CajunRules Policy Manager User Guide. Version 2.0

Transcription

1 CajunRules Policy Manager User Guide Version 2.0 January, 2001

2 Copyright Avaya Inc ALL RIGHTS RESERVED Printed in USA, January 2001 The products, specifications, and other technical information regarding the products contained in this document are subject to change without notice. All information in this document is believed to be accurate and reliable, but is presented without warranty of any kind, express or implied, and users must take full responsibility for their application of any products specified in this document. Avaya disclaims responsibility for errors which may appear in this document, and it reserves the right, in its sole discretion and without notice, to make substitutions and modifications in the products and practices described in this document. P550 is a registered trademark, and Avaya, Cajun, CajunView, and CajunRules are trademarks of Avaya Inc. Lucent and QIP are trademarks of Lucent Technologies, Inc. Netscape, Navigator, and the Netscape N and Ship's Wheel logos are registered trademarks of Netscape Communications Corporation in the U.S. and other countries. Microsoft, Windows, Windows NT, Windows 95, Windows 98, Active Directory, and Internet Explorer are trademarks or registered trademarks of Microsoft Corporation in the U.S. and/or other countries. Novell, NDS, Netware, and Novell Directory Services are registered trademarks of Novell, Inc. Sybase is a registered trademark of Sybase, Inc. ALL OTHER TRADEMARKS MENTIONED IN THIS DOCUMENT ARE PROPERTY OF THEIR RESPECTIVE OWNERS.

3 Table of Contents Preface Overview... vii Software Version Information... viii Technical Support... viii Conventions... viii Using Note, Caution, and Warning... ix Related Documentation... ix Online Documentation... ix Online Help... x Documentation Feedback... x Avaya Products and Services... x Chapter 1 Introduction to CajunRules Overview Policy-Based Networking Parameters Policy-Based Networking Technologies Using CajunRules with Your Network Overview of Domains and Devices/Interfaces Overview of Policies Abstract Policies Custom Policies Overview of Rules CajunRules Process Flow Char Chapter 2 Overview of the CajunRules Console Overview Console Panels and Tabs Tree Pane View Pane Console Window Tool Bar Menu Items File Menu New Window Change Password Reconnect Create Rename Import Devices Exit iii

4 Edit Menu Select All Find and Find Again Show References Properties View Menu Actions Menu Import Set QIP Server Move Rule Up/Down Set Target Deploy Policy Detailed Status Assign to Domain Remove from Domain Assign to/remove from Group Detect Interfaces Customize Services Validate 2-14 Display Active Policy 2-14 Tools Menu 2-15 Help Menu 2-16 Chapter 3 Creating the CajunRules Network Environment Overview Creating Networks Creating Subnets Creating Host Addresses Creating Host Groups Displaying Properties for Host Groups Creating Applications Adding Members to a New Application Displaying Properties for Applications Chapter 4 Managing Devices Overview Before Creating Devices Creating a Device Discovering a Cajun P550 or P880 Device Discovering a Cisco 7500 or 2500 Device Creating Interfaces Discovering Interfaces Creating Services Managing Cisco Devices and Interfaces Importing Devices Creating Device Groups Deleting a Device Group iv

5 Assigning Device Group Properties Assigning Device Group Properties to a Cajun Device Assigning Device Group Properties to a Cisco Device 4-23 Managing Groups of Devices Manipulating the Contents of a Deployed Device Group 4-25 Managing the Properties of a Device Group Chapter 5 Creating Policies and Rules Overview Creating an Abstract Policy Creating Custom Policies Creating Rules Editing Rules Deleting Rules Chapter 6 Managing Domains...-1 Overview Creating a Domain Deleting a Domain Viewing Detailed Status Assigning Devices, Interfaces, and Device Groups to Domains.6-5 Adding a Device, Interface, or Device Group to a Domain 6-5 Adding a Device to a Domain Using the Domains Tab 6-6 Adding a Device to a Domain Using the Devices Tab..6-8 Deleting a Device, Device Group, or Interface from a Domain Moving a Device, Interface, or Device Group from One Domain to Another Domain Deploying/Changing Policies on a Domain Deleting a Policy Validating Devices, Domains, and their Policies Chapter 7 Using the CajunRules Tools Overview The Event Browser Querying Events Customizing the Event Browser Window Setting the Log Size Saving Event Browser Information to a File Using the Activation Period Wizard Creating a New Activation Period Modifying Activation Periods Deleting an Activation Period Show References on an Activation Period Managing the Protocol List Managing the Port List v

6 Managing the Administrator List Adding New Administrators Modifying Administrator Information Deleting an Administrator from the List Administrator Rights Changing Administrator Rights Removing Administrator Rights Adding QIP Users Appendix A Troubleshooting...A-1 Overview A-1 The CajunRules server fails to connect.... A-1 Application Error... A-1 Device Failed to Execute... A-2 QIP Import Fails... A-2 Unknown Administration Username and Password... A-2 Appendix B Examples...B-1 Overview B-1 Setting Up CajunRules Using Abstract Policies... B-1 Method # 1: First Domains, then Devices... B-2 Method # 2: First Devices, then Domains... B-3 Specific Use of CajunRules... B-4 Glossary Index vi

7 Preface Overview This guide explains how to install and use the CajunRules Policy Manager. The guide includes the following chapters: Chapter 1, "Introduction to CajunRules" - Provides an overview of the CajunRules Policy Manager. Chapter 2, "Overview of the CajunRules Console" - Provides an in-depth description of the console (client) window and how to navigate the console. Chapter 3, "Creating the CajunRules Network Environment" - Provides information on how to set up a CajunRules network. Chapter 4, "Managing Devices" - Provides information on adding devices to your CajunRules network. Chapter 5, "Creating Policies and Rules - Provides information about creating rules and how to use them to manage your network. Chapter 6, "Managing Domains" - Provides information on creating and managing your policy domains. Chapter 7, "Using the CajunRules Tools" - Explains how to use the CajunRules tools, such as the event browser and activation periods wizard. Appendix A, "Troubleshooting" - Provides troubleshooting information. Appendix B, "Examples" - Provides several network scenarios using CajunRules. vii

8 Chapter Software Version Information This guide describes CajunRules Policy Manager software version 2.0. To contact Avaya s technical support: From the United States: Outside the United States: Contact your distributor. This document uses the following conventions: Convention Represents Examples User Input User entered text. To enable the network, enter: set network enable Boldface Text System Output Menu command, keyword to be acte upon, or button name. Text displayed by the system. Select Default from the Interfaces pull-down menu. Click Cancel to cancel the installation. If you enable the network successfully, the following output displays: ATM(configure)# set network enable Network has been enabled viii

9 * Note: Provides additional information about a procedure or topic. CAUTION Indicates a condition that may damage hardware or software. Indicates a condition that may cause bodily injury or death. WARNING This section provides information on related documentation, including: Online Documentation Online Help Documentation Feedback For more information on your LDAP servers, QIP, or Cisco devices, refer to that product s documentation. The following document provides additional information on CajunRules: CajunRules Release Notes, Version 2.0 CajunRules Getting Started Guide, Version 2.0 CajunRules Quick Start Card, Version 2.0 ix

10 Chapter Avaya maintains copies of these technical documentation on the web server. To access online documentation in PDF format, use Netscape Navigator version 4.5 or higher or Microsoft Internet Explorer version 3.x or higher and enter the following URL: You must have a browser installed on your system in order to use the online help. The following browsers are supported: Netscape Navigator 4.5 or later Microsoft Internet Explorer 4.01 or later To launch help, selec Help > CajunRules Help or press F1. A Welcome page opens. The window is divided into two panes. The left pane contains two tabs, TOC (Table of Contents) and Index. Use either tab to locate the information you are looking for. The right pane contains a Welcome screen that explains how to navigate through the help system. * Note: When launching the online help, wait until the help window has completely loaded before resizing the window. If you have comments about the technical accuracy or general quality of this document, please send us an at: LSG-CTechPubs@avayactc.com Please cite the document title, part number, and page reference, if appropriate. For information about Avaya products and services, please consul the Avaya World Wide Web site at x

11 1 Introduction to CajunRules Overview CajunRules Enterprise Policy Manager is a software tool for managing policies on Cajun P550, P880, and P330 devices, as well as Cisco 2500 and 7500 systems. It consists of a Policy Engine (server) and a Console user interface application (client) that enable you to manage your network of devices according to your business needs. It uses applications, network services, directories, and industry standards, allowing you to manage your network more efficiently. * Note: Cajun P550 and P880 generally refer to the entire family of products, including the P550, P580, P880, and P882 devices. The Console application is a graphical user interface (client) that can reside on the same system as the CajunRules server and/or on a remote server. * Note: If you are managing Cisco devices, the console and server must reside on the same system. The Console application allows you to define policies and rules by which your network operates. The policies are stored in a Lightweight Directory Access Protocol (LDAPv3) complian directory. Figure 1-1 represents a brief overview of the CajunRules system. Figure 1-1. CajunRules Overview Console User Interface (Client) Policy Engine (Server) LDAP Server QIP Server (Optional) * Note: All components shown can be installed on the same system or on different systems. 1-1

12 Chapter 1 Policy-Based Networking Parameters The CajunRules application allows you to manage your network using the following features: Quality of Service (QoS) - Manages resources to prioritize traffic, and/or control delay or loss based on application or user identity Access Control - Permits or denies visibility and connectivity to network resources through host application or user identity. It also provides security via permit/deny rules. Scheduling - Enables policies to take effect at defined times and for specific domains. Policy-Based Networking Technologies CajunRules takes advantage of a number of technologies as shown in Table 1-1. Table 1-1. Product Technologies CajunRules Element Common Distributed Data Store Communication Protocols Data Management Device Management/ Configuration Technology and Standard CIM/DEN (Common Information Model/ Directory Enabled Network) Directory Servers (data replication, synchronization) LDAP for both policy server and devices to/from directory - use of Netscape Directory Services and Novell Directory Services (NDS). Simple Network Management Protocol (SNMP) for device status LDA SNMP Cisco CLI over Telnet (for Cisco devices) LDA 1-2

13 Introduction to CajunRules Using CajunRules with Your Network To effectively use CajunRules, you must establish some methodology for policies, if they are not already established. This requires a three-step process: 1. Define your business objectives by prioritizing applications and users, access controls, and schedules. 2. Map those objectives to network policies, i.e., traffic priority, security access, and time of day. 3. Administer policies with CajunRules. Overview of Domains and Devices/Interfaces A domain is a collection of targets (devices and/or interfaces). Only entities that are enforcement targets can be put in a domain. All members of the policy domain share the same abstract policy. The policy can be customized for individual members or sub-groups of the domain. All members of the policy domain share the same Time Zone. * Note: Interface are Cisco only Devices must be added to a domain in order to apply a policy to them. A device/interface can be added to a single domain only. Different interfaces of the same device can be put into different domains if they need to get different policies. Policies are created/defined independently of domains. A policy can be associated with one or more domains. A policy can be customized for individual targets, validated, and enforced. If it passes validation on that domain, then the policy can be deployed to members of the domain. 1-3

14 Chapter 1 Overview of Policies CajunRules has two levels of policy presentation. The first level is referred to as abstract policy. Abstract policy describes network-wide high-level policy rules defined by you. For each rule, you specify a Service Name. This Service Name implies the level of priority, or a deny action. Services may also be defined to include additional parameters for device behavior. The second type of policy is referred to as a custom policy that allows you to customize each abstract policy for an individual enforcement target. Abstract Policies Custom Policies A policy is made of rules that are application and/or user group oriented, and are domain-wide and not specific to a certain target. Once an abstract rule is created, customization can be done to fine tune the policy for specific enforcement targets. A rule defines a traffic flow and a service. The traffic flow can be defined using application profiles and network infrastructure elements, combined into an application condition or by specifying Precedence conditions. Application traffic flow may be defined as a bidirectional flow or a unidirectional flow. A Custom policy is made up of a list of rules with target-specific details, customized for specific enforcement targets. A target can be a device, a device interface, or a group of either. The policy can be viewed and edited for a given target. The target-specific view is called the Custom policy for that target. CajunRules may have a tree of target-specific Custom policies related to the Abstract policy. The target-specific options may include: Ability to specify mandatory enforcement of individual rules Ability to disable individual rules (directions) Ability to specify a different service class for individual rules 1-4

15 Introduction to CajunRules Overview of Rules If the rule is defined at the Abstract level as bidirectional, it can be viewed and customized for each direction separately in the custom level. A Custom policy rule can be made mandatory. If a rule is mandatory for a device, it must e applied when the policy is activated on the device. If the device is limited and cannot support all rules, the mandatory rules may preferred over others. If a mandatory rule cannot be applied, policy validation displays an error and refuses to allow the policy to be deployed to the domain. A Custom policy includes an editable custom service. The custom service serves as the target specific override of the abstract service. By default, the custom service has the same service name as the abstract service. You can change the custom service of a rule by selecting from the list of services already defined for this target. Rules are components of a policy that define how the target should implement the instructions. A rule may not be applicable for a certain device if the functionality specified in the rule is not supported by the device (or if CajunRules can not support this function on this device). When validating the policy, CajunRules considers such a rule not-applicable for the device, making the validation result for the policy invalid or partial, depending on whether or not the rule is mandatory. For each rule, specify a Service Name. This Service Name implies the level of priority, or a deny action. In some cases full policy enforcement may not be possible. CajunRules supports different types of devices in the same policy domain, even though devices differ in capabilities. The approach to device limitations with regard to QoS policy rules is to enforce the policy partially. Partial enforcement decisions are made automatically by the system (CajunRules combined with the devices themselves). 1-5

16 Chapter 1 Reasons for non-enforcement of a rule vary. The rule may not be applicable for the device, or the rule may be translated but still not supported by the device. Or the rule may be supported by itself, but not enforceable with the rest of the policy due to a limit the device has on it. When a policy is translated and validated, partial enforcement choices are made, depending on which rules are activated if not all the rules can be accommodated by the device. In some cases, partial enforcement choices may be rather sophisticated, taking into account local device information in order to choose the most relevant rules. CajunRules provides a means to affect partial enforcement choices by configuring a rule as mandatory at the Custom policy for the device. This makes the rule preferred over other rules and guarantees that the rule gets enforced, or if not possible, the whole policy is rejected as not valid. If you want to make changes to the policy to affect what is enforced, the modifications have to be done at the Custom policy or the Abstract policy level. Through the Translation-View, you are able to view the status of each entry as applicable, partially applicable, not applicable, or unknown. This is provided per domain, and applies only to one policy enforced on the domain, not to other policies possibly being validated for this domain. These entries indicate whether the entry is applied or not if the policy is activated now. The value partially applicable means only part of the rule can be applied on the device. The value unknown means CajunRules cannot determine the applicability status of the rule. This may happen if the device is unreachable and CajunRules depends on the device for this information. CajunRules Process Flow Chart Figure 1-2 provides an overview of the process of setting up CajunRules. 1-6

17 Introduction to CajunRules Figure 1-2. CajunRules Process Flow Chart Create a Network Chapter 3 Create Devices Chapter 4 Set QoS Define Services Properties Chapter 4 Chapter 4 Create/Edit Create Abstract Create Custom Policies Rule Policy Chapter 5 Chapter 5 Chapter 5 View Translation No Policy Valid? Yes Create Domain Chapter 6 Assign Devices to Domain Set Target Chapter 6 Deploy Policies Associate with Domain Chapter 6 Policy Scheduled? Time to Activate? Yes Activate Policy Chapter 6 1-7

18 2 Overview of the CajunRule Console Overview This chapter explains the various panels, tabs, and menu items of the CajunRules Console main window. Use the Console to create and manage policies and rules that apply to your network. Figure 2-1 shows the CajunRules Console window Figure 2-1. CajunRules Console Window Console Panel and Tabs Tree Pane Tool Bar Menu Bar Vertical Splitter View Pane 2-1

19 Chapter 2 * Notes: There is a vertical splitter that separates the Tree Pane and the View Pane. Click and drag to expand the view for either pane. You can right-click on most entities to select from a list of actions. If you select Show References (network elements), Detailed Status (domains), or Display Active Policy (Cajun P330 devices), an additional pane appears at the bottom of the Console window. This pane has it s own Close, Minimize, and Maximize buttons. If you open more than one pane, they layer on top of each other. This chapter contains the following information: Console Panels and Tabs Tree Pane View Pane Console Window Tool Bar Menu Items Console Panels and Tabs There are four Console Tabs (Figure 2-1): Network - Use the Network tab to define the hierarchy of IP elements (networks, subnets, and hosts) that can be used in the condition portion of policy rules. You can also define host groups or logical collections of IP elements. An application profile may be defined to represent the software running on one or more hosts. Devices - Use the Devices tab to define a set of devices (routers, switches, and their interfaces) that you want to manage with CajunRules. 2-2

20 Overview of the CajunRules Console Policies - Use the Policies tab to create and view your policies and rules. Domains - Use the Domains tab to define Policy Domains which contain a set of enforceable targets (router interfaces or switches) that all receive the same policy. A domain also has a time zone associated with it and must have a policy associated with it. There can be one active policy per domain. The time zone, together with activation periods specified in the rules for the policy deployed on the domain, determine when the targets are scheduled to have new policy rules sen to them. Tree Pane The Tree pane (Figur e2-1) contains a hierarchical view of objects contained in your CajunRules environment, based upon the selected tab. Use a single click to highlight an item in the Tree pane. Then, right-click and select an option from the pull-down menu. Option vary, depending in the type of Tree node. * Note: Some of the pull-down menus may extend beyond the viewing area. Changing your screen resolution may create a larger display area. Table 2-1 shows and describes the icons found in the CajunRules Console tree panels. Table 2-1. Console Panel Icons Icon Description of Icon Network Tab - Root - Entire Network Networks Subnets IP Client Hosts and/or Servers (static addresses Network Tab - Top Level Host Groups Host Groups 2-3

21 Chapter 2 Icon Description of Icon Network Tab - Top Level Application Applications Devices Tab - Top Level Device. Cannot be deleted. Cajun P550 Devices Cajun P880 Devices Cajun P330 Devices Cisco 7500 Devices Cisco 2500 Devices Cisco Interfaces Devices Tab - Top Level Device Groups. Cannot be deleted. Device Groups Cisco Interface Groups Domains Tab - Top Level Domain. Cannot be deleted. Domains - symbolizes domains. Policies Tab - Top Level Policies. Cannot be deleted. Policies. 2-4

22 Overview of the CajunRules Console Icon Description of Icon Abstract Policy Custom policy Abstract Rule Custom Rule * Note: If you import information from the QIP enterprise server, the data appears in black in the Tree pane. Information manually entered into CajunRules appears in blue. To view the IP address of a specific Tree pane object in the Network tab, place the cursor over the object in the Tree pane. The IP address appears in Tool Tip format. You can use the Copy/Cut/Paste/Delete options to manage objects in your CajunRules system. To enter information in the View pane, copy or cut a selection in the Tree pane and paste it into the appropriate field in the dialog box. The commands allow you to complete the following: Cut - Valid only on IP elements under User Groups and Applications in the Network tab. Copy - Valid on any object or collection of objects in the tree in the Network tab. Paste - Valid only on a Group (collection of network or application items). It is valid on a single IP element onto a source or destination cell of a rule when the cell is active. Delete - Valid for an object or collection of objects in the Tree pane. 2-5

23 Chapter 2 View Pane The View pane (contents of a network are displayed in Figure 2-2) allows you to display and/or edit the contents of an element selected in the Tree pane. The column heading displayed depends on the type of object you are editing. For example, the View of a Network Tree element shows all the subnets defined in that network, displayed for each subnet row in the View pane are the subnet name, IP address and mask. The Rule Editor also appears in the View pane. Refer to "Creating Rules" in Chapter 5 for more information on the Rule Editor. * Note: You can change the order of the columns by clicking on the column heading and dragging it to a new location, and the width of the column by clicking and dragging the column divider. Figure 2-2. View Pane Console Window Tool Bar There are five tools in the Console Window tool bar (Figure 2-1). From left to right, the tools are Open, Cut, Copy, Paste and Delete. These tools are standard Windows tools. 2-6

24 Overview of the CajunRules Console Menu Items There are six menu lists in the CajunRules Console window (Figure 2-1). The following section describes the features of eac menu: File Menu Edit Menu View Menu Actions Menu Tools Menu Help Menu File Menu This section describes each of the File menu options, as well as the procedures to change the current logged-in administrator s password and reconnect to the Policy Engine. New Window This option opens a copy of the CajunRules Console application main window, allowing you to create, manipulate, or view any of the tree hierarchies independently, or edit more than one policy at a time. * Note: If you open more than one Console window, make all changes in one window only. Change Password This option allows you to change your password. To change your password: 1. Select File > Change Password. The Change Password dialog box opens. 2. Enter your old password in the Old Password field. 3. Enter your new password in the New Password field. 4. Re-enter your new password in the Confirm Password field. 5. Click OK to change the password; click Cancel to exit the Change Password dialog box without saving changes. 2-7

25 Chapter 2 Reconnect This option allows you to reconnect to the CajunRules Policy Engine. You may need to reconnect if the Console hangs or if you want to log in as a different user. 1. Select File > Reconnect. The Reconnect to the CajunRules Server dialog box opens: 2. Enter your CajunRules password. 3. Click Refresh if you want to rebuild the data from the server. * Note: If you want to reconnect while in the process of making changes, do not click Refresh or those changes are lost. 4. Click OK to reconnect to the Policy Engine. Click Cancel if you do not want to reconnect to the CajunRules Policy Engine. Create This option allows you to create the following: Network Subnet Host Address Application Host Group Device Groups Domain Device Interface (Cisco devices only) Policy Custom Policy Save As * Note: You cannot modify or edit deployed policies, but you can use the Save As feature to copy the selected policy to a new policy, modify this new policy, and deploy it on a domain, effectively changing your deployed policy. 2-8

26 Overview of the CajunRules Console In order for these options to be enabled, you need to highlight the specific entity in the Tree pane. For example, to access Create > Network, you need to highlight Network in the Tree pane. You can also access the same function by highlighting Network in the Vie pane and right-clicking. Rename This option allows you to rename certain entities such as subnets. * Note: You cannot rename domains, device groups, host groups, or applications. 1. Highlight the object you want to rename. 2. Select File >Rename and the Rename <xxx> dialog box opens: 3. Enter the new name for the entity you are changing. 4. Click OK to rename the entity; click Cancel to exit the Rename <xxx> dialog box without saving changes. Import Devices Exit This option allows you to import device information fro CajunView or other file. Refer to "Importing Devices" in Chapte r4. This option allows you to exit the CajunRules Console application. * Note: This only shuts down the CajunRules Console. To shut down the Policy Engine, click the close box of the CRServices Status Browser window. Edit Menu These options are also displayed in the Console application Tool Bar, and are standard Windows tools: Cut Copy Paste Delete The following sections describe the other options in the Edit menu. 2-9

27 Chapter 2 Select All Find and Find Again Show References This option allows you to select the entire contents in the Vie pane. To select the contents, click on a field in the View pane and select Edit > Select All. These options allow you to search for specific items in the Tree pane. Find and Find Again only search for information in the tab that is selected. This option allows you to display a window that lists all the references to a given object (network, subnet, host, host group, or application). IP entities (network, subnet, host) may be referenced in host groups or applications (as members). These entities, as well as host groups and applications, may be referenced in the address condition part of an abstract rule. The information appears at the bottom of the CajunRules Console window (Figu r e2-3). * Note: This pane has its own Close, Minimize, and Maximize buttons. If you open more than one pane, they layer on top of each other. Figure 2-3. Show References Pane Close Button Show References Panel To edit this information, double-click an item from the Search Results pane or select an item and right-click and selec Edit from the pull-down menu. The editor for the selected object opens. You cannot use the Copy and Paste functions with this feature. 2-10

28 Overview of the CajunRules Console Properties This option displays editable properties for Host Groups, Applications, and Devices. Refer to the following sections for more information on Properties: "Displaying Properties for Host Groups" in Chapter3 "Displaying Properties for Applications" in Chapter3 "Assigning Device Group Properties" in Chapte r4 View Menu The View menu allows you to: Show and hide the Tool Bar Switch between any of the following Console tabs: Network Policies Domains Devices Actions Menu The Actions menu functions are discussed in the following sections. Many of these functions can be accessed in other ways, for example by right-clicking on certain entities or the Rule Editor in the view pane. Import * Note: This option is available only if you have Lucent s QIP installed. This option is only enabled when you log in with manage CajunRules privileges. It allows you to import address information about networks and subnets from the QIP database. Refer to the QIP documentation for more information. Set QIP Server * Note: This option is available only if you have QIP installed. This option allows you to configure the identity of your QIP server, using your QIP hostname, user ID, and organization. Refer to the QIP documentation for more information. 2-11

29 Chapter 2 Move Rule Up/ Down When editing an abstract policy, these options allows you to change the order of the rules. * Note: You can also move rules within the Rule Editor. For more information on the Rule Editor, refer to Chapter 5, Creating Policies and Rules. Set Targets This option is enabled when a domain is selected (and is also accessible from the pop-up menu of a domain). This establishes the enforceable targets that are part of this domain. An enforceable target is considered: A device that does not support interfaces An interface A device/interface group * Note: You can also access Set Targets by right-clicking domain nodes in the Domains tab. Refer to "Adding a Device to a Domain Using the Domains Tab" in Chapter 6 for more information. Deploy Policy Detailed Status This option displays a window that shows the results of the validation of the policy on the domain. IF the policy is valid you receive a message asking if you want to deploy it now. Click Yes to deploy it. If there are errors, you can fix the problem by changing the abstract policy or by customizing it for certain targets. Click Revalidate which attempts the validation again. This option allows you to view the detailed status of any domain. A screen opens at the bottom on the CajunRules Console window. This pane has it s own Close, Minimize, and Maximize buttons. If you open more than one pane, they layer on top of each other. You can move column headings by clicking and dragging them. * Note: You can also view Detailed Status by right-clicking Domain nodes. 2-12

30 Overview of the CajunRules Console Assign to Domain This option is only enabled when you select an enforceable target in the Devices tab. It allows you to assign devices to different domains. * Note: You can also access Assign to Domain by right-clicking devices, interfaces, and device groups in the Tree pane. Refer to "Assigning Devices, Interfaces, and Device Groups to Domains" in Chapter 6 for more information. Remove from Domain This option is only enabled when you select an enforceable target in the Devices tab. This operation is available on a single target that is currently part of a domain. If the target is a device group, all the targets that are part of the group get removed from the domain. * Note: You can also access Remove from Domain by rightclicking devices, interfaces, and device groups in the Tree pane. Refer to "Deleting a Device, Device Group, or Interface from a Domain" in Chapter 6 for more information. Assign to/ Remove from Group This options allows you to add device(s) to or remove them from an existing Device Group. * Note: You can also access Assign to Group by right-clicking devices or interfaces in the Tree pane. To remove from a group, highlight the device under the Device Group and right-click. Refer to "Deleting a Device Group" in Chapter 4 for more information. Detect Interfaces This option is available for Cisco devices in the Devices tree. It allows you to manage the list of interfaces on the device that you want to be part of the CajunRules database. These interfaces can subsequently be placed in device groups or domains, and can have customized policies and service definitions created for them. * Note: You can also access Detect Interfaces by right-clicking a Cisco device in the Tree pane. Refer to "Discovering Interfaces" in Chapter 4 for more information. 2-13

31 Chapter 2 Customize This option is available on an enforceable target (switch or router interface) in the Devices tree tab. It allows you to customize an abstract policy for a given target, making it a custom policy. In the Custom Policy Editor, you can declare certain abstract rules to be either disabled or non-mandatory, and can assign different service definitions that override those specified in the abstract policy. When a policy is deployed on a domain, if a target in the domain has a customization of that policy, the definitions in the custom policy override the abstract definitions for that target. Refer to "Creating Custom Policies" in Chapter 5 for more information. Services Validate Display Active Policy This option is for Cisco interfaces only. It allows you to set color shaping, priority customs, etc. Refer to "Creating Services" in Chapter 4 for more information. This option allows you to validate a policy against the selected device. Refer to "Validating Devices, Domains, and their Policies" in Chapter 6 for more information. This option allows you to display the Active Policy on Cajun P330 devices. The information is displayed in a pane at the bottom of the Console window (Figure 2-4). This pane has it s own Close, Minimize, and Maximize buttons. If you open more than one pane, they layer on top of each other. 2-14

32 Overview of the CajunRules Console Figure 2-4. Display Active Policy Pane Close Box Display Active Policy Pane Tools Menu The Tools menu contains the functions you can use to manage the policies. These are discussed in detail in Chapter 7, Using the CajunRules Tools.. Event Browser - Allows you view the events taking place in CajunRules. Activation Periods - Allows you to create activation periods for scheduling policies. Protocol List - Allows you to add protocols to the default protocols list. Port List - Allows you to add ports to the default ports list. Administrator List - Allows to add new administrators and/or change administrator information and rights. Add QIP User - Allows you to import QIP user information from the QIP database into CajunRules. Refer to "Adding QIP Users" in Chapter 7 for more information. * Note: This is available only if you have QIP installed. 2-15

33 Chapter 2 Help Menu The Help menu has two options: About - Displays a screen that indicates what version of CajunRules you have installed on your system. CajunRules Help - Allows you to access the complete online help for the CajunRules application. Refer to "Online Help" in the Preface for more information on navigating the online help. 2-16

34 3 Creating the CajunRules Network Environment Overview Creating Networks To manage policies using CajunRules, you must define the network infrastructure. A network consists of one or more networks, subnets, hosts, host groups, and/or applications. This chapter contains the following information: Creating Networks Creating Host Groups Creating Applications To create your CajunRules network: 1. Select the Network tab. 2. Highlight Entire Network. 3. Right-click and select New Network from the pull-down menu. Or Select File > Create > Network. The Create Network dialog box opens (Fi gure3-1). 3-1

35 Chapter 3 Figure 3-1. Create Network Dialog Box 4. Enter the Name you want to give your network. 5. Select the Network Class from the pull-down menu. * Note: Class A range of first octets is 1-126; 127 is for loopback testing. Class B range is Class C range is Class D range is This class is typically used for multicast addresses and is not assignable. 6. Enter the IP Address of your network. * Note: The Mask of your network is automatically calculated based on your network class. 7. Click OK to save the changes; click Cancel to exit the Create Network dialog box without saving changes. The name of your network now appears in the tree structure of the Tree pane. 3-2

36 Creating the CajunRules Network Environment Creating Subnets * Notes: You can create multiple network structures. You can also add a new network by clicking New at the bottom of the View pane. Repeat steps 4-6 in this section to add additional networks. Subnets are groups of addresses or subnetworks within a network. They are created so that those addresses can share the same parameters and policies and be managed as a group. You can create subnets automatically through the Create Network dialog box (refer to "Creating Networks", earlier in this chapter), or you can create them manually using the following procedure: 1. Select the Network tab. 2. Highlight the Network you want to create the subnet in. 3. Right-click and select New Subnet. Or Select File > Create > Subnet. The Create Subnet dialog box opens (Figure 3-2). Figure 3-2. Create Subnet Dialog Box 4. Enter the Name of the new subnet. 5. Enter the IP Address of the new subnet. * Note: You cannot change the network portion of the subnet. 3-3

37 Chapter 3 Creating Host Addresses 6. Enter the Mask of your subnet. * Note: Make sure that the subnet matches your mask or you receive an error message. 7. Click OK to save the changes; click Cancel to exit the Create Subnet dialog box without saving changes. The name of your Subnet appears in the tree structure of the Tree pane. You can create multiple subnets within a network. To represent individual stations in your IP network, you can create host addresses. To create hosts: 1. Select the Network tab. 2. Highlight the Subnet you want to add the host address to. 3. Right-click and select New Host Address from the pull-down menu. Or Select File > Create > Host Address. The Create Host Address for dialog box opens (Figu r e3-3). Figure 3-3. Create Host Address for Dialog Box 4. Enter the Name you want to give the Host address. 5. Enter the editable octets of the IP Address. You cannot change the masked portion of the IP address or the mask. 3-4

38 Creating the CajunRules Network Environment Creating Host Groups * Note: The Host Number is automatically calculated base on the IP address and mask. If you enter the Host Number, the IP address is automatically calculated. 6. Click OK to save the changes; click Cancel to exit the Create Host Address for dialog box without saving changes. The name of your Host (object) now appears in the tree structure of the Tree pane. You can create multiple Hosts (objects) within a subnet. A Host Group is a selection of IP networks, subnets, and/or host addresses to which you can apply specific policies. Group subnet hosts together according to the network resources they use and the QoS access control policies you want to apply. To create a Host Group: 1. Select the Network tab. 2. Highlight Host Groups. 3. Right-click and select New Host Group. Or Select File > Create > Host Group. The New Host Group dialog box opens (Figu re3-4). 3-5

39 Chapter 3 Figure 3-4. New Host Group Dialog Box 4. Enter the Name of the host group you are creating. 5. Select the networks, subnets, and IP addresses (hosts) that you wish to add to this Group Name from the Available Members list. The member you wish to add must already exist in your network. * Note: You can use the CTRL and SHIFT keys to select multiple entities from the Available Members lis to add to Selected Members list. 6. Click Add to add them to the Selected Members list. * Note: To delete members from the Host Group, highlight the group(s) in the Selected Members list and click Remove. 7. Click OK to save the changes; click Cancel to exit the New Host Group dialog box without saving changes. * Note: If you wish to delete a group or remove its last member, you must first remove the group s association from any rules that reference it. Highlight the group and select Edit > Show References to determine references. Refer to "Edit Menu" in Chapter 2 for more detailed information. 3-6

40 Creating the CajunRules Network Environment Displaying Properties for Host Groups To display the properties for Host Groups: 1. Select the Network tab. 2. Highlight the Host Group you want to view the properties for. 3. Right-click and select Properties from the pull-down menu Or Select Edit > Properties. The Properties of <xxx> dialog box opens (Figu re3-5). Figure 3-5. Properties of <xxx> Dialog Box 4. Select the Available Member(s) you want to add to the Selected Members pane. 5. Click Add. The Available Members now display in the Selected Members pane. 3-7

41 Chapter 3 Creating Applications An Application is a specification of IP protocol and/or por parameters. Typically, they represent application traffic that passes through a target. Once you have created an application, you can assign IP address members to it for inclusion in a policy definition. To create an application: 1. Select the Network tab. 2. Highlight Applications. 3. Right-click and select New Application. Or Select File > Create > Application. The Create Application dialog box opens (Figu r e3-6). This dialog box has two tabs, the General tab and the Application Members tab. Figure 3-6. Create Application Dialog Box (General Tab Shown) 3-8

42 Creating the CajunRules Network Environment 4. Enter the Name of the new application you are creating. 5. Select the Protocol from the Protocol pull-down menu. * Note: The default protocols are listed, but you can add and modify protocols. Refer to "Managing the Protocol List" in Chapter 7 for more information. 6. Optional: If you have specified TCP or UDP as the Protocol, you can specify a single Control Port by selecting Specify, and then the appropriate option from the Protocol pull-down menu. You can add and modify port numbers to this list. Refer to "Managing the Port List" in Chapte r7 for more information. * Notes: A TCP or UDP application running in the network listens for session connection requests on a particular port. For example, HTTP requests usually use port 80. When defining an application, you can specify its control port. When the application is used in a rule, the translation of the rule condition uses the port information. For example, suppose you want to deny traffic from host to the web using HTTP. You would define the Web application as TCP, control port 80. Then create a rule and in the condition, specify source as and destination as Web. This condition gets translated as source (address= , port=any) destination (address=any, port 80). If you have specified TCP or UDP as the Protocol, you can specify a Port Range by selecting Not Specified Any, or Specify. If you select Specify, you can then select the Start and End of the Port Range. The Port Range values are set up in the port list. Refer to "Managing the Port List" in Chapter 7 for more information. When some applications start a new session for a client, it allocates a dynamic port out of a range and sends that back to the application. Further communication to the application (for this session) between the client and the application operates over this dynamic port. 3-9

43 Chapter 3 7. Click OK to save the changes; click Cancel to exit the Create Application dialog box without saving changes. * Note: You can also create new applications by double-clicking on the application folder. Click New in the View Pane. Use the pull-down menus of each field to selec information for the application (similar to steps 4-6). Click Apply. Adding Members to a New Application * Notes: Members represent specific servers where the application is located or subnets that the originating application traffic is restricted to. If the application had already been created, you can add members by right-clicking on the existing application and selecting Properties. Refer to "Displaying Properties for Applications" later in this chapter. To add members to an application: 1. Select the Network tab. 2. Highlight the Applications folder. 3. Right-click and select New Application. Or Select File > Create > Application. The Create Application dialog box appears (Fi gure3-6). This dialog box has two tabs, the General tab and the Application Members tab. 4. Select the Application Members tab (Figure 3-7). * Note: In this tab you can select the networks, subnets, and IP addresses (hosts) that you wish to attach to this Application from the Available Members list. 3-10

44 Creating the CajunRules Network Environment Figure 3-7. Create Application Members Dialog Box (Application Members Tab Shown) 5. Select a member to add from the Available Members list. The member you wish to add must already exist in your network. 6. Click Add to add them to the Selected Members list. Likewise, you can remove them from the Application by highlighting them in the Selected Members list and click Remove. 7. Click OK to save the changes; click Cancel to exit the Create Application dialog box without saving changes. * Note: You may not delete an Application if the application is referenced in any rules. 3-11

45 Chapter 3 Displaying Properties for Applications To display the properties for applications: 1. Select the Network tab. 2. Highlight the Application you want to view properties of. 3. Right-click and select Properties from the pull-down menu. Or Select Edit > Properties. The Properties of Application <xxx> dialog box opens (Figure 3-8). Figure 3-8. Properties of Application <xxx> Dialog Box 4. Edit the necessary fields in both tabs. 5. Click OK to save changes to both tabs; click Cancel to exit the Properties of Application <xxx> dialog box without saving any changes. 3-12

46 4 Managing Devices Overview You can create (add) devices from CajunRules or you can import devices from a file (for example, a file created with CajunView). For Cajun devices, you manage the entire device. For Cisco devices, you manage each individual interface. Once you set up your devices, you can add them to policy domains and deploy policies on them. This chapter contains the following information: Before Creating Devices Creating a Device Importing Devices Creating Device Groups Managing Groups of Devices Before Creating Devices Device information can initially be entered in the CajunRules database by initiating the New Device function from the Device tab. This is referred to as creating or discovering devices. You can create policies to manage the following network devices: Cajun P550/P880/P330 devices Cisco 2500/7500 devices * Note: Only one instance of each device should be added and managed. Choose one IP address for each device and use that IP address to add the device to the network and manage it. The following properties must be set based on the device you are adding (Tabl e4-1): 4-1

47 Chapter 4 Table 4-1. Device Properties Property Name P550/P880 P330 Cisco IP Address Required Required Required SNMP Read Community N/A N/A N/A SNMP Write Community Required Required Required Save2NVRam N/A N/A Optional Telnet Password N/A N/A Required Privileged Telnet Password N/A N/A Required Prompt N/A N/A Required LDAP Server Required N/A N/A Port Number (Default 389) Required N/A N/A * Note: You can add a device to CajunRules while it is unreachable. You must manually configure parameters that CajunRules easily recognizes, such as type and version. When the device comes up, CajunRules polls it to learn the user-configured information. If there is a conflict, CajunRules considers the device disabled. Device policy activation status for all device types are: Success Failed In Progress Unknown - Device Unreachable Unknown - No CajunRules policy enforced on this device 4-2

48 Managing Devices Creating a Device To create (add) a device: 1. Select the Devices tab. 2. Highlight the Devices icon. 3. Right-click and select New Device from the pull-down menu. Or Select File> Create > Device. The Discover Device dialog box opens (Figu re4-1): Figure 4-1. Discover Device Dialog Box 4. Enter the IP Address of the device you are creating in CajunRules. 4-3

49 Chapter 4 5. Enter the SNMP Read/Write Community string in the Community field. * Note: The Read and Write Community strings should be set on the device before you create the device in CajunRules. Refer to the appropriate device documentation for more information on setting the community strings. 6. Select the device family from the Model pull-down menu. 7. Click Verify to verify the device. Typically, you would use Verify when adding new devices that you know are online. To use Verify, you only need to establish the IP Address and the Community fields, then click Verify. The dialog box fills in the information from the devices. Additionally, all the subscreens for the particular devices are activated. * Notes: If you selected a Cajun P330 device from the Model pull-down menu, you do not have to input any additional information for the device. If you selected a Cajun P550 or P880 device, refer to "Discovering a Cajun P550 or P880 Device", later in this chapter. If you selected a Cisco device, refer to "Discovering a Cisco 7500 or 2500 Device", later in this chapter. If you opted to NOT use Verify: a. Select the Model of this device from the pull-down menu. Based on the option you select, different dialog boxes appear. They are discussed in subsequent sections. b. Select the Software Revision type for the device you are discovering from the Software Revision pull-down menu. c. Click OK to complete the discover of the device; click CANCEL to exit the Discover Device dialog box without saving changes. * Note: If you click OK without clicking Verify, you receive the following message (Figur e4-2): 4-4

50 Managing Devices Figure 4-2. Discover Device Dialog Box 8. Click Yes, Verify the Device to verify it, or No, Save the Device Data to save the device data you input. Discovering a Cajun P550 or P880 Device If you selected a Cajun P550 or P880 device from the Model pull-down menu in the upper portion of the Discover Device dialog box, the following additional information appears at the bottom of Discover Device dialog box (Figure 4-3). Figure 4-3. Discover Device Dialog Box (Cajun P550/P880 Device) 4-5

51 Chapter 4 1. Enter the Primary Addres of your LDAP server in the Primary Address field. * Note: This is the LDAP server that the device contacts for its primary source of policy configuration. This address can be the same as the address of the LDAP server CajunRules uses, or the address of a server where an LDAP replica of the same database is running. Refer to your LDAP documentation for information on configuring replication. 2. Enter the Primary Port of your LDAP server. * Note: The default port is 389. If you have configured your LDAP server with a different port, enter that port number here. 3. Enter the Secondary Address of your LDAP server. This address should point to an LDAP server replica that is used by the device when it cannot communicate with the primary LDAP server. Refer to your LDAP documentation for information on configuring replication. 4. Enter the Secondary Port of your LDAP server. The default port is 389. If you have configured your LDAP server with a different port, enter that port number here. * Note: The Search Base is filled in automatically, based on information from the installation of CajunRules. Change the Search Base of your directory server, only if necessary. 5. Click OK to save the changes; click Cancel to exit the Discover Device dialog box without saving changes. You can verify the device at this point, or save the device data you input. 4-6

52 Managing Devices Discovering a Cisco 7500 or 2500 Device If you selected a Cisco Device from the Model pull-down menu in the upper portion of the dialog box, the following additional information appears on the Discover Device dialog box (Figur e4-4). Figure 4-4. Discover Device (Cisco 7500 or 2500 Device) 1. Enter the Telnet Password of the Cisco device. 2. Enter the Privileged Password of the Cisco device. 3. Enter the Telnet Prompt of your of the Cisco device. 4. Optional: Click Save to NVRAM to save the entire running configuration of the device to permanent (non-volatile) memory. If you do not select this option and the device is rebooted, deployed access lists are lost. CAUTION * Note: If the device reboots, it reads the configuration from permanent memory. 4-7

53 Chapter 4 5. Click OK to save the changes; click Cancel to exit the Discover Device dialog box without saving changes. * Note: If you clicked OK without clicking Verify, you receive the Discover Devices verification message (Figur e4-2). You can verify the device at this point, or save the device data you input. Creating Interfaces * Note: This applies to Cisco devices only. To create a new interface: 1. Select the Devices tab. 2. Select the Cisco device you want to create the interface on. 3. Right-click and select New Interface from the pull-down menu. The Create New Interface dialog box opens (Figure 4-5).The IP address of that device is displayed. Figure 4-5. Create New Interface Dialog Box * Note: The Software Revision field is non-editable. 4-8

54 Managing Devices 4. Enter the Name for the interface. 5. Select the Interface Type from the pull-down menu. 6. Enter the Interface Rate. 7. Select the QoS Technique from the pull-down menu (Table 4-2): Table 4-2. QOS Technique Options Parameter Not Defined Priority Queuing Custom Queuing Options N/A The Queue-Size Limit options are: High (Service 6-7) - Default is 20 datagrams. Medium (Service 4-5) - Default is 4 datagrams. Normal (Service 2-3) - Default is 60 datagrams. Low (Service 0-1) - Default is 8 datagrams. Select the Packet Size. * Note: Priority queuing ensures timely delivery of a specific protocol or type of traffic because that traffic is transmitted first. Custom queuing establishes bandwidth allocation for each different type of traffic and is host specific. 8. Click OK to save changes; click Cancel to exit the Create New Interface dialog box without saving changes. 4-9

55 Chapter 4 Discovering Interfaces CajunRules detects Cisco interfaces. To detect an interface: 1. Select the Devices tab. 2. Select the Cisco device you want to discover the interface(s) on. 3. Right-click and select Detect Interfaces from the pull-down menu. Or Select Actions > Detect Interfaces. If CajunRules detects any interfaces, the Detect Interfaces dialog box opens (Figure 4-6). Figure 4-6. Detect Interfaces Dialog Box Creating Services * Note: This is for Cisco devices only. Services are created on the interface, not the entire device, establishing the priority level, coloring (priority level), bandwidth allocation, conformance limiting, shaping, and queuing. Services are referenced in an abstract rule to define what priority the traffic should get. 4-10

56 Managing Devices Service definitions for the pre-defined services are created automatically with default values on all applicable targets. Where applicable, these service definitions can be modified by the user for given targets. The pre-defined services are: Service-0 (low) through Service-7 (high) Deny Permit At the custom policy for a given target, you can make a rule reference a new Service Name, in which case you would have to create this new Service definition on that target To create a new service: 1. Select the Devices tab. 2. Select the Cisco interface on which you want to create the service. 3. Right-click and select Create Service from the pull-down menu. Or Select Actions > Create Service. The Create Service on <xxx> dialog box opens (similar to Figure 4-7). 4-11

57 Chapter 4 Figure 4-7. Create Service Dialog Box (Coloring Tab Shown) * Note: If you did not set queuing (custom or priority) when you created the interface, the Queuing tab does not display. 4. Enter a Name for the service at the bottom of the dialog box. 5. Select the Coloring Style. Options are listed in Tabl e4-3: * Notes: For more information about coloring, refer to your Cisco documentation. Depending on the Coloring Style you select, different options become available. 4-12

58 Managing Devices Table 4-3. Coloring Style Parameters Parameters None Simple Coloring CAR (Committed Access Rate Coloring Description Select None if you do not want any coloring style options. Select Simple Coloring to set direction and color value (Figure 4-8). Options include: Direction: Inbound - Applies to traffic entering the interface. Outbound - Applies to traffic leaving the interface. Both - Applies to all traffic. Color Value - 0 (lowest priority) -7 (highest priority) Select CAR Coloring to set the IP precedence (Figure 4-9). Options include: Direction: Inbound - Applies to traffic entering the interface. Outbound - Applies to traffic leaving the interface. Both - Applies to all traffic. Conforming Rate Criteria - The target rate for the traffic that the policy covers. Rate - The target rate for the traffic that the policy covers. If the traffic flow is greater than this rate, your Exceeding Actions values are applied. Burst Size - The amount allowed to the traffic flow to accommodate bursty traffic. Exceed Burst Size - The amount allowed to the traffic flow to accommodate bursty traffic in excess of the bandwidth allocated to normal bursts. 4-13

59 Chapter 4 Parameters CAR (Committed Access Rate) Coloring (Continued) Description Conforming Action - None - Select None to set no Conforming Action. Color Value - 0 (lowest priority) -7 (highest priority) Continue - Check Continue to indicate that the device should check subsequent policies for conforming flows after applying the Conforming Action. Exceeding Action - None - Select None to set no Exceeding Action. Drop - Color Value Continue - Check Continue to indicate that the device should check subsequent policies for conforming flows after applying the Exceeding Action. Figure 4-8. Coloring Style Option - Simple Coloring 4-14

60 Managing Devices Figure 4-9. Coloring Style Option - CAR Coloring 6. Optional: If the Queuing tab is displayed, select it to set the Queuing values. The Enable Queuing dialog opens (Figure 4-10). * Note: If the Queuing tab is not displayed, continue to Step

61 Chapter 4 Figure Queuing Option 7. Check Enable Queuing. 8. Select the Priority Queuing parameter from the pull-down menu. The Options are: High Medium Normal Low 9. Select the Shaping tab. The Shaping dialog box opens (Figure 4-11). 4-16

62 Managing Devices Figure Shaping Option 10. Check Enable Shaping. 11. Set the Shaping Parameters (Table 4-4). * Notes: Shaping allows you to set bandwidth limit for specifi types of traffic. You can use the arrow keys to enter this information for the Rate, Burst Size, and Exceed Burst Size. Select one of the following for each parameter - bps, Kbps, Mbps. or % of the link. Table 4-4. Shaping Parameter Parameter Rate Burst Size Exceed Burst Size Description Enter the target rate for traffic. Enter the amount of traffic that is allowed to accommodate bursty traffic. Enter the amount of traffic that is allowed to exceed the burst size. 12. Click OK to make changes; click Cancel to exit the Creat Service on <xxx> dialog box without saving changes. 4-17

63 Chapter 4 Managing Cisco Devices and Interfaces CajunRules can detect the device interfaces when the device is created in CajunRules, and on user request thereafter. If you add or remove interfaces to the device, you must instruct CajunRules to rediscover the interfaces of that device, in order to keep CajunRules synchronized with the actual device interfaces. Importing Devices If CajunRules runs the process of rediscovering the device interfaces, and finds a new interface that was not known before, the interface is added to the interface list of the device. It is not assigned to any policy domain until you assign it to one. If CajunRules discovers that a detected interface no longer exists on the device, it is removed from CajunRules. For more information on Cisco devices, refer to the product documentation for that device. * Note: This applies to Cajun P550, P880, and P330 devices only. CajunRules supports the ability to import a list of IP addressable devices and other parameters from a Comma Separated Variable (CSV) file, from CajunView, and ldif formatted files through the Auto Import of Device Information function. An Auto Import of Device Information option is available on the menu of CajunRules. Select a file, and the following entries are read: SNMP Agent IP Address of the device Read/Write community string and ID of the device The import process creates a device object from each entry, and verifies the device. If the device is reachable, the object is completed with the information obtained from the device, potentially overriding the device type. The object is then added to the CajunRules Devices database. If the device is reachable, but not a supported device type, it is not added. If the device is not reachable, the import function displays a list, upon completion, of entries that were not successfully added. Once the device file is read, the Device tree is populated with these devices. 4-18

64 Managing Devices To import devices: 1. Select File > Import Devices. The Import Devices dialog box opens (Figure 4-12). Figure Import Devices Dialog Box 2. Select the file to import. 3. Click Import Devices to import; click Cancel to exit the Import Devices dialog box without saving changes. 4-19

65 Chapter 4 Creating Device Groups You can group devices of the same family together for easier policy assignment and management of enforcement targets. For example, you may want to manage all devices from the Cajun P550 family in the same way, or deploy the same policy to all P550 devices. To create a device group: 1. Select the Devices tab. 2. Highlight the Device Groups folder. 3. Right-click and select New Device Group from the pulldown menu. Or Select File> Create > Device Group. The Create New Device Group dialog box opens (Figure 4-13). Figure Create New Device Group Dialog Box 4. Enter a Name for the Device Group in the Name field. 5. Select a family of devices from the Device Family pull-down menu. 6. Select the Software Revision for this group. 7. Select the Interface Type from the pull-down menu (Cisco Only). 4-20

66 Managing Devices Deleting a Device Group 8. Enter the Interface Rate Minimum (Cisco Only). 9. Click OK when you have completed establishing the group. Click Cancel to exit the Create New Device Group dialog box without saving the changes. To delete a device group: 1. Select the Devices tab. Assigning Device Group Properties 2. Highlight the Device Group you want to delete. 3. Right-click and select Delete. The Confirm Delete dialog box opens. 4. Click OK to complete the deletion; click CANCEL to keep the device group. In order to modify the properties of a device group, the group can not be associated with a policy domain. A few rules apply: All group members must belong to the same domain. Groups cannot include members of different types, such as P550 and a Cisco-device-interface or Cisco interface of different types, such as serial and Ethernet. If a device/interface belongs to a group, then it cannot be a target for configuration of properties or for rule customization. A device/interface cannot belong to more than a single group. Assigning Device Group Properties to a Cajun Device To assign device group properties to a Cajun P550/P880 device: 1. Select the Devices tab. 2. Highlight the Device Group you wish to assign properties to. 3. Right-click and select Properties from the pull-down menu. The Properties of <xxx> dialog box opens (Figu re4-14). 4-21

67 Chapter 4 Figure Cajun P550/P880/P330 Properties Dialog Box 4. Add group members from the Available Group Member list to the Selected Members list in the lower portion of the dialog box. You can remove members from the group as well. 5. Click OK to assign the properties to the selected members; click Cancel to exit the Properties dialog box without saving changes. * Notes: If the member to be added is currently part of a policy domain, it must be removed from the domain in order to be added to the group. When a member is removed from the group, it has its group's properties copied to its private properties, and then is no longer associated with the group. Custom rules are also copied to the individual properties of a target upon removal from a device group. The removed target may now be individually configured, rule customization modified, and/or added to a domain. 4-22

68 Managing Devices Assigning Device Group Properties to a Cisco Device To assign device group properties: 1. Select the Devices tab. 2. Highlight the Device Group you wish to assign to a domain. 3. Right-click and select Properties from the pull-down menu. The Properties of <xxx> for a Cisco device dialog box opens (Figure 4-15). * Note: This dialog box may vary, depending on the QoS technique. Figure Cisco Properties Dialog Box 4-23

69 Chapter 4 Table 4-5. Queuing Options Option Not Defined Priority Queuing Custom Queue Parameters Description No additional information is needed. Queuing is not defined. Select the Priority Queuing Limits: Service-0 and service-1 are mapped to 'low' priority. Service-2 and service-3 are mapped to 'regular' priority. Service-4 and service-5 are mapped to 'medium' priority. Service-6 and service-7 are mapped to 'high' priority. Set the Packet Size to distinguish the queuing. 4. Add group members from the Available Group Member list to the Selected Members list in the lower portion of the dialog box. You can remove members from the group as well. 5. Click OK to assign the properties to the selected members; click Cancel to exit the Properties dialog box without saving changes. 4-24

70 Managing Devices Managing Groups of Devices You can manage groups of devices by manipulating the contents of a deployed device group or managing the properties of a device group. Manipulating the Contents of a Deployed Device Group A deployed device group is a group that belongs to a domain with a deployed policy. You can manage devices as a group in the domain (assigning to and removing from), delete device groups, rename device groups, and customize the policy for the domain through this option. Managing the Properties of a Device Group If you select Properties on a device group, a dialog box displays the View pane containing all objects currently part of the device group, and the Tree pane contains all objects not part of the device group that share the same attributes as the device group (i.e., model). In this pane you can designate the objects that you wish to be part of the group. The result is objects being added to the group, objects being deleted from the group, and objects being moved from one group to another. For each object being deleted from a group, a confirmation box appears asking you what to do with the policy on the device displayed. For a case where multiple objects are being deleted, this is presented in a single screen that has a list of all the affected devices. After confirmation, the affected devices are removed from the group in the Devices tree, and repopulated to their actual parent in the tree (either an actual device if it is an interface, or the Devices root tree if i is a router). For each object being moved, a confirmation box appears asking if you really want to move the device from one group to another. For a case where multiple objects are being moved, they are treated singly For each object being added to the deployed group, the object, and if multiple objects, the entire group has to be validated on the domain. 4-25

71 5 Creating Policies and Rules Overview Policies and their included rules allow you to effectively manage your defined networks, subnets, user groups and applications at specified times. The management of network policies and rules involves devices and domains as well. Once domains are created and policies are deployed on them, the devices within those domains are also governed by those policies. This chapter provides information on how to set up abstract policies, create customized policies if necessary, and add rules to the policies to manage the domains, devices, and applications in your network. It contains the following sections: Creating an Abstract Policy Creating Custom Policies Creating Rules Creating an Abstract Policy A policy is a label or a name for a set of actions (or rules) that you want to take place at a certain time, related to a network activity. You must select a default rule for the policy. A policy must have a least one active rule in order for it to be deployed. To create an abstract policy: * Note: You must create an abstract policy before you can customize it. 1. Select the Policies tab. 2. Highlight the Policies icon. 5-1

72 Chapter 5 3. Right-click and select New Policy. Or Select File > Create > Polic. The Create New Policy dialog box opens (Fi gure5-1). Figure 5-1. Create New Policy Dialog Box 4. Enter the Name of your policy. 5. Select a Default Action from the pull-down menu. * Note: The options are Allowing or Denial. Allowing allows all traffic to be forwarded; Denial prevents all traffic from being forwarded. CAUTION If you create and enforce a policy with only a Denial action, access to the device is effectively blocked for ALL, restricting subsequent management of the device to its Console. 6. Click OK to save the changes; click Cancel to exit the Create New Policy dialog box without saving changes. The name of your new policy now appears in the tree structure of the Tree pane. You can now edit the policy to add rules to it. If you want to customize your policy, refer to "Creating Custom Policies", later in this chapter. 5-2

73 Creating Policies and Rules Creating Custom Policies To create a custom policy: 1. Select the Policies tab. 2. Highlight the Policy you want to customize. 3. Right-click and select New Custom Policy. Or Select File > Create > Custom Polic. The Customize <x-axes> dialog box opens (Figu re5-2). Figure 5-2. Customize <xxx> Dialog Box * Note: When customizing a policy, it must be applied to a target 4. Select a Device, Interface, or Device Group to customize. 5. Click OK to customize the policy; click Cancel to exit the Customize <xxx> dialog box without saving changes. 5-3

74 Chapter 5 Creating Rules To create a rule for a policy: 1. Select the Policies tab. 2. Double-click the policy you want to create the rule for. The Contents of Policies/<Policy Name>, with the Rule Editor, appears in the View pane (Figure 5-3). This also enables the New button at the bottom of the View Pane. Figure 5-3. Contents of Policy (with Rule Editor) Rule Editor 3. Click New at the bottom of the View pane. A generic rule line is added to the dialog box (Figure 5-4). 5-4

75 Creating Policies and Rules Figure 5-4. View Pane with Policy Editor Enabled New Rule Line 4. Enter the Name of the rule in the Name field. 5. Select the Service level from the pull-down menu. Options are: Deny Permit Service 0 (lowest) - 7 (highest) * Note: Service level is the hardware queuing on the device. If packets have 802.1P tagging, the service level queues are 0-3 or Select the Activation Time from the When pull-down menu. * Note: To create new Activation Times, refer to "Using the Activation Period Wizard", in Chapte r7. 7. Optional: Check Application Condition to conditionally apply the rules, for example, to control traffic between subnets. 8. Optional: Check Bidirectional if you want this rule to move both ways. Otherwise, the rule moves in one direction only, and instead of two unidirectional rules, there is one rule. 5-5

76 Chapter 5 9. Optional (Cisco Only): Check the Precedence Condition box and select a precedence value (0-7). 10. Optional: Check Established Sessions. 11. Press F2 to accept the changes. 12. (Optional): Click New at the bottom of the View pane and repeat steps 4-11 to add more rules. 13. Click Apply to save the rules; click Reset to discard any changes you made. An example of a created rule is shown in Figure5-5. Figure 5-5. Contents of Policy with Rules Displayed Rule The icons in the Status Column provide information about the rule (Table 5-1): 5-6

77 Creating Policies and Rules Table 5-1. Status Column Icons Icon Description Rule is unmodified. Rule has been modified. Rule is new. Rule is marked for deletion. You must click Apply to save the rule. At that time the status icon may change. Click Undo to reinstate the rule to its original form. To change the order of the rules, highlight a rule and either click the appropriate button at the bottom of the dialog box, or selec Actions > Move Rule Up > Move Rule Down. When you alter the order of the rules, the Status Column turns yellow until you click Apply. * Note: The device processes the rules from the top of the list down. Priority is assigned to rules based on order. In other words, the first applicable rule wins. Editing Rules To edit an existing rule: 1. Select the Policies tab. 2. Double-click the policy that contains the rule you want to edit. The Contents of Policies/<Policy Name>, with the Rule Editor, appears in the View pane (Fig ure5-5). 3. Select the Rule you want to change. 4. Change the necessary information in the Rule Editor (Figure 5-3). 5. Press F2 to accept the changes. 6. Click Apply at the bottom of the View pane to apply the changes; click Reset to reinstate the original rule. * Note: Changes cannot be made to policies that are already deployed. 5-7

78 Chapter 5 Deleting Rules To delete a rule: 1. Select the Policy tab. 2. Highlight the policy containing the rule you want to delete. A list of rules appears in the View pane. 3. Highlight the rule you want to delete. 4. Click Delete at the bottom of the View pane. A red X appears next to the rule, indicating it has been marked for deletion. 5. Click Apply at the bottom of the View pane in order to affect the delete; click Undo to reinstate the rule. 5-8

79 6 Managing Domains Overview Once you set up your devices (Cajun switches) and interfaces (Cisco routers), you can add them to policy domains and apply policies to them. A CajunRules policy domain is a collection of devices and interfaces to which you can apply policies. Only entities that are enforcement targets can be put in a domain. CajunRules allows you to define different policies for the differen interfaces of a Cisco device, by allowing you to assign interfaces to different domains or customize a single policy differently for each device. You can assign individual device interfaces to policy domains. * Note: All members of a domain share the same abstract policy and the same Time Zone. However, the policy can be customized for individual members or sub-groups of the domain. This chapter contains the following information: Creating a Domain Assigning Devices, Interfaces, and Device Groups to Domains Deploying/Changing Policies on a Domain Validating Devices, Domains, and their Policies 6-1

80 Chapter 6 Creating a Domain To create domains, 1. Select the Domains tab. 2. Highlight the Domain folder. 3. Right-click and select New Domain. Or Select File > Create > Domain. The Create New Policy Domain dialog box opens (Figure 6-1). Figure 6-1. Create New Policy Domain Dialog Box 4. Enter the Name of your new domain. 5. Select a Policy you wish to enforce on this domain. * Notes: You can change the policy by deploying a different one. Refer to "Creating an Abstract Policy" or "Creating Custom Policies" in Chapter 5. The selected policy is not automatically deployed. To deploy the policy, refer to "Deploying/Changing Policies on a Domain", later in this chapter. 6. Select a Time Zone that is shared by all devices in the domain. 6-2

81 Managing Domains * Notes: The Time Zone normalizes the time in an active policy between the CajunRules Policy Server and the device. By default, the policy domain has a time zone attribute the same as the CajunRules server host's time zone, referred to as Absolute Time. A domain-local-time activation period means that CajunRules schedules the rule (the one referencing this time period) based on the policy domain's specified time zone (i.e., the rule triggers at the policy domain's local time-of-day specified in the activation period). Absolute Time triggers the rule at the CajunRules server's time zone. If the time zone attribute is not present, it is interpreted the same as the Absolute Time zone (i.e., the Time Zone of the system on which the Policy Server is running is used). 7. Click OK to save the changes; click Cancel to exit the Create New Policy Domain dialog box without saving changes. Deleting a Domain To delete a domain: 1. Select the Domains tab. 2. Highlight the Domain you wish to delete. 3. Right-click to access and selec Delete. The Confirm Delete dialog box opens (Figure 6-2). * Note: If you attempt to delete a domain that has enforced policies, a dialog box opens, indicating that devices are assigned to that domain. This gives you the option of deleting certain policy domains from governing the device. 6-3

82 Chapter 6 Figure 6-2. Confirm Delete (Domain) Dialog Box Viewing Detailed Status 4. Select Clear to delete the domain; selec Current to keep the device in the current domain * Note: You cannot clear Cisco devices. 5. Click OK to delete the domain; click Cancel to exit the dialog box without saving changes. To view the status of the domain: 1. Select the Domains tab. 2. Highlight the Domain you want to view the status of. 3. Right-click and select Detailed Status from the pull-down menu. The Detailed Status pane opens at the bottom of the CajunRules Console window. For more information on Detailed Status, refer to "Detailed Status" in Chapter

83 Managing Domains Assigning Devices, Interfaces, and Device Groups to Domains Once the target (Device, Interface, or Device Group) is established, you can assign it to domains and deploy policy on it. Adding a member to a group which is currently associated to a domain is equivalent to adding the device to the domain; the group's properties and custom rules are used in combination with the new target to validate and enforce the domain policy. Prior individual target configured properties and rule customizations are no longer applicable to the new member. Groups are collections of devices or interfaces within a domain. Grouping allows you to configure the same thing across multiple devices/interfaces, without the burden of repeating the same configuration multiple times. Groups are used for two purposes: 1. Configuration of Properties - The property configured must be in the common subset supported by all group members. The property you see by default, before configuring any value, depends on what is currently on the groups members. 2. Rule Customization - Groups can be chosen as targets for customization of rules. The actions you chose are for all group members. Adding a Device, Interface, or Device Group to a Domain The devices you add to a domain are governed by the policies of the domain. Validation is performed automatically when a policy is associated with a domain, before a change is enforced, and whenever a device is added to a domain (as domains always have an enforced policy). Validation pertains to all policy rules defined for any Activation Period. You receive feedback about validity and enforceability of the policy at the time the policy is defined, and not just later at activation time. If an error is discovered at activation time, the error is logged in the CajunRules Event Log, the activation fails, and an activation failure status is shown for the device. You can add a device, interface, or device group to a domain through the Domains tab or the Devices tab. 6-5

84 Chapter 6 Adding a Device to a Domain Using the Domains Tab To add a device, interface, or device group to a domain using the Domain tab: 1. Select the Domains tab. 2. Highlight the domain you want to add the device to. 3. Right-click and select Set Targets from the pull-down menu. Or Select Actions > Set Targets. The Set Targets for <domain name> dialog box opens (Figure 6-3). Figure 6-3. Set Targets for <domain name> Dialog Box 4. Highlight the device, interface, or device group in the Available Targets list that you want to add to the domain. 5. Click Add. The Device moves to the Selected Targets pane. * Note: If this device already belongs to a domain, CajunRules assumes you wish to move the device to a new domain, and the following dialog box opens (Figu r e6-4). Otherwise, the device is added accordingly and the Validation screen opens (Figure 6-5). 6-6

85 Managing Domains Figure 6-4. Confirm Device Move Dialog Box a. Click Yes. The Validation of Policy <xxx> (Figur e6-5) dialog box opens, stating that the targets passed validation. b. Click Yes to add the target to the domain. Figure 6-5. Validation Screen * Notes: Expand the Tree view to see the targets on the Domain. For more information on validation, refer to "Validating Devices, Domains, and their Policies", later in this chapter. 6-7

86 Chapter 6 Adding a Device to a Domain Using the Devices Tab To add a device, interface, or device group to the domain from the Devices tab: 1. Select the Devices tab. 2. Highlight the Device Group you wish to assign to a domain. 3. Right-click and select Assign to Domain > domain from the pull-down menu. * Note: If this device already belongs to a domain, CajunRules assumes you wish to move the device to a new domain, and the following dialog box opens (Figu r e6-4). Otherwise, the device is added accordingly and the Validation screen opens (Figure 6-5). 4. Click Revalidate to revalidate the target; click Dismiss to exit the Validation screen. * Note: For more information on validation, refer to Validating Devices, Domains, and their Policies", later in this chapter. Deleting a Device, Device Group, or Interface from a Domain To delete a device or interface from a domain: 1. Select the Domains tab. 2. Highlight the Domain the target is in. 3. Select the target you wish to delete. 4. Right-click and select Delete from the pull-down menu. A Confirm Deletion dialog box opens (Figure 6-6). 6-8

87 Managing Domains Figure 6-6. Confirm Delete (Device) Dialog Box 5. Select Clear to remove the policy data from the device, or Current to leave the device in the current state. 6. Click OK to activate the deletion; click Cancel to keep the device in the domain. Moving a Device, Interface, or Device Group from One Domain to Another Domain In order to move a target, it must already be a part of a domain. * Note: You cannot move an entire Cisco device. You must move interfaces. To move a target: 1. Select the Devices tab. 2. Select the target you want to move to another domain. 3. Select Actions > Assign to Domain. A confirmation dialog opens, asking you if you want to move the device from one domain to another. 4. Click Yes to move the target; click No to keep the target in the domain. 6-9

88 Chapter 6 * Note: If you click Yes, the device is validated against the proposed new domain's policy. Refer to "Validating Devices, Domains, and their Policies", later in this chapter. To verify that the device, interface, or device group has been moved to the new domain: 1. Select the Domains tab. 2. Highlight and expand the domain that the target was moved to. The target should be listed under that Domain in the Tree pane. Deploying/Changing Policies on a Domain An abstract policy is a policy that could be applied to all devices in a domain. The abstract policy may have customizations of it on one or more devices that span multiple domains where the policy is deployed. To deploy a policy on a domain: 1. Select the Domains tab. 2. Highlight the Domain you want to deploy the policy on. 3. Right-click and select Deploy Policy > <policy name>. The Enforcement Information for Policy <xxx> dialog box opens (Figure 6-7). * Note: Validation is started automatically. If the policy is valid, the Policy is Valid dialog box opens. 4. Click Yes to deploy the policy; click No to exit the dialog box without deploying the policy. 6-10

89 Managing Domains Figure 6-7. Enforcement Information for Policy <xxx> Dialog Box * Note: If the policy is validated, Deploy Now becomes enabled. If validation is not successful, refer to the detailed status window of an individual target. For more information on validation, refer to "Validating Devices, Domains, and their Policies", later in this chapter. 5. Click Deploy Now to deploy the policy; click Cancel to exit the Enforcement Information for Policy <xxx> dialog box without deploying the policy. Deleting a Policy To delete a policy: 1. Select the Policies tab. 2. Highlight the Policy you want to delete 3. Right-click and select Delete from the pull-down menu. The Confirm Delete dialog box opens. 4. Click Yes to delete the policy; click No to retain the policy. 6-11

90 Chapter 6 * Note: If the policy you choose to delete is already deployed on domains, you receive the following message (Figu re6-8): Figure 6-8. Cannot Delete Policy Message Otherwise, you receive a Confirm Delete message ensuring this is the policy you wish to delete. Validating Devices, Domains, and their Policies Devices can live outside a domain but then they are not able to have any policy applied to them. A device/interface can be put into a single domain only. Different interfaces of the same device can be put into different domains if they need to have different policies applied to them. A policy can be associated with one or more domains. Then for each of those domains the policy can be customized for individual targets (within that domain) and enforced. There are three possible states for policies: Invalid - At least one mandatory rule cannot be enforced on at least one of the devices, or another validation problem has been encountered, such as bandwidth allocation definitions exceeding the allowed limit, the policy cannot be enforced. You can try to customize the policy to make it valid/partial. This can include disabling certain rules on certain devices, making them not mandatory, or modifying service definitions. View the Validation Results screen or the Translation-View of the different devices in the domain to discover what actually must be changed. 6-12

91 Managing Domains Partial - The policy is not invalid, but cannot be enforced in full on all devices. This means that at least one nonmandatory rule cannot be enforced on at least one of the devices. You can attempt to customize the policy, or enforce it as is. Valid - The policy can be enforced in full on all devices. * Note: If a rule is mandatory for an enforcement target, and it cannot be applied on a device, the policy is considered invalid and is rejected by CajunRules. The Validation summary of the policy on a domain is a result of the validity status of individual objects. For example, if the validity status is Invalid on any device at any time, the validity status of the policy on a domain is Invalid. You can view the validity status of each device/interface for each time requested, using the same values as described above. You can also validate a policy by requesting to view the Translation- View for a device. In this case, CajunRules validates the policy only for the time period for which the translation-view is requested. To validate Cajun P550, P880, and P330 devices, or Cisco interfaces: 1. Select the Devices tab. 2. Select the P550, P880, or P330 device, or the Cisco interface you want to validate. 3. Right-click and select Validate > policy name from the pulldown menu. Or Select Actions > Validate > policy name. The Validation for Policy <xxx> screen opens (Figure 6-9). 6-13

92 Chapter 6 Figure 6-9. Validation for Policy <xxx> Screen Tree Pane View Pane 4. Double-click on a policy in the Tree pane. The Policy information is displayed in the View pane. Two tabs, Rules and Translation, appear at the bottom of the screen (Figure 6-10). Figure Validation for Policy <xxx> (Rules Tab Shown) 6-14

93 Managing Domains * Note: When the Rule tab is displayed, the rule and any error information is displayed in the View pane. The rules, their condition, and their service are displayed in the tab pane. 5. Select the Translation tab to view a summary of the access lis (Figure 6-11). This is a summary of the actual CLI commands that go to the target Figure Validation for Policy <xxx> (Translation Tab Shown) 6. Click Revalidate to refresh the information; click Dismiss to exit the Validate dialog box. 6-15

94 7 Using the CajunRules Tools Overview The Event Browser The following tools are available to assist you in using CajunRules. Event Browser Activation Periods Protocol Lists Port List Administrator List The Event Browser allows you to view the event logs for each event that occurs in your network, and search a large database of stored events for quick diagnosis of network problems. CajunRules captures and logs the actions of an administrative user and displays these actions and the user's login ID in the Even Browser. For each action, the log captures: a brief message, severity, date-time, source, the policy domain of the action (if applicable), and the user's login ID obtained from the Policy Engine. Not all user actions generate an event; only significant actions do. Not all reported events are user-initiated; some are initiated by the event service, DOM, or the Policy Engine. Therefore, events are typed as user-initiated or non-user (system) initiated. Figure 7-1 shows an example of the Event Browser. 7-1

95 Chapter 7 Figure 7-1. Event Browser Window Table 7-1 describes information displayed in the Event Browser. Table 7-1. Event Browser Column Severity Date-Time Source Policy Domain Message User Description There are three options: Information Warning Critical Lists the date and time the event occurred. Gives the source address/name of the entity sending the event. Lists the policy domain that events are generated from. A brief description of the event, for example, the IP address of the device that was added. The Login ID of the individual who initiated the action. Note: If the field is blank, the action was not initiated by a user. 7-2

96 Using the CajunRules Tools Once the maximum number of events is reached in the Event Log, each new event is added to the top of the event table. The earliest event, shown at the bottom, is then dropped to keep the number of events in the table constant. You can organize the information contained in the Event Browser. To change the order of the columns, click on the column heading and drag to it to the position you want. To sort the information in the columns, double click on the column heading where you want to sort the information. The Event Browser has its own menu items (Table 7-2): Table 7-2. Event Browser Menus Menu File Edit View Options Help Options Save - Allows you to save the viewed events into a file on the same system as your CajunRules Console application. Print - Allows you to print a copy of the Event Browser information. Close - Allows you to exit the Event Browser. Query Event - Opens the Query Dialog box where you can select the criteria you wish to view. Preferences > Save Settings on Exit - Allows you to save settings between subsequent launches of the Event Browser. Refer to "Customizing the Event Browser Window", later in this chapter for more information. Status Bar - Allows you to enable/disable the status bar at the bottom of the window. Refresh Events - Updates the information on the screen. Log Setting - Allows you to set the number of events you wish to view. Refer to "Setting the Lo Size", later in this chapter for more information. Refresh Mode - allows you to set the refresh option for manual or automatic. About - Provides the version of CajunRules CajunRules Help - Allows you to access the CajunRules online help. 7-3

97 Chapter 7 Querying Events You can select the information regarding events that you wish to view in the Event Browser. 1. Select Tools > Event Browser from the CajunRules Console window. The Event Browser window opens (Figur e7-1). 2. Select Edit > Query Events. The Query Dialog box opens (Figure 7-2). Figure 7-2. Query Dialog Box 3. Select the range of time you wish to view the events. * Note: The View From and View Through options allow you to establish the range of events you wish to view in the Event Browser. You can also specify the Date and Time of the events you wish to view if you have selected the Events On or Events To options. 4. Select the Severity Level you want to query on all events. The options are All, Informational, Warning, and Critical. 5. Enter the Source on which you wish to query for information. 7-4

98 Using the CajunRules Tools * Note: The Source is an IP address, or you can add a Policy Domain to make the inquiry more refined. 6. Enter the Policy Domain on which you wish to query for information. * Note: The Policy Domain must be an existing Policy Domain. The Policy Domain and the Source are case-sensitive. 7. Enter the User on which you wish to query for information. 8. Click OK to start the query; click Cancel to exit the Query Dialog box without saving changes. * Notes: You can open a maximum of four query windows, one per severity. If the query-related criteria is too broad, an error message appears. Customizing the Event Browser Window You can customize your Event Browser windows and then save the settings. To customize your Event Browser window: 1. Select Tools > Event Browser from the CajunRules Console window. The Event Browser window opens (Figur e7-1). 2. Complete the necessary customizations: Click and drag to adjust the width and height of the Even Browser windows. Select Options > Refresh Mode (select Auto to automatically refresh, or Manual to refresh on demand). Click and drag the column headings to move to a new position or resize the column width. Select View > Status Bar to view or hide the status bar at the bottom of the Event Browser. 7-5

99 Chapter 7 Setting the Log Size Select Options > Log Settings to change the number of log entries that appear in the Event Browser windo Refer to "Setting the Log Size", later in this chapter for more information. 3. Select Edit > Preference > Save Setting on Exit to save the settings in the Event Browser. To change the Event Browser log size: 1. Select Tools > Event Browser from the CajunRules Console window. The Event Browser window opens (Figur e7-1). 2. Select Options > Log Setting. The Log Size Setting Dialog opens (Figure 7-3). Figure 7-3. Log Size Setting Dialog Box 3. Enter the number of lines you want to display in your Event Browser log by entering a number in the Log Size Setting field or by using the up and down arrows. * Note: The default Log Size Setting is 50 Lines; the minimum is 50, the maximum is 5000 lines. 4. Click OK to save the log size setting changes. Click Cancel to exit the Log Size Setting dialog box without saving changes. If you click OK, a confirmation dialog opens. 5. Click OK to save the changes; click Cancel to exit the Log Setting Size dialog box without saving changes. 7-6

100 Using the CajunRules Tools Saving Event Browser Information to a File You can save the Event Browser information to a file that can be viewed by a text editor. To save Event Browser information to a file: 1. Select Tools > Event Browser from the CajunRules Console window. The Event Browser window opens (Figur e7-1). 2. Select File > Save from the Event Browser. The Save dialog box opens (Figure 7-4). Figure 7-4. Save Dialog Box 3. Select the folder where you want to save the information. 4. Click OK to save the changes; click Cancel the exit Save dialog box without saving changes. 7-7

101 Chapter 7 Using the Activation Period Wizard The Activation Period Wizard allows you to create, modify, and delete time periods (Activation Periods) during which rules apply to your network. Once an Activation Period is created, you can apply i to a Rule. This wizard presents a series of screens prompting you for for information is in the When area of the rule editor. Creating a New Activation Period To create a new Activation Period: 1. Select Tools > Activation Periods from the CajunRules Console window. The Activation Period Manager Wizard screen opens (Figu re7-5). Figure 7-5. Activation Period Manager * Note: The Activation Period of Always is a default activation period supplied by CajunRules. 2. Click New to add another activation period. The Activation Period Wizard screen opens. 3. Enter the Name of the new Activation Period you are establishing. 7-8

102 Using the CajunRules Tools 4. Click Next. In this screen, you can select the length of time you want the rules to apply to the network. You can select either Daily, Weekly, Monthly, or One Time. Depending on which option you select, you move to specific screens in the wizard to correctly establish the Activation Period. 5. Use Table 7-3 to complete the Activation Wizard. * Note: When setting Activation periods with Start and Stop times, you must make sure the Stop time is at least 15 minutes later than the Start time. Initially, they are the same time, and unless they are changed, the activation period does not start. Table 7-3. Setting Activation Period If You Selected: Daily Complete These Steps: a. Select Every Day, Week Days, or Weekends. b. Click Next. c. Enter the Start Time. Note: You can use the arrow keys to change the start and stop times. Put the cursor next to the Hour to change the hour or the minutes to change the minutes. You can use the keyboard arrow keys to change the start and stop dates. If the start or stop date check box is not checked, Immediately becomes the default. d. Enter the Stop Time. e. Enter the Start Date. f. Enter the End Date. g. Select the Time Zone from the Time Zone pull-down menu. Server Time Zone Domain Time Zone h. Click Finish. 7-9

103 Chapter 7 If You Selected: Weekly Complete These Steps: a. Select the days to activate. You can select more than one. b. Click Next. c. Select the Days of The Month. d. Enter the Start Time. Note: You can use the arrow keys to change the start and stop times. Put the cursor next to the Hou to change the hour or the minutes to change the minutes. You can use the keyboard arrow keys to change the start and stop dates. If the start or stop date check box is not checked, Immediately becomes the default. e. Enter the Stop Time. f. Enter the Start Date. g. Enter the End Date. h. Select the Time Zone from the Time Zone pull-down menu. Options are: Server Time Zone Domain Time Zone i. Click Finish. 7-10

104 Using the CajunRules Tools If You Selected: Monthly Complete These Steps: a. Select the Month(s) to activate. Note: You can click Select All to select all 12 months or Clear All to deselect selecte months. b. Click Next. c. Enter the Start Time. Note: You can use the arrow keys to change the start and stop times. Put the cursor next to the Hour to change the hour or the minutes to change the minutes. You can use the keyboard arrow keys to change the start and stop dates. If the start or stop date check box is not checked, Immediately becomes the default. d. Enter the Stop Time. e. Enter the Start Date. f. Enter the End Date. g. Select the Time Zone from the Time Zone pull-down menu. Options are: Server Time Zone Domain Time Zone h. Click Finish. One Time a. Select the Start Date. b. Select the End Date. c. Select the Start Time. d. Select the Stop Time. e. Select the Server Time Zone: Server Time Zone Domain Time Zone f. Click Finish. 7-11

105 Chapter 7 * Notes: Daily and One Time option : - When a range spans midnight, it includes parts of two successive days. For example, if the range extends from 9 PM until 8 AM on Monday and Tuesday, the policy is active fro midnight Sunday until 8 AM Monday, from 9 PM Monday until 8 AM Tuesday, and from 9PM until 11:59:59 Tuesday. Daily options - If you do not select specific dates, the defaults are Start Immediately and No Expiration. 6. Click Finish in the final Wizard screen; click Cancel to exit the Wizard without saving changes. 7. Click Close when you are finished with the Activation Period function. If you wish to apply this new Activation Period to a rule: 1. Select the Policies tab. 2. Click on the rule in the View pane you wish to modify. 3. Select a new Activation Period from the When pull-down menu. 4. Press F2 to accept. Modifying Activation Periods 5. Click Apply. The changes are then applied to the rule(s) you highlighted and modified. Click Cancel to exit the Activation Period Wizard without saving any changes. To modify an Activation Period: 1. Select Tools > Activation Periods from the CajunRules Console window. The Activation Period Manager screen opens (Figu re7-5). 2. Select the Activation Period you want to modify. The Modify button enables. 3. Click Modify. The Activation Period Wizard - Period Name screen opens. 4. Follow steps 3-6 of "Creating a New Activation Period", earlier in this chapter to change the information. 7-12

106 Using the CajunRules Tools Deleting an Activation Period 5. Click Finish in the final Wizard screen. 6. Click Close when you are finished with the Activation Period function. To delete an Activation Period: 1. Select Tools > Activation Periods from the CajunRules Console window. The Activation Period Manager screen opens (Figure 7-5). 2. Select the Activation Period you want to delete. 3. Click Delete. The Confirm Delete dialog box opens. 4. Click Yes to delete the Activation Period; click No to exit the Confirm Delete dialog box without deleting the activation period. 5. Click Close when you are finished with the Activation Period function. Show References on an Activation Period To show references on an activation period: 1. Select Tools > Activation Periods from the CajunRules Console window. The Activation Period Manager screen opens (Figure 7-5). 2. Highlight the Activation Period you want to search on. 3. Click Show References. The Search Results screen for that Activation Period displays at the bottom of the CajunRules Console window. The Show References area highlights all devices that are affected by that activation period. 7-13

107 Chapter 7 Managing the Protocol List You can add frequently used protocols to the default Protocol List. When creating new Applications in the Tree pane in the Networks tab, these protocols are available from a pull-down menu, for use in CajunRules to manipulate traffic from that protocol. For a list of industry standard protocols, access: To add a new protocol: 1. Select Tools > Protocol List from the CajunRules Console window. The Protocol List Manager opens dialog box (Figure 7-6). * Note: The default protocols are the only ones listed until you add others. Figure 7-6. Protocol List Manager Dialog Box 2. Click New. The Create New Protocol dialog box opens (Figure 7-7). 7-14

108 Using the CajunRules Tools Figure 7-7. Create New Protocol Dialog Box 3. Enter the Name of the protocol you wish to add to the Protocol List. 4. Enter the Value of that protocol from: protocol-numbers web site. * Note: The value is the Decimal Number you see in the protocol numbers web page. Each protocol has a value assigned to it which needs to be input in the Value field in this dialog box. For example, HTTP, the protocol for transferring Web pages, has an industry standard of Click OK to save the new protocol in the Protocol List; click Cancel to exit the Create New Protocol dialog box withou saving changes. 6. Click Close to exit the Protocol List Manager. * Notes: To view the list of protocols, select the Networks tab in the Tree pane, and select Application > New Application. The list of available protocols is displayed in the pull-down menu of the Create Application dialog box. From here, you can assign the newly added protocol to an Application. To restore the default list of protocols, click Defaults in the Protocol List Manager dialog box. 7-15

109 Chapter 7 To delete a protocol from the list: Managing the Port List 1. Select Tools > Protocol List from the CajunRules Console window. The Protocol List Manager dialog box opens (Figure 7-6). 2. Select the protocol you want to delete. 3. Click Delete. A confirmation message displays. 4. Click Yes to delete the protocol; click No to keep the protocol in the list. 5. Click Close to exit the Protocol List Manager dialog box. The port list contains a list of registered standard ports and their values. There are new port numbers added constantly for new and changing protocols. CajunRules allows you to add to the list of accepted protocols. You can add additional ports to the default ports list, and then select them from the pull-down menu of the Port field when you are creating Applications. Refer to the following web site for more information and a list of registered ports: To add a new port: 1. Select Tools > Port List from the CajunRules Console window. The Port List Manager dialog box opens (Figure 7-8). * Note: The default ports are the only ones listed until you add others. 7-16

110 Using the CajunRules Tools Figure 7-8. Port List Manager Dialog Box 2. Click New. The Create New Port dialog box opens (Figure 7-9). Figure 7-9. Create New Port Dialog Box 3. Enter the Name of the new port you want to add to the port list. 4. Enter the Value of that port from: * Note: The value is part of the Decimal Number you see in the port number web page. Each port is assigned a well-known port number by IANA. This value needs to be input in the Value field in this dialog box. 7-17

111 Chapter 7 5. Click OK to save the new port in the Port List; click Cancel to exit the Create New Port dialog box without saving changes. 6. Click Close to exit the Port List Manager. * Notes: To view the list of ports, select the Networks tab in the Tree pane, and select Application > New Application. The list of available protocols is displayed in the pull-down menu of the Create Application dialog box. From here, you can assign the newly added port to a particular application. To restore the default list of ports, click Defaults in the Port List Manager dialog box. To delete a port from the list: 1. Select Tools > Port List from the CajunRules Console window. The Port List Manager opens (F igure7-8). 2. Select the port you want to delete. 3. Click Delete. A confirmation message displays. 4. Click Yes to delete the port; click No to keep the port in the list. 5. Click Close to exit the Port List Manager dialog box. Managing the Administrator List You can add new administrators, delete administrators, or change the privileges of administrators already in the list. Initially the administrator, CRAdmin, is the only administrator in the list. 7-18

112 Using the CajunRules Tools Adding New Administrators To add a new administrator: 1. Select Tools > Administrator List from the CajunRules Console window. The Administrator List Manager dialog box opens (Figure 7-10). Figure Administrator List Dialog Box 2. Click New. The New Administrator dialog box opens (Figure 7-11). Figure New Administrator Dialog Box 7-19

113 Chapter 7 Modifying Administrator Information 3. Enter the Login Name the new administrator logs in with. 4. Enter the new administrator s name in the appropriate fields. 5. Enter the administrator s password and then confirm in the appropriate fields. 6. Click OK to save the new administrator information; click Cancel to exit the New Administrator dialog box without saving changes. 7. Click Close to exit the Administrator List Manager dialog box. To modify an administrator s information: 1. Select Tools > Administrator List from the CajunRules Console window. The Administrator List Manager dialog box opens (Figu re7-10). 2. Click Modify. The Modify Administrator dialog box opens (Figure 7-12). * Note: The Login Name field cannot be changed. Figure Modify Administrator Dialog Box 3. Change the administrator s name in the appropriate fields. 4. Change the administrator s password and then confirm in the appropriate fields. 7-20

114 Using the CajunRules Tools 5. Click OK to save the new administrator information; click Cancel to exit the Modify Administrator dialog box without saving changes. 6. Click Close to exit the Administrator List Manager dialog box. Deleting an Administrator from the List To delete an administrator from the list: 1. Select Tools > Administrator List from the CajunRules Console window. The Administrator List Manager dialog box opens (Figure 7-10). 2. Highlight the administrator you want to delete. 3. Click Delete. The Confirm Delete dialog box opens. 4. Click Yes to delete the Administrator from the list; click No to keep the administrator in the list. 5. Click Close to exit the Administrator List Manager dialog box. Administrator Rights You can assign specific rights to the Administrators in the list. Table 7-4 describes the rights you can assign and what they mean. Table 7-4. Administrator Rights Administrator Right Manag CajunRules Browse CajunRules Users Manag CajunRules Users Description Read/Write privileges for policies, networks, domains, etc., but NOT users. This is the same as Read Only privileges to view user data. This is Read/Write privileges for users. You can read/write users and rules. 7-21

115 Chapter 7 Changing Administrator Rights To assign or change administrator rights: 1. Select Tools > Administrator List from the CajunRules Console window. The Administrator List Manager dialog box opens (Figu re7-10). 2. Click Rights. The Administrator Rights dialog box opens (Figure 7-13). Figure Administrator Rights Dialog Box 3. Select the level of rights you want to grant to the administrators from the Rights pull-down menu (Table 7-4). 4. Click Add Administrators. The Add Administrators dialog box opens. 5. Select the Administrators to whom you want to assign these rights. You can select more than one by holding down the Ctrl key, and selecting the names. 7-22

116 Using the CajunRules Tools 6. Click OK. The names appear in the Grant to: list in the Administrator Rights dialog box. * Note: Continue by assigning more administrators to other privileges, or click OK to close the Administrator Rights dialog box. Or Click Cancel to exit the Administrators Rights dialog box without adding administrators. 7. Click Close in the Administrator List Manager to save the information. Removing Administrator Rights To remove an administrator s rights: 1. Select Tools > Administrator List from the CajunRules Console window. The Administrator List Manager dialog box opens (Figure 7-10). 2. Click Rights in the Administrator List Manager dialog box. The Administrator Rights dialog box opens (Figure 7-13). 3. Select the Administrator you want to remove rights from. 4. Click Remove Administrator. 5. Click OK to remove the rights from the administrator; click Cancel to exit the Administrators Rights dialog box without saving changes. 7-23

117 Chapter 7 Adding QIP Users In addition to importing IP addresses and numbering plans from QIP s databases, you can also import information about specific users already listed in your QIP network environment. To add new QIP users to your CajunRules network: 1. Select Tools > Add QIP Use. The CajunRules Add QIP User dialog box opens (Figur e7-14). Figure Add QIP User Dialog Box 2. Enter the Login Name or Last Name of the user you want to import into CajunRules. 3. Click Find User. The User(s) appears in the Add QIP User dialog box (Figure 7-15). 7-24

118 Using the CajunRules Tools Figure Add QIP User Dialog Box (Users Displayed) 4. Select the user you want to import. 5. Click Add User to add the user to the CajunRules list. A message stating the user has been successfully added displays. Or If the user has more than one IP address, the Select IP to Add dialog box opens (Figure 7-16): a. Check the IP address you want to add. b. Click OK. 6. Click Close to exit from the Add QIP User dialog box. 7-25

119 Chapter 7 Figure Select IP to Add Dialog Box 7-26

120 A Troubleshooting Overview This Appendix contains troubleshooting information for CajunRules. * Note: For troubleshooting information regarding QIP or the LDAP, refer to that specific application s documentation. The CajunRules server fails to connect. If the CajunRules server fails to connect, check the following: Can the server host ping the LDAP server host? Is the ldaphost in the CajunRules/bin/srvprops/ install.properties file set correctly? Is the LDAP server running? Refer to the appropriate LDAP server's documentation for more information. Is the server problem caused by an intermittent network problem? Try restarting the server. Application Error If you receive an error stating that the login is incorrect, check the following: Make sure you are using the correct login and password. Make sure you are connecting to the correct CajunRules server. Make sure you are connected to the correct LDAP server. Make sure Caps Lock is off. A-1

121 Chapter A Device Failed to Execute If you received an error message stating that the device failed to execute, check the following: Make sure the subnet mask is correct Make sure there are not too many ACLs. The maximum number of ACLs is 127. Make sure the TCP check box (Policy tab in the View pane) is not enabled when TCP applications are not being used. QIP Import Fails If you receive an error message after entering the QIP password, check the following: Make sure your CajunRules server can reach the QIP enterprise server. Make sure the Schedule Service (qipd) is running on the QIP enterprise server. Make sure the Sybase database has been started on the QIP enterprise server. Make sure the Sybase client is configured correctly on the system running the CajunRules Console application, as well as the QIP enterprise server. Unknown Administration Username and Password To recreate the Administration Server username and password, you must login as the configuration directory administrator and change the Administration Server's username and password. For information on changing the Administration Server's username and password, refer to "Managing the Administrator List" in Chapter 7. A-2

122 B Examples Overview This appendix provides several scenarios using CajunRules to manage different network situations. It contains the following information: Setting Up CajunRules Using Abstract Policies Specific Use of CajunRules Setting Up CajunRules Using Abstract Policies Once you have created the Abstract Policies, you can continue by then establishing your environment in one of two ways: First domains, then devices (Method #1) First devices, then domains (Method #2) In order to apply one of these methods, you must create the network/host/application/activation instance infrastructure before you edit a policy, create the instance while writing policy rules, or a combination of the two. B-1

123 Chapter B Method # 1: First Domains, then Devices 1. Select the Devices tab. 2. Highlight the device you want to create a policy for. 3. Select Actions > Assign to Domain. 4. Select the domain you wish to add the device to. 5. Click OK. Device Validation Results display. * Note:s Or * Notes: If the policy deployed on the domain is completely valid (there are no partial enforcements) for the device, the device is added to the domain. If the policy/device is invalid or partial, a Device Validation Results screen displays for this one device. You can revalidate or cancel the action. Use the results screen to look at the view translation. Select Set Targets (devices) in the Policy Domain. In this screen, select multiple targets (devices) to add to the domain. If all of the devices are completely valid, they are added to the domain and no validation results screen displays. If any device is invalid or partial, a Device Validation Results screen displays, and may contain multiple devices. All devices that are completely valid do not display on the results screen, but are added to the domain. From the Device Validation Results screen, you can revalidate a selected list of devices, add a selected list of devices, or cancel the action. The Add button is not enabled unless some or all of the devices are valid or partially valid. As valid devices are added, they are removed from the results screen. If you select cancel, the remaining devices left on the screen are not added to the domain. B-2

124 Examples Method # 2: First Devices, then Domains 1. Select the Devices tab. 2. Highlight the device you want to add to the domain. 3. Select Actions > Assign to Domain. OR 4. Select the domain you wish to add the device to. 5. Click OK. * Note: If the policy deployed on the domain is completely valid (there are no partial enforcements) for the device, the device is added to the domain. If the policy/device is invalid or partial, a Device Validation Results screen displays for this one device. You can revalidate, add or cancel the action. 6. Use the results screen to look at the view translation. 1. Discover one or more devices and create Device Groups. 2. Activate View Translation for each device. 3. Select a policy and a time period in the View Translation screen. From here you may choose to create a customization for that Policy/Device combination. Edit and save the customization. * Note: Repeat for each device, if necessary. 4. Create a domain, and populate it with devices without associating a policy on creation. 5. Deploy the policy on the domain. B-3

125 Chapter B Specific Use of CajunRules The following example is a specific use of CajunRules. The scenario is a large corporation that wants to stop employees from listening to one of the music sites during standard working hours. 1. Set up your network. Refer to "Creating Networks" in Chapter Add your gateway device to the Devices tree. Refer to "Creating a Device" in Chapter Add the music site to the Application tree. Refer to "Creating Applications" in Chapter 3. a. Highlight the Application icon. b. Right-click and select New Application. The Create Application dialog box opens (Figu reb-1): Figure B-1. Create Application Dialog Box c. Enter the name of the Application. For example, Deny Music. d. Select TCP for the protocol. B-4

126 Examples e. Select the Control Port. Add the port number of the gateway device to the Ports List. Refer to Managing the Port List" in Chapter 7. You can locate the port number in the access control list. f. Select Unspecified for the Port Range. g. Select the Application Members tab. h. Move any members you want exempt from this rule from the Available column to the Specified column. i. Click OK. 4. Set up your activation period for the time you want to block access to the specific web site. Refer to "Using the Activation Period Wizard" in Chapter 7. For example, you do not want access to the music Web site Monday through Friday from 8 a.m. to 6 p.m. a. Select Tools > Activation Periods. b. Click New. The Activation Period Wizard opens. c. Enter the Name of the Activation Period. For example, Deny Music. d. Click Next and continue to click Next as you fill in each Wizard screen. e. Select Dail. f. Select Week Days. g. Enter the Start time. For example 8 a.m. h. Enter the Stop Time. For example, 6 p.m. i. Select Server Time Zone from the Time Zone pull-down menu. j. Click Finish. k. Click Close to exit the Activation Period Wizard. 5. Create your policy. Refer to Chap ter in Chap ter5. a. Select the Policie tab. b. Highlight the top level Policies icon. c. Right-click and select New Policy. The Create New Policy dialog box opens. B-5

127 Chapter B Figure 2-2. Create New Policy Dialog Box d. Enter the name of your policy. For example, Deny Music. e. Select DenyAll form the Default Action pull-down menu. f. Click OK. 6. Create the Rule. Refer to "Creating Rules" in Chapter 5. a. Select the Policies tab. b. Double click the policy (Deny Music) you want to create the rule for. The Rule Editor displays in the View pane (Figure 2-3). Figure 2-3. Rule Editor c. Click New at the bottom of the Rule Editor. d. Enter the name of the Rule. For Example, Deny Music. e. Select Deny from the Service level pull-down menu. B-6