16-9
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 16 Policy Table Lookup on Cisco Security Manager
Checklist for Security Manager-to-MARS Integration
3.
Bootstrap the reporting devices and mitigation devices managed by Security Manager.
For each device identified in Task
1.
, you must prepare, or bootstrap, that device to ensure that the desired
communications with MARS occur. Bootstrapping a device involves configuring the settings for that device,
based on its role in the STM system. Perform the following subtasks as applicable to a device type and its role:
•
Enable management of the device by the MARS Appliance for mitigation and access.
•
Turn on the correct logging level and logging services.
•
Direct the logs to the MARS Appliance.
•
Enable discovery of the device settings.
Note
While many Cisco devices support the EMBLEM syslog format, this format is
not compatible
with MARS.
As part of this task, you must verify that the devices are not reporting to the MARS Appliance using the
EMBLEM format.
You must configure the router and switch settings using the CLI, as Security Manager does not support those
features. However, for ASA, FSWM, and PIX, you can use the Security Manager user interface to configure the
management and log settings.
Tip
Any events published by a device to MARS prior to adding and activating the device in the web interface can
be queried using the reporting IP address of the device as a match criterion. This technique can be useful for
verifying that the device is properly bootstrapped.
You may also need to enable alternate settings on the to provide richer data. For more information on these possible
settings, see Task 5 in the
Checklist for Provisioning Phase, page 1-2
found in the
STM Task Flow Overview
chapter.
Result
: The correct logging levels are enabled on the reporting devices and mitigation devices. The MARS
Appliance can receive or pull any necessary logs from those devices, and it can retrieve configuration settings
and push ACLS to the supported mitigation devices. While the MARS Appliance picks up and stores the events
it receives, it does not inspect them until the reporting devices and mitigation devices are defined and activated
in web interface.
For more information, see:
•
Device Inventory Worksheet, page 1-18
•
Bootstrap Summary Table, page 2-12
•
Cisco Router Devices, page 3-1
•
Cisco Switch Devices, page 3-9
User Guide for Cisco Security Manager 3.0
•
Understanding Device Credentials
See SNMP credentials.
•
Managing Firewall Devices
(ASA, PIX, and FWSM)
See device access, SNMP settings, logging policies, and static routes as needed.
Note
When defining SNMP settings for the FWSM and ASA, you should define these setting for the admin context.
•
Field definitions for the
Logging Policies
(ASA, PIX, and FWSM)
•
Managing Routers
(Cisco IOS Routers)
See device access, SNMP, 802.1x, NAC, and static routes as needed.
•
Using the Catalyst 6500/7600 Device Manager
(Cisco Switches)
See
Spanning Tree Settings
(STP).
Task
