Reference Sections

Result: A connection is made with the Primary Policy Database, and the Cisco Secure Policy Manager GUI opens.

Note If you receive an error message and are unable to log on, refer to Troubleshooting, for possible problems and solutions.

You can also access this dialog box by double-clicking the Network icon in Control Panel.

Result: The Network dialog box appears.

Step 2 Click the Protocols tab in the Network dialog box.

Result: The Protocols tab appears at the forefront.

Step 3 To add the TCP/IP protocol stack to the list of installed protocols in the Network Protocols box, click Add, and then select TCP/IP Protocol by clicking it in the Network Protocol list of the Select Network Protocol dialog box. Then, click OK.

Result: You are prompted for the location of the Windows NT CD-ROM.

Step 4 Click Continue on the Windows NT Setup dialog box after you specify the directory path to the Windows NT CD-ROM.

Result: After the appropriate files are copied, you must reboot the computer.

Result: The Command Prompt window appears.

Result: If TCP/IP is not functioning properly, a request timeout message appears. Otherwise, the host receives a response from the IP address that you pinged.

Note If you are upgrading from a previous version of Cisco Secure VPN Client, uninstall the old version, reboot, and then install the new version. When you uninstall a previous version, you may keep any existing key pairs and certificates.

If you want to install Cisco Secure VPN Client, you must do so before you begin the setup program for Cisco Secure Policy Manager. This section defines the tasks that you must perform to install Cisco Secure VPN Client on the target host(s).

To install Cisco Secure VPN Client, perform the following task:

Result: The Welcome panel appears.

• If the setup program does not start automatically, locate and double-click the setup.exe file in the root directory on the Cisco Secure VPN Client CD-ROM. If you downloaded the zip file, the setup.exe file is located in the directory where you extracted the zip file.

Step 2 To begin setup, click Next.

Result: The License Agreement panel appears.

Step 3 To review all conditions of the license agreement, use the scroll bar on the right side of the window. To accept the license agreement and continue with the installation process, click Yes.

Result: The User Information panel appears.

Step 4 To specify user information, type your name and the name of your company in the corresponding fields. To proceed to the next panel, click Next.

Result: The Choose Destination Location panel appears.

Result: The Select Program Folder panel appears.

Step 6 To select the program folder, type in a new folder name, or scroll to locate an existing folder. To proceed to the next panel, click Next.

Result: The Start Copying Files panel appears.

Step 7 To start copying the files to the selected folder, verify the current settings and click Next.

Result: The Setup Complete panel appears.

Step 8 To complete the installation process, select Yes, I want to restart my computer now. Remove the CD-ROM disc and click Finish.

Result: Cisco Secure VPN Client starts automatically each time your computer starts, and runs transparently on your computer.

Result: If Windows Messaging is not installed, a dialog box displays a message asking if you want to install it.

Step 2 If you receive this dialog box, click Yes. Otherwise, skip to Step 5.

Result: A dialog box prompts you to insert the Windows NT CD-ROM into the local CD-ROM drive.

Step 3 To install the requisite files, insert the Windows NT CD-ROM, and then ensure that the correct path appears in the Copy File From box. If not, type the correct path to the Windows NT CD-ROM. Then, click Next.

Result: The required files are copied from the Windows NT CD-ROM to the target host.

Step 4 To initiate the Windows Messaging Setup Wizard, double-click the Inbox icon again.

Result: The Windows Messaging Setup Wizard starts and prompts you to choose the type of mail service for your user profile.

Step 5 Click Internet Mail. Then, click Next.

Result: A dialog box prompts you to choose the type of connection for your user profile.

Step 6 Click Network. Then, click Next.

Result: A dialog box prompts you to specify either the name or the IP address of the mail server.

Step 7 Type the name or IP address of the mail server. Then, click Next.

Result: A dialog box prompts you to choose whether to have mail automatically downloaded to the inbox.

Step 8 To have mail automatically downloaded to the inbox, click Automatic. Then, click Next.

Result: A dialog box prompts you to specify the e-mail address from which messages on the system originate.

Step 9 Type the e-mail address from which messages on the system should originate in the E-mail Address box. Also, type the name that should appear on all messages originating from the system in the Full Name box. Then, click Next.

Result: A dialog box prompts you to specify the mailbox name on the mail server.

Result: A dialog box prompts you to choose whether to accept the default personal address book.

Step 11 Accept the default personal address book and default personal folders. Then, click Next.

Result: A message signals that you are done configuring Windows Messaging.

Step 12 Click Finish to complete the process.

Result: The computer is now configured to use MAPI for e-mail notifications.

To configure the modem for alphanumeric paging, perform the following task:

Result: The Modems Properties dialog box appears.

Step 2 To specify which modem you want to configure, click that modem in the Modem list, and then click Properties.

Result: The Modem Properties dialog box for the selected modem appears.

Step 3 To access the connection settings, click the Connection tab.

Step 4 Under Connection preferences, verify the following settings:

• Data bits: 7

• Parity: Even

• Stop bits: 1

• standard protocol = ASCII with X ON

• X OFF either direction

• 10 bit code (1 start, 7 data, even parity, and 1 stop bit)

Step 5 To access the Advanced Connection Settings dialog box, click Advanced.

Result: The Advanced Connection Settings dialog box appears.

Step 6 Under Use flow control, verify that the Software (XON/XOFF) option is selected.

Step 7 To close the Advanced Connection Settings dialog box, click OK.

Step 8 To accept your changes and close the Modem Properties dialog box, click OK.

Step 9 To close the Modems Properties applet, click Close.

Step 10 To close Control Panel, click Close on the File menu.

Result: The Network dialog box appears.

Step 2 Click the Protocols tab on the Network dialog box.

Result: The Protocols tab appears at the forefront.

Step 3 To access TCP/IP properties, click TCP/IP Protocol in the Network Protocols list, and then click Properties.

Result: The Microsoft TCP/IP Properties dialog box appears with the IP Address tab at the forefront.

Step 4 To disable DHCP, click Specify an IP address.

Result: The IP Address, Subnet Mask, and Default Gateway boxes become available.

Step 5 To assign a permanent IP address to the host, type an available IP address in the IP Address box, its corresponding subnet mask in the Subnet Mask box, and the default gateway IP address to which all packets should be sent for routing in the Default Gateway box. Click Apply.

Result: The IP address that you specified becomes permanently associated with the host, unless you change it in the future.

Note You must disable DHCP for each network adapter installed in the host. You can select another adapter by clicking that adapter in the Adapter box in the IP Address panel.

Step 6 To effect your changes against your network settings, click the Bindings tab.

Result: Windows NT recalculates the TCP/IP stack bindings.

Step 7 To exit and reboot your host, click OK.

Result: You are prompted to reboot your computer. You should reboot before you continue verifying the network connectivity.

You can also access this dialog box by double-clicking the System icon in Control Panel.

Result: The System Properties dialog box appears with the General panel at the forefront.

Step 2 Click the Startup/Shutdown tab.

Result: The Startup/Shutdown tab appears at the forefront.

Step 3 Under System Startup, change the value that appears in the Show list for box to zero. Click Apply, and then click OK.

Result: The dialog box closes, and upon the next reboot the operating system takes control of the host without any timeout.

The following procedures detail the commands entered at the console terminal. The commands use brackets surrounding a capital letter, such as [A], to refer to values that you have written on the worksheet. When you are carrying out a procedure that has a reference to the worksheet, type the value from the field on the worksheet, not the reference letter that we use to point you to the field on the worksheet.

For cases where we cannot use the worksheet to collect the required data, we use the standard command syntax. Do not include the braces <, >, [, or ] in any commands that you type.

Caution Cisco Secure Policy Manager only detects and imports a small number of configuration commands installed on a PIX Firewall (for support limitations, see Release Notes for Cisco Secure Policy Manager; for a full list of supported commands, see the Configuring Cisco Secure Policy Manager guide). If you have a large number of configuration rules active on the target PIX Firewall(s), you should copy that configuration to a backup location before continuing with this task. If you have rules defining unsupported commands, you can copy those rules directly into the Cisco Secure Policy Manager GUI client after the initial configuration is completed.

To bootstrap a PIX Firewall, perform the following task:

Step 2 To specify that you want to configure the PIX Firewall using privileged mode, type enable and press Enter.

Step 3 Type the enable password [A] for the PIX Firewall, and then press Enter.

Step 4 To enter terminal configuration mode, type configure terminal and press Enter.

Result: You are in the PIX Firewall terminal configuration mode.

Step 5 To name each interface and specify an interface security level between 0 and 100, type nameif <hardware_id> <if_name> <security_lvl>, and then press Enter.

Use the following parameter guidelines to complete the nameif command:

• hardware_id---if you have all Ethernet interfaces, replace hardware_id with ethernet2.

If you have both Token Ring and Ethernet interfaces, specify three nameif command statements and for each, replace hardware_id starting with ethernet0 or token0 and consecutively number the Ethernet or Token Ring interfaces thereafter. For example, if you have an Ethernet interface on the outside, a Token Ring on the inside, and an Ethernet interface as the third interface, the slots would be named ethernet0, token0, and ethernet1.

You can abbreviate the hardware_id name with any significant letters, such as e0 for ethernet0, or t0 for token0.

• interface---When naming an interface (the if_name parameter) installed in a PIX Firewall, you must adhere to the following specific guidelines.

  • The interface installed in slot 0 must be named outside. The security level for outside must be 0.

  • The interface installed in slot 1 must be named inside. The security level for inside must be 100.

  • The interface installed in slot 2 must be named DMZ-slot:2. The security level must be an unused level between 0 and 100.

  • The interface installed in slot 3 must be named DMZ-slot:3. The security level must be an unused level between 0 and 100.

For a PIX Firewall that has more than four interfaces installed, you must name all the DMZ-slot:# interfaces, where the "#" is replaced by the slot number in which that interface is installed. Also, you will only modify the slot number itself. If you change the interface to a name that is not listed above, Cisco Secure Policy Manager issues consistency errors.

• security_level---a value such as security40. You can choose any security level between 1 and 99 for a perimeter interface as long as it is not the same as the inside and outside interfaces.

Step 12 To specify the route to reach the Policy Proxy host if it is not located on the network attached to the inside interface, type route inside <network_address> <netmask> [J] [metric], and then press Enter.

• network_address---The network address on which the Policy Proxy host resides.

• netmask---Specify a network mask to apply to network_address.

• metric---Specify the number of hops to the gateway identified by [F]. The default value is 1 if a metric is not specified.

The following procedures detail the commands entered at the console terminal. The commands use brackets surrounding a capital letter, such as [A], to refer to values that you have written on the worksheet. When you are carrying out a procedure that has a reference to the worksheet, type the value from the field on the worksheet, not the reference letter that we use to point you to the field on the worksheet.

For cases where we cannot use the worksheet to collect the required data, we use the standard command syntax. Do not include the braces <, >, [, or ] in any commands that you type.

Caution Cisco Secure Policy Manager only detects and imports a small number of configuration commands installed on a managed device (for support limitations, see Release Notes for Cisco Secure Policy Manager; for a full list of supported commands, see the Configuring Cisco Secure Policy Manager guide). If you have a large number of configuration rules active on the target managed device(s), you should copy that configuration to a backup location before continuing with this task. If you have rules defining unsupported commands, you can copy those rules into Cisco Secure Policy Manager after the initial configuration is completed.

To bootstrap the Cisco router, perform the following task:

Step 2 Turn ON power to the router.

• If you start up the router for the first time, the system automatically enters the setup command facility, which determines which interfaces are installed, and prompts you for configuration information for each interface. On the console terminal, after the system displays the system banner and hardware configuration, you will see the following System Configuration Dialog prompt:

Step 3 To specify that you want to configure this router using privileged mode, type enable and press Enter.

Step 4 Type the enable password [A] for this router, and then press Enter.

Step 5 To enter terminal configuration mode, type configure terminal and press Enter.

Result: You are in Cisco IOS terminal configuration mode.

Step 6 To specify the static default gateway for your router, type ip route 0.0.0.0 0.0.0.0 [B] [metric], and then press Enter.

Use the following parameter guidelines to complete the ip route 0.0.0.0 0.0.0.0 command:

• metric---Specify the administrated distance. The default value is 1 if a metric is not specified.

If the managed device is not on the same network, you will need to add a route to enable Cisco Secure Policy Manager to distribute its generated command sets. You can confirm this need by pinging the managed device from the Policy Proxy host. If you cannot ping the managed device, you need a route from the managed device back to the network where the Policy Proxy host resides.

Step 7 To specify a route to reach the Policy Proxy host if it is not located on the network attached to the inside interface, type ip route <network_address> <netmask> [C] [metric], and then press Enter.

Use the following parameter guidelines to complete the ip route command:

• network_address---The network address on which the Policy Proxy host resides.

• netmask---Specify a network mask to apply to the network_address.

• metric---Specify the number of hops to the destination network. The default value is 1 if a metric is not specified.

Step 14 To assign an IP address to the interface you selected, type ip address [I] [J], and then press Enter.

Step 19 To save your configuration changes to the Flash memory of the router, type write memory, and then press Enter.

Step 20 To exit the enable privileged mode and close the terminal console connection, type exit, and then press Enter.

You should be able to Telnet and log in to this router from the Policy Proxy host.

Note If this router supports IPSec, you will be required to perform additional bootstrapping procedures when you define your network topology in Cisco Secure Policy Manager. These procedures are required after Cisco Secure Policy Manager is installed and are therefore not covered in this installation guide. Refer to the Cisco Secure Policy Manager Administrator's Guide: Policy Development and Enforcement for more information.

Result: The Autostart panel appears, and the What Do I Need To Do? box explains the results of the system check.

• If the Autostart panel does not automatically appear, locate and double-click the setup.exe file in the root directory on the Cisco Secure Policy Manager CD-ROM disc. If you downloaded the zip file, the setup.exe file is located in the directory where you extracted the zip file.

Step 2 To continue with the upgrade process, select Install Product in the Options box. To proceed to the next panel, click Next.

Result: The License Disk panel appears when you upgrade between major versions.

Step 3 To specify the location of the Cisco Secure Policy Manager license disk, type the directory path in the Location box, or click Browse to find the correct path. Then type the corresponding password in the Password box. To proceed to the next panel, click Next.

Note If you are upgrading from the evaluation version of this software to the standard product license, refer to the readme.txt file located with the license.

Result: The Backup Folder panel appears.

Result: A file containing your current system data is stored in the location that you specify. You can use this backup file to restore the system to the exact configuration at the time the backup was created. After you click Next, the Verify Settings panel appears.

Step 5 To verify the settings that you chose before copying files, use the scroll bar on the right side of the window. Review all settings carefully before clicking Copy Files.

Result: The system or feature set on the local host is upgraded to the newer version.

Repeat this procedure for any remaining Cisco Secure Policy Manager hosts on your network.

Result: The system attempts to Telnet to the interface you specified.

• If you get a password prompt, enter the Telnet password for this managed device.

Result: Connectivity between the Policy Proxy host and managed device is confirmed when the password is accepted.

Result: If the ping attempt was successful, the host receives a response from the IP address that you pinged. If the ping was unsuccessful, a request timeout message appears.

• If the ping attempt was successful, try to Telnet from the Policy Proxy host to another device on your network.

• If the ping attempts are unsuccessful, you should perform the following tests:

a. verify that the managed device is not down

b. check network connectivity

c. verify that an existing security policy is not denying Telnet to the managed device

If you cannot confirm the connectivity for command distribution, you must bootstrap the managed device to ensure that it has a basic configuration that enables it to receive commands from the Policy Proxy host.

Explanation   You should retype the username and password, ensuring that you use the correct case and keystroke sequence for a valid Cisco Secure Policy Manager administrative account. If you forget the username/password combination for a full-access account, or if the database frames get destroyed, you will be unable to log on to the Cisco Secure Policy Manager GUI client. If you still receive the same error message, you must follow the procedures below to create a new, temporary Cisco Secure Policy Manager Administrative Account for immediate log on.

To create a temporary Administrative Account, use the Accounts panel of the Troubleshooting Tool Kit to perform the following task:

Step 2 To specify the password that corresponds to the username you just entered, type that password in the Password box.

Step 3 Confirm the password you just entered by retyping it in the Confirm Password box.

Step 4 To specify the location of the license.dsk file that was used to install Cisco Secure Policy Manager on this host, type that path in the License Path box, or click Browse to search directories and locate the file.

Step 5 Submit the password associated with this license.dsk file by typing it into the Password box.

Step 6 To submit the specifications and create a new temporary Administrative Account, click Create.

Result: Tool Kit attempts to create a temporary administrative account that can be used for a one-time logon to the Cisco Secure Policy Manager GUI client. The Status field displays the results of the create command.

Step 7 To close the Troubleshooting Tool Kit, click OK.

Warning Once you have logged on to the GUI client, you must create a new permanent full-access account and perform a Save and Update operation. The temporary account does not appear in the Administrative Accounts tree and will be deleted upon a Save and Update operation.

Wrong NT Password Entered During Installation

If you type the wrong NT password during installation, you will see the following error messages. The first message appears after you click Finish during the installation process. The second message appears when you attempt to log on to the GUI client.

Failed to start Cisco Controlled Host Component

The connection attempt to the policy database failed. This application was unable to establish a connection to the Policy Database using the specified server and port. Make sure the server is started, correct erroneous target machine or port information, and then retry Connect.

Explanation   The setup program detects the Windows NT username that you used to log on to the target host and expects you to submit the corresponding password. However, the setup program will create a default Cisco Secure Policy Manager account using the password you type and confirm, even if you type the wrong password or type the password incorrectly. The installation process will continue, but the Cisco Controlled Host Component will fail to start because the username and password for the default Cisco Secure Policy Manager account do not match the Windows NT username and password. You will not be able to log on to Cisco Secure Policy Manager until you correct the password.

To correct the password, perform the following task:

Result: The Services panel appears.

Step 2 To access the Cisco Controlled Host Component, select Cisco Controlled Host Component in the Service list, and then click Startup.

Result: The Cisco Controlled Host Component Service panel appears.

Step 3 To submit the correct password, click This Account in the Log On As dialog box, and then type the correct user name and password.

Result: The system replaces the existing password with the new password you just specified.

Step 4 To accept your changes and close the panel, click OK.

Using Local Maintenance or Installation Manager to Reinstall Your System

You can use the local maintenance method or Installation Manager to reinstall your system. However, there are distinct differences between the methods that make one method more practical, depending on what feature set you are reinstalling and on which host. Installation Manager enables you to remotely reinstall any feature set, except the Policy Server. The local maintenance method enables you to locally reinstall any feature set. When using the local maintenance method to reinstall a secondary host, you have the option of keeping the existing data stored in the secondary database or synchronizing it with the data stored in the primary database on the Policy Server host. When using Installation Manager to reinstall a secondary host, the binary files are reinstalled, but the database is not.

To reinstall using the local maintenance method, perform the following task:

Result: The Autostart panel appears, and the What Do I Need To Do? box explains the results of the system check.

• If the Autostart panel does not automatically appear, locate (with Windows NT Explorer or My Computer) and double-click the setup.exe file in the root directory on the Cisco Secure Policy Manager CD-ROM disc. If you downloaded the zip file, the setup.exe file is located in the directory where you extracted the zip file.

Step 2 To continue with the reinstallation process, select Install Product in the Options box. To proceed to the next panel, click Next.

Result: The Policy Database panel appears.

Note When you recover a database from the backup folder, you access a backup stored on the primary host. If you have not created a backup of your current database, no backups will be present for you to select.

Step 5 To specify the backup folder on the primary host that you want to use to recover/reinstall the database, type that folder name in the Backup Folder box. To proceed to the next panel, click Next.

Step 7 To complete the reinstallation, click Finish.

Result: The database on the local host is reinstalled from a backup.

Installation Manager enables you to remotely reinstall any feature set, except the Policy Server. When you use Installation Manager to reinstall a secondary host, the binary files are reinstalled, but the database is not.

Result: The Connect to Policy Database dialog box appears.

Step 2 To submit the proper administrative account information, type the username and password in the respective boxes in the Connect to Policy Database dialog box. If you are logged on to the Policy Server, select Local; otherwise, select Remote Server, and then type the IP address or DNS name in the box (you do not have to specify the port number unless it is different from the default 2567). Then, click Connect.

Result: Installation Manager connects to the Primary Policy Database (either locally or remotely, depending on what you specified) and retrieves data about all secondary servers with installed feature sets. Then, the Remote Hosts panel appears.

Step 3 To designate which feature set to reinstall, select the name of the secondary server on which it is installed in the Name box under Include these hosts. Then, click Next.

Result: A dialog box displays a message asking if you really want to reinstall the specified feature set. After you click Yes, the Open dialog box appears.

Step 4 To specify the setup.exe file that contains the version of Cisco Secure Policy Manager identical to the one currently installed on the host, select that file in the Open dialog box, and then click Open.

You must select the setup.exe file in the root directory on the Cisco Secure Policy Manager CD-ROM disc. If you downloaded the zip file, the setup.exe file is located in the directory where you extracted the zip file.

Result: The reinstallation process begins. The % column indicates the completion rate for the reinstallation process.

Result: The shortcut menu for the Cisco Secure Policy Manager program group appears.

Step 2 Click Remove Cisco Secure Policy Manager on the displayed program group.

Result: A dialog box prompts you to confirm the uninstallation before all files, directories, and Registry entries are removed from the local host.

You must reboot to complete the uninstallation.

You can use Installation Manager to uninstall the Policy Proxy, Policy Proxy-Monitor, Policy Monitor, or Policy Administrator feature sets of a distributed system.

Result: The Connect to Policy Database dialog box appears.

Step 2 To submit the proper administrative account information, type the username and password in the respective boxes in the Connect to Policy Database dialog box. If you are logged on to the Policy Server, select Local; otherwise, select Remote Server, and then type the IP address or DNS name in the box (you do not have to specify the port number unless it is different from the default 2567). Then, click Connect.

Result: Installation Manager connects to the primary database on the Policy Server host (either locally or remotely, depending on what you specified) and retrieves data about all secondary hosts with installed feature sets. Then, the Remote Hosts panel appears.

Step 3 To designate which feature set to uninstall, select the name of the secondary host on which it is installed in the Name box under Include these hosts. Then, click Next.

Result: A dialog box displays a message asking if you really want to uninstall the specified feature set. After clicking Yes, the uninstallation process begins. The % column indicates the completion rate for the uninstallation process.

The secondary host will automatically reboot to complete the uninstallation.