Cisco Secure PIX Firewall Supports Management Module SM-CIS1011

Transcription

1 Cisco Secure PIX Firewall Titlepae Supports Management Module SM-CIS1011 Device Management

2 Copyright Notice Document Copyright October 2001 Aprisma Management Technologies, Inc., 121 Technology Drive, Durham, NH USA. All rights reserved worldwide. Use, duplication, or disclosure by the United States government is subject to the restrictions set forth in DFARS (c)(1)(ii) and FAR Liability Disclaimer Aprisma Management Technologies, Inc. ( Aprisma ) reserves the right to make changes in specifications and other information contained in this document without prior notice. In all cases, the reader should contact Aprisma to inquire if any changes have been made. The hardware, firmware, or software described in this manual is subject to change without notice. IN NO EVENT SHALL APRISMA, ITS EMPLOYEES, OFFICERS, DIRECTORS, AGENTS, OR AFFILIATES BE LIABLE FOR ANY INCIDENTAL, INDIRECT, SPECIAL, OR CONSEQUENTIAL DAMAGES WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOST PROFITS) ARISING OUT OF OR RELATED TO THIS MANUAL OR THE INFORMATION CONTAINED IN IT, EVEN IF APRISMA HAS BEEN ADVISED OF, HAS KNOWN, OR SHOULD HAVE KNOWN, THE POSSIBILITY OF SUCH DAMAGES. Trademark, Service Mark, and Logo Information SPECTRUM, IMT, and the SPECTRUM IMT/VNM logo are registered trademarks of Aprisma Management Technologies, Inc., or its affiliates. APRISMA, APRISMA MANAGEMENT TECHNOLOGIES, the APRISMA MANAGEMENT TECHNOLOGIES logo, MANAGE WHAT MATTERS, DCM, VNM, SpectroGRAPH, SpectroSERVER, Inductive Modeling Technology, Device Communications Manager, SPECTRUM Security Manager, and Virtual Network Machine are unregistered trademarks of Aprisma Management Technologies, Inc., or its affiliates. For a complete list of Aprisma trademarks, service marks, and trade names, go to All referenced trademarks, service marks, and trade names identified in this document, whether registered or unregistered, are the intellectual property of their respective owners. No rights are granted by Aprisma Management Technologies, Inc., to use such marks, whether by implication, estoppel, or otherwise. If you have comments or concerns about trademark or copyright references, please send an to spectrum-docs@aprisma.com; we will do our best to help. Restricted Rights Notice (Applicable to licenses to the United States government only.) This software and/or user documentation is/are provided with RESTRICTED AND LIMITED RIGHTS. Use, duplication, or disclosure by the government is subject to restrictions as set forth in FAR (June 1987) Alternate III (g)(3) (June 1987), FAR (June 1987), or DFARS (c)(1)(ii) (June 1988), and/or in similar or successor clauses in the FAR or DFARS, or in the DOD or NASA FAR Supplement, as applicable. Contractor/manufacturer is Aprisma Management Technologies, Inc., 121 Technology Drive, Durham, NH In the event the government seeks to obtain the software pursuant to standard commercial practice, this software agreement, instead of the noted regulatory clauses, shall control the terms of the government's license. Virus Disclaimer Aprisma makes no representations or warranties to the effect that the licensed software is virus-free. Aprisma has tested its software with current virus-checking technologies. However, because no anti-virus system is 100 percent effective, we strongly recommend that you write-protect the licensed software and verify (with an anti-virus system in which you have confidence) that the licensed software, prior to installation, is virus-free. Contact Information Aprisma Management Technologies, Inc. 121 Technology Drive Durham, NH Phone: U.S. toll-free: Web site: Device Management Page 2 Cisco Secure PIX Firewall

3 Contents INTRODUCTION 4 Purpose and Scope...4 Required Reading...4 Supported Devices...5 The SPECTRUM Model...5 TASKS 7 DEVICE VIEW 8 Interface Icons...9 Interface Icon Subviews Menu...10 Interface Status View...10 Secondary Address Panel...11 DEVICE TOPOLOGY VIEW 12 Interface Icons...13 Interface Icon Subviews Menu...14 Interface Status View...14 Secondary Address Panel...15 CISCOVIEW 16 Common Applications Device-Specific Applications Cisco Syslog Application Syslog Message Filter View...20 Cisco SysLog Basic Configuration View...21 Cisco SysLog History Table View...22 PERFORMANCE VIEWS 24 Device Performance View...25 Port Performance View CONFIGURATION VIEWS 26 Device Configuration View Interface Configuration View SYSLOG TRAP SUPPORT 28 MODEL INFORMATION VIEW 31 INDEX 32 APPLICATION VIEWS 18 Main Application View...18 Supported Applications...19 Device Management Page 3 Cisco Secure PIX Firewall

4 Introduction This section introduces the SPECTRUM Device Management documentation for the Cisco Secure PIX Firewall devices. This introduction contains the following topics: Purpose and Scope Required Reading Supported Devices (Page 5) The SPECTRUM Model (Page 5) Purpose and Scope Use this document as a guide for managing the Cisco Secure PIX Firewall devices described on Page 5 with SPECTRUM management module SM-CIS1011. This document describes the icons, menus, and views that enable you to remotely monitor, configure, and troubleshoot Cisco PIX devices through software models in your SPECTRUM database. Information specific to SM-CIS1011 is what is primarily included in this document. For general information about device management using SPECTRUM and explanations of SPECTRUM functionality and navigation techniques, refer to the topics listed under Required Reading. Required Reading To use this documentation effectively, you must be familiar with the information covered by the other SPECTRUM online documents listed below. Getting Started with SPECTRUM for Operators Getting Started with SPECTRUM for Administrators How to Manage Your Network with SPECTRUM SPECTRUM Views SPECTRUM Menus SPECTRUM Icons SPECTRUM Software Release Notice Device Management Page 4 Cisco Secure PIX Firewall

5 Introduction Supported Devices SPECTRUM management module SM-CIS1011 currently lets you model the Cisco Secure Pix Firewall which allows you to manage traps. Cisco Secure PIX Firewall 5.2 provides secure networking and NAT (Network Address Translation). The SPECTRUM Model Supported Devices The model type for the Cisco Secure PIX Firewall devices is CisPIXDev. Modeling results in the creation of Device icons that represent the devices and Application icons that represent their supported applications. The Device icons contain double-click zones and provide access to Icon Subviews menus that let you perform device management activities such as those listed in Tasks on Page 7. As Figure 1 shows, the appearance of the Device icons varies slightly depending on the kind of view it appears in. Figure 1: Device Icons Model Name Small Device icon appears in Topology and Application views PIX FireWall Large Device icon appears in Device Topology, Location, and Device Interface views. Model Name PIX Firewall Device Management Page 5 Cisco Secure PIX Firewall

6 Introduction The device-specific Icon Subviews menu options available from the Device icon are listed below. Option Fault Management Accesses the... Fault Management View, which is described in the How to Manage Your Network with SPECTRUM documentation. Device View Device View (Page 8) Device Topology Device Topology View (Page 12) Application Application Views (Page 18) Configuration Performance Views (Page 24) Model Information Model Information View (Page 31) The SPECTRUM Model The rest of this document covering the Cisco Secure PIX Firewall management module is organized as follows. Tasks (Page 7) Device View (Page 8) Device Topology View (Page 12) Application Views (Page 18) Performance Views (Page 24) Model Information View (Page 31) Device Management Page 6 Cisco Secure PIX Firewall

7 Tasks This section contains an alphabetical list of device management tasks, with each task providing one or more links to views that let you perform the task. Administrative Information (check) Model Information View (Page 31) Alarm Thresholds (set) Interface Icon Subviews Menu (Page 14) Configuration Information (check) Performance Views (Page 24) IP Address (find/change) Device View (Page 8) Secondary Address Panel (Page 15) Performance (check) Device View (Page 8) Interface Icons (Page 13) Topology (check) Device View (Page 8) Device Management Page 7 Cisco Secure PIX Firewall

8 Device View This section describes the Device view and subviews available for models of Cisco Secure PIx Firewall devices in SPECTRUM. Access: From the Icon Subviews menu for the Device icon, select Device. This view (Figure 2) uses icons and labels to represent the device and its components, such as modules, ports, and applications. The view provides dynamic configuration and performance information for each of the device s serial and network I/O ports, which are represented by Interface icons in the bottom panel of the view. The middle panel of the view displays a Device icon, which lets you monitor the device operation and access other device-specific views. Figure 2: Device View SpectroGRAPH: Router Device: Model Name File View Tools Bookmarks Help Model Name Contact Description Location Model Name PIX_Firewall 1 ON Ethernet ei0 0:0:1D:F:FD:B6 2 ON ATM CPU Network Address Primary Application Gen Bridge App Filter Physical Interface Description Device Icon 3 ON 4 ATM 7B2 Sys Up Time Manufacturer Device Type Serial Number Interface Options Panel ATM 8B3 ON 5 ON SFTWARLPBK lo0 0:0:1D:F:FD:B6 6 ON ATM port CPU.1 7 ON ATM 7B3 8 ON ATM 8B4 9 ON ATM8023 zn1 0:0:1D:F:FD:B6 512 ON AAL5 UAAL5 10 ON ATM 7A1 ON ATM 7B ON ATM 8B1 ON ATM 8B2 Interface Icons Model Name of type CiscoPIXFirewall of Landscape node: Primary Device Management Page 8 Cisco Secure PIX Firewall

9 Device View Interface Icons Figure 3 shows a close-up of an Interface icon from the Device view. Most of the informational labels on the icon also provide double-click access to other views, as explained in the following label descriptions. Figure 3: a Interface Icon b Interface Icons Interface Number Label This label displays the interface (port) number. IF Status Label This label displays the current status of the interface for the primary application selected, e.g., Gen Rtr App or MIB-II App. Table 1 lists the possible label color representations. Note that the color of the label also depends on the interface s current Administrative Status, which you set in the Interface Status View (Page 10). This view can be accessed by double-clicking the label. a b c d e f 1 ON Table 1: Interface Status Label Colors ethernet c fxp0 d Operational Administrative Label Color Status Status Text 0:0:1D:F:FD:B6 e f Green up up ON Interface Number Label IF Status Label Interface Type Label Network Type Label Physical Address Label IP Address Label Blue down down OFF Yellow down up OFF Red testing testing TEST Interface Type Label This label identifies the interface type (Ethernet, ATM, etc.). Double-click this label to access the Interface Configuration View (Page 27). Device Management Page 9 Cisco Secure PIX Firewall

10 Device View Network Type Label This label identifies the type of network to which the interface is connected. Double-click the label to open the Model Information view for the interface. Physical Address Label This label displays the physical (MAC) address of the interface. Double-click this label to open the IF Address Translation Table. IP Address Label This label displays the IP address for the interface. Double-click this label to open the Secondary Address Panel (Page 11), which lets you change the address and mask for the interface. Interface Icon Subviews Menu Table 2 lists the device-specific interface Icon Subviews menu options and the views to which they provide access. Detail Table 2: Option Interface Icon Subviews Menu Interface Icon Subviews Menu Accesses the... Interface Detail view, which displays packet, error, and discard breakdown statistics for the interface. IF Status Interface Status View (Page 10). IF Configuration Interface Configuration View (Page 27). IF Address Translation Table Secondary Address Panel Thresholds Model Information Interface Address Translation Table, which identifies the physical and network address for the interface. Secondary Address Panel (Page 11). Interface Threshold view, which lets you set the on/off alarm thresholds for load, packet rate, error rate, and % discarded for the interface. Model Information View (Page 31). Interface Status View Access: From the Icon Subviews menu for the Interface icon in the Device view, select IF Status. This view provides information on the operational status of the interface and allows you to enable or disable the port. Device Management Page 10 Cisco Secure PIX Firewall

11 Device View Secondary Address Panel Operational Status The current state of the interface (Up, Down, Unknown, Dormant, Not Present, Lower Layer Down, or Testing). Administrative Status This button allows you to select the desired administrative state of the interface (On, Off, or Testing). Secondary Address Panel Access: From the Icon Subviews menu for the Interface icon in the Device view, select Secondary Address Panel. This panel provides a table of IP addresses and masks obtained from the Address Translation table within the device s firmware. You can change the current address displayed in the IP Address field by selecting an entry from the table in this panel and clicking the Update button. Device Management Page 11 Cisco Secure PIX Firewall

12 Device Topology View This section describes the Device Topology view available for models of the Cisco Secure PIX Firewall devices. Access: From the Icon Subviews menu for the Device icon, select Device Topology. The Device Topology view (Figure 4) shows the connections between a modeled device and other network entities. The lower panel of the view uses Interface icons to represent the device s serial, network, and I/O ports. These icons provide the same information and menu options as those in the Device View (Page 8). If a device is connected to a particular interface, a Device icon appears on the vertical bar above the Interface icon along with an icon representing the network group that contains the device. Refer to the SPECTRUM Views documentation for details on Device Topology view. Figure 4: Device Topology View SpectroGRAPH: Device Topology: Model Name File View Tools Bookmarks Help Graphic of Cisco Device Model Name Pix Firewall 1 ON 2 ON 3 ON Ethernet ei0 0:0:1D:F:FD:B6 ATM A2 0:0:1D:F:FD:B6 ATM CPU 0:0:1D:F:FD:B6 Model Name of type Model Type of Landscape node: Primary Device Management Page 12 Cisco Secure PIX Firewall

13 Device Topology View Interface Icons Figure 5 shows a close-up of an Interface icon from the Device view. Most of the informational labels on the icon also provide double-click access to other views, as explained in the following label descriptions. Figure 5: a Interface Icon b Interface Icons Interface Number Label This label displays the interface (port) number. IF Status Label This label displays the current status of the interface for the primary application selected, e.g., Gen Rtr App or MIB-II App. Table 3 lists the possible label color representations. Note that the color of the label also depends on the interface s current Administrative Status, which you set in the Interface Status View (Page 14). This view can be accessed by double-clicking the label. a b c d e f 1 ON Table 3: Interface Status Label Colors ethernet c fxp0 d Operational Administrative Label Color Status Status Text 0:0:1D:F:FD:B6 e f Green up up ON Interface Number Label IF Status Label Interface Type Label Network Type Label Physical Address Label IP Address Label Blue down down OFF Yellow down up OFF Red testing testing TEST Interface Type Label This label identifies the interface type (Ethernet, ATM, etc.). Double-click this label to access the Interface Configuration View (Page 27). Device Management Page 13 Cisco Secure PIX Firewall

14 Device Topology View Network Type Label This label identifies the type of network to which the interface is connected. Double-click the label to open the Model Information view for the interface. Physical Address Label This label displays the physical (MAC) address of the interface. Double-click this label to open the IF Address Translation Table. IP Address Label This label displays the IP address for the interface. Double-click this label to open the Secondary Address Panel (Page 15), which lets you change the address and mask for the interface. Interface Icon Subviews Menu Table 4 lists the device-specific interface Icon Subviews menu options and the views to which they provide access. Detail Table 4: Option Interface Icon Subviews Menu Interface Icon Subviews Menu Accesses the... Interface Detail view, which displays packet, error, and discard breakdown statistics for the interface. IF Status Interface Status View (Page 14). IF Configuration Interface Configuration View (Page 27). IF Address Translation Table Secondary Address Panel Thresholds Model Information Interface Address Translation Table, which identifies the physical and network address for the interface. Secondary Address Panel (Page 15). Interface Threshold view, which lets you set the on/off alarm thresholds for load, packet rate, error rate, and % discarded for the interface. Model Information View (Page 31). Interface Status View Access: From the Icon Subviews menu for the Interface icon in the Device Topology view, select IF Status. This view provides information on the operational status of the interface and allows you to enable or disable the port. Device Management Page 14 Cisco Secure PIX Firewall

15 Device Topology View Secondary Address Panel Operational Status The current state of the interface (Up, Down, Unknown, Dormant, Not Present, Lower Layer Down, or Testing). Administrative Status This button allows you to select the desired administrative state of the interface (On, Off, or Testing). Secondary Address Panel Access: From the Icon Subviews menu for the Interface icon in the Device Topology view, select Secondary Address Panel. This panel provides a table of IP addresses and masks obtained from the Address Translation table within the device s firmware. You can change the current address displayed in the IP Address field by selecting an entry from the table in this panel and clicking the Update button. Device Management Page 15 Cisco Secure PIX Firewall

16 CiscoView This section describes how to access Cisco s CiscoView management software from SPECTRUM. CiscoView is management software specific to Cisco Routers. The Cisco Secure PIX Firewall model type provides a menu option from the Device icon that is used to launch CiscoView. In order for this menu option to function you must update your.profile file to map this menu selection to where CiscoView is located on your system. For HP-UX and Solaris Add the following information to the /opt/spectrum/spectrum60.env file: 1 #CiscoView export CVIEW =<path_to_ciscoview> For Windows NT and Window From the Start>Run window, type regedit (registry editor) 2 Navigate to HKEY_LOCAL_MACHINE>SOFTWARE> Aprisma Management Technologies> Spectrum60> Environment 3 Choose Edit>New>String Value 4 Type CVIEW for the name, and <path_to_ciscoview> as the string value. Device Management Page 16 Cisco Secure PIX Firewall

17 CiscoView Secondary Address Panel Note: CiscoView 3.0 will appear as Cisco View on your device menu after the above steps have been followed. This should not be confused with CiscoView, which denotes the CiscoWorks 2000 CiscoView. The CiscoWorks 2000 menu picks will only appear in the device menu if the SPECTRUM Adapter script has been run. See the CiscoWorks 2000 documentation for further information. Device Management Page 17 Cisco Secure PIX Firewall

18 Application Views This section describes the main Application view and the associated application-specific subviews available for models of Cisco Secure PIX Firewall devices in SPECTRUM. Access: From the Icon Subviews menu for the Device icon, select Application. Main Application View When a device model is created, SPECTRUM automatically creates models for each of the major and minor applications supported by the device. The main Application view identifies all of these application models, shows their current condition status, and provides access to application-specific subviews. Figure 6 shows this view in the Icon mode. If you prefer the List mode, which displays applications as text labels, select View > Mode > List. For more information on this view, refer to the MIBs and the Application View documentation. Figure 6: Main Application View SpectroGRAPH: Application: Model Name File View Tools Bookmarks Help Model Name Contact Description Location Network Address System Up Time Manufacturer Device Type Serial Number Model Name Model 6E132_25 Type Model Name of type <model type> of Landscape node: Primary Device Management Page 18 Cisco Secure PIX Firewall

19 Application Views Supported Applications SPECTRUM s applications can be grouped within two general categories as follows: Common Applications, below Device-Specific Applications (Page 20) Common Applications For the most part, these applications represent the non proprietary MIBs supported by your device. Listed below (beneath the title of the document that describes them) are some of the common applications currently supported by SPECTRUM. Note: The documents listed are available for viewing at: Bridging Applications - Spanning Tree - Static - Transparent - PPP Bridging - Source Routing - Translation Routing Applications - Generic Routing - Repeater - AppleTalk - DECnet - Open Shortest Path First MIB II Applications - SNMP - IP - ICMP - TCP - System2 - UDP Transmission Applications - FDDI - Point to Point - DS1 - DS3 - RS WAN - Frame Relay - Token Ring - Ethernet - Fast Ethernet - rfc1317app - rfc1285app - rfc1315app Supported Applications Device Management Page 19 Cisco Secure PIX Firewall

20 Application Views App - SONET Technology Applications - APPN - ATM Client - DHCP - PNNI - rfc1316app - DLSw Device-Specific Applications SPECTRUM imports the following device-level proprietary MIBs into its database: CISCO-FIREWALL-MIB-V1SMI.my CISCO-MEMORY-POOL-MIB.my CISCO-SYSLOG-MIB-V1SMI.my RFC1213-MIB.my These MIBs can be used in conjunction with SPECTRUM s optional customization products (referred to as the Level I Tool Kits) to create application models and views that display the condition of selected MIB objects. Note: Cisco Syslog Application Aprisma Management Technologies can provide training, technical assistance, and custom engineering support services for creating application models and their associated views. Cisco Syslog Application See Syslog Trap Support (Page 28) for more information about this application. The Cisco Syslog Application provides access to the following views: Syslog Message Filter View Cisco SysLog Basic Configuration View (Page 21) Cisco SysLog History Table View (Page 22) Syslog Message Filter View Access: From the Icon Subviews menu of the CiscSysLogApp icon, select Syslog Message Filters. The Syslog Message Filter view allows you to filter out unwanted syslog messages from the following categories. Filters can be set to true or false. Device Management Page 20 Cisco Secure PIX Firewall

21 Application Views System_Filter Set to true to filter out all Syslog messages whose Facilities deal with the System, e.g. CBUS, MEMSCAN, etc. Protocol_Filter Set to true to filter out all Syslog messages whose facilities deal with Protocols such as BGP, OSPF, SNMP, SPANTREE, etc. Software_Filter Set to true to filter out all Syslog messages that deal with internal software such as PARSER, RSP, GRPGE, etc. Hardware_Configuration_Filter Set to true to filter out all Syslog messages that deal with Hardware Configuration of the device such as IOCARD, MODEM, DIALSHELF, etc. Security_Filter Set to true to filter out all Syslog messages tht deal with the Security of the system such as RADIUS, SECURITY, etc. Environment_Filter Set to true to filter out all Syslog messages that deal with Environment variables such as LCFE, LCGE, etc. Cisco Syslog Application Connection_Configuration_Filter Set to true to filter out all Syslog messages that deal with Connection Configuration of the device such as MROUTE, ISDN, X25, etc. Cisco_Pix_Filter Set to true to filter out all Syslog Messages that deal with the Cisco PIX Firewall device. Cisco SysLog Basic Configuration View Access: From the Icon Subviews of the CiscSysLogApp Application icon, select Basic. This view displays the following information. Notifications Sent The number of syslog Message Generated notifications that have been sent. This number may include notifications that were prevented from being transmitted due to reasons such as resource limitations and/or non-connectivity. If one is receiving notifications, one can periodically poll this object to determine if any notifications were missed. If so, a poll of the History Table may be appropriate. Notifications Enabled Indicates whether notifications will or will not be sent when a syslog message is generated by the Device Management Page 21 Cisco Secure PIX Firewall

22 Application Views device. Disabling notifications does not prevent syslog messages from being added to the History Table. Messages Ignored Indicates the number syslog messages which were ignored. A message will be ignored if it has a severity value greater then Max Severity. Messages Dropped The number of messages which could not be processed due to a lack of system resources. A message that is dropped will not appear in the History Table. Max Severity Level Indicates which syslog severity levels will be processed. Any syslog message with a severity value greater than this value will be ignored by the agent. Severity numeric values increase as their severity decreases, e.g. error (4) is more severe than debug (8). Severity values are (1) emergency, (2) alert, (3) critical, (4) error, (5) warning, (6) notice, (7) info, and (8) debug. Cisco Syslog Application Cisco SysLog History Table View Access: From the Icon Subviews of the CiscSysLogApp Application icon, select History. This view displays the History Table which displays the syslog messages generated by the device. Max Table Length The limit on the number of entries that the History Table may contain. A value of 0 will prevent any history from being retained. When this table is full, the oldest entry will be deleted and a new one will be created. Messages Flushed The number of entries that have been removed from the History Table in order to make room for new entries. This object can be used to determine whether your polling frequency is fast enough. Index An increasing integer that indexes messages. When it reaches the maximum value, the agent flushes the table and returns this value to 1. Facility The name of the facility that generated this message. Severity The severity of the message. Device Management Page 22 Cisco Secure PIX Firewall

23 Application Views Cisco Syslog Application Message Name A textual name for the message type. A facility name in conjunction with a message name uniquely identifies a message type. Message Text The text of the message. If the text of the message exceeds 255 bytes, the message will be truncated to 254 bytes and a * character will be appended to indicate this. Time Stamp The value of sysuptime when this message was generated. Device Management Page 23 Cisco Secure PIX Firewall

24 Performance Views This section provides brief descriptions of the Performance views available for the Cisco Secure PIX Firewall devices in SPECTRUM. Performance views display performance statistics in terms of a set of transmission attributes, e.g., cell rates, frame rates, % error, etc. A typical view is shown in Figure 7. The instantaneous condition of each transmission attribute is recorded in a graph. The statistical information for each attribute is presented in the adjacent table. Figure 7: Performance View SpectroGRAPH: IP Addreess File View Tools Bookmarks Model Name Contact Description Location Network Address Primary Application System Up Time Manufacturer Device Type Serial Number Generally, you determine performance at the device level through Performance views accessed from the Device and Application icons. You determine performance at the port/interface level through Performance views accessed from Interface icons. 0:40:0 0:30:0 0:20:0 Value Average Peak Value Log * Frame Rate % Delivered % Forwarded % Transmit % Error % Discarded 0 *Frames per second Graph Properties Scroll to Date-Time Detail For more information on Performance views, refer to the SPECTRUM Views documentation. type routing of type IP Routing of Landscape node: Primary The following paragraphs list the performance attributes displayed for each Performance view supported by this management module. Device Management Page 24 Cisco Secure PIX Firewall

25 Performance Views Device Performance View Device Performance View Access: From the Icon Subviews menu for the Device icon, select Performance. Current and historical frame transmission information is provided via the following attributes. Frame Rate % Received % Transmit % Error % Discarded Port Performance View Access: From the Icon Subviews menu for the Device Interface icon, select Performance. Current and historical packet transmission information is provided via the following attributes. Load Packet Rate % Error % Discarded Device Management Page 25 Cisco Secure PIX Firewall

26 Configuration Views This section describes the various Configuration views available for models of the Cisco Secure PIX Firewall devices in SPECTRUM. Configuration views let you view and modify current settings for the modeled device and its interfaces, ports, and applications. The following Configuration views are available for models of Cisco PIX devices: Device Configuration View (Page 26) Interface Configuration View (Page 27) Figure 8: File View Tools Bookmarks Model Name Contact Description Location Device Configuration View SpectroGRAPH: Model Name Device Configuration View Network Address Primary Application System Up Time Manufacturer Device Type Serial Number Help Device Configuration View Sort Find Update Interface Configuration Table Print Access: From the Icon Subviews menu for the Device icon, select Configuration. This view (Figure 8) provides status and configuration information about the device as a whole as well as on a port-by-port basis. Fields and column headings within the Device Configuration view and its subviews are explained in detail in the SPECTRUM Views documentation. Index Type Physical Address Max Frame Size Operational Status Model Name of type PIX Firewall of Landscape node: Primary Device Management Page 26 Cisco Secure PIX Firewall

27 Configuration Views Interface Configuration View Access: From the Icon Subviews menu for an Interface icon in the Device Topology view, select IF Configuration. This view provides the following information for the selected interface: Operation Status The current operational state of the interface (Up, Down, Unknown, Dormant, Not Present, or Lower Layer Down). Interface Configuration View do not vary in bandwidth, or no accurate estimate can be made, a nominal bandwidth is provided. Packet Size The largest packet that can be transmitted or received by the port, displayed in octets. Queue Length The length of the outbound packet queue, in packets. Admin. Status The desired operational state of the interface (up, down, or testing). Last Change The System UpTime value when the interface entered its current operational state. IP Address/Network Mask This window provides a list of the user-defined names and IP addresses for the interface. Physical Address The Ethernet (MAC) address of the interface. Bandwidth The estimated bandwidth of the interface, measured in bits per second. For interfaces that Device Management Page 27 Cisco Secure PIX Firewall

28 Syslog Trap Support This section describes the Syslog Trap Support available for the Cisco PIX Secure Firewall. The System Message Log (syslog) protocol is used to send text messages from a Cisco PIX Secure Firewall to the Network Management Software. These messages are sent to the SPECTRUM Event Manager as SNMP traps. Syslog trap support allows the router device to identify these messages and escalate them to alarms as necessary. Syslog trap support also provides the Cisco PIX Secure Firewall model icon the capability to communicate model alarm severity information. When an alarm occurs, as indicated by the Cisco PIX Secure Firewall device icon, you will be able to observe the SPECTRUM Alarm Severity and a Syslog message will appear in the Alarm log (which can be found in the Alarm Manager View). These Syslog messages are classified by severities that range from 0 to 7 (most severe to least severe). These messages are described in Table 5. The alarms are displayed in the Alarm Log. As these alarms are associated with the Cisco PIX Secure Firewall device model, the model icon will change color and flash depending on the severity of the alarm that it receives. Table 5: Severity Level Severity Level Code Description 0 emergency-system is unusable. 1 alert- Immediate action required. 2 critical -Critical condition. 3 error- Error condition. 4 warning- Warning condition. 5 notification- normal but significant condition 6 informationalinformational message only. 7 debugging- message that appears during debugging only. Device Management Page 28 Cisco Secure PIX Firewall

29 Syslog Trap Support The Syslog message severity is mapped to the SPECTRUM alarm severity as listed in Table 6. Table 6: Alarm Severity 0-1 Red 2-3 Orange 4 Yellow Syslog Message Severity Color Messages with an Alarm Severity of 5 through 7 typically do not generate an alarm, as they are of minor importance. Messages are listed by the facility (hardware device, protocol, or a module or system software) that produces the messages. A facility code is an abbreviation of the facility to which the message refers. A facility could be a specific hardware device, a protocol, or a portion of software. Within each facility, messages are listed by the severity level, from highest (0) to lowest (7). A mnemonic is a code that uniquely identifies the message. Each message is followed by an explanation and a recommended action. Messages appear only when Interface Configuration View the system remains operational. The following is an example of a syslog message: 01/01/2001,18:31:15:SYS-5- MOD_INSERT:Module 5 has been inserted The meaning of this message is as follows: 01/01/2001,18:31:15 is the date and time of the error (this appears if set for system log messaging). SYS is the facility type. 5 is the severity level, indicating that it is a normal but significant condition. MOD_INSERT is the mnemonic code that uniquely identifies the message. Module 5 has been inserted is the message text that describes the condition and may contain detailed information which varies from message to message. See the Alarm Notification Manager documentation for more information about model alarms in SPECTRUM. Note: This management module supports the system error messages for the Cisco IOS Release 12.1 T. Device Management Page 29 Cisco Secure PIX Firewall

30 Syslog Trap Support Interface Configuration View Note: The URL uct/iaabu/pix is a link to more information about Cisco Pix syslog messages including a list of facility codes and of error messages with their corresponding recommended actions. The System Message Log (syslog) software can save the system messages in a log file or direct them to other devices. Syslog software allows you to do the following: Save logging information for monitoring and troubleshooting. Select the types of logging information captured. Select the destination of captured logging information. By default the switch logs normal but significant system messages to its Internal buffer and sends these messages to the system console. You can specify which system messages should be saved based on the type of facility and the severity level. Messages can be time-stamped to enhance realtime debugging and management. Device Management Page 30 Cisco Secure PIX Firewall

31 Model Information View This section provides a brief overview of the Model Information view. This view displays administrative information about the device and its applications and lets you set thresholds and alarm severity for the device. Figure 9 shows a sample Model Information view. The layout of this view is the same for all model types in SPECTRUM but some information will vary depending on the model it defines. Refer to the SPECTRUM Views documentation for a complete description of this view. Model Name Contact Description Location Figure 9: File View Tools Bookmarks Model Information View SpectroGRAPH: Model Name Model Information View Network Address Primary Application System Up Time Manufacturer Device Type Serial Number Help General Information MM Name MM Part Number MM Version Number Model Type Model Creation Time Model Created By Model State Security String Condition Condition Value Contact Status Lost Child Count Value When Yellow Value When Orange Value When Red Communication Information DCM TimeOut DCM Retry Community Name Poll/Log Information Poll Interval Polling Status Last Successful Poll Log Ratio LOGGED POLLED type Model Type of Landscape: Primary Device Management Page 31 Cisco Secure PIX Firewall

32 33 Index A Address Interface IP 10, 14 Physical (MAC) 10, 14 Translation 11, 15 Admin Status 9, 13, 27 Applications 18 G Gauge Label 14 H Hardware 5 M Management Tasks 7 Mask 11, 15 Model Information 31 Types of 5 B Bandwidth 27 C Configuration Device 26 Interface 27 D DevTop Views 8 Documentation 4 I Icons Device 5 Interface 9, 13 Interface Status 10, 14 Type, Device 9, 13 IP Address/Network Mask 27 L Last Change 27 N Network I/O ports 12 Network Type 10, 14 O Operation Status 27 P Packet Size 27 Performance Statistics 14, 24 Physical Address 27 Port Number, Device 9, 13 Device Management Page 32 Cisco Secure PIX Firewall

33 Index Index Q Queue Length 27 S Serial ports 12 Statistics Routing Frame Transmission 25 T Threshold Information 10, 14 Troubleshooting 7 Device Management Page 33 Cisco Secure PIX Firewall