cc/td/doc/product/ismg/security
hometocprevnextglossaryfeedbacksearchhelp
PDF

Table of Contents

Release Notes for Cisco Security Manager Version 1.1

Release Notes for Cisco Security Manager Version 1.1

October 5, 1999

These release notes pertain to Cisco Security Manager Version 1.1.

Contents

Introduction

Cisco Security Manager is a scalable, comprehensive security policy management system for Policy Enforcement Points (PEPs), specifically PIX Firewalls. With Cisco Security Manager, Cisco Systems customers can define, distribute, enforce, and audit multiple distributed firewall security policies from a central location. As the management cornerstone of the Cisco end-to-end security product line and a fundamental element of CiscoAssure Policy Networking, Cisco Security Manager can dramatically simplify firewall management.

Features and Functionality Changes

This section describes the significant changes in a feature or functionality found in Cisco Security Manager. However, this section does not address the caveats resolved as part of the ongoing maintenance and development of this product.

New or Improved Features and Functionality

New or improved features and functionality in Cisco Security Manager improve your experience and provide enhanced support for managing your network security. The following list identifies such features and functionality:

Deprecated Features and Functionality

Deprecated features are those features and functionality that will be removed from Cisco Security Manager in an upcoming release. You should avoid becoming dependent on these features and familiarize yourself with those features that replace the deprecated ones. You should consider the following features, found in Cisco Security Manager Version 1.0 and Version 1.1, deprecated:

System Requirements

You can install Cisco Security Manager on any computer that meets the minimum hardware requirements and that runs Microsoft Windows NT Server version 4.0 or Windows NT Workstation version 4.0 using an NTFS file partition. You can also install the user interface for Cisco Security Manager on a computer that runs Windows NT 4.0, Windows 95, or Windows 98. The demo version also runs on Windows NT 4.0, Windows 95, or Windows 98.

Cisco Security Manager also requires several pieces of requisite software to operate as intended, including the following:

You must also have the TCP/IP protocol stack installed and operating correctly on each computer before you begin installation. The Autostart utility makes fulfilling the software requirements easy by checking the target computer for all requisites and then allowing you to install any missing requisites before continuing with the setup program. You cannot proceed with the setup program unless you install all requisite software.

The computer or computers on which you install Cisco Security Manager must meet the minimum hardware requirements; otherwise, we cannot guarantee the integrity and functionality of the system that you install. To ensure optimal performance, though, you should install Cisco Security Manager on computers that meet or exceed these recommended hardware requirements.

Note You should define the virtual memory settings for your Windows NT computer to be at least two times the physical memory installed in the computer. To reduce fragmented memory allocation and improve efficiency, you should also specify the same value for the Initial Size and Maximum Size boxes in the Virtual Memory dialog box, which you can access from the Performance panel of the My Computer property sheet.

Minimum Hardware Requirements

Recommended Hardware Requirements

Hardware Supported

This section identifies the PEPs, such as PIX Firewalls, currently supported by Cisco Security Manager. Cisco Security Manager supports Ethernet, Token Ring, and FDDI interfaces installed in the PIX Firewalls.

Cisco Security Manager Version 1.1 supports PIX Firewall 10000, 510, 515, and 520 models running software version 4.2.4, 4.2.5, 4.4.1, and 4.4.2.

Software Compatibility

The following software either is known to conflict with Cisco Security Manager or has not been extensively tested with this product:

Currently, the only supported versions of PIX Firewall software are versions 4.2.4, 4.2.5, 4.4.1, and 4.4.2.
Currently, the only supported operating system is the U.S. version of Windows NT 4.0, running Service Pack 4. This product has not been tested with non-U.S. versions of the operating system.
This product has not been tested with the final release of Internet Explorer 5.0. At this time, no known issues exist; however, running Cisco Security Manager on a host with Internet Explorer 5.0 is not supported, nor is it supported on a workstation used for remote administration of Cisco Security Manager.
This product has not been tested with Windows NT Service Pack 5. As a result, you cannot install Cisco Security Manager on a host that is running Service Pack 5.
Cisco Security Manager operates from 01/01/1999 through 12/31/2035. If you attempt to run the Cisco Controlled Host Component outside this time range, it may stop responding to the Windows NT Service Control Manager (SCM) and you may get an application event that states the service hung on starting. The only way to get the service working properly again is to change the date to a valid date (within the operational period specified above) and reboot the computer.
The preview release of Internet Explorer 5.0 causes the toolbars to appear improperly (they are very small boxes) in the GUI. It also affects the navigation toolbar within the embedded HTML viewer accessed through View Reports on the Tools menu of the GUI.
The final release of Microsoft Visual Studio version 6.0 prevents HTML Help from working correctly. This problem affects the Help systems provided with the setup program, Installation Manager, and the GUI.
The pre-releases of Microsoft Visual InterDev version 6.0 and Visual J++ version 6.0 cause the GUI to crash when you try to access the embedded Microsoft HTML Help control from View Reports on the Tools menu and from Product Information on the Help menu.
The uncompiled HTML documentation does not work with Netscape Navigator version 4.04 or earlier. This incompatibility is due to the use of style sheets and DHTML.

Installation Notes

For instructions about managing your installed Cisco Security Manager server, refer to Appendix B, "Upgrading, Downgrading, Reinstalling, and Uninstalling" of the Cisco Security Manager Installation Guide document.

The following note applies to installing any release or install type of Cisco Security Manager:

To install the Demo, your computer only needs Internet Explorer 3.02 or later. However, the CD-ROM does not include this version of Internet Explorer. It only includes Internet Explorer 4.01 as part of the Windows NT SP4 setup.
The demo file, gravy.cpm, was removed from Cisco Security Manager 1.1. However, the shortcut used by the demo program was not updated to reflect this change. To start the demo, edit the shortcut to reference the TwoPixExample.cpm file.

License Key Information (CD-ROM Only)

The following list identifies where to locate the license disk that is required to install Cisco Security Manager, as well as identifies the limitations and password associated with the license.

Limitations and Restrictions

The license key provided on the CD-ROM installation media for Cisco Security Manager only supports one PIX Firewall.

Network Shortcut Limitations

Network shortcuts are not fully supported in this release. This issue may prevent you from creating multiple instances of the same network under the Network Topology tree. In other words, you may not be able to define a topology where two firewalls protect the same network in complex topologies.

Command Distribution Ordering Restrictions

You can construct network topologies for which you should not use automatic command distribution. The problem lies in the order that command sets are downloaded to the various PEPs. The problem occurs when a Cisco Security Manager server (CSM Server) attempts to publish command sets to an external firewall from behind an internal firewall that translates the server's real address. In some cases, the automatically downloaded command sets can fail and prevent the download of generated command sets to some PIX Firewalls in the topology.

For example, assume that you have a network topology in which you have defined three PIX Firewalls (called outside, middle, and inside in this example) and that the CSM Server that distributes command sets to the each of these firewalls resides behind the inside firewall. Now assume that you have defined a mapping rule on the middle or inside firewall that hides the CSM Server address from the outside firewall. In this case, if you distribute the commands to the inside or middle firewalls before you distribute them to the outside firewall, the outside firewall becomes unreachable by the CSM Server. Even though the command set generated for the outside firewall understands the address hiding rule, the command set to be replaced does not. Therefore, the outside firewall does not know to allow administrative updates from the translated CSM Server's address.

Note The automatic command distribution to the outside firewall fails only when a change to the mapping rules occurs on the inside or middle firewall. In other words, it can occur when you add, delete, or modify an existing mapping rule for the CSM Server. Once you use the manual distribution method to change the mapping rules, you can return to the automatic distribution method until a similar change occurs.

If the address of the CSM Server is not translated on any of the firewalls or it is translated only on the outside firewall, automatic updates would work fine, because in that case order does not matter.

Caveats

This section identifies caveats and issues for Cisco Security Manager.

Hardware Caveats

Refer to "Release Notes for the PIX Firewall" for information about hardware caveats that might affect Cisco Security Manager. You can access these release notes online at the following URL: http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v42/pixrn420.htm

Open Caveats---Version 1.1

This section identifies known caveats and issues with Cisco Security Manager Version 1.1.

Cisco Security Manager: System Caveats

After you import a large *.cpm file, you should perform a Save operation and allow that operation to complete before you perform a Save and Update operation.
After you perform a Save and Update operation, you should allow the device-specific command set to generate completely before you perform another Save and Update operation.
In a distributed installation scenario that has a large number of secondary servers (four or more), the Save operation is not optimized. Therefore, Save operations can take five minutes or longer.
The following maximum threshold values exist for the specified hardware configurations:
When the system is under high stress, frequently saving or requesting reports (every 10 minutes) may disable the system. Error messages similar to the following appear in the Windows NT Event Viewer when this error occurs:
Krs error 28772: Database terminating with message: Failed to map page.
Krs error 28801: The process cannot access the file because another process has locked a portion of the file. Failed to create file mapping for backing file d:\csm\data\memory\memfrm1730.mmf.
The Policy Database does not auto detect when another application consumes too much disk space. In other words, if another application begins consuming too much disk space, the Policy Database cannot recover from system crashes that result because it does not have enough disk space to perform the recovery operation. You should back up your Policy Database often to ensure that you can recover from such incidents.
You must define the disk space settings for the Policy Database on all primary and secondary server panels (hosts running components of Cisco Security Manager). In addition, this setting must be less than the total available disk space on the host. If you fail to define these settings, the system can become unusable.
If you attempt to generate a network service activity report about a secondary Cisco Security Manager server, no data is available about that activity. Currently, no workaround exists.

Cisco Security Manager: Command Generation Caveats

Each time you perform a Save and Update operation, a new copy of the generated command set is published to each PEP installed on your network, even if the generated command set did not change from the set currently published to the PEPs. Currently, no workaround exists for this issue.
The case, referred to as nested network address translation (NAT), is not currently supported. It typically seems plausible in a nested PIX Firewall scenario. You cannot nest any forms of address translation within the defined topology.
When Cisco Security Manager generates the logging host commands for the PIX Firewall, some of the commands may point the syslog stream out an interface where the host does not reside (for example, the statement could read logging host outside when the actual syslog server resides somewhere off the inside interface). This problem is caused by a routing discrepancy that only affects the syslog servers and Policy Monitor Points. Depending upon your network topology, this caveat can increase network traffic as the syslog data is sent out the wrong interface.
The workaround involves two steps:

Step 1 Using the Enforcement panel on the PIX Firewall node in the GUI, disable the PIX Firewall from sending its syslog data stream to that particular host.

Step 2 In the Epilogue box of the Command panel on the same PIX Firewall node, type the logging host command and specify the correct interface information.

This workaround prevents syslog traffic from being sent over the incorrect interface.
When Cisco Security Manager generates conduit commands allowing network access, it generates a duplicate set of conduit commands that deny the same network access. These deny commands are generated immediately following the permit commands. Although this doesn't harm the usability of the config (because conduits are processed in order), it does take up config memory. This problem occurs quite frequently, but it is harmless.
When you define a network service that has only one port (such as Telnet), the outbound command generated by Cisco Security Manager uses the port-port format (for Telnet, it generates 23-23). This command entry format is acceptable to the PIX Firewall. Therefore, you can safely ignore entries with two ports.
If you change the name of a PIX Firewall node in the GUI, a corresponding hostname command is not distributed to that PIX Firewall. Instead, you must use either the Epilogue or Prologue command set in the Command panel to manually specify the hostname for that PIX Firewall.
When you rename the PIX Firewall node, the network service activity reports use the old name until the Cisco Security Manager server that is monitoring that PIX Firewall is rebooted. To work around this problem, exit the GUI (saving your changes first) and then restart it.
AAA must be configured outside Cisco Security Manager. It is not supported in Version 1.0 or Version 1.1.

GUI: User Interface Caveats

After you import a *.cpm file, you must perform a Save operation and allow that operation to complete before you perform a Save and Update operation. This order of operations is necessary to generate the device-specific command sets correctly. The first operation stores the new data in the Policy Database, and the second operation generates the command sets.
In a distributed installation scenario, if you import a *.cpm file that alters the Policy Distribution Point, Cisco Security Manager may not be able to distribute the generated command sets. To prevent this problem, perform a Reset operation on the File menu. Next, remove all network objects in the General panel of the Network Topology node, and save your changes to the Policy Database before you import the *.cpm file.
If you change the IP address of the inside interface of a PIX Firewall, the administrative connection used by Cisco Security Manager is reset. Therefore, you must reestablish this connection by performing another Save and Update.
Currently, the GUI prevents you from defining a bundle that contains both the echo reply and echo request services based on the ICMP protocol. To work around this problem, you can define a security policy abstract that contains a condition to test for each service. For example, you can define a compound condition that states "If Service is ICMP Echo Reply or If Service is ICMP Echo Request, then Accept, Else Reject."
When the Service Wizard is used to define a new network service, the list controls under Session Settings do not "drop down" to allow selection of options even though a default value exists. Two workarounds exist for this problem: You can click on the box and use the UP ARROW and DOWN ARROW keys to scroll through the options, or you can modify the definition by editing the resulting network service definition under the Network Services branch of the Tools and Services tree. This appears to be a problem in the MFC library.
When you approve the PIX Firewall commands and they are being distributed to the PIX Firewall, a period of time exists before the newest command set appears in the Command panel. You must click Refresh to see these new commands; however, this button will not be available until the new command set has been published to the firewall. Otherwise, you are reviewing the commands that were already enforced by the PIX Firewall before you made changes and generated the new command set.
Each interface in a PIX Firewall must have an associated IP address regardless of whether it is enabled or not. This restriction is required for discovery to work properly.
Backing up the Policy Database can take a long time, depending on the size of the database. You should be patient during backups because feedback is not provided about the progress of the backup.
Currently, you cannot directly use the GUI to change the enable password for a PIX Firewall. However, two workarounds exist: Use the PIX Firewall Setup Wizard to change the password during initial configuration of the PIX Firewall, or use the Pending command box in the GUI.

To use the Pending command box to change the enable password, perform the following task:

Step 1 To generate a new set of pending commands, click Save and Update on the File menu.

Result: A new set of pending commands is generated for all PEPs residing on your network.

Step 2 To view the Network Topology tree alone, click Network Topology on the Navigator toolbar.

Result: The Network Topology tree appears in the Navigator pane.

Step 3 To find the PIX Firewall for which you want to specify the enable password, expand the Network Topology tree until you view that PIX Firewall node in the Navigator pane.

You can expand or collapse the tree structure in one of two ways:

Step 4 To access the shortcut menu, right-click the PIX Firewall icon for which you want to specify the enable password.

Step 5 To view the Command panel, point to Properties, and then click Command on the shortcut menu.

Result: The Command panel appears in the View pane.

Step 6 To specify that you want to edit the Pending command set, click Pending under Command Review/Edit.

Result: The Pending command set appears in the Command/Messages box.

Step 7 To change the enable password, use the following format to type that password as part of the Pending command set in the Command/Messages box:

enable password <new_password>

Step 8 To publish the new command set to the PIX Firewall and change the existing password to the password that you just specified, return to the Command panel on the PIX Firewall node, and then click Approve Now.

Result: The pending command set is published to the selected PIX Firewall. The next time that Cisco Security Manager accesses the PIX Firewall, it will use the enable password that you specified in the command above. Verify that you have specified this new password in the Enable password box in the Enforcement panel of the selected PIX Firewall node.

If a primary server is not configured within the Network Topology branch and you attempt to view reports using the View Reports command on the Tools menu, the embedded web browser will display the reports folder under the Cisco Security Manager root directory. This behavior is correct and expected.
The GUI and the web browser interface (HTML-based) for on-demand and scheduled reports provide different options for selecting the times for reviewing selected audit events. The GUI delineates time on the basis of hours, minutes, and seconds, while the web browser interface delineates time in days, hours, minutes, and seconds.
When accessing a generated report from the GUI, the web browser caches the first report that is viewed. If you regenerate the report, you will still see the first one until you click Refresh. You can ensure current reports are seen by changing the browser settings for Internet Explorer so that you reload each page for all requests.
To verify that your pages are reloaded on each page visit, perform the following task:

Step 1 To access the shortcut menu, right-click the Internet Explorer icon on your desktop.

Step 2 To view the Internet Explorer Properties dialog box, click Properties on the shortcut menu.

Step 3 To specify that the pages are reloaded each time, click Settings under Temporary Internet Files in the General panel.

Step 4 Under Check for newer versions of stored pages, click Every visit to the page.

Step 5 To save your changes and close the Settings dialog box, click OK.

Step 6 To apply your changes and close the Internet Explorer Properties box, click OK in the General panel.

If you use Netscape Navigator, you may also experience this problem. You can configure Netscape Navigator with similar settings to resolve this problem.

GUI: Help System Caveats

Under "What do I need to do?" in the Advanced options panel of the Setup program and when using the Installation Manager utility, no descriptive help is provided.

Related Documentation

The following documents directly support Cisco Security Manager:

In addition to these two documents, an extensive Help system is provided with the GUI, the user interface that configures Cisco Security Manager.

Platform Documents

The following documents provide information about configuring the PIX Firewall hardware and provide references to the command sets that can be specified in the Command panel associated with each PIX Firewall node defined under the Network Topology tree of the GUI.

All these documents, including these release notes, apply to all PIX Firewall hardware versions, including the PIX Firewall, PIX 10000, PIX 510, and PIX 520 models.

Cisco provides PIX Firewall technical tips at

Cisco Connection Online

Cisco Connection Online (CCO) is Cisco Systems' primary, real-time support channel. Maintenance customers and partners can self-register on CCO to obtain additional information and services.

Available 24 hours a day, 7 days a week, CCO provides a wealth of standard and value-added services to Cisco's customers and business partners. CCO services include product information, product documentation, software updates, release notes, technical tips, the Bug Navigator, configuration notes, brochures, descriptions of service offerings, and download access to public and authorized files.

CCO serves a wide variety of users through two interfaces that are updated and enhanced simultaneously: a character-based version and a multimedia version that resides on the World Wide Web (WWW). The character-based CCO supports Zmodem, Kermit, Xmodem, FTP, and Internet e-mail, and it is excellent for quick access to information over lower bandwidths. The WWW version of CCO provides richly formatted documents with photographs, figures, graphics, and video, as well as hyperlinks to related information.

You can access CCO in the following ways:

For a copy of CCO's Frequently Asked Questions (FAQ), contact cco-help@cisco.com. For additional information, contact cco-team@cisco.com.

Note If you are a network administrator and need personal technical assistance with a Cisco product that is under warranty or covered by a maintenance contract, contact Cisco's Technical Assistance Center (TAC) at 800 553-2447, 408 526-7209, or tac@cisco.com. To obtain general information about Cisco Systems, Cisco products, or upgrades, contact 800 553-6387, 408 526-7208, or cs-rep@cisco.com.

Documentation CD-ROM

Cisco documentation and additional literature are available in a CD-ROM package, which ships with your product. The Documentation CD-ROM, a member of the Cisco Connection Family, is updated monthly. Therefore, it might be more current than printed documentation. To order additional copies of the Documentation CD-ROM, contact your local sales representative or call customer service. The CD-ROM package is available as a single package or as an annual subscription. You can also access Cisco documentation on the World Wide Web at http://www.cisco.com, http://www-china.cisco.com, or http://www-europe.cisco.com.


hometocprevnextglossaryfeedbacksearchhelp
Posted: Tue Oct 5 15:33:47 PDT 1999
Copyright 1989-1999©Cisco Systems Inc.