This section examines some problems that often occur and how to resolve them.
| 1 | Why can't I download the CSA Agent kit from CSA MC on Windows 2003? |
| Answer: | You may have problems with downloading the CSA Agent kit on Windows 2003 directly from CSA MC due to the extra Internet Explorer (IE) security settings in Windows 2003. To take off the extra security go to: Add/Remove Programs > Windows Components > Internet Explorer Enhanced Security Configuration
Removing this Windows component should remove some of the security on IE that could be blocking the download of the agent kit installer. |
| 2 | Where can I find CSA MC and Security Agent documentation? |
| Answer: | For CSA MC and CSAgent documentation refer to the following: http://www.cisco.com/en/US/products/sw/secursw/ps5057/tsd_products_support_series_home.html
|
| 3 | Where can I download the latest versions and patches for CSA MC? |
| Answer: | Go to the following location to get the latest version and patches of CSA (you must be a registered user): http://www.cisco.com/pcgi-bin/tablebuild.pl/csa
|
| |
| 4 | Where can I find information on existing bugs for CSA MC? |
| Answer: | You can go to the following link to find the details on existing bugs: http://www.cisco.com/pcgi-bin/Support/Bugtool/selection.pl?cco_product=Cisco&Security&Agent&mdf_label=Cisco&Security&Agent
|
| 5 | CSA MC keeps saying I need to generate rules, even after I generate them. What should I do now? |
| Answer: | This is a time issue. Set the clock to the correct time. |
| 6 | What ports do I need to open in my firewall to allow agents to communicate with CSA MC? |
| Answer: | These agent components and relevant ports are needed for communication to the CSA MC: - - Registration By default, the CSAgents communicate to the CSA MC on TCP port 5401. If that port is not available, the agents try TCP port 443 instead.
- - Browsing If you use a Web browser to communicate to the CSA MC, open TCP ports 1741, 1742, and 443.
- - Profiler The Profiler communicates with CSA MC on TCP port 5402.
|
| 7 | I have disabled logging for a particular rule. However, I am still receiving logs for this rule. Is this normal? |
| Answer: | In CSA MC Version 4.0.2 when the group is in test mode, these rule types are logged regardless of the configuration: - Application control - COM component access control - File access control - File version control - Registry access control
For all other rule types, logging will be enabled or disabled as configured. In CSA MC Version 4.5 and later, the logging configuration is utilized for all rules types regardless of whether the group is in test or production mode. |
| 8 | How do I switch an agent from test mode to production? |
| Answer: | To place a CSAgent in production mode, use the CSA MC to place the CSAgent's group into production mode: Step 1. | From CSA MC, go to Systems > Groups.
| Step 2. | Select the group that the agent is in.
| | | Step 3. | In the group properties, uncheck the Test mode check box.
| Step 4. | Click on Generate rules. The next time the agent polls the CSA MC and downloads the new setup, it is placed in production mode.
|
|
| 9 | Where can I get information about each policy and a description for the rules? |
| Answer: | In CSA MC, go to Configuration > Policies and select the policy you want to view. Then click the Explain rules link for a detailed description of each rule in the policy. This link is also available for a group in which multiple policies are applied, and for an individual host that may belong to multiple groups. |
| 10 | What are the run levels for the CSA Agent on UNIX? |
| Answer: | These are the run levels for the CSA Agent on UNIX: - /etc/rc0.d/K40csa - /etc/rc1.d/K40csa - /etc/rc2.d/S32csatdi - /etc/rc2.d/S77csa - /etc/rcS.d/K40csa - /etc/rcS.d/S22csanet
For information about run levels, type the main init command to refer to the manual for init on UNIX. |
| 11 | Can I generate Reports Using Crystal Reports from CSA MC Database? |
| Answer: | You can get events directly from the CSA MC DB if you choose, but Cisco changes the database schema often enough that any application written for a specific version of the CSA MC product will most likely not work when the next version comes out. It should not be a surprise that CSA MC DB will be modified whenever necessary to make the product better. However, there is a view in the product that you may use (or use a FULL version of SQL Server and look at CSA MC Schema). Refer to the following link for additional details: http://www.cisco.com/en/US/products/sw/secursw/ps5057/products_configuration_guide_chapter09186a0080424781.html#wp953202 |
| 12 | How can I change the Profiler port from default? |
| Answer: | If you have a firewall blocking the default port between the profiler and the CSAgent, use the following procedure to change the port from default: Step 1. | Open a DOS window and change the directory to program files\Cisco\CSAgent\bin.
| Step 2. | Type report_install u to uninstall the existing port number, which is 5402 by default.
| | | Step 3. | Type report_install -p 8000 i to install the new port number. In this example, 8000 is the new port number that you want Profiler to use.
|
To see which port is used by Profiler, look at sfront.cf in the program files\Cisco\CSAgent\cfg directory. |
| 13 | Is it possible to attach a saved database instead of export and import? |
| Answer: | Yes, it is possible. Actually, if for some reason you forget to export the database and then uninstall the CSA MC, and during uninstall you save the database, you can attach the saved database files with the following procedure: Step 1. | Reinstall CiscoWorks VMS, and then reinstall CSA MC. This will install a generic database. You must first detach this generic database so you can use the saved database files.
| Step 2. | To detach the database, at the CMD prompt type the command on DOS prompt (osql -E is case sensitive) as shown in Example 21-14.
Example 21-14. Detaching the Database Using SQL osql -E osql>sp_detach_db csamc45 <enter> osql>go <enter> osql>exit <enter>
|
| Step 3. | Delete or rename the generic database files found in Program Files\CSCOpx\CSAMC45\db\(csamc45.mdf and csamc45_log.ldf)
| Step 4. | Copy or move the saved database files (csamc45.mdf and csamc45_log.ldf) into the Program Files\CSCOpx\CSAMC45\db\ directory.
| Step 5. | Open a CMD prompt and type the commands shown in Example 21-15 (anything after the at sign ( @ ) is the exact path to your CSA MC system. This example uses the e:\drive).
Example 21-15. Attaching the Database osql -E <enter> osql>sp_attach_db @dbname='csamc45' , @filename1='e:\program files\CSCOpx\csamc\db\csamc45.mdf `, @filename2='e:\program files\CSOpx\csamc\db\csamc45_log.ldf ` <enter> osql>go <enter> osql>exit <enter> net start csamc.
|
| Step 6. | Restore the certificates used by this database.
|
|
