IOS Router icon that will enforce the address hiding rule that you want to create.

Step 4 To view the Mapping panel, point to Properties, and then click Mapping on the shortcut menu.

Result: The Mapping panel appears in the View pane.

Step 5 To specify that you want to define an address hiding rule, click Address Hiding (source remapping) in the Select rule type box.

Result: The list of active address hiding rules appears in the Address Hiding list.

Step 6 To begin defining a new address hiding rule, click Insert Rule.

Result: A new rule named H# is created in the Address Hiding list.

Step 7 To specify which network object to hide with this rule, click that network or host in the Hide object box under Address Hiding (source remapping).

The Hide object box displays a list of the network objects that reside under the Policy Enforcement Point node for which you are defining this rule. If you do not see the network object that you want to hide, you must define it within the Network Topology tree.

Tips You can lock the Mapping panel by clicking the Lock this view box at the bottom of the panel, and then use a drag-and-drop operation to move a network host from the Network Topology tree onto the Hide object box.

Step 8 To specify the interface, or set of interfaces, from which the network or host will be hidden, click the interface(s) in the from interface(s) box.

The from interface(s) box displays a list of the interfaces directly attached to the Policy Enforcement Point. However, this list does not contain the interface to which the network or host that you want to hide is attached. You cannot hide a network or host from the interface to which it is attached.

When you hide a network or host from an interface, you are declaring that any network object attached to that interface cannot use the real address to access the hidden network object. Instead, such network objects must deliver all network traffic to one of the addresses specified in the using address and through    with boxes (presumably, the address assigned to the interface to which the network objects are attached). The Policy Enforcement Point acts as a proxy agent between the hidden objects and the interface objects by mapping between the two addresses. However, this mapping only occurs for communications that originate from the hidden object.

Tips To select more than one value from this list, press and hold the Shift key or the Ctrl key while selecting an item in the list. The Shift+Click option enables you to select a sequential set of values. The Ctrl+Click option enables you to select values in any order.

Step 9 To specify the IP address, or starting address of an IP range, that the internal network object address(es) will be remapped to, type that IP address in the using address box.

This value is the specific alias IP address to which you want to translate the real addresses of the translated object. If the value in the through    with box is also specified, this address identifies the starting address of the IP range that will be used to translate the network object. However, you can define exactly one address. If the Policy Enforcement Point is exposing the network object to users on the Internet, this IP address must be a valid IP address that is registered with ARIN.

Step 10 To specify the ending address of the IP range that the internal network object address(es) will be remapped to, type that IP address in the through    with box.

This value identifies the ending alias IP address in an IP address range that will be used for this translation rule. If the Policy Enforcement Point is exposing the network object to users on the Internet, this IP address must be a valid IP address that is registered with ARIN.

Step 11 To specify the network mask value of the IP range that the internal network object address(es) will be remapped to, type that value in the mask box.

This value identifies the mask of the network on which IP address(es) used as aliases are members. It represents the number of bits in the netmask.

Step 12 (PIX Firewall only: Optional) To specify the maximum number of simultaneous connections for this rule, type that value in the MaxC box.

This value is a whole number that represents the maximum number of simultaneous connections that can use this translation rule. The Policy Enforcement Point enforces this value against new session requests. Use 0 (zero) to specify the default value assigned to the Policy Enforcement Point.

Step 13 (PIX Firewall only: Optional) To specify the maximum number of simultaneous embryonic links for this rule, type that value in the EmbL box.

This value is a whole number (smaller than the MaxC value) that represents the maximum number of simultaneous embryonic links that can use this translation rule. The Policy Enforcement Point enforces this value against new session requests by restricting the number of session requests that have not completed the handshake. This feature enables you to guard against TCP_SYN attacks. Use 0 (zero) to specify the default value assigned to the Policy Enforcement Point.

Step 14 For each new rule that you want to create, repeat Steps 6 through 13.

Step 15 To accept your changes and close the Mapping panel, click OK.

Step 16 To save any changes that you have made, click Save on the File menu.

Creating a Path Restriction Rule

You can define the path restriction rules that the selected Policy Enforcement Point enforces against network traffic that traverses this Policy Enforcement Point. To define a rule, you specify what network object that you want to restrict the traffic flows to and from, and then you specify the interface(s) that should be used to enforce the rule.

Note You cannot restrict the paths used to reach a specific host or IP range. In other words, you cannot select a host or IP range as part of this rule type definition.

To add a path restriction rule, perform the following task:

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the gateway object for which you want to create a new path restriction rule, expand the Network Topology tree until you view that gateway object node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the gateway object icon on which you want to create the path restriction rule.

Step 4 To view the Mapping panel, point to Properties, and then click Mapping on the shortcut menu.

Result: The Mapping panel appears in the View pane.

Step 5 To specify that you want to define a path restriction rule, click Path Restriction in the Select rule type box.

Result: The list of active path restriction rules appears in the Path Restriction list.

Step 6 To begin defining a new path restriction rule, click Insert Rule.

Result: A new rule named R# is created in the Path Restriction list.

Step 7 To specify the network object to/from which you want to restrict network traffic, click that network object in the Disable paths to box under Path Restriction.

The Disable paths to box displays a list of the network objects that reside under the Network Topology tree. If you do not see the network object to/from which you want to restrict a specific network path, you must define it within the Network Topology tree. However, you can select neither Host nor IP Range nodes. To refer to an interface on another Policy Enforcement Point, you must select the interface by navigating the tree shown in the Disable paths to box in the Mapping panel. The interfaces are not first-level objects in the Network Topology tree in the Navigator pane.

Step 8 To specify the interface, or set of interfaces, that will enforce the path restriction rule, click that interface(s) in the from interface(s) box.

The from interface(s) box displays a list of the interfaces attached to the Policy Enforcement Points that can enforce the path restriction rule. If you are defining a rule on a specific Policy Enforcement Point, only the interfaces on that Policy Enforcement Point are presented as options for enforcing the rule. However, this list does not contain the interface to which the network object to which you are disabling the paths is attached. You cannot hide a network object from the interface to which it is attached.

When you disable paths to a network object from an interface, you are declaring that any packets received from or sent to that network object will not be permitted to traverse the selected interface(s). In other words, these interfaces cannot be used to reach the network object.

Tips To select more than one value from this list, press and hold the Shift key or the Ctrl key while selecting an item in the list. The Shift+Click option enables you to select a sequential set of values. The Ctrl+Click option enables you to select values in any order.

Step 9 For each new rule that you want to create, repeat Steps 6 through 8.

To verify that the path restriction rule you are defining is a valid path restriction rule, ensure that the flow that you want to restrict actually traverses the gateway object on which you are defining this rule.

Step 10 To accept your changes and close the Mapping panel, click OK.

Step 11 To save any changes that you have made, click Save on the File menu.

Specifying DES Cipher Settings

From the IPSec panel, you can identify the strongest DES cipher that the selected node supports. Cisco Secure Policy Manager uses this information to perform consistency checks that validate that all peers in IPSec Tunnel Group definitions based on IPSec Tunnel Templates that require specific ciphers can support those ciphers.

To specify the strongest DES cipher that this node can support, perform the following task:

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the gateway object for which you want to specify the DES cipher support settings, expand the Network Topology tree until you view that gateway object node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the gateway object icon that has IPSec Support enabled in its General panel.

Step 4 To view the IPSec panel, point to Properties and click IPSec on the shortcut menu.

Result: The IPsec panel appears in the View pane.

Step 5 To specify which DES cipher is supported by this node, click that cipher in the list of ciphers in the DES Cipher Support box.

Two types of DES ciphers are available, depending on the type of software that is running on the selected node:

• DES. This option identifies that the node can support the standard DES cipher for IPsec-based communications, including the IKE authentication and the ESP payloads. If DES is not supported by the peer, the IPSec session request fails. All peers must, at a minimum, support the standard DES cipher.

• triple DES. This option identifies that the node can support the triple DES cipher. If a peer does not support triple DES, a node that supports triple DES can also support the standard DES cipher for the duration of a session.

Step 6 To accept your changes and close the IPSec panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Specifying Pre-Shared Secrets for IKE

From the IPSec panel, you can specify a pre-shared secret that is used to perform IKE negotiations between the selected node and its IPSec Tunnel Group peers. Cisco Secure Policy Manager uses this secret to generate the device-specific commands that enable these pre-shared secrets on this node and its peers. You only need to specify this secret in this panel, as it is propagated to the IPSec panels for the specified peers. In other words, you only have to specify a shared secret on one of the two peer nodes.

To specify the secrets to share between this node and its peers, perform the following task:

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the gateway object for which you want to specify the pre-shared keys to use with peers when negotiating the IPSec sessions based on IKE, expand the Network Topology tree until you view that gateway object node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the gateway object icon that has IPSec Support enabled in its General panel.

Step 4 To view the IPSec panel, point to Properties and click IPSec on the shortcut menu.

Result: The IPsec panel appears in the View pane.

Step 5 To specify the peer for which you want to define a pre-shared secret between the selected node and that peer, click that peer in the list of available peers in the Tunnel Peers box.

Result: The Secret shared with peer label displays the name of the selected peer.

This list contains only those gateway objects and Cisco Secure Policy Manager hosts defined under the Network Topology tree that have the IPSec Support option selected in the General panel.

Step 6 To specify the secret to share between this node and the peer selected in the Tunnel Peers box, type that secret in the Secret shared with peer box.

This secret identifies a valid secret that can be used by IKE to set up an IPSec tunnel between this node and the selected peer. The minimum length for this secret value is 8 characters and the maximum length is up to 128 alphanumeric characters. You cannot use Tab, Enter, spaces, question marks, or double quotes when defining this shared secret.

Step 7 For each peer that you want to define a pre-shared secret, repeat Steps 5 and 6.

Step 8 To accept your changes and close the IPSec panel, click OK.

Step 9 To save any changes that you have made to the Policy Database, click Save on the File menu. To generate a new command set that includes the pre-shared secrets required by each peer, click Save and Update on the File menu.

Configuring for use with a Certificate Authority

From the IPSec panel, you can identify that you want the selected node to be able to communicate with a certificate authority server that is defined under the Network Topology tree. Certificate authority servers use HTTP as the protocol for renewing and validating certificates. They manage data about when the certificates managed by the server expire and the rules for automatically refreshing or issuing new certificates to the network objects that are subscribers to that certificate authority. In addition, certificate authority servers provide support for certificate revocation lists (CRLs), which enable you to specify that certain certificates should not be trusted.

Tips Cisco Secure Policy Manager automatically creates and applies a security policy that permits HTTP traffic to pass between this node and the specified certificate authority server.

To specify the certificate authority server to use for this node, perform the following task:

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the gateway object for which you want to specify the certificate authority server to use, expand the Network Topology tree until you view that gateway object node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the gateway object icon that has IPSec Support enabled in its General panel.

Step 4 To view the IPSec panel, point to Properties and click IPSec on the shortcut menu.

Result: The IPsec panel appears in the View pane.

Step 5 To specify which certificate authority server to use with this node, click that server in the list of certificate authority servers in the Trusted Certificate Authority Server box.

This value identifies a host defined in the Network Topology tree that has been configured to identify a certificate authority server by adding the Certificate Authority client/server product type to that host.

Step 6 To accept your changes and close the IPSec panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Discovering Certificate Information

From the IPSec panel, you can discover specific information about any certificates that are installed on a managed Policy Enforcement Point that has the IPSec Support option selected in the General panel for that Policy Enforcement Point node.

To discover the certificate information, perform the following task:

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the Policy Enforcement Point for which you want to discover the certificate information, expand the Network Topology tree until you view that Policy Enforcement Point node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the PIX Firewall icon or IOS Router icon that has IPSec Support enabled in its General panel and has a previously configured certificate installed on that Policy Enforcement Point.

Step 4 To view the IPSec panel, point to Properties and click IPSec on the shortcut menu.

Result: The IPsec panel appears in the View pane.

Step 5 To specify that you want to discover the information about the certificates used by this node, click Discover.

Result: The Discovery dialog box appears with the IPSec box selected under the Discovery Selections box.

Step 6 To discover the certificate information and other IPSec settings for this node, click Discover.

Result: The Discovery Status box displays the status of the device discovery, including the time remaining before the discovery process aborts its discover attempt. When this process is complete, a message stating "Configuration completed. The configuration attempt was successful" appears.

In addition, the Results button appears, which provides information about the discovery. Specifically, the Discovery Results dialog box should display the following messages:

• IPSec capability detected.

• Triple DES capability detected. (This message only appears if this node supports triple DES.)

• # certificates detected. (Where # is the number of certificates discovered on this node.)

Step 7 To close the Discovery dialog box, click OK.

Result: The IPSec panel now displays information about each certificate that was discovered. This information is organized on separate subtabs (below the Trusted Certificate Authority box) for each certificate that is discovered.

Step 8 To accept your changes and close the IPSec panel, click OK.

Step 9 To save any changes that you have made, click Save on the File menu.

Caution If you modify the IP address that Cisco Secure Policy Manager uses to publish the commands to a Policy Enforcement Point (the address in the Policy Enforcement Point panel), you must define an intermediate security policy to allow the network service selected in the Policy Enforcement Point panel for both the old and the new IP addresses. Otherwise, the connection to the Policy Enforcement Point is broken while the Policy Distribution Point is publishing the command set that changes from the old address to the new address.

Modifying the IP Address Setting

You can specify the IP address that a Cisco Secure Policy Manager host acting as a Policy Distribution Point uses to contact the Policy Enforcement Point for the purpose of publishing the derived network policies and to obtain status about the Policy Enforcement Point. This IP address must be an IP address assigned to an interface of the Policy Enforcement Point. This IP address can also be the IP address used by any other administrative tools that you use to review the status of this Policy Enforcement Point.

Note For Policy Enforcement Points based on 4.x and earlier versions of PIX Firewall software, you cannot assign an IP address that is assigned to the outside interface of a PIX Firewall. The IP address must be assigned to the inside interface or one of the perimeter interfaces.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the PIX Firewall node or IOS Router node for which you want to modify the IP address used by the Policy Distribution Point to download new network policies, expand the Network Topology tree until you view that Policy Enforcement Point node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Policy Enforcement Point icon.

Step 4 To view the Policy Enforcement Point panel, point to Properties and click Control on the shortcut menu.

Result: The Policy Enforcement Point panel appears in the View pane.

Step 5 To change the IP address on which the Policy Enforcement Point listens for requests from the Policy Distribution Point and other administrative tools, select the new IP address in the IP Address box under General Settings.

The list of IP addresses available are those IP addresses that are defined for the valid interfaces of this Policy Enforcement Point. These addresses are defined in the Interfaces panel of the selected Policy Enforcement Point node. By default, the Policy Enforcement Point panel uses the first IP address listed under the first interface attached to an upstream network.

Caution If you modify the IP address that Cisco Secure Policy Manager uses to publish the commands to a Policy Enforcement Point (the address in the Policy Enforcement Point panel), you must define an intermediate security policy to allow the network service selected on the Policy Enforcement Point panel to that enables both the old and the new IP addresses. Otherwise, the connection to the Policy Enforcement Point is broken while the Policy Distribution Point is publishing the command set that changes from the old address to the new address.

Step 6 To accept your changes and close the Policy Enforcement Point panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Selecting the Policy Distribution Point

From the Policy Enforcement Point panel, you can specify the Policy Distribution Point that is used to publish new network policies to the Policy Enforcement Point. This Policy Distribution Point is responsible for generating and publishing network policies to Policy Enforcement Points, such as the PIX Firewall and IOS Router.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the PIX Firewall or IOS Router for which you want to select the associated Policy Distribution Point, expand the Network Topology tree until you view that Policy Enforcement Point node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Policy Enforcement Point icon for which you want to select a Policy Distribution Point.

Step 4 To view the Policy Enforcement Point panel, point to Properties and click Control on the shortcut menu.

Result: The Policy Enforcement Point panel appears in the View pane.

Step 5 To select the host that is running the Policy Distribution Point that you want to use, click that host name in the Policy Distribution Point box under Policy Distribution.

This box displays only those primary and/or secondary servers defined under the Network Topology tree that have a Policy Distribution Point client/server product installed on them.

If you installed a standalone Cisco Secure Policy Manager, the Policy Distribution Point resides on that primary server. Otherwise in a distributed installation, it can reside on either a primary or secondary server, depending on which feature sets you chose to install on the various hosts.

Step 6 To accept your changes and close the Policy Enforcement Point panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Requiring Use of IPSec Tunnel

From the Policy Enforcement Point panel, you can specify that you want the Cisco Secure Policy Manager host acting as the Policy Distribution Point to use an IPSec tunnel when communicating with the Policy Enforcement Point, such as a PIX Firewall or IOS Router. This tunnel can provide additional authentication, as well as encryption, for sessions that occur between the Policy Enforcement Point and the Policy Distribution Point, providing non-repudiation and data integrity for the network policies that are published to the Policy Enforcement Point.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the PIX Firewall or IOS Router for which you want to require the use of an IPSec tunnel during Policy Enforcement Point-to-Policy Distribution Point communications, expand the Network Topology tree until you view that Policy Enforcement Point node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Policy Enforcement Point icon for which you want to require the use of an IPSec tunnel.

Step 4 To view the Policy Enforcement Point panel, point to Properties and click Control on the shortcut menu.

Result: The Policy Enforcement Point panel appears in the View pane.

Step 5 To select the IPSec Tunnel Template definition used to connect to the selected Policy Enforcement Point, click that template in the Use secure IPSec with template box under Policy Distribution.

This template must be defined under the IPSec Tunnel Templates branch of the Tools and Services tree. By default, the Policy Distribution Point does not use an IPSec tunnel when communicating with the Policy Enforcement Point.

Step 6 To accept your changes and close the Policy Enforcement Point panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

From the Policy Enforcement Point panel, you can specify the Policy Monitor Point that is used to monitor the syslog data streams generated by the Policy Enforcement Point, such as a PIX Firewall or IOS Router. This Policy Monitor Point studies the syslog data to derive higher-level audit records, such as session records.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the PIX Firewall or IOS Router for which you want to select the associated Policy Monitor Point, expand the Network Topology tree until you view that Policy Enforcement Point node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Policy Enforcement Point icon for which you want to select a Policy Monitor Point.

Step 4 To view the Policy Enforcement Point panel, point to Properties and click Control on the shortcut menu.

Result: The Policy Enforcement Point panel appears in the View pane.

Step 5 To select the host that is running the Policy Monitor Point that you want to use, click that host name in the Policy Monitor box under Logging.

This box displays only those primary and/or secondary servers defined under the Network Topology tree that have a Policy Monitor Point client/server product installed on them.

Step 6 To accept your changes and close the Policy Enforcement Point panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Selecting the Associated Syslog Servers

From the Policy Enforcement Point panel, you can specify one or more syslog servers, in addition to the Cisco Secure Policy Manager host acting as Policy Monitor Point, that you can use to provide additional monitoring of the syslog data streams generated by the Policy Enforcement Point.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the PIX Firewall or IOS Router for which you want to select the associated syslog servers, expand the Network Topology tree until you view that Policy Enforcement Point node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Policy Enforcement Point icon for which you want to select a syslog server.

Step 4 To view the Policy Enforcement Point panel, point to Properties and click Control on the shortcut menu.

Result: The Policy Enforcement Point panel appears in the View pane.

Step 5 To select one or more hosts on which syslog servers are running, click those host names in the Syslog Monitors box under Logging.

This box displays only those hosts defined under the Network Topology tree that have a syslog client/server product installed on them. The host or hosts that you select must have a syslog application capable of processing the data streams. For instructions on installing and configuring these applications, refer to the documentation that came with those products.

Step 6 To accept your changes and close the Policy Enforcement Point panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Specifying the Enable Password

From the Policy Enforcement Point panel, you can specify the enable password for the selected Policy Enforcement Point. The Policy Distribution Point uses this password to authenticate to the Policy Enforcement Point before it can publish new network policies to that Policy Enforcement Point.

Note All managed gateway objects require that you specify the enable password.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the PIX Firewall or IOS Router for which you want to specify the enable password, expand the Network Topology tree until you view that Policy Enforcement Point node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Policy Enforcement Point icon for which you want to specify the enable password.

Step 4 To view the Policy Enforcement Point panel, point to Properties and click Control on the shortcut menu.

Result: The Policy Enforcement Point panel appears in the View pane.

Step 5 To specify the enable password, type that password in the Enable password box under Authentication.

The enable password can be up to 16 alphanumeric characters. Also, you can use both uppercase and lowercase characters. This password is case sensitive.

Step 6 To accept your changes and close the Policy Enforcement Point panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Specifying the Telnet Password

From the Policy Enforcement Point panel, you can specify the Telnet password for the selected Policy Enforcement Point. Any administrators who connect to the Policy Enforcement Point to perform any diagnostic tests must first use this password to authenticate to the Policy Enforcement Point.

Note Currently, only the IOS Router uses (and requires) the Telnet password. However, both the PIX Firewall and the IOS Router require that you specify the enable password.

Result: The Network Topology tree appears in the Navigator pane.

Step 2 To find the PIX Firewall or IOS Router for which you want to specify the Telnet password, expand the Network Topology tree until you view that Policy Enforcement Point node in the Navigator pane.

Step 3 To access the shortcut menu, right-click the Policy Enforcement Point icon for which you want to specify the Telnet password.

Step 4 To view the Policy Enforcement Point panel, point to Properties and click Control on the shortcut menu.

Result: The Policy Enforcement Point panel appears in the View pane.

Step 5 To specify the Telnet password, type that password in the Telnet password box under Authentication.

The Telnet password can be up to 16 alphanumeric and special characters; however, you cannot use the question mark, space, or colon in the password. You can use both uppercase and lowercase characters, because this password is case sensitive.

Step 6 To accept your changes and close the Policy Enforcement Point panel, click OK.

Step 7 To save any changes that you have made, click Save on the File menu.

Viewing the Associated Network Service

Modifying the network service associated with a Policy Enforcement Point has no effect on the system or the configuration of that Policy Enforcement Point. For an IOS Router, this network service is Telnet on (TCP port 23). For a PIX Firewall, this network service is PIX Secure Telnet (TCP 1467).

Viewing the TCP Port used by the Policy Enforcement Point

Modifying the port used for the network service associated with a Policy Enforcement Point has no effect on the system or the configuration of that Policy Enforcement Point. For an IOS Router, this network service is Telnet on (TCP port 23). For a PIX Firewall, this network service is PIX Secure Telnet (TCP 1467).