Table of Contents

Learn More About Security Policy Enforcement

Policy Evaluation Rules
Policy Inheritance

What to Add to the Security Policy Enforcement Branch
Strategies for Populating Your Security Policy Enforcement Branch
Security Policy Enforcement Task List

Adding a Network Object
Creating a Security Policy Enforcement Folder
Applying a Security Policy
Removing a Security Policy Abstract

Security Policy Enforcement

Within the Security Policy Enforcement branch, you organize only those network objects for which you want to enforce security policies directly. You can also create Security Policy folders that define high-level logical groups of network objects to which you can apply a single security policy.

Learn More About Security Policy Enforcement

The Security Policy Enforcement branch displays the network objects on which you want to enforce security policies directly. By performing a drag-and-drop operation to move network objects from the Network Topology tree onto this branch, you can construct a logical tree that determines which security policy applies to any given network object. When a network object in this branch has a policy enforced on it, the scroll icon beside it is yellow.

• Policy Evaluation Rules. To enforce the desired network security policy, you need to understand how security policies are processed within this tree structure. This topic explains the rules for how security policies are evaluated when they are applied in the Security Policy Enforcement branch.

• Policy Inheritance. Policy inheritance allows you to isolate exceptions at those network objects that require unique security policies, without having to duplicate the common security policy settings that are applied to higher level objects. This topic details how policy inheritance works and provides examples of how you should apply security policies within the Security Policy Enforcement branch.

Policy Evaluation Rules

After you have populated your Security Policy Enforcement branch with network objects and applied security policies to those network objects, Cisco Secure Policy Manager publishes lists of commands to the Policy Enforcement Points specifying which security policy applies to each network object. It generates the lists of commands using a "first and all" match semantic.

Cisco Secure Policy Manager searches for the first network object match from a top-down, right-to-left (or depth) perspective of the Security Policy Enforcement branch. It continues the traversal of all branches in the Security Policy Enforcement branch in this manner, generating rule lists from the policy attached to each network object (or parent object if no policy is attached to the network object---for more information see Policy Inheritance) until all instances of that network object are added to the rule list. After all the branches have been traversed, the policy (if any) applied to the Default Policy node is added to the rule list. When evaluating policies (or rule lists), if Cisco Secure Policy Manager finds no matches for a specific network object or in the Default Policy, it applies the default security stance of "deny all network traffic that is not expressly permitted."

Note For Users of Cisco Security Manager version 1.x   In version 1.x of Cisco Security Manager, all policies were source-based policies, containing an implicit "If source is this network object" source condition. This precluded the use of the same network object on multiple branches of the Security Policy Enforcement branch. The policy evaluation rule used a "best match" semantic for policy evaluation, which meant that the most specific security policy in relation to the network object was enforced first, followed by the security policies enforced on any parent objects (until it reached the top level of the Security Policy Enforcement branch, where the default stance of "deny all traffic that is not expressly permitted" was applied). After the source condition was matched, only the security policy on that object (or its parent objects) was evaluated; the system did not look for matches on other branches.   With the addition of the explicit source condition, the preclusion of repeated network objects was removed to enable multiple instances of the same network object in the Security Policy Enforcement branch. In this way, both source-based and destination-based policies could be enforced on a network object (by creating two instances of that network object and putting a single policy on each). The best match policy evaluation semantic was replaced with the "first and all" match semantic.

Policy Inheritance

Policy inheritance refers to the use of recursive lists of security policies. The Security Policy Enforcement branch is a hierarchal structure in which network objects are placed in a logical, rather than physical, arrangement as siblings or children of one another. Inheritance means that children objects inherit the security policies applied to their parent objects if the child object does not have a security policy applied to it or if the evaluation of the decision tree contained by an applied policy does not result in a terminal action (Permit or Deny).

This concept becomes clearer with an example. Let's say that in your Security Policy Enforcement branch you have put a trusted network (parent node represented by A in Figure 10-1), and under that trusted network you have positioned numerous workstations (sibling nodes underneath the trusted network in the graphic below). Furthermore, you know that the person working at one of those sibling workstations (see Workstation Bob, B, in Figure 10-1) has a need to access a particular server out on the Internet (such as an FTP server) that you want to prevent all other sibling workstations from accessing. You could construct two security policy abstracts to allow the person at Workstation Bob to access the server while restricting all other FTP services.

You could construct a security policy abstract specifying that FTP traffic destined for that server on the Internet is accepted (see Figure 10-2).

You could construct another security policy abstract specifying that all FTP traffic (see Figure 10-3) destined for the Internet is rejected.

Applying the first security policy to Workstation Bob (the sibling) and then applying the second security policy to the trusted network (the parent) creates an instance where policy inheritance applies. If the person working at Workstation Bob tries to access the specified FTP server on the Internet, the Policy Enforcement Point permits the network service. If that person tries to access another FTP server on the Internet, the security policy applied to that workstation does not apply, and the policy processing is deferred to the next security policy up (the security policy attached to the parent node). In our example, the next security policy up denies all FTP traffic to the Internet; therefore no other FTP server can be accessed from Workstation Bob except the one specified by the security policy attached to it.

---

Note For Users of Cisco Security Manager version 1.x   In version 1.x of Cisco Security Manager, the Use Parent Policy node was used to force policy inheritance. In Cisco Secure Policy Manager version 2.x, the Use Parent Policy node was removed from the decision tree, and policy inheritance occurs whenever policy evaluation does not result in a terminal action.

---

What to Add to the Security Policy Enforcement Branch

You can add a variety of objects to the Security Policy Enforcement branch to which you can apply security policies. When you apply a security policy to an object in the Security Policy Enforcement branch, it becomes the conditional object in the "If Source Is This Network Object" or "If Destination Is This Network Object" condition of the security policy. Table 10-1 lists each type of object that you can add to the Security Policy Enforcement branch and the reason you would want to add it.

Table 10-1: Security Policy Enforcement Branch Objects

Object	Location	Reason
Host	Network Topology tree	A host is a single device on your network that you represent in your Network Topology tree. You can place hosts in the Security Policy Enforcement branch to apply a security policy specific for that host. Host objects are useful for creating policies that are exceptions to the more general policies, such as permitting a specific host on your network Telnet access to your Policy Enforcement Points while all other hosts are denied such access.
Gateway	Network Topology tree	A gateway object is router or firewall that resides on your network. You typically only add gateway objects to your Security Policy Enforcement branch if you want to specifically define the network traffic that you want to flow to or from that object. Cisco Secure Policy Manager automatically adds gateway objects and generates the policies required for the Cisco Secure Policy Manager host to publish policy to the gateways and receive syslog messages from the gateway. You would only need to add the gateway object to the Security Policy Enforcement branch if you wanted to permit or deny access by additional hosts to the gateway.
Network	Network Topology tree	Networks represent particular segments of your network topology. You can use networks in the Security Policy Enforcement branch to apply a consistent policy to all hosts and devices on that network.
Cloud	Network Topology tree	Clouds represent areas of your network that you do not define in detail in your Network Topology tree. Clouds are useful for creating consistent policy that apply to large areas of your network.
Network Object Group	Network Object Groups branch of the Tools and Services tree	Network object groups are used to create logical groupings of objects from your Network Topology tree. They can be useful for grouping similar objects, such as web servers, that are located in various areas of your network topology and to which you want to apply a single policy.
Policy Domain	Policy Domains branch of the Tools and Services tree	A policy domain is simply a collection of network perimeters. Policy domains are useful for creating high-level, general security policies that apply to large areas of your network.
Perimeter	Policy Domains branch of the Tools and Services tree	A perimeter represents a network or collection of networks that is bounded by one or more gateways. Perimeters are useful for creating high-level, general security policies that apply to large areas of your network.

Strategies for Populating Your Security Policy Enforcement Branch

The following strategies will assist you in populating the Security Policy Enforcement branch.

Keeping your planned policies in mind while populating the Security Policy Enforcement branch will enable you to determine which of your network objects need to be placed on the branch and which do not. Also, remember that some of your network objects will need both a destination-based policy and a source-based policy. You can create two instances of each network object in the Security Policy Enforcement branch, and apply a source-based policy to one and a destination-based policy to the other, or place a single instance of that network object in the Security Policy Enforcement branch and create a policy that contains both source-based and destination-based frameworks within the decision tree. Refer to Destination-Based and Source-Based Policies, in "Policy Builder" for more information about this topic.

2. Think network traffic endpoints, not Policy Enforcement Points.

Unless you are defining a security policy that is intended to regulate network traffic to a specific Policy Enforcement Point (such as permitting Telnet access from an administrative workstation to a firewall), you do not need to put your Policy Enforcement Points into the Security Policy Enforcement branch. Instead, you only need to populate the Security Policy Enforcement branch with the network traffic endpoints, whether those endpoints are workstations, servers, or entire networks, to which you are going to apply security policies.

3. Use folders to group network objects.

You can use Security Policy folders to group similar objects from different areas in your network topology, and then apply a security policy to the folder that will cover all the objects. For example, you can create a Security Policy folder called "Web Servers" and place all of your web servers within that folder. By placing a security policy on that folder, you are essentially placing it on each object within that folder (see Policy Inheritance, for more information). If you add a web server to your network topology at a later time, you can simply drop it in the "Web Servers" folder to have it covered by the same security policy that covers your other web servers.

4. Start populating the branch with the more general objects and work down toward the specific ones.

You do not need to place every object from your Network Topology tree in the Security Policy Enforcement branch; you only need to place those objects against which you want to enforce security policies. Place the more high-level, container objects (such as networks) on the branch first. When you apply a security policy to a network object, the security policy is enforced against the network traffic that is originating from or destined for the object or the objects it contains. If you want to create an exception policy for an object contained by the higher-level object, place the exception object under the container object and apply the specific security policy to the exception object. In this way, the specific policy on the exception object will be enforced for that object, while the more general policy applied to the container object will be enforced for all other objects contained by the container object. See Policy Evaluation Rules, and Policy Inheritance, for more information about how security policies are evaluated in the Security Policy Enforcement branch.

5. Be careful where you place policies that reference the Internet node.

The Internet node is interpreted as "any IP address." Therefore, any policy permitting a specific service to the Internet will also permit that service to any intermediate networks between the object the policy was applied to and the actual Internet. If you want to prevent this, you will need to place a more specific policy denying the traffic from the source node to the intermediate network under the more permissive Internet policy in the Security Policy Enforcement branch.

Another strategy is to place all network objects that will have an Internet policy applied to them on a branch farther down the Security Policy Enforcement branch. This will cause the policies on the upper branches to be evaluated first, and the more permissive Internet policies to be evaluated later.

See Policy Evaluation Rules, and Policy Inheritance, for more information about how security policies are evaluated in the Security Policy Enforcement branch.

Security Policy Enforcement Task List

This topic lists all the tasks that can be performed from the Security Policy Enforcement branch. For procedures to perform a particular task, refer to the appropriate task topic.

• Adding a Network Object

• Creating a Security Policy Enforcement Folder

• Applying a Security Policy

• Removing a Security Policy Abstract

Adding a Network Object

Before you can enforce a security policy on a network object (from the Network Topology tree), you must add that network object to the Security Policy Enforcement branch of the Network Policy tree. Where you place the network object in the Security Policy Enforcement branch does affect which security policies apply to it (policy inheritance).

To add a network object to the Security Policy Enforcement branch, perform the following task:

---

Step 1 Expand the Network Topology tree until the object you want to add appears. Expand the Security Policy Enforcement branch until the desired area on the tree appears.

Step 2 Click the object in the Network Topology tree, and while holding down the mouse button, drag the network object over the node in the Security Policy Enforcement branch under which you want to place the network object, and then release the mouse button.

Result: The network object appears in the Security Policy Enforcement branch underneath the parent node on which you dropped the object. Also, an empty scroll icon appears beside the new network object node.

Step 3 To save any changes that you have made, click Save on the File menu.

---

Note When you make a change to a network object in the Network Topology tree, such as renaming it, that change automatically propagates up to the representation of that object in the Security Policy Enforcement branch.

---

---

 

Creating a Security Policy Enforcement Folder

You can create any number of Security Policy folders, which you can use to organize and sort network objects into logical groups, to which you can apply a single, consistent security policy (by applying that policy to a folder). You can also define folders within folders to further organize network objects. These logical groupings help you to take advantage of policy inheritance, which enables you to define exceptions to lower-level objects, while maintaining a consistent security policy at higher-level objects (such as folder).

To create a Security Policy folder, perform the following task:

---

Step 1 Expand the Security Policy Enforcement branch until you view the object under which you want to create the folder.

---

Note You can also define a folder just below the Security Policy Enforcement branch.

---

Step 2 Right-click the icon under which you want to define a new folder.

Step 3 Point to New, and then click Security Policy Folder on the shortcut menu.

Result: A new node named Security Policy Folder # appears under the selected node.

Step 4 Type the new name in the Name box and press Enter.

Result: The new name appears in the Name box of the selected node.

The name of the folder may include up to 256 alphanumeric characters, but it may not include quotation marks (") or semicolons (;).

---

Tips If you cannot edit the name, right-click the new Security Policy Folder node, and click Rename on the shortcut menu.

---

Step 5 To save any changes that you have made, click Save on the File menu.

---

 

Applying a Security Policy

A network object in the Security Policy Enforcement branch cannot access any network service until you enforce a security policy on it. The reason for this is that Cisco Secure Policy Manager forces a minimalist stance on any Policy Enforcement Point (PIX Firewall) that it manages. This minimalist stance means that every request for network service is rejected unless specifically permitted with a security policy.

To apply a security policy to a network object, perform the following task:

---

Step 1 Expand the Security Policy Abstracts branch of the Tools and Services tree, and the subfolder (if any) to view the security policy abstract to be applied. Expand the Security Policy Enforcement branch of the Network Policy tree until the network object to which the policy is to be applied appears in the Navigator pane.

Step 2 Click the security policy abstract in the Security Policy Abstracts branch of the Tools and Services tree, and while holding down the mouse button, drag the policy over the network object in the Security Policy Enforcement branch, and then release the mouse button.

Result: A yellow scroll icon appears beside the network object node, signifying that a security policy has been enforced on it.

Step 3 To save any changes you have made, click Save on the File menu.

---

Note You can apply security policies to network objects in the Security Policy Enforcement branch in two other ways: you can use the Policy Assignment utility listed on the Tools menu, or you can create the security policy by right-clicking the network object in the Security Policy Enforcement branch, which opens Policy Builder and enables you to create a security policy that is automatically enforced on that network object.

---

---

 

Removing a Security Policy Abstract

You can remove a security policy abstract that is no longer valid from a node in the Security Policy Enforcement branch.

---

Note If you are going to apply another security policy abstract to the node, you do not need to remove the existing security policy abstract from it. Instead, you can simply apply the new security policy abstract over the existing one on the node. The new security policy abstract will replace the one that was previously applied.

---

To remove a security policy abstract from a node, perform the following task:

---

Step 1 Expand the Security Policy Enforcement branch, and any folders or network objects, until you view the desired network object in the Navigator pane.

Step 2 Right-click the icon of the network object that contains the security policy abstract you want to remove, point to Policy, and then click Remove on the shortcut menu.

Result: The security policy abstract is removed from the network object.

Step 3 To save any changes you have made, click Save on the File menu.

---

 

Posted: Mon Jun 5 20:25:32 PDT 2000
Copyright 1989 - 2000©Cisco Systems Inc.