F-SECURE POLICY MANAGER 9.0, Руководство администратора

Страница: 49 / 102

Managing policies
This section describes how to configure and distribute policies.
Settings
To configure settings, browse the policy tree and change the values of the policy variables.
There are two types of policy variables:
• leaf nodes under a subtree,
• table cells.
All policy variables have an associated type. You can set their values in the main application area. A policy
variable can be one of the following types:
• Integer: normal integer number.
• Display String: 7-bit ASCII text string.
• IP Address: four-octet IP address.
• Counter: incrementing integer.
• Gauge: non-wrapping integer.
• TimeTicks: elapsed time units (measured in 1/100s of a second).
• Octet String: binary data (this type is also used in UNICODE text strings).
• OID: object identifier.
• Opaque: binary data that can represent additional data types.
A policy variable may have a pre-defined default value. The default values behave as if they were inherited
from above the root domain. That is, they appear to be inherited values even if the top (root) domain is
selected. Default values can be overridden just like any other value.
Values on the selected policy domain level are color-coded as follows:
• Black – changed values on the selected policy domain or host level.
• Gray – inherited values.
• Red – invalid values.
• Dimmed red – inherited invalid values.
Restrictions
Using value restrictions, an administrator can restrict the values of any policy variable to a list of acceptable
values from which the user can choose.
There are two types of restriction: access restrictions and value restrictions. Access restrictions are Final
and Hidden . Final always forces the policy: the policy variable overrides any local host value, and the end
user cannot change the value as long as the Final restriction is set. Hidden merely hides the value from the
end user. Unlike the Final restriction, the Hidden restriction may be ignored by the managed application.
Additionally, the administrator can restrict integer-type variables ( Integer , Counter , and Gauge ) to a range
of acceptable values. An additional restriction, the FIXED_SIZE restriction, can be applied to tables. With this
restriction, the end user cannot add or delete rows from fixed-size tables. Because the Final restriction cannot
be used for empty tables, the FIXED_SIZE restriction should be used for this purpose (preventing end users
from changing a table's values).
If a variable in the product Management Information Base (MIB) already contains a range or choice definition,
the administrator can further restrict the range or choices, but not extend them. If the product MIB does not
define value restrictions, the administrator can specify any range or choice restriction.
F-Secure Policy Manager | Using Policy Manager Console | 49