Installation Guide for Cisco Security Manager 4.27
Bias-Free Language
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The following topics are tasks to complete after you install Security Manager or its related applications on a server.
Server Tasks To Complete Immediately
Make sure that you complete the following tasks immediately after installation.
Task
Re-enable or re-install antivirus scanners and similar products. If you uninstalled or temporarily disabled any server security software, such as an antivirus tool, re-install or restart
that software now, then restart your server if required.Make sure to exclude the NMSROOT directory and the eventing folder
from scanning as long as Security Manager is installed on the server.
Note
If you see that your antivirus software is reducing the efficiency or responsiveness of a Security Manager server, see your
antivirus software documentation for recommended settings.
Re-enable the services and server processes that you disabled for installation. Do not re-enable IIS.
On the server, add a self-signed certificate to the list of trusted certificates. To learn how, see your browser documentation.
Check for updates on Cisco.com for Security Manager and its related applications. If you learn that updates are available, install the ones that are relevant to your organization and network.
Verifying that Required Processes Are Running
You can run the pdshow command from a Windows command prompt window to verify that all required processes are running correctly for the Cisco server
applications that you choose to install. Process requirements differ among the applications.
Tip
To learn more about pdshow, see the Common Services documentation.
Use Table 7-1 to understand which applications require which processes.
Configuration of Heap Sizes for Security Manager Processes using MRF
Memory Reservation Framework (MRF), a feature introduced in Security Manager 4.1, provides Cisco Security Manager administrators
the capability to modify heap sizes of key processes; doing so can enhance the performance of the server. MRF enables processes
to adjust heap sizes on the basis of the RAM installed on the server.
The Security Manager processes that can be configured using MRF are listed in Table 7-2.
Table 2. Security Manager Processes that Can Be Configured by Using MRF
Process
Name as shown in pdshow
Description
Backend Process
VmsBackendServer
Performs device discovery and deployment operations.
Tomcat
Tomcat
Hosts applications responsible for editing and validating policies, etc.
Report Server
CsmReportServer
Generates reporting data.
Event Server
VmsEventServer
Collects events being sent from devices.
Note
Based on your configuration load, it is always recommended to find Tomcat & Backend Server heap size according to your environment
for better performance.
Note
There is no MRF configuration for the HPM (Health and Performance Monitor) server.
The processes listed in Table 7-3, which are the Security Manager processes that can be configured by using MRF, are pre-configured with default values for
heap sizes. Table 7-3 lists the default minimum and maximum heap sizes in megabytes for different amounts of RAM available to the server for each
Security Manager process that can be configured by using MRF.
Table 3. Default Heap Sizes Preconfigured for Security Manager Processes
Physical RAM on server (GB)
VmsBackendServer
Tomcat
CsmReportServer
VmsEventServer
CsmHPMServer
< 8
1024, 2048
512, 1024
1024, 1024
1024, 2048
512, 1024
8
1024, 3072
1024, 2048
1024, 1024
1024, 3072
512, 1024
12
2048, 4096
2048, 3072
1024, 2048
2048, 4096
512, 1024
16
2048, 4096
2048, 4096
1024, 4096
4096, 4096
512, 1024
24
4096, 8192
4096, 4096
1024, 4096
4096, 8192
512, 1024
>= 28
8192, 8192
4096, 4096
1024, 4096
4096, 8192
512, 1024
Some RAM is reserved for the operating system and for other processes and is not listed here. For example, consider the case
of 16 GB RAM in Table 7-3. The total maximum heap size for all 4 processes is (4096 + 4096 + 1024 + 4096) = 13312 Mb or 13 Gb. There is 3 GB additional
RAM available for the operating system and for other processes.
Note
Please refer the deployment model guide and use the respective RAM for your environment. You can fine tune the above parameters
for better performance if memory-related slowness is observed.
Configuration Commands
MRF provides a command and a set of sub-commands to read and modify heap sizes for Security Manager server processes. Minimum
and maximum heap sizes can be set for the process by using the mrf command. Information on using of this command is displayed
by executing this command as follows:
> mrf
mrf help
Prints this message.
mrf backup
Backup existing configuration
mrf revert
Restores backed up configuration
mrf set_heap_params process X-Y [min],[max]
Sets minimum and maximum heap sizes
process -> process name
X-Y -> Memory Range in MB to which heap sizes apply
[min],[max] -> minimum and maximum heap sizes in MB. These are optional but atleast one should be specified.
mrf get_heap_params process [memory]
Prints minimum and maximum heap sizes in MB
process -> process name
[memory] -> memory size in MB for which heap sizes are to be printed. If not specified heap sizes are to be printed for current system memory.
Make sure that only valid process names are used while running mrf commands. No error is thrown when an invalid process name is specified. Valid process names are listed in Table 7-2. Process names are case-sensitive.
Configuring Heap Sizes for Processes
Configuring heap sizes for Security Manager processes can be thought of as consisting of the following three major steps:
Configuring a process heap size is a critical procedure that can affect the performance of Security Manager, so Cisco recommends
that it be done only under the guidance of application experts.
Also, as a precautionary measure, Cisco recommends that you save your existing memory configurations for processes before
changing them, and MRF provides two methods for doing so.
The first method can be used if you are testing the configuration changes. In this case the old configuration can be saved,
and new modifications can be reverted to old configurations, by using the two commands listed below, respectively:
mrf backupmrf revert
The second method is useful if you would like to revert to old values after you have used the new configuration for a significant
period. There are two ways of doing this; you can use one or the other of the following ways:
You can run mrf revert, provided you have not run mrf backup after you did the configuration changes.
You will be taking a backup of your Cisco Security Manager Server before you make configuration changes. If you want to revert
the changes, then restore the backup. In this case, data changes done after backup was taken will be lost.
2. Read Existing Configuration
Now that you have saved your data, you can query existing values for the processes by using the following command:
mrf get_heap_params [process name][memory]
If memory is not specified in this command, the current RAM size will be used. Usually you are interested in the current
RAM size. The parameter [process name] has one of the values listed in Table 7-2. Process names are case-sensitive.
The output of the command appears as shown below. Values are in MB.
Minimum Heap Size = 1024
Maximum Heap Size = 2048
3. Modify Configuration
After you have verified the current configuration, you can proceed to modify the configuration as described in this section.
To configure the heap sizes, use the following command:
The parameter [process name] can be any of the processes listed in Table 7-2. Process names are case-sensitive.
You need to restart the Security Manager server after executing this command for the changes to take effect.
Note
Changes made by using mrf set_heap_params can be lost if the backup that was taken before modifying heap parameters is restored. In this case, if you want to retain
the new values, you can follow these steps:
[X-Y[
: memory range in MB to which heap sizes apply
[min],[max]:
minimum and maximum heap sizes in MB. These are optional but at least one should be specified.
The parameter [process name] has one of the values listed in Table 7-2. Process names are case-sensitive.
Examples of Modify Configuration
The following examples illustrate how you can modify heap size configurations:
mrf set_heap_params Tomcat 7372-8192 2048,4096
Sets minimum and maximum heap sizes to 2048 MB and 4096 MB, respectively, for the Tomcat process when the RAM size is in the
range of 7372 MB to 8192 MB
mrf set_heap_params Tomcat 7372-8192 2048
Sets the minimum heap size to 2048 MB for the Tomcat process when the RAM size is in the range of 7372 MB to 8192 MB
mrf set_heap_params Tomcat 7372-8192,4096
Sets the maximum heap size to 4096 MB for the Tomcat process when the RAM size is in the range of 7372 MB to 8192 MB
mrf set_heap_params Tomcat 8080-8080 2048,4096
Sets the minimum and maximum heap sizes to 2048 MB and 4096 MB, respectively, for the Tomcat process when the RAM size is
8080 MB. You can execute the getramsize command to get the existing RAM size in MB.
Verification of Modify Configuration
After heap parameters are set, you can verify the changes by executing the mrf get_heap_params command.
Summary of Configuring Heap Sizes for Processes
The three major steps described in this section for configuring heap sizes for Security Manager processes can be summarized
by the following commands, listed in their order of execution:
mrf backup
mrf get_heap_params process
mrf set_heap_params Tomcat 7372-8192 2048,4096
mrf revert #if required to revert changes
Typical scenarios in which the User Might Have to Reconfigure Heap Sizes
Scenario 1
A Security Manager 4.0 user potentially may be using a maximum heap size of 4 GB for the Backend Process (VmsBackendServer).
This is more than the default maximum heap size of 3 GB allocated in Security Manager 4.1 for 8 GB RAM. In this scenario,
the user may have to reconfigure the Backend Process heap size to 4 GB. The user can choose to do this in case Event Management,
which uses the Event Server process (VmsEventServer) is not enabled.
Scenario 2
Suppose Security Manager is being used in configuration-only mode (Event Management and reporting are disabled). In this scenario,
the Backend Process and Tomcat heap sizes can be increased.
Scenario 3
Suppose Security Manager is being used in configuration-only mode (Event Management and reporting are disabled) and Event
Management needs to be enabled. In this scenario, the Backend process and Tomcat heap sizes should be decreased, before enabling
Event Management, so that the total of all heap sizes of Security Manager processes does not exceed the RAM size available
to the server.
Scenario 4
Event Management and the Backend process are memory-intensive and need higher RAM allocation. (If event Management is unused,
that RAM could be allocated for the Backend process by increasing its maximum heap size.)
Best Practices for Ongoing Server Security
The least secure component of a system defines how secure the system is. The steps in the following checklist can help you
to secure a server and its OS after you install Security Manager:
Task
Monitor server security regularly. Log and review system activity. Use security tools such as the Microsoft Security Configuration Tool Set (MSCTS) and Fport
to periodically review the security configuration of your server. Review the log file for the standalone version of Cisco
Security Agent that is installed sometimes on a Security Manager server.
Tip
You can obtain MSCTS from the Microsoft web site and Fport from the Foundstone/McAfee web site.
Limit physical access to your server. If your server contains removable media drives, set the server to boot from the hard drive first. Your data can be compromised
if someone boots your server from a removable media drive. You can typically set the boot order in the system BIOS. Make sure
you protect the BIOS with a strong password.
Do not install remote access or administration tools on the server. These tools provide a point of entry to your server and are a security risk.
Set a virus scanning application to run automatically and continuously on the server. Virus scanning software can prevent trojan horse applications from infecting your server. Update the virus signatures regularly.
Back up your server database frequently. Store all backups in a secure location with restricted access.
Note
Remove the logs/ database backup files regularly in order to maintain sufficient free space on your hard disk at all times.
It is recommended to have a minimum of 10GB hard disk space free.
Back up your Security Manager Server regularly. If regular backups have not been made, or if several changes have been made to your Security Manager installation, back up
your Security Manager server before running any Windows Update.
Verifying an Installation or an Upgrade
You can use Common Services to verify that you installed or upgraded Security Manager successfully. If you are trying to verify
the installation because the Security Manager interface does not appear or is not displayed correctly, see XREF.
Procedure
Step 1
Use a browser on the client system to log in to the Security Manager server using either of the following:
For HTTP service—http://<server_name
>:1741
For SSL service—https://<server_name
>:443
To learn which browsers and browser versions are supported, see Client Requirements.
Step 2
From the Cisco Security Management Suite page, click the Server Administration panel to open Common Services at the Server > Admin page.
Step 3
To display the Process Management page, click Processes.
The resulting list names all the server processes and describes the operational status of each process. The following processes
must be running normally:
vmsDbEngine
vmsDbMonitor
EDS
(Optional) Changing the Hostname of the Security Manager Server
If you are required to change the hostname of the Security Manager Server, follow the steps below:
Procedure
Step 1
Change the hostname in the OS:
Right-click Computer and select Properties or open Control Panel and select System.
Under Computer Name, Domain and Workgroup Settings, click Change Settings.
Click Change to modify the Computer Name (hostname).
Restart the computer.
Step 2
Stop the Security Manager Daemon Manager by entering net stop crmdmgtd in the command window.
Step 3
Execute the Security Manager Server hostname change script by running the following command in a command window:
Example:
NMSROOT\bin\perl NMSROOT\bin\hostnamechange.pl
In this command, NMSROOT is the path to the Security Manager installation directory.
Tip
hostnamechange.pl is a utility that updates the hostname changes in the Common Services- related directories, files, database entries and registry
entries after the hostname is changed in the OS.
Step 4
Restart the computer.
Note
In this step, you must restart the computer. Restarting the Security Manager Daemon Manager is not sufficient.
Verifying and Validating CSM Log Viewer
From Cisco Security Manager 4.24 onwards, post CSM software installation or upgrade, you can use the CSM Log Viewer to verify
and validate the supported options.
Procedure
Step 1
Navigate to the following location:
C:\ProgramFiles(x86)\CSCOpx\bin\
Step 2
Run the batch file CsmLogViewer
You can view the CSM Log Viewer tool with all the following supported options:
Process Status
Install Logs
CSM Logs
Tomcat Logs
CSM operation Logs
Client Logs
Figure 1. CSM Log Viewer
Step 3
From the CSM log viewer drop down box, select the log you want to check the information or error and validate the data.
Where To Go Next
If you want to:
Do this:
Understand the basics
See the interactive JumpStart guide that opens when you start Security Manager.
Get up and running with the product quickly
See the “Getting Started with Security Manager” topic in the online help, or see Chapter 1 of User Guide for Cisco Security Manager .
Complete the product configuration
See the “Completing the Initial Security Manager Configuration” topic in the online help, or see Chapter 1 of User Guide for Cisco Security Manager .