16-5
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 16 Policy Table Lookup on Cisco Security Manager
Overview of Cisco Security Manager Policy Table Lookup
Restrictions for Policy Table Lookup
•
A Local Controller can be configured to retrieve the policy tables from only one
Cisco Security Manager server at a time.
•
The Policy Table Lookup icon in MARS is displayed only for traffic logs which are reported by the
following MARS device types:
–
Cisco Switch-IOS
–
Cisco PIX firewalls
–
Cisco Adaptive Security Appliance (Cisco ASA)
–
Cisco Firewall Services Module (Cisco FWSM)
•
MARS displays the Cisco Security Manager security policy committed views, not the deployed
views. The access rule causing the MARS event may not be visible in the policy table. To examine
the deployed policies view of a device, you must login to the device or Cisco Security Manager
directly.
•
MARS examines only Layer 3 ACLs for traffic events on the supported reporting devices. The policy
table lookup cannot directly indicate the cause of a traffic event caused by a deny not related to the
displayed access rules, though the policy table can be displayed for the event (For instance, a no
route deny, or a Network Address Translation [NAT] deny due to a NAT misconfiguration).
•
The Security Manager Policy Table Lookup icon displays only for those events with 5-tuple event
data (source and destination address, protocol, source and destination port). In the MARS web
interface, the all matching events query diplays the text “session five tuple” for events with no
5-tuple event data. These events will not have a policy query icon.
•
The Security Manager Policy Table Lookup icon displays for NetFlow events even though they are
not triggered by an ACL. This extra event data allows you to determine whether there is a policy
permitting that traffic, which ensures you are able to tune accordingly.
Note
Because this is NetFlow data, it may not match the exact ACL or match multiple ACLs.
•
The same events received by MARS can display the Security Manager Policy Table Lookup icon
inconsistently between the low-latency, real-time event query and standard queries, such as sessions
ranked by time. Specifically, the icon will not appear in the low-latency, real-time query, but it may
appear in queries against sessionized events.
This behavior is expected. When MARS receives events, they are parsed, sessionized, written to an
event shared buffer, and then written to the database. Because sessionization takes time, sometimes
keeping an event in cache for 2 minutes, the low-latency event query displays events right after
parsing, but before sessionization. Displaying the event at this point allows the low-latency query
to achieve a close to real-time effect. For some events, parsing cannot determine some part of the
5-tuple data, such as a destination address. Later, sessionization later fills in such missing data using
configuration data. As a result, the 5-tuple data displayed by the low-latency event query can be
different from values stored in the database, which are used to populate the standard queries.
•
An error can occur with the policy query if a device configuration is discovered using Security
Manager but it is not submited in Security Manager. The following error message is an example of
this issue:
<190>2312080: *May 9 23:50:02.199: %SEC-6-IPACCESSLOGDP: list permit-all permitted
icmp 10.2.3.8 -> 10.4.21.2 (0/0), 1 packet
