Representing Your Network

When you describe the physical layout of your network, you want to define the different gateway objects on your network and the networks that are attached to those gateway objects. The Internet node is a special gateway object (a cloud) that represents the Internet to which all networks that you are defining are attached, directly or indirectly. Therefore, you should view your network from the connection to your Internet service provider (ISP) through the innermost gateway objects on your network.

1. The IOS Router node is the Policy Enforcement Point that exists on this network.

2. A single high-level policy can address the security concerns of each network depicted in the cloud.

3. An internal gateway object exists that can be used to reach, in some way, all networks depicted in the cloud.

Assuming these three criteria are true, we can define a single gateway address to reach all the networks within that cloud and to serve as the default gateway for those networks to reach the 172.16.1.0 network.

The checklist below outlines the steps required to understand the decision-making process and basic flow required to complete the definition of your Network Topology tree. Each step, described in the Step column, may contain several substeps and should be performed in the order presented. References to the specific procedures used to perform each step appear in the Reference column.

Table 2-1: Checklist for Defining your Network Topology

	Step	Reference
	1. Identify the required network objects on your network Internet Connection Points. Because Cisco Secure Policy Manager controls the flows into and out of your network, you must identify the connection points out of your network. Within Cisco Secure Policy Manager, all such connection points must be defined within the Internet node in the Network Topology tree. Most Valuable Network Assets. While your entire network is considered an asset, you can define a global security policy that addresses the enablement of most network service flows that commonly occur across your network. It is only when you want to define an exception to this global security policy that you need to be concerned with defining specific network assets within your network topology tree. Policy Enforcement Points. Policy Enforcement Points represent those network objects that enforce some aspect of the defined network policies. For example, an IOS Router or PIX Firewall can enforce the permitted traffic flows across your network. Policy Enablement Hosts. Policy enablement hosts represent those network objects that are required to enable network policy deployment. These hosts include the Cisco Secure Policy Manager hosts, as well as other hosts such as certificate authority servers and syslog servers. Reachable Networks. This list of networks identifies your internal networks that can send or receive network traffic. Many of these networks will be attached to a Policy Enforcement Point. The purpose of identifying these networks is to ensure that they are defined within Cloud nodes so that the correct routing rules can be generated for those Policy Enforcement Points that act as gateway objects.	"Identify Key Components" section "Worksheet for Defining your Network Topology" section
	Result: You should have a completed worksheet that identifies the required network objects, their IP addresses, and the types of network servers that run on the policy enablement hosts. This worksheet is used to complete Step 2.
	2. Define the outermost gateway objects When you define your network topology, you must define it from downstream (from the Internet) to upstream (into your internal networks). The easiest method for defining gateway objects is to use the Topology Wizard. Using the Topology Wizard, you can discover the interface and device settings or specify them manually. You can access the Topology Wizard by clicking Topology Wizard on the Wizards menu. In addition, you can manually define any gateway object. The tasks referenced by this step are the tasks that explain how to manually define a gateway object. You must define the interface settings on the Internet node before you can define any other gateway objects. If you use the Topology Wizard, the interface settings for the Internet node are defined automatically based on the configuration information that you provide. One of the most important concepts within Cisco Secure Policy Manager is a Cloud node. A strongly suggested guideline is that unless you must define a managed gateway or a specific network on which special hosts, such as a policy enablement host, resides, you should use a Cloud node to represent all gateways and networks. You can define networks going into and out of a Cloud node, as well as networks contained within the cloud. For more information on Cloud nodes, refer to Step 5 in this checklist. Result: The outermost networks and gateway devices are defined and the connections between those gateway devices and the Internet node, which represent connections to Internet service providers, are defined.	"Specifying Interface Settings of the Internet Node" section "Creating an IOS Router Node" section "Specifying the Interface Settings for an IOS Router" section "Creating a PIX Firewall Node" section "Specifying the Interface Settings for a PIX Firewall" section "Defining a Cloud Node" section "Specifying Interface Settings for a Cloud" section "Defining Cloud Networks" section
	3. Define network assets Network assets represent those network objects, such as specific networks and hosts, for which you want to define exceptional network policies. These network objects are the ones that identified in Step 1, with the exception of the Cisco Secure Policy Manager hosts, which will be defined during the next step. Result: The network assets that you identified in Step 1 are defined under the Network Topology tree.	"Creating a Network Node" section "Creating a Host Node" section "Specifying a Client/Server Product is Running on a Host Node" section "Creating an IP Range Node" section
	4. Define Cisco Secure Policy Manager hosts The Primary Server node represents one of two server types that host the client/server products for Cisco Secure Policy Manager. The Primary Server node indicates that this host is running the Primary Policy Database, where all configuration information is stored and to which all GUI clients connect to view or edit the system configuration. This node organizes those settings specific to the subsystems that store and retrieve audit event records, generate and display reports, and publish network policies to Policy Enforcement Points. These subsystems include the Primary Policy Database, Policy Monitor Point, Policy Report Point, and Policy Distribution Point. The Secondary Server node indicates that this host is running a distributed installation feature set. Depending on what feature set you installed, this node organizes those settings specific to the subsystems that store and retrieve audit event records, generate and display reports, and publish network policies to Policy Enforcement Points. These subsystems can include the Secondary Policy Database, Policy Monitor Point, Policy Report Point, and Policy Distribution Point.	"Creating a Host Node" section
	Note You must create the nodes that represent any Cisco Secure Policy Manager servers that you have installed on your network. To create these nodes, you must first define the parent network on which these hosts reside and then create a host under that node. You will be prompted to add a host based on the Windows NT name of that computer. The special panels associated with a primary or secondary server were automatically defined when you chose to add a host of this type. Result: All Cisco Secure Policy Manager hosts are defined within your Network Topology.
	5. Define reachable networks When you define the remainder of your network topology, you should use Cloud nodes. In fact, you should define Cloud nodes for as much of your network as possible. Clouds provide a logical grouping of networks, and thereby, hosts residing on those networks, that are reachable via an upstream gateway. The Cloud node is a special gateway object that attaches cloud networks to fully defined networks. To attach the two types of networks, the Cloud node identifies the IP addresses, representing default gateways, attached to those interfaces residing on the fully defined networks (which are either upstream or downstream of the cloud). The Cloud node also has a special interface type called Cloud Networks, which organizes the cloud networks. In terms of the Cloud node, cloud networks exist within the cloud. However, in reality, they exist upstream from the default gateway specified on the downstream interface of the Cloud node.	"Defining a Cloud Node" section "Specifying Interface Settings for a Cloud" section "Defining Cloud Networks" section
	Cloud nodes organize those settings required to identify and route to networks that reside upstream from the gateway. Clouds are unique gateway objects because they do not require at least two real interfaces, as do Policy Enforcement Points. Instead, the Cloud node has at least one real interface (the downstream interface) and exactly one Cloud Networks interface (an upstream interface). When you specify an IP address associated with a non-cloud interface, you are specifying the default gateway through which the cloud networks organized under the Cloud Networks interface (and therefore, within the cloud) can be reached. Result: All internal networks that are reachable from other network objects within your network are defined within one or more Cloud nodes.

The primary reason that Cisco Secure Policy Manager must know of these servers is to ensure that the appropriate Policy Enforcement Points permit the required Policy Distribution Point-to-Policy Enforcement Point traffic to pass, which is required to publish the device-specific command sets. In addition, the Cisco Secure Policy Manager system must know how to communicate with the various hosts that compose the system in distributed installation types. After you associate a Policy Enforcement Point to a Cisco Secure Policy Manager server in the Network Topology tree, Cisco Secure Policy Manager automatically generates and applies the correct security policies that guarantee correct flows of this traffic. These security policies and servers are also automatically populated and applied under the Cisco System Folder in the Security Policy Enforcement branch.

The primary reason that you must specify these hosts in the Network Topology tree is to ensure that Cisco Secure Policy Manager can generate the commands that ensure the appropriate Policy Enforcement Points permit the required Policy Enforcement Point-to-certificate authority server traffic to pass. After you associate a Policy Enforcement Point to a certificate authority server in the Network Topology tree, Cisco Secure Policy Manager generates the correct security policies that enable this traffic to flow correctly. These security policies and servers are also automatically populated and applied under the Cisco System Folder in the Security Policy Enforcement branch.

Table 2-2: Worksheet for Defining your Network Topology

Network Object Type	Required Information
ISP Connections	IP Address used by your outermost gateways to reach the ISP connections
Valuable Network Assets	asset name	IP address or network address	associated network mask (if asset is a network)
Policy Enforcement Points	IP addresses/per interface	associated network address	associated network mask
Policy Enablement Hosts	hostname	IP address	client/server product type
Reachable Networks	network name	network address	default gateway address for network