Installing a Distributed System

Procedures for Installing a Distributed System

Installing a Distributed System

Installation of a distributed Cisco Secure Policy Manager system is divided into distinct, order-dependent installations:

Installation of the Policy Server feature set is a one-time installation on the primary host. See Installing the Policy Server Feature Set, for procedures related to this task.
After the Policy Server feature set is installed, installation of the Policy Administrator, Policy Proxy, Policy Proxy-Monitor, and Policy Monitor feature sets can be performed on as many additional hosts as desired for distributed functionality and remote administration. See Installing the Policy Proxy, Policy Monitor, and Policy Administrator Feature Sets, for procedures related to this task.

Before you begin installing the feature sets for a distributed Cisco Secure Policy Manager system, you should complete the Distributed System Preparation Checklist and verify that you have the following items:

Cisco Secure Policy Manager CD-ROM disc
Cisco Secure Policy Manager license disk
Target hosts meeting the Cisco Secure Policy Manager Host(s) Requirements

Table 4-1: Distributed System Preparation Checklist

Task
To see specific procedures for these tasks, refer to Appendix A .

Bootstrap Managed Devices

Ensure that any supported devices you wish to manage have been installed on your network and that you can Telnet from the target host to the managed device.

For information on how to bootstrap a managed device, refer to Preparing the Managed Device(s), in Appendix A .

Prepare Each Target Host

Ensure that the target host for each feature set meets the minimum hardware requirements and runs Windows NT 4.0 (the Policy Administrator host can run Windows NT, 95, or 98). The following settings are also required:

NTFS File Partition

TCP/IP Protocol Stack

Review and implement any recommend settings for the target hosts, including the following:

TAPI/MAPI (required for e-mail and pager notifications)

DHCP Disabled

Windows NT startup time set to Zero

For procedures on implementing these settings, refer to Preparing the Target Host(s), in Appendix A .

Create a Windows NT Account for Installation

Create a special Windows NT account with administrative privileges.

For procedures on how to create an account, refer to Creating a Windows NT Account for Installation, in Appendix A .

Install Requisite Software

Ensure that each target host has the requisite software installed, including the following:

Service Pack 5 for Windows NT

Microsoft Internet Explorer 5.0

HTML Help 1.22 Update

For more information on requisite software, refer to Software Requirements, in Chapter 1.

Install Optional Software

Decide whether or not you want to install Cisco Secure VPN Client on the Policy Server, Policy Proxy, or Policy Proxy-Monitor hosts.

For procedures on installing this software, refer to Installing Cisco Secure VPN Client, in Appendix A.

	Task To see specific procedures for these tasks, refer to Appendix A .
	Bootstrap Managed Devices Ensure that any supported devices you wish to manage have been installed on your network and that you can Telnet from the target host to the managed device. For information on how to bootstrap a managed device, refer to Preparing the Managed Device(s), in Appendix A .
	Prepare Each Target Host Ensure that the target host for each feature set meets the minimum hardware requirements and runs Windows NT 4.0 (the Policy Administrator host can run Windows NT, 95, or 98). The following settings are also required: NTFS File Partition TCP/IP Protocol Stack Review and implement any recommend settings for the target hosts, including the following: TAPI/MAPI (required for e-mail and pager notifications) DHCP Disabled Windows NT startup time set to Zero For procedures on implementing these settings, refer to Preparing the Target Host(s), in Appendix A .
	Create a Windows NT Account for Installation Create a special Windows NT account with administrative privileges. For procedures on how to create an account, refer to Creating a Windows NT Account for Installation, in Appendix A .
	Install Requisite Software Ensure that each target host has the requisite software installed, including the following: Service Pack 5 for Windows NT Microsoft Internet Explorer 5.0 HTML Help 1.22 Update For more information on requisite software, refer to Software Requirements, in Chapter 1.
	Install Optional Software Decide whether or not you want to install Cisco Secure VPN Client on the Policy Server, Policy Proxy, or Policy Proxy-Monitor hosts. For procedures on installing this software, refer to Installing Cisco Secure VPN Client, in Appendix A.

Procedures for Installing a Distributed System

Installing the Policy Server Feature Set

The following task outlines the procedures for installing a Policy Server feature set on the target host.

To install a distributed Cisco Secure Policy Manager system, perform the following task on the target host for the Policy Server feature set:

Step 1 To install a distributed system, you must install the Policy Server feature set before you install the remaining feature sets. To initiate the Autostart sequence, insert the Cisco Secure Policy Manager CD-ROM into the drive on the Policy Server host.

Result: The Autostart panel appears.

If the Autostart panel does not automatically appear, locate and double-click the setup.exe file in the root directory on the Cisco Secure Policy Manager CD-ROM disc. If you downloaded the zip file, the setup.exe file is located in the directory where you extracted the zip file.

If Cisco Secure VPN Client is not installed on the target host, a message will appear asking if you want to terminate the installation of Cisco Secure Policy Manager and install Cisco Secure VPN Client first. For more information, refer to "Installing Cisco Secure VPN Client" in "Reference Sections."
If you have not installed all requisite software, Autostart detects this, and you cannot begin the setup program. However, you can install the requisite software from the Autostart panel and then continue with the setup program.

Figure 4-1: Autostart panel

Step 2 To begin setup, select Install Product in the Options box, and then click Next.

Result: The License Agreement panel appears.

Step 3 To review all conditions of the license agreement, use the scroll bar on the right side of the window. To accept the license agreement and continue with the installation process, select I accept the agreement. To proceed to the next panel, click Next.

Result: The License Disk panel appears.

Figure 4-2: License Disk panel

Step 4 To specify the location of the Cisco Secure Policy Manager license disk, type the directory path in the Location box, or click Browse to find the correct path. Then, type the corresponding password in the Password box. To proceed to the next panel, click Next.

Note By default, the setup program accesses the floppy drive (A:) when searching for the license.dsk file. The unique password is printed on the license disk label. However, if you downloaded the software from CCO, the password is located in a readme file in the downloaded directory.

Result: The Installation Options panel appears.

Figure 4-3: Installation Options panel

Step 5 To select the type of system to install, click Distributed CSPM.

Result: A brief text description of the distributed system appears in the Installation Option box.

Step 6 To specify the feature set to install, click Policy Server in the Feature Set list.

Step 7 To specify where to install the Policy Server feature set, type the directory path to the installation folder in the Installation Folder box, or click Browse to find the correct path. To proceed to the next panel, click Next.

If the folder that you specified in the directory path does not exist, the setup program offers to create a default folder (Program Files\Cisco Systems\Cisco Secure Policy Manager) for you. In the popup window, click Yes to create the folder and proceed with the setup program; click No to return to the Installation Options panel.

Result: The Account Information panel appears.

Step 8 To submit the corresponding password for the Windows NT username detected by the setup program, type the password in the Password box. Also, to confirm the password, retype it in the Confirm Password box. To proceed to the next panel, click Next.

Result: The Settings panel appears.

Figure 4-4: Settings panel

Step 9 You must select one of the IP addresses configured on the target host for all inbound and outbound Cisco Secure Policy Manager communications. To designate an IP address, select one by clicking it in the Local IP Address list.

Step 10 You must ensure that the Policy Database listens on the proper port for communication requests. The IANA-assigned port number for database communications is 2567. To change the port number, double-click the existing one in the Primary Policy Database box, and then type the desired unused port number.

Step 11 To export the database key, click Export this key, and then type the directory path in the File Destination box to the location where you want to store the key. To proceed to the next panel, click Next.

Caution We do not recommend that you export this key to a network folder, especially one that is shared and readily accessible. Instead, we advise you to export the database key to a floppy disk that is stored in a secure place. Otherwise, you might compromise the security of your network.

Result: The database key is written to the location that you specified and the Verify Install Settings panel appears.

Step 12 To copy all files to your disk, verify the settings that you chose, and then click Copy Files.

Note If you find an incorrect setting, click Back until you arrive at the proper panel. Make the necessary changes, and then click Next to return to the Verify Install Settings panel.

Result: The TechSmith Screen Capture Codec Installation panel appears.

Step 13 To install the compression software (TSCC) required for viewing the tutorial videos, click Install on the TechSmith Screen Capture Codec Installation panel.

The Getting Started Videos were created using TechSmith's Camtasia. Camtasia uses a proprietary AVI compression codec called TechSmith Compression Codec (TSCC). Before you can view the videos, you must have TSCC installed on your computer.
If you downloaded the software, TSCC is installed when you run the videoex.exe file.

Result: The setup program copies all files to the specified installation folder and creates the necessary Registry keys. Then, the Setup is complete panel appears.

Step 14 To close the setup program, click Finish.

Result: The setup program completes and the window closes.

You have successfully installed the Policy Server feature set for a distributed Policy Manager system. You must now install the remaining feature sets. Follow the steps listed in Installing the Policy Proxy, Policy Monitor, and Policy Administrator Feature Sets for the remaining hosts in your distributed system. If you are installing the Policy Administrator feature set for remote administration, skip Steps 10 and 11.

Installing the Policy Proxy, Policy Monitor, and Policy Administrator Feature Sets

Before you begin installing the remaining feature sets of a distributed Cisco Secure Policy Manager system, you should verify that you have the following items:

Cisco Secure Policy Manager CD-ROM disc
Cisco Secure Policy Manager license disk
Disk containing Policy Database key (exported during Policy Server installation)
Target host(s) meeting the requirements listed in this guide

To continue installation of a distributed Cisco Secure Policy Manager system, perform the following task on each target host for the remaining feature sets:

Step 1 To initiate the Autostart sequence, insert the Cisco Secure Policy Manager CD-ROM into the drive on the target host for the specific feature set you are installing.

Result: The Autostart panel appears.

If the Autostart panel does not automatically appear, locate and double-click the setup.exe file in the root directory on the Cisco Secure Policy Manager CD-ROM. If you downloaded the zip file, the setup.exe file is located in the directory where you extracted the zip file.

If Cisco Secure VPN Client is not installed on the target host, a message will appear asking if you want to terminate the installation of Cisco Secure Policy Manager and install Cisco Secure VPN Client first. For more information, refer to "Installing Cisco Secure VPN Client" in "Reference Sections."
If you have not installed all requisite software, Autostart detects this, and you cannot begin the setup program. However, you can install the requisite software from the Autostart panel and then continue with the setup program.

Figure 4-5: Autostart panel

Step 2 To begin setup, select Install Product in the Options box, and then click Next.

Result: The License Agreement panel appears.

Result: The License Disk panel appears.

Figure 4-6: License Disk panel

Result: The Installation Options panel appears.

Figure 4-7: Installation Options panel

Step 5 To select the type of system to install, click Distributed CSPM.

Result: A brief text description of the client-server system appears in the Installation Option box.

Step 6 To specify the feature set to install, click Policy Proxy, Policy Monitor, Policy Proxy-Monitor, or Policy Administrator in the Feature Set list.

Step 7 To specify where to install the feature set, type the directory path to the installation folder in the Installation Folder box, or click Browse to find the correct path. To proceed to the next panel, click Next.

If the folder that you specified in the directory path does not exist, the setup program offers to create a default folder (Program Files\Cisco Systems\Cisco Secure Policy Manager) for you. In the popup window, click Yes to create the folder and proceed with the setup program; click No to return to the Installation Options panel.

Result: The Key Location panel appears.

Figure 4-8: Key Location panel

Step 8 To specify the location of the Policy Database key, type the directory path to the key in the Primary Policy Database Key box, or click Browse to locate the path.

If the Policy Server host is on a private network behind a Policy Enforcement Point performing address translation (NAT), you need to override the IP address contained by the database key. To override this information, click Use these parameters, and then type the registered IP address to which you mapped the Policy Server host (as specified by the bi-directional mapping rule) in the Server IP Address box. If you need to override the port number, type the new value in the Port box. To proceed to the next panel, click Next.

Result: The Account Information panel appears.

Step 9 To submit the corresponding password for the Windows NT username detected by the setup program, type the password in the Password box. Also, to confirm the password, retype it in the Confirm Password box. To proceed to the next panel, click Next.

Result: The Settings panel appears.

Figure 4-9: Settings panel

Step 10 You must select one of the IP addresses configured on the target host for all inbound and outbound Cisco Secure Policy Manager communications. To designate an IP address, select one by clicking it in the Local IP Address list.

Step 11 You must ensure that the Policy Database listens on the proper port for communication requests. The IANA-assigned port number for database communications is 2567. To change the port number, double-click the existing one in the Primary Policy Database box, and then type the desired unused port number.

Result: The database key is written to the location that you specified and the Verify Install Settings panel appears.

Step 12 To copy all files to your disk, verify the settings that you chose, and then click Copy Files.

Note If you find an incorrect setting, click Back until you arrive at the proper panel. Make the necessary changes, and then click Next to return to the Verify Install Settings panel.

Result: The TechSmith Screen Capture Codec Installation panel appears.

Step 13 To install the compression software (TSCC) required for viewing the tutorial videos, click Install on the TechSmith Screen Capture Codec Installation panel.

The Getting Started Videos were created using TechSmith's Camtasia. Camtasia uses a proprietary AVI compression codec called TechSmith Compression Codec (TSCC). Before you can view the videos, you must have TSCC installed on your computer.
If you downloaded the software, TSCC is installed when you run the videoex.exe file.

Result: The setup program copies all files to the specified installation folder. Then, the Setup is complete panel appears.

Step 14 To close the setup program, click Finish.

Result: The setup program completes and the window closes.

Tips Repeat Steps 1 through 14 in this section to install the Policy Administrator, Policy Monitor, Policy Proxy, or Policy Proxy-Monitor feature sets on any additional hosts in your distributed Cisco Secure Policy Manager system.

You have successfully installed a distributed Cisco Secure Policy Manager system. For logon instructions, see the "Logging on to Cisco Secure Policy Manager" section. After you have logged on to the GUI client, you have the option of viewing the Getting Started videos for general guidance on using Cisco Secure Policy Manager.

Table of Contents