Map view enables you to create customized, visual topology maps of your network, within which you can view connections between your devices and easily configure VPNs and access control settings. The following figure identifies the functional areas of the Map view.

To open the Map view main page, click the Map View button in the toolbar.

You can undock the map window, which enables you to use other product features while keeping the map open. To undock the map, select Map > Undock Map View. To dock the map window, select Map > Dock Map View.

The following table describes the buttons on the map toolbar.

Table 1. Map Toolbar

Toolbar Button	Description
	Selects objects on the map. Click the button, then click items on the map.
	Pans the map. Click the button, click and hold on the map, then drag the cursor.
	Zooms in on the map.
	Zooms out from the map.
	Zooms the map to fill a rectangle that you draw.
	Zooms the map to include the entire map.
	Zooms the map to actual size.
	Creates a new Security Manager-managed node. After you create the new device in the inventory, it is added to the active map as a device node.
	Adds a new map object to the map.
	Adds a new link to the map.
	Creates a new VPN connection between nodes on the map.
	Select devices to show on the map as device nodes.
	Select VPNs to show on the map.

The navigation window displays a smaller version of the entire active map. The shaded rectangle defines the area of the map that is currently displayed.

Use the navigation window to select the portion of the map to view and to change the map zoom level.

• To toggle the display of the navigation window, select Map > Show/Hide Navigation Window.

• To pan the navigation control to select which portion of the map to display, click within the shaded rectangle and drag it to a new location.

• To change the zoom level, click one of the resizing handles in the corners of the shaded rectangle, then drag it to increase or decrease the area of the map to display. The map zooms to display the area covered by the map indicator.

The title bar in the navigation window displays the name of the map. If the map has unsaved changes, an asterisk (*) appears next to the map name.

For information on other ways to pan and zoom maps, see Panning, Centering, and Zooming Maps.

The following topics describe the menus that contain maps commands. To open the context menus, right-click map elements.

• Managed Device Node Context Menu

• Multiple Selected Nodes Context Menu

• VPN Connection Context Menu

• Layer 3 Link Context Menu

• Map Object Context Menu

• Map Background Context Menu

Access to maps is controlled based on two systems of user privileges:

• Device privileges—You must have at least read privileges to all the devices in a map to open the map.

• Map privileges—Access to maps is based on your Security Manager user role. There are two levels of map access:

  • Read-only—You can open maps, but you cannot modify them. If you have this map privilege level, the features for modifying maps are not available.

  • Read-write—You can modify maps. All map modification features are available.

To open an existing map, select Map > Open Map, select the desired map from the list of available maps, and click OK. You must already be in Map view (select View > Map View). If you currently have a map open with unsaved changes, you are asked if you want to save it.

The list of available maps includes a special map called the Default Map. This map contains all of the managed devices and VPNs in the inventory. You are essentially creating a new map each time you open it. For more information about the default map, see Creating New or Default Maps.

Tip	You can open any map that you have created or the default map. You can also open any map that another user has created provided you have the requisite permission settings with regard to the devices shown on that map (seeAccess Permissions for Maps).

To save the active map, select Map > Save Map. Any changes that you made since you last saved it are saved. If you did not save the map previously, the Save Map As dialog box opens, enabling you to assign a name to the map and save it.

To save a map under a new name, select Map > Save Map As. The map name can be as long as 256 characters, but cannot be the reserved names “Default Map” or “New Map.”

If you close a map that contains unsaved changes, you are prompted to save the changes.

If your Security Manager session closes automatically because of inactivity when a map is open with unsaved changes, the current version of the map is saved if it has a name. If you have not yet saved the map, the map is discarded. For example, if you generate the default map, or create a new map, and do not save it before your session times out, you cannot retrieve that map.

If you no longer need a map, you can delete it (presuming that you have edit permission). Deleting a map does not delete any devices or VPNs shown on the map, nor does it delete or modify their configurations; only the map is deleted.

When you delete a map, it is permanently deleted from the server. Other users cannot use the deleted map.

To delete a map, select Map > Delete Map, select the map you want to delete from the available maps list and click OK. You are asked to confirm the deletion.

You must already be in Map view (select View > Map View) to delete a map.

To move a map element, click and hold, then drag it to the desired position. Attached links move automatically, but the other end of the link remains where it is.

You can also automatically arrange the network nodes on the map in several predefined layouts. Only nodes that are already displayed on the map are arranged. Any nodes that you later add do not follow the layout.

To select a map layout, right-click the map background, then select one of the following layouts from the map context menu:

• Hierarchical Layout—Arranges the nodes in a hierarchical layout.

• Radial Layout—Arranges the nodes in a radial layout.

• Circular Layout—Arranges the nodes in a circular layout.

There are many options for navigating maps. You can pan the map (move around in the map without changing the zoom level), pan a map so that a particular map element is centered in your view, or zoom in or out to see a different map extent.

The following table describes how to select map elements. If the selected element contains other elements (for example, a Catalyst switch that contains an FWSM), the containment relationship is shown. For more information, see Showing Containment of Catalyst Switches, Firewalls, and Adaptive Security Appliances.

To search for a map node to help you find it in the active map, select Map > Find Map Node. This command opens the Find Node dialog box.

The Find Node dialog box initially lists all objects on the map. Use the fields above the list to filter it (the list shows only objects that satisfy all filter criteria). When you find the desired node, select it in the list and click OK to have the node centered and selected in the map.

To filter the list, you can:

• Select a node type from the Type list to show only objects of that type.

• Enter the name, or at least the initial characters of the name, in the Name field. The list is filtered as you type. Your search term must be from the start of the object name. You cannot use wildcard characters.

• Enter all or part of the IP address or subnet mask. The list is filtered as you enter information.

You can change the background of a map by changing the color or by configuring an image. A suggested use for a background image is to use an image that represents a geographic area. Then you can position map elements according to their geographic locations.

Some background images are included with Security Manager. You can also transfer images to the server to use as background images. You can use background images of the following file formats: JPEG, GIF, PNG, IVL, and SVG. If you want to use a new image, copy the image file to the Security Manager server file system by connecting directly to the server. For security reasons, Security Manager does not provide a method of transferring files to the server.

To configure the map background, in Map view, select Map > Map Properties to open the Map Settings dialog box.

• To configure a background image, select it in the file list. (Select none to remove the map’s background image.)

If the image is not listed, click Add and browse to the file you placed on the server using the Import Background Image dialog box. Click OK to have Security Manager add it to the list of available background images.

If you no longer need a listed image, select it and click Delete.

Tip	You can control the position and scale of the image using the X and Y coordinates and scale settings. The X,Y source point is the upper left corner of the image. You can use positive or negative numbers. You must experiment to get the results you desire. The scale setting is in percentage.

• To change the background color, click Select next to the background color field and choose the desired color.

All objects that can appear on a map are map elements. You display map elements on a map to create a representation of a portion of your network. For more information about maps, see Working With Maps. To open a map, see Opening Maps.

The following tables describe the elements that can appear on a map:

• Table 1 describes the device nodes that can appear on a map. These elements are managed by Security Manager.

• Table 2 describes the map objects that can appear on a map. These elements are not managed by Security Manager.

• Table 3 describes the map element indicators that can appear with a device node.

A device node represents a device that is managed by Security Manager. You add a device node to a map by selecting the device from the Security Manager inventory.

When you add a device node to a map, its layer 3 connectivity to other nodes on the map is created automatically. For more information, see Creating and Managing Layer 3 Links on the Map.

You can add, remove, or show managed nodes by the following means:

• To add devices that are already in the Security Manager inventory—Select Map > Show Devices on Map to open a device selector. Select the desired devices from the list of available devices and click >> to move them to the selected devices list. You can select device groups to move all devices in the group. Click OK when the list of selected devices has the desired nodes. Only those devices in the selected list are shown on the map.

You can remove devices by selecting them in the selected list and clicking <<.

• To add a new device to the map and the device inventory—Click the New Device button in the map toolbar or right-click the map background and select New Device. The New Device dialog box opens. Follow the procedures for adding new devices described in Adding Devices to the Device Inventory.

• To remove a managed node—Right-click the node and select Remove from Map.

• To locate a device on the open map when in Device view—Right-click the device in the device selector and select Show in Map view. If the device is shown on the active map, it is shown centered and highlighted on the undocked map. You are told that the device cannot be found if the device is not shown on the active map.

• To locate a device in Device view from the map—Right-click the device and select Show in Device View. Device view is opened with the device selected so that you can edit its policies.

Note	From version 4.17, though Cisco Security Manager continues to support Cisco Catalyst switches features/functionality, it does not support any enhancements.

The containment relationship between Catalyst and Adaptive Security Appliance (ASA) devices and their service modules and security contexts, between PIX 7.x+ devices and FWSM and their security contexts, or between IPS devices and their virtual sensors, is displayed in maps as follows:

• When you select a Catalyst device, nodes that represent its Firewall Services Modules (FWSM) are highlighted.

• When you select an ASA, nodes that represent its Security Service Modules are highlighted.

• When you select a service module, the device that contains it is highlighted.

• When you select an IPS device, the nodes that represent virtual sensors defined on the device are highlighted.

• You can view a list of the security contexts contained in an ASA, firewall, or FWSM device, or the virtual sensors contained in an IPS device, by right-clicking the node and selecting Show Containment. This command also shows the service modules in a device that has them.

• When you select a security context node, all its ancestor device nodes are highlighted.

• When you select a virtual sensor, the device on which it is defined is highlighted.

To display an existing VPN on the map, select Map > Show VPNs on Map. You are prompted with a list of existing VPNs. Select the ones you want from the available VPNs list and click >> to move them to the selected list.

Tip	You can also remove a VPN using this command. Select the VPNs you want to remove from the selected VPNs list and click <<. When you remove a VPN, only the VPN tunnels are removed. The device nodes remain on the map.

When you display a VPN, all of the its member devices are added to the map as device nodes, and all of its tunnels are highlighted. However, devices that you removed from the map previously are not added, even if they are members of a VPN that you display. You can add such devices to the map manually, and their VPN connectivity is displayed.

A VPN tunnel is a line on the map that represents a VPN connection between two devices. VPN tunnels are not added to the map automatically when you add a device node that is a member of a VPN. However, if the VPN was already selected to be shown on the map, adding a device in the VPN to the map will also display the tunnel.

For an explanation of the icons used in the map, see Understanding Map Elements.

You can create VPN connections between VPN-capable managed device nodes that are displayed on the map. You cannot create Extranet VPNs, however.

To create a VPN, do one of the following:

• Click the New VPN button in the toolbar and select the type of VPN you want to configure: point-to-point, hub and spoke, or full mesh.

• Select the devices that you want to participate in the VPN (use Ctrl+click to select multiple devices), and either right click and select the command for the desired type of VPN, or click the New VPN button and select the VPN type.

Consider the following tips:

• Select only 2 devices to create a point-to-point VPN.

• If you create a hub-and-spoke VPN, the device you right-click is initially defined as the hub, but you can change that in the wizard.

• While in the wizard, you can add or remove devices. You are not restricted to the devices you selected on the map.

Using either technique, the Create VPN wizard opens, where you can create the VPN. For more information, see Creating or Editing VPN Topologies or click the Help button in the wizard.

The VPN is displayed on the map when you are finished with the wizard.

You can edit VPN policies, or the peers that participate in a VPN, from map view. To edit policies or peers, right-click a VPN tunnel or device node and select one of these commands:

• Edit VPN Policies—To open the Site-to-Site VPN Manager, where you can edit the policies that define the VPN. For more information, see Site-to-Site VPN Manager Window.

• Edit VPN Peers—To open a dialog box that allows you to configure the peers that participate in the VPN. Click the Help button in the dialog box for more information.

• Show VPN Peers—To see which devices participate in a VPN without editing the list (VPN Peers dialog box).

If the device participates in more than one VPN, you are first prompted to select the desired VPN (with the Select VPN to Configure dialog box) before the appropriate dialog box is opened.

You can perform some basic policy management tasks in Map view. Right click the device and select one of the following commands:

• Copy Policies Between Devices—To copy local device policies from one device to another. For more information on copying policies, see Copying Policies Between Devices.

• Share Device Policies—To create shared policies from local device policies. For more information on sharing policies, see Sharing Multiple Policies of a Selected Device.

• Clone Device—To create a copy of a device, including its policies. For more information on cloning devices, see Cloning a Device.

• Preview Configuration—To view the configuration file that will be generated for the device, including the changes from the previous deployment. For more information on previewing configurations, see Previewing Configurations.

• Discover Policies on Device—To discover the policies defined on the device and configure them in Security Manager, wiping out whatever policies are defined in Security Manager for the device. For more information device discovery, see Discovering Policies on Devices Already in Security Manager.

You can configure firewall policies on a device in Map view. These policies are local to the device rather than being shared policies (you must use Policy view to configure shared policies).

Tip	If you want to assign a shared policy to a device, see Performing Basic Policy Management in Map View.

To configure local firewall policies on a device in Map view, right click the device and select one of the following commands:

• Edit Firewall Policies > AAA Rules—To configure AAA policies, which control who is allowed access to the device and what services they are allowed to use once they have access. For more information on configuring AAA rules, see AAA Rules Page.

• Edit Firewall Policies > Access Rules—To configure Access Rules policies, which control the traffic that flows through a device. For more information on configuring access rules, see Access Rules Page.

• Edit Firewall Policies > Inspection Rules—To configure Inspection Rules policies, which analyze traffic at the application layer and track TCP and UDP sessions to perform refined access control. For more information on configuring inspection rules, see Inspection Rules Page.

• Edit Firewall Policies > Botnet Traffic Filter Rules—(ASA 8.2 and later only) To configure Botnet Traffic Filter Rules policies, which monitor web traffic. For more information on configuring botnet traffic filter rules, see Botnet Traffic Filter Rules Page.

• Edit Firewall Policies > Transparent Rules—To configure Transparent Rules policies, which define EtherType rules for transparent firewalls. For more information on configuring inspection rules, see Transparent Rules Page.

• Edit Firewall Policies > Web Filter Rules—To configure Web Filter Rules policies, which define rules for web access. For more information on configuring web filter rules, see Web Filter Rules Page (ASA/PIX/FWSM) or Web Filter Rules Page (IOS).

• Edit Firewall Policies > Zone Based Firewall Rules—(IOS 12.4(6)T and later only) To configure Zone Based Firewall Rules policies, which configure inspection and web filtering using security zones. For more information on configuring zone based firewall rules, see Zone-based Firewall Rules Page.

You can configure firewall settings policies on a device in Map view. These policies are local to the device rather than being shared policies (you must use Policy view to configure shared policies).

Tip	If you want to assign a shared policy to a device, see Performing Basic Policy Management in Map View.

To configure local firewall settings policies on a device in Map view, right click the device and select one of the following commands:

• Edit Firewall Settings > AAA Firewall—(ASA/PIX/FWSM only) To configure AAA Firewall settings policies, which configures proxy, authentication challenge, MAC exempt lists, and other general AAA settings. For more information on configuring AAA firewall settings, see AAA Firewall Settings Page, Advanced Setting Tab and AAA Firewall Page, MAC-Exempt List Tab.

• Edit Firewall Settings > Access Control—To configure Access Control settings policies, which configures optimization and other general access control settings. For more information on configuring access control settings, see Access Control Settings Page.

• Edit Firewall Settings > AuthProxy—(IOS devices only) To configure AuthProxy settings policies, which configure general settings for authorization proxies. For more information on configuring authorization proxies, see AAA Page.

• Edit Firewall Settings > Inspection—(IOS devices only) To configure Inspection settings policies, which configure timeout and session settings for inspection rules. For more information on configuring inspection settings, see Configuring Settings for Inspection Rules for IOS Devices.

• Edit Firewall Settings > Web Filter—To configure Web Filter settings policies, which configure the server used for web filtering. For more information on configuring web filter settings, see Web Filter Settings Page.

• Edit Firewall Settings > Zone Based Firewall—(IOS 12.4(6)T and later devices) To configure Zone Based Firewall settings policies, which configure zones and Trend web filter server settings.