Task Flow Overview:
How to Complete
the Initial Configuration

Introduction

This chapter outlines the tasks that you must perform when you first configure your Cisco Security Manager system. For this task flow, we assume that you are installing a single standalone Cisco Security Manager server and managing one PIX Firewall, which is acting as your Policy Enforcement Point (PEP). We will use a sample network diagram to illustrate the task flow.

Figure 2-1 depicts a small corporation's network topology. An Internet service provider (ISP) has a backbone network 192.168.1.0 with a network mask of 255.255.255.0. The registered external IP address of the access router is 172.31.7.130, while the default gateway on the internal side of the router is 192.168.1.254. All outbound traffic destined for the Internet is routed to the default gateway.

Figure 2-1:
Example Network Topology

For the remainder of this tutorial, we are going to focus on the small corporate network. For this corporation, the PIX Firewall protects a perimeter/administrative network 10.1.1.0 with a network mask of 255.255.255.0. On the 10.1.1.0 network, the 10.1.1.10 server is dedicated for Cisco Security Manager. This PIX Firewall also protects an inside network 10.1.2.0 with a network mask of 255.255.255.0. This network provides connectivity for two key hosts and for the main network users. In this discussion, the 10.1.2.35 host represents the corporate web server and the 10.1.2.36 host represents the corporate e-mail server.

The PIX Firewall itself has an external IP address pool. 192.168.1.51 is the address of the outside interface, for which 192.168.1.52 through 192.168.1.59 are additional IP addresses that can be used for other purposes. In PIX Firewall terminology, we would refer to these additional IP addresses as belonging to a global network address translation (NAT) pool.

Assumptions and Desired Policy

This example assumes that you have installed a standalone Cisco Security Manager server on the 10.1.1.10 host (hostname Admin-NT) and that you are logged on to Cisco Policy Manager for the first time. It also assumes that the PIX Firewall that you want to protect uses 192.168.1.51 as the IP address assigned to its outside interface and that this firewall has the enable password of corp1.

In addition, we want to implement a security policy that accomplishes the following objectives:

Allows only SMTP services to connect to the corporate e-mail server
Allows only HTTP sessions to connect to the corporate web server
Allows all corporate users to use SMTP, DNS, FTP, Telnet, and HTTP network services
Allows only the Cisco Security Manager server to use ICMP services to test network connectivity and to connect to and publish device-specific commands sets to the PIX Firewall
Hides the internal networks using valid external IP addresses
Exposes the corporate e-mail and web servers to external users using two of the valid external IP addresses
Monitors only allowed network services for suspicious activities