Cisco Router and Security Device Manager (SDM), Version 2.1 User Guide for the Cisco 7000 Family

Note This User Guide covers the Cisco 7204VXR, the Cisco 7206VXR, and the Cisco 7301 routers. For information on additional SDM supported platforms, go to: http://www.cisco.com/go/sdm.

Cisco Router and Security Device Manager (SDM), Version 2.1, is an intuitive Java-based device-management tool that lets you configure LAN interfaces, routing, Network Address Translation (NAT), firewalls, Virtual Private Networks (VPNs), and other features without knowledge of the Cisco command-line interface (CLI).

Note SDM does not support the following features on the Cisco 7000 family: Startup Wizard, SDM Reset, WAN configuration; therefore, you will need to use CLI commands to support these functions.

Because SDM uses a GUI interface, it requires that you access it from a PC using a supported web browser. For the supported browsers, see the "Cisco IOS Software Requirements" section.

Overview

You can configure secure network access on your Cisco 7204VXR, Cisco 7206VXR, or Cisco 7301 router using both the SDM management tool and CLI commands.

You launch SDM using a supported browser on a PC. SDM allows you to configure supported security features, such as VPNs and firewalls, on interfaces that must be configured using CLI commands, such as token ring. SDM attempts to read any configurations added through CLI commands, but unsupported features are displayed as read-only or unsupported.

Although multiple users can concurrently use SDM to monitor a router, it is not recommended that multiple users concurrently modify the configuration; results may be inconsistent.

Features

Cisco SDM Version 2.1 New Features

Table 1 SDM 2.1 New Features
Feature	Benefits
New Hardware Support •Cisco VPN Acceleration Module 2+ (VAM2+) •High-speed WAN interface card 4T (HWIC-4T), HWIC-4A/S, HWIC-8A/S, HWIC-8A, and HWIC-16A	•Provides ability to recognize, configure, and monitor the new hardware
Cisco SDM Express •Wizard-based deployment of router	•Offers quick and easy router deployment for basic WAN access configurations •Ideal router deployment tool for non-expert users
PC-Based SDM •Cisco SDM installed on Windows-based PC instead of router Flash memory	•No extra Flash memory space required on router for SDM •Great tool to manage the installed base of Cisco routers
PPP over ATM (PPPoA)	•Offers quick and easy deployment of xDSL router interfaces for PPPoA configurations
Three New IPS Engines •STRING.TCP, STRING.UDP, STRING.ICMP	•Allows deployment of 200+ additional IPS signatures through SDM
Dial-Backup Improvements	•Support for dial-back for dynamically addressed primary WAN interface •Offers several fixes to make the configuration process more user-friendly

Cisco SDM Features

Table 2 SDM Features
Feature	Description
Embedded Web-based Management Tool	•Turns the router into a complete security and remote-access solution with its own management tool •Does not require a dedicated management station •Allows remote management from any supported desktop or laptop
SSL- and SSHv2-Based Secure Remote Access	•Provides for secure management across the WAN
At-a-Glance Router Status Views	•Offers quick graphical summary of router hardware, software, and primary router services such as VPN, firewall, QoS, etc.
Router Security Audit	•Assesses vulnerability of existing router •Provides quick compliance to best-practices (Cisco TAC, ICSA recommendations) security policies for routers
One-Step Router Lock Down	•Simplifies firewall and Cisco IOS Software configuration without requiring expertise about security or Cisco IOS Software
Smart Wizards for Most Frequent Router and Security Configuration Tasks	•Generates Cisco TAC-approved configurations •Averts misconfigurations with integrated routing and security knowledge •Reduces network administrators' training needs for new Cisco IOS Software security features •Secures the existing network infrastructure easily and cost-effectively
Policy-Based Firewall and Access-Control-List (ACL) Management (Firewall Policy)	Allows security administrators to easily and quickly manage access control lists (ACLs) and packet inspection rules through a graphical and intuitive policy table
Intrusion prevention (IPS)	• Allows easy and quick provisioning of Cisco tuned and recommended high-fidelity attack signatures on any router interface for inbound and outbound traffic •Allows dynamic update of new IPS signatures without impacting basic router operations •Allows graphical customization of IPS signatures for immediate response to new worm or virus variants •Allows filtering of signatures and mass configuration changes (action or severity) for the selected signatures •Shows real-time status and error messages from IPS engine
Cisco Easy VPN Server	•Offers wizard-based configuration and real-time monitoring of remote-access VPN users •Provides integration with on-router or remote authentication, authorization, and accounting (AAA) server
Role-Based Access	•Offers logical separation of router between different router administrators and users •Provides for secure access to Cisco SDM user interface and Telnet interface specific to each administrator's profile •Helps enable Cisco value-added resellers and service providers to offer a graphical, read-only view of the CPE services to end customers •Offers factory-default profiles: –Administrator –Firewall administrator –Easy VPN Client user –Read-only user
VPN Troubleshooting	•Reduces mean time to repair (MTTR) by taking advantage of the integration of routing, LAN, WAN, and security features on the router for detailed troubleshooting •Takes advantage of integration of routing, LAN, WAN, and security features on the router for detailed troubleshooting of IPSec VPNs or WAN links •Integrates Layer 2 and above troubleshooting with Cisco TAC knowledge base of recovery actions
QoS Policy	•Easily and effectively optimizes WAN and VPN bandwidth and application performance for different business needs (voice and video, enterprise applications, Web, etc.) •Three predefined categories: Real time, business critical, and best effort
NBAR	•Provides real-time validation of application usage of WAN and VPN bandwidth against predefined service policies •Provides for traffic performance monitoring
SSHv2	•Provides for secure management between PC and Cisco router •Automatically uses SSHv2 for all encrypted communication between Cisco SDM and router
Real-Time Monitoring and Logging	Allows administrators to proactively manage router resources and security before they affect mission-critical applications on the network
Digital Certificates	•Offers highly scalable and more secure solution than preshared keys •Now easy to use and deploy with the combination of Cisco SDM, Cisco IOS Certificate Authority Server, and Easy Secure Device Deployment (EzSDD)
Real-Time Network and Router Resource Monitoring	•Offers faster and easier analysis of router resource and network resource usage •Offers graphical charts for LAN and WAN traffic and bandwidth usage
Task-Based Cisco SDM User Interface	•Provides for faster and easier configuration of security configurations-IPSec VPNs, firewall, ACLs, IPS, etc. •Offers quick snapshot of router services configuration through dashboard view on the homepage

System Requirements

Memory Requirements

SDM Version 2.1 requires at least 6 MB of free Flash Disk or CompactFlash Disk on the router. Note that the Cisco IOS software requires approximately 20 MB of Flash Disk space.

Note Flash Disks and CompactFlash Disks provide from 48 MB to 356 MB of storage space. Flash Disks and CompactFlash Disks are supported on Cisco 7000 products that have PC card slots—formerly called Personal Computer Memory Card International Association (PCMCIA) slots.

Hardware Requirements

SDM requires a PC with a supported browser, and one of the following supported Cisco 7000 routers (see Table 3):

Browser and Java Requirements

PC Operating System Requirements

Cisco IOS Software Requirements

Connectivity Requirements

You can connect to SDM via a PC or server using any of the following methods: HTTP and HTTPS; Telnet, SSH, and SSHv2.

Determining if SDM Is Installed

Use one of the following methods to determine if SDM is installed on your router:

Table 3 Supported Hardware
Supported Routers	Supported Processors	Supported Service Adapters¹	Supported Port Adapters
Cisco 7204VXR	NPE-225, NPE-400, NPE-G1, NSE-1	VAM, VAM2, VAM2+	PA-2FE-TX PA-2FE-FX PA-8E PA-4E
Cisco 7206VXR	NPE-225, NPE-400, NPE-G1, NSE-1	VAM, VAM2, VAM2+
Cisco 7301	—	VAM2, VAM2+

Table 4 Minimum Supported Cisco IOS Software for Use with SDM
Platform	Minimum Cisco IOS Software
Cisco 7204VXR Cisco 7206VXR Cisco 7301	Cisco IOS Software Release 12.3(2)T or later or 12.3(3)M or later; no support for B, E, and S trains

•

Using the CLI, enter the dir all-filesystems or the show flash command, and check to see if the SDM file set is present: sdm.tar, ips.tar, home.shtml, home.tar.

Configuring Your Router to Support SDM

Before installing SDM on your router, modify the existing configuration using the CLI to include the following configuration information:

•

Configure your router to have a user account with level 15 privileges, by typing the username command:

Note

By default, privilege level 15 is enabled on the router.

For security purposes, the user account defined should be different from the default one used in the preceding example.

•

(Optional) Enable local login to support the log monitoring function by typing the following command:

Note This completes the procedure for configuring your router to support SDM. If SDM is preinstalled on your router, go to the "Launching SDM" section.

Installing SDM (Optional)

Launching SDM

To start SDM on your router using a PC browser to access SDM, follow these steps:

Step 1

Access the router CLI using the Telnet connection or the console port.

Note https://... specifies that the Secure Sockets Layer (SSL) protocol be used for a secure connection. http://... can be used if SSL is not available.

If you do not enter https:// and you are using Windows IE, you will receive a message, warning you that you are not in secure mode. Click Yes to configure in secure mode, or click Cancel to continue using http (see Figure 1).

Step 3

At the Netscape Prompt screen, enter your user ID and password (see Figure 2), and check the `Use Password Manager to remember these values' box to remember your user ID and password in the future. Then, click OK.

Note You must disable your active popup blocker for SDM to function. An error message will appear if you have not disabled your browser's popup blockers.

Step 4

At the IE Enter Network Password window (see Figure 4), enter your user ID and password, then click OK. Check the box `Save this password in your password list' if you want the system to remember your password.

At the Netscape Password Needed Networking screen (see Figure 5), enter your user name and password, then click OK.

The Cisco Router and Security Device Manager (SDM) Launch screen appears (see Figure 7) in the background. Leave this window open and wait for the next window.

Note Do not close this window ( Figure 7) until you log out from SDM, as it will close SDM.

Note The Startup wizard, WAN configuration, and Reset to Factory Default wizards are not supported on the Cisco 7000 routers.

Upgrading SDM

If SDM is already configured on your router, you can upgrade SDM using the Tools main menu.

For instructions on upgrading SDM, see Downloading and Installing Cisco Router and Security Device Manager.

Obtaining Documentation

Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.

Cisco.com

Documentation DVD

Cisco documentation and additional literature are available in a Documentation DVD package, which may have shipped with your product. The Documentation DVD is updated regularly and may be more current than printed documentation. The Documentation DVD package is available as a single unit.

Registered Cisco.com users (Cisco direct customers) can order a Cisco Documentation DVD (product number DOC-DOCDVD=) from the Ordering tool or Cisco Marketplace.

Ordering Documentation

•

Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Ordering tool:

•

Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, USA) at 408 526-7208 or, elsewhere in North America, by calling 1 800 553-NETS (6387).

Documentation Feedback

You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:

Cisco Systems
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883

Cisco Product Security Overview

A current list of security advisories and notices for Cisco products is available at this URL:

If you prefer to see advisories and notices as they are updated in real time, you can access a Product Security Incident Response Team Really Simple Syndication (PSIRT RSS) feed from this URL:

Reporting Security Problems in Cisco Products

Cisco is committed to delivering secure products. We test our products internally before we release them, and we strive to correct all vulnerabilities quickly. If you think that you might have identified a vulnerability in a Cisco product, contact PSIRT:

Tip

We encourage you to use Pretty Good Privacy (PGP) or a compatible product to encrypt any sensitive information that you send to Cisco. PSIRT can work from encrypted information that is compatible with PGP versions 2.x through 8.x.

Never use a revoked or an expired encryption key. The correct public key to use in your correspondence with PSIRT is the one that has the most recent creation date in this public key server list:

Obtaining Technical Assistance

For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, Cisco Technical Support provides 24-hour-a-day, award-winning technical assistance. The Cisco Technical Support Website on Cisco.com features extensive online support resources. In addition, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not hold a valid Cisco service contract, contact your reseller.

Cisco Technical Support Website

The Cisco Technical Support Website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day, 365 days a year, at this URL:

Access to all tools on the Cisco Technical Support Website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can register at this URL:

Note Use the Cisco Product Identification (CPI) tool to locate your product serial number before submitting a web or phone request for service. You can access the CPI tool from the Cisco Technical Support Website by clicking the Tools & Resources link under Documentation & Tools. Choose Cisco Product Identification Tool from the Alphabetical Index drop-down list, or click the Cisco Product Identification Tool link under Alerts & RMAs. The CPI tool offers three search options: by product ID or model name; by tree view; or for certain products, by copying and pasting show command output. Search results show an illustration of your product with the serial number label location highlighted. Locate the serial number label on your product and record the information before placing a service call.

Submitting a Service Request

Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool provides recommended solutions. If your issue is not resolved using the recommended resources, your service request is assigned to a Cisco TAC engineer. The TAC Service Request Tool is located at this URL:

For S1 or S2 service requests or if you do not have Internet access, contact the Cisco TAC by telephone. (S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco TAC engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.

Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553-2447

Definitions of Service Request Severity

To ensure that all service requests are reported in a standard format, Cisco has established severity definitions.

Severity 1 (S1)—Your network is "down," or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.

Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.

Severity 3 (S3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.

Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.

Obtaining Additional Publications and Information

Information about Cisco products, technologies, and network solutions is available from various online and printed sources.

•

Cisco Marketplace provides a variety of Cisco books, reference guides, and logo merchandise. Visit Cisco Marketplace, the company store, at this URL:

•

Cisco Press publishes a wide range of general networking, training and certification titles. Both new and experienced users will benefit from these publications. For current Cisco Press titles and other information, go to Cisco Press at this URL:

•

Packet magazine is the Cisco Systems technical user magazine for maximizing Internet and networking investments. Each quarter, Packet delivers coverage of the latest industry trends, technology breakthroughs, and Cisco products and solutions, as well as network deployment and troubleshooting tips, configuration examples, customer case studies, certification and training information, and links to scores of in-depth online resources. You can access Packet magazine at this URL:

•

iQ Magazine is the quarterly publication from Cisco Systems designed to help growing companies learn how they can use technology to increase revenue, streamline their business, and expand services. The publication identifies the challenges facing these companies and the technologies to help solve them, using real-world case studies and business strategies to help readers make sound technology investment decisions. You can access iQ Magazine at this URL:

•

Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL:

•

World-class networking training is available from Cisco. You can view current offerings at this URL:

Table Of Contents