Cisco 5520 - ASA IPS Edition Bundle Manual de usuario

Corporate Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 526-4100

Cisco Secure Desktop Configuration

Guide

for Cisco ASA 5500 Series Administrators

Software Release 3.1.1

October 2006

Text Part Number: OL-8607-02

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL

STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT

WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT

SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE

OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH

ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT

LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF

DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,

WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO

OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the

document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

Cisco Secure Desktop Configuration Guide

CCVP, the Cisco Logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems,

Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco

Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing,

FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys,

MeetingPlace, MGX, Networking Academy, Network Registrar, Packet , PIX, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StackWise, The Fastest Way to Increase

Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship

between Cisco and any other company. (0609R)

iii

Cisco Secure Desktop Configuration Guide

OL-8607-02

CONTENTS

About This Guide vii

Audience and Scope vii

Organization and Use vii

Conventions viii

Related Documentation viii

Obtaining Documentation ix

Cisco.com ix

Product Documentation DVD ix

Ordering Documentation ix

Documentation Feedback x

Cisco Product Security Overview x

Reporting Security Problems in Cisco Products x

Product Alerts and Field Notices xi

Obtaining Technical Assistance xi

Cisco Technical Support & Documentation Website xi

Submitting a Service Request xii

Definitions of Service Request Severity xii

Obtaining Additional Publications and Information xiii

CHAPTER

1Installing or Upgrading the CSD Software 1-1

CHAPTER

2Enabling and Disabling CSD 2-1

Using CLI to Enable or Disable CSD 2-1

Using ASDM to Enable or Disable CSD 2-3

CHAPTER

3Introduction 3-1

CSD Capabilities 3-1

Navigation 3-2

Saving and Resetting the Running CSD Configuration 3-5

CHAPTER

4Tutorial 4-1

Step One: Define Windows Locations 4-1

Step Two: Define Windows Location Identification 4-3

Contents

Cisco Secure Desktop Configuration Guide

OL-8607-02

Work 4-3

Home 4-3

Insecure 4-4

Step Three: Configure Windows Location Modules 4-4

Work 4-4

Home 4-4

Insecure 4-5

Step Four: Configure Windows Location Features 4-6

Work 4-6

Home 4-6

Insecure 4-7

Step Five: Configure Windows CE Features 4-8

Step Six: Configure Macintosh and Linux Features 4-8

CHAPTER

5Setting Up CSD for Microsoft Windows Clients 5-1

Creating Windows Locations 5-1

Defining Location Criteria 5-3

Location Module 5-4

Certificate Criteria 5-5

Using a Certificate File to Specify Certificate Criteria 5-5

Using a Signed File to Specify Certificate Criteria 5-6

Using the Certificates in Your Store to Specify Certificate Criteria 5-7

IP Criteria 5-7

Registry and File Criteria 5-8

Registry Criteria 5-9

File Criteria 5-11

Configuring the Secure Desktop for Clients that Match Location Criteria 5-13

Configuring a VPN Feature Policy for a Location 5-13

Configuring a Group-based Policy for a Location 5-13

Configuring Web Browsing, File Access, Port Forwarding, and Full Tunneling VPN Policies for a

Location 5-16

Configuring Keystroke Logger for a Location 5-19

Configuring Cache Cleaner for a Location 5-22

Configuring Secure Desktop General for a Location 5-23

Configuring Secure Desktop Settings for a Location 5-25

Configuring Secure Desktop Browser for a Location 5-27

Contents

Cisco Secure Desktop Configuration Guide

OL-8607-02

CHAPTER

6Setting Up CSD for Microsoft Windows CE Clients 6-1

CHAPTER

7Setting Up CSD for Macintosh and Linux Clients 7-1

APPENDIX

AFrequently Asked Questions A-1

General Questions A-1

Can I use Fast User Switching on Windows XP? A-1

Which Java Virtual Machine is used by the Secure Desktop and the Cache Cleaner? A-1

When do modified settings apply to the Cache Cleaner and the Secure Desktop? A-1

Do I need Administrator privileges to use the CSD features? A-2

Does the Secure Desktop Manager support Japanese character encodings? A-2

What does transparent handling of e-mail applications mean? A-2

Which applications does the Secure Desktop handle transparently? A-2

Timeout Questions A-2

How does the timeout setting work on the Secure Desktop? A-2

Do Macintosh and Linux have a timeout setting? A-2

Vault and Secure Desktop Questions A-3

Does Secure Desktop completely eliminate the risk that data will be left behind on a system? A-3

Can I use uninstallation and Vault reuse with the Secure Desktop? A-3

If I enable Vault reuse, how large is the download the second time? A-3

How does an end user use the Vault after downloading it the first time? A-3

Can I run multiple Secure Desktops at the same time? A-3

System Detection Questions A-3

Can CSD detect all keystroke loggers? A-3

For System Detection, what is the AND/OR relationship among the various settings? A-4

Which antivirus applications does System Detection support? A-4

Which antispyware applications does System Detection support? A-4

Which personal firewall applications does System Detection support? A-4

Which personal operating systems does System Detection support? A-5

Security Questions A-5

What security settings do I need to set on user computers? A-5

What kind of encryption do the Secure Desktop and Cache Cleaner use? A-6

How long can the password be for Vault reuse? A-6

What happens when the cache is cleaned, either by the Cache Cleaner or the Secure Desktop? A-6

Networking and Firewall Questions A-6

Does the Secure Desktop or Cache Cleaner detect a second network card for location

determination? A-6

I am using a personal firewall. What application must I “Allow” to access the network? A-6

Contents

Cisco Secure Desktop Configuration Guide

OL-8607-02

NDEX

vii

Cisco Secure Desktop Configuration Guide

OL-8607-02

About This Guide

Refer to the following sections to understand the audience, topics, and conventions in this guide, and the

titles of related documents. Subsequent sections describe how to obtain documentation, provide

feedback, learn about Cisco product security, report security problems, and obtain technical assistance.

Audience and Scope

Written for network managers and administrators, this guide describes how to install, configure, and

enable Cisco Secure Desktop (CSD) on a Cisco ASA 5500 Series security appliance to provide a safe

computing environment through which clients can connect from a variety of locations.

This guide describes how to specify the types of locations from which Microsoft® Windows users

connect, the criteria used to identify those locations, and the access rights and restrictions to assign to

clients that match the location criteria. It also describes how to configure features to support

Windows CE, Macintosh, and Linux clients.

Organization and Use

Table 1 describes the contents of this guide.

Table 1 Document Organization

Topic Purpose

Installing or Upgrading the

CSD Software

Describes how to obtain the CSD software, and install or upgrade it.

Enabling and Disabling CSD Describes how to enable or disable remote client access to CSD.

Introduction Describes CSD capabilities, how to access the Secure Desktop

Manager (the browser-enabled interface for CSD administrators), how

to navigate the Secure Desktop Manager, and how to save

configuration changes.

Tutorial Steps you through an example configuration to provide an overview of

how to deploy CSD, and introduces you to the security decisions that

you need to make to best accommodate your users and secure your

network.

viii

Cisco Secure Desktop Configuration Guide

OL-8607-02

About This Guide

Conventions

This document uses the following conventions:

•Boldface indicates commands and keywords that you enter literally as shown, menu options you

choose, or buttons and check boxes you click.

•Italics indicate arguments for which you supply values.

•Examples show screen displays and the command line in screen font.

Note Means reader take note. Notes contain helpful suggestions, or references to material not

covered in the manual.

Caution Means reader be careful. Cautions alert you to actions or conditions that could result in equipment

damage or loss of data.

Related Documentation

For more information, refer to the following documentation:

•Release Notes for Cisco Secure Desktop

•Cisco ASA 5500 Series Release Notes

•Cisco ASDM Release Notes

•Regulatory Compliance and Safety Information for the Cisco ASA 5500 Series

•Cisco ASA 5500 Series Hardware Installation Guide

•Migrating to ASA for VPN 3000 Concentrator Series Administrators

•Cisco ASA 5500 Series Adaptive Security Appliance Getting Started Guide for the ASA 5510, ASA

5520, and ASA 5540

•Cisco Security Appliance Command Line Configuration Guide

•Cisco Security Appliance Command Reference

Setting Up CSD for Microsoft

Windows Clients

Describes how to configure Secure Desktop and Cache Cleaner support

for remote clients running Microsoft Windows.

Setting Up CSD for Microsoft

Windows CE Clients

Describes how to configure a VPN feature policy to enable or restrict

web browsing and file access for remote clients running Microsoft

Windows CE.

Setting Up CSD for

Macintosh and Linux Clients

Describes how to configure the Cache Cleaner and VPN feature policy

for clients running Macintosh or Linux.

Frequently Asked Questions Provides questions and answers on a broad range of CSD functions.

Table 1 Document Organization (continued)

Topic Purpose

Cisco Secure Desktop Configuration Guide

OL-8607-02

About This Guide

Obtaining Documentation

•Selected ASDM VPN Configuration Procedures for the Cisco ASA 5500 Series

•Cisco Security Appliance Logging Configuration and System Log Messages

Obtaining Documentation

Cisco documentation and additional literature are available on Cisco.com. This section explains the

product documentation resources that Cisco offers.

Cisco.com

You can access the most current Cisco documentation at this URL:

http://www.cisco.com/techsupport

You can access the Cisco website at this URL:

http://www.cisco.com

You can access international Cisco websites at this URL:

http://www.cisco.com/public/countries_languages.shtml

Product Documentation DVD

The Product Documentation DVD is a library of technical product documentation on a portable medium.

The DVD enables you to access installation, configuration, and command guides for Cisco hardware and

software products. With the DVD, you have access to the HTML documentation and some of the

PDF files found on the Cisco website at this URL:

http://www.cisco.com/univercd/home/home.htm

The Product Documentation DVD is created and released regularly. DVDs are available singly or by

subscription. Registered Cisco.com users can order a Product Documentation DVD (product number

DOC-DOCDVD= or DOC-DOCDVD=SUB) from Cisco Marketplace at the Product Documentation

Store at this URL:

http://www.cisco.com/go/marketplace/docstore

Ordering Documentation

You must be a registered Cisco.com user to access Cisco Marketplace. Registered users may order

Cisco documentation at the Product Documentation Store at this URL:

http://www.cisco.com/go/marketplace/docstore

If you do not have a user ID or password, you can register at this URL:

http://tools.cisco.com/RPF/register/register.do

Cisco Secure Desktop Configuration Guide

OL-8607-02

About This Guide

Documentation Feedback

You can provide feedback about Cisco technical documentation on the Cisco Technical Support &

Documentation site area by entering your comments in the feedback form available in every online

document.

Cisco Product Security Overview

Cisco provides a free online Security Vulnerability Policy portal at this URL:

http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html

From this site, you will find information about how to do the following:

•Report security vulnerabilities in Cisco products

•Obtain assistance with security incidents that involve Cisco products

•Register to receive security information from Cisco

A current list of security advisories, security notices, and security responses for Cisco products is

available at this URL:

http://www.cisco.com/go/psirt

To see security advisories, security notices, and security responses as they are updated in real time, you

can subscribe to the Product Security Incident Response Team Really Simple Syndication (PSIRT RSS)

feed. Information about how to subscribe to the PSIRT RSS feed is found at this URL:

http://www.cisco.com/en/US/products/products_psirt_rss_feed.html

Reporting Security Problems in Cisco Products

Cisco is committed to delivering secure products. We test our products internally before we release them,

and we strive to correct all vulnerabilities quickly. If you think that you have identified a vulnerability

in a Cisco product, contact PSIRT:

•For emergencies only —[email protected]

An emergency is either a condition in which a system is under active attack or a condition for which

a severe and urgent security vulnerability should be reported. All other conditions are considered

nonemergencies.

•For nonemergencies— [email protected]

In an emergency, you can also reach PSIRT by telephone:

•1 877 228-7302

•1 408 525-6532

Tip We encourage you to use Pretty Good Privacy (PGP) or a compatible product (for example, GnuPG) to

encrypt any sensitive information that you send to Cisco. PSIRT can work with information that has been

encrypted with PGP versions 2.xthrough 9.x.

Never use a revoked encryption key or an expired encryption key. The correct public key to use in your

correspondence with PSIRT is the one linked in the Contact Summary section of the Security

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Software de Cisco

Cisco

Cisco UC520-24U-8FXO-K9 Guía de instalación

Cisco

Cisco Router IOS XR Manual de usuario

Cisco

Cisco 11.0 BT Cómo utilizar

Cisco

Cisco 2509 - Router - EN Manual de usuario

Cisco

Cisco TELEPRESENCE CALL DETAIL RECORDS FILE FORMAT... Manual de usuario

Cisco

Cisco CVPN3002-8E-K9 - Fast Ethernet VPN Gateway Manual de usuario

Cisco

Cisco CCNA NETWORK SIMULATOR Manual de usuario

Cisco

Cisco GO GREEN Manual de usuario

Cisco

Cisco TELEPRESENCE MANAGEMENT SUITE SECURE SERVER - CONFIGURATION GUIDE... Manual de usuario

Cisco

Cisco 4700M Manual de instrucciones

Cisco

Cisco IPICS Manual de usuario

Cisco

Cisco TELEPRESENCE MANAGEMENT SUITE EXTENSION 2.2 - FOR MICROSOFT... Manual de servicio

Cisco

Cisco WS-SUP32-GE-3B - Supervisor Engine 32 Manual de usuario

Cisco

Cisco 4700M Manual de usuario

Cisco

Cisco IPS-4240-K9 - Intrusion Protection Sys 4240 Manual de usuario

Cisco

Cisco Craft Works Interface Manual de usuario

Cisco

Cisco 1811W - Integrated Services Router Wireless Manual de instrucciones

Cisco

Cisco DVD-ROM Manual de instalación y operación

Cisco

Cisco IP Communicator Manual de usuario

Cisco

Cisco SGACL Manual de usuario

Cisco

Cisco 6503-E - Catalyst Chassis With Supervisor Engine 32... Manual de instrucciones

Cisco

Cisco CRS-1 - Carrier Routing System Router Manual de instrucciones

Cisco

Cisco CONFERENCING EXTENSIONS - FOR MICROSOFT EXCHANGE... Manual de usuario

Cisco

Cisco 3600 Series Manual de usuario

Manuales populares de Software de otras marcas

COMPRO

COMPRO COMPROFM Manual de usuario

Muratec

Muratec OFFICEBRIDGE ONLINE Manual de usuario

Oracle

Oracle Contact Center Anywhere 8.1 Manual de usuario

Adobe

Adobe 65007312 - Photoshop Lightroom Manual

Avaya

Avaya NULL One-X for RIM Blackberry Manual de usuario

HP ProLiant BL420c Manual de usuario

PS Audio

PS Audio PowerPlay Manual del propietario

Brady

Brady LOCKOUT PRO 3.0 Manual de servicio

Avaya

Avaya Interaction Center Manual de usuario

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manual

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manual de usuario

Oracle

Oracle Application 9i Manual de usuario

Acer

Acer RDM Manual de usuario

Canon

Canon Vixia HF21 Manual de usuario

Canon

Canon ZR950 Manual de usuario

Samsung

Samsung Auto Backup Manual de usuario

Polycom

Polycom Vortex EF2201 Instrucciones de instalación y funcionamiento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manual de usuario