Cisco 5520 - ASA IPS Edition Bundle User manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco Secure Desktop Configuration
Guide
for Cisco ASA 5500 Series Administrators
Software Release 3.1.1
October 2006
Text Part Number: OL-8607-02

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the
document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
Cisco Secure Desktop Configuration Guide
© 2006 Cisco Systems, Inc. All rights reserved.
CCVP, the Cisco Logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems,
Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco
Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing,
FormShare, GigaDrive, GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys,
MeetingPlace, MGX, Networking Academy, Network Registrar, Packet , PIX, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StackWise, The Fastest Way to Increase
Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0609R)

iii
Cisco Secure Desktop Configuration Guide
OL-8607-02
CONTENTS
About This Guide vii
Audience and Scope vii
Organization and Use vii
Conventions viii
Related Documentation viii
Obtaining Documentation ix
Cisco.com ix
Product Documentation DVD ix
Ordering Documentation ix
Documentation Feedback x
Cisco Product Security Overview x
Reporting Security Problems in Cisco Products x
Product Alerts and Field Notices xi
Obtaining Technical Assistance xi
Cisco Technical Support & Documentation Website xi
Submitting a Service Request xii
Definitions of Service Request Severity xii
Obtaining Additional Publications and Information xiii
CHAPTER 1Installing or Upgrading the CSD Software 1-1
CHAPTER 2Enabling and Disabling CSD 2-1
Using CLI to Enable or Disable CSD 2-1
Using ASDM to Enable or Disable CSD 2-3
CHAPTER 3Introduction 3-1
CSD Capabilities 3-1
Navigation 3-2
Saving and Resetting the Running CSD Configuration 3-5
CHAPTER 4Tutorial 4-1
Step One: Define Windows Locations 4-1
Step Two: Define Windows Location Identification 4-3

Contents
iv
Cisco Secure Desktop Configuration Guide
OL-8607-02
Work 4-3
Home 4-3
Insecure 4-4
Step Three: Configure Windows Location Modules 4-4
Work 4-4
Home 4-4
Insecure 4-5
Step Four: Configure Windows Location Features 4-6
Work 4-6
Home 4-6
Insecure 4-7
Step Five: Configure Windows CE Features 4-8
Step Six: Configure Macintosh and Linux Features 4-8
CHAPTER 5Setting Up CSD for Microsoft Windows Clients 5-1
Creating Windows Locations 5-1
Defining Location Criteria 5-3
Location Module 5-4
Certificate Criteria 5-5
Using a Certificate File to Specify Certificate Criteria 5-5
Using a Signed File to Specify Certificate Criteria 5-6
Using the Certificates in Your Store to Specify Certificate Criteria 5-7
IP Criteria 5-7
Registry and File Criteria 5-8
Registry Criteria 5-9
File Criteria 5-11
Configuring the Secure Desktop for Clients that Match Location Criteria 5-13
Configuring a VPN Feature Policy for a Location 5-13
Configuring a Group-based Policy for a Location 5-13
Configuring Web Browsing, File Access, Port Forwarding, and Full Tunneling VPN Policies for a
Location 5-16
Configuring Keystroke Logger for a Location 5-19
Configuring Cache Cleaner for a Location 5-22
Configuring Secure Desktop General for a Location 5-23
Configuring Secure Desktop Settings for a Location 5-25
Configuring Secure Desktop Browser for a Location 5-27

Contents
v
Cisco Secure Desktop Configuration Guide
OL-8607-02
CHAPTER 6Setting Up CSD for Microsoft Windows CE Clients 6-1
CHAPTER 7Setting Up CSD for Macintosh and Linux Clients 7-1
APPENDIX AFrequently Asked Questions A-1
General Questions A-1
Can I use Fast User Switching on Windows XP? A-1
Which Java Virtual Machine is used by the Secure Desktop and the Cache Cleaner? A-1
When do modified settings apply to the Cache Cleaner and the Secure Desktop? A-1
Do I need Administrator privileges to use the CSD features? A-2
Does the Secure Desktop Manager support Japanese character encodings? A-2
What does transparent handling of e-mail applications mean? A-2
Which applications does the Secure Desktop handle transparently? A-2
Timeout Questions A-2
How does the timeout setting work on the Secure Desktop? A-2
Do Macintosh and Linux have a timeout setting? A-2
Vault and Secure Desktop Questions A-3
Does Secure Desktop completely eliminate the risk that data will be left behind on a system? A-3
Can I use uninstallation and Vault reuse with the Secure Desktop? A-3
If I enable Vault reuse, how large is the download the second time? A-3
How does an end user use the Vault after downloading it the first time? A-3
Can I run multiple Secure Desktops at the same time? A-3
System Detection Questions A-3
Can CSD detect all keystroke loggers? A-3
For System Detection, what is the AND/OR relationship among the various settings? A-4
Which antivirus applications does System Detection support? A-4
Which antispyware applications does System Detection support? A-4
Which personal firewall applications does System Detection support? A-4
Which personal operating systems does System Detection support? A-5
Security Questions A-5
What security settings do I need to set on user computers? A-5
What kind of encryption do the Secure Desktop and Cache Cleaner use? A-6
How long can the password be for Vault reuse? A-6
What happens when the cache is cleaned, either by the Cache Cleaner or the Secure Desktop? A-6
Networking and Firewall Questions A-6
Does the Secure Desktop or Cache Cleaner detect a second network card for location
determination? A-6
I am using a personal firewall. What application must I “Allow” to access the network? A-6

Contents
vi
Cisco Secure Desktop Configuration Guide
OL-8607-02
I NDEX

vii
Cisco Secure Desktop Configuration Guide
OL-8607-02
About This Guide
Refer to the following sections to understand the audience, topics, and conventions in this guide, and the
titles of related documents. Subsequent sections describe how to obtain documentation, provide
feedback, learn about Cisco product security, report security problems, and obtain technical assistance.
Audience and Scope
Written for network managers and administrators, this guide describes how to install, configure, and
enable Cisco Secure Desktop (CSD) on a Cisco ASA 5500 Series security appliance to provide a safe
computing environment through which clients can connect from a variety of locations.
This guide describes how to specify the types of locations from which Microsoft® Windows users
connect, the criteria used to identify those locations, and the access rights and restrictions to assign to
clients that match the location criteria. It also describes how to configure features to support
Windows CE, Macintosh, and Linux clients.
Organization and Use
Table 1 describes the contents of this guide.
Table 1 Document Organization
Topic Purpose
Installing or Upgrading the
CSD Software
Describes how to obtain the CSD software, and install or upgrade it.
Enabling and Disabling CSD Describes how to enable or disable remote client access to CSD.
Introduction Describes CSD capabilities, how to access the Secure Desktop
Manager (the browser-enabled interface for CSD administrators), how
to navigate the Secure Desktop Manager, and how to save
configuration changes.
Tutorial Steps you through an example configuration to provide an overview of
how to deploy CSD, and introduces you to the security decisions that
you need to make to best accommodate your users and secure your
network.

viii
Cisco Secure Desktop Configuration Guide
OL-8607-02
About This Guide
Conventions
Conventions
This document uses the following conventions:
•Boldface indicates commands and keywords that you enter literally as shown, menu options you
choose, or buttons and check boxes you click.
•Italics indicate arguments for which you supply values.
•Examples show screen displays and the command line in screen font.
Note Means reader take note. Notes contain helpful suggestions, or references to material not
covered in the manual.
Caution Means reader be careful. Cautions alert you to actions or conditions that could result in equipment
damage or loss of data.
Related Documentation
For more information, refer to the following documentation:
•Release Notes for Cisco Secure Desktop
•Cisco ASA 5500 Series Release Notes
•Cisco ASDM Release Notes
•Regulatory Compliance and Safety Information for the Cisco ASA 5500 Series
•Cisco ASA 5500 Series Hardware Installation Guide
•Migrating to ASA for VPN 3000 Concentrator Series Administrators
•Cisco ASA 5500 Series Adaptive Security Appliance Getting Started Guide for the ASA 5510, ASA
5520, and ASA 5540
•Cisco Security Appliance Command Line Configuration Guide
•Cisco Security Appliance Command Reference
Setting Up CSD for Microsoft
Windows Clients
Describes how to configure Secure Desktop and Cache Cleaner support
for remote clients running Microsoft Windows.
Setting Up CSD for Microsoft
Windows CE Clients
Describes how to configure a VPN feature policy to enable or restrict
web browsing and file access for remote clients running Microsoft
Windows CE.
Setting Up CSD for
Macintosh and Linux Clients
Describes how to configure the Cache Cleaner and VPN feature policy
for clients running Macintosh or Linux.
Frequently Asked Questions Provides questions and answers on a broad range of CSD functions.
Table 1 Document Organization (continued)
Topic Purpose

ix
Cisco Secure Desktop Configuration Guide
OL-8607-02
About This Guide
Obtaining Documentation
•Selected ASDM VPN Configuration Procedures for the Cisco ASA 5500 Series
•Cisco Security Appliance Logging Configuration and System Log Messages
Obtaining Documentation
Cisco documentation and additional literature are available on Cisco.com. This section explains the
product documentation resources that Cisco offers.
Cisco.com
You can access the most current Cisco documentation at this URL:
http://www.cisco.com/techsupport
You can access the Cisco website at this URL:
http://www.cisco.com
You can access international Cisco websites at this URL:
http://www.cisco.com/public/countries_languages.shtml
Product Documentation DVD
The Product Documentation DVD is a library of technical product documentation on a portable medium.
The DVD enables you to access installation, configuration, and command guides for Cisco hardware and
software products. With the DVD, you have access to the HTML documentation and some of the
PDF files found on the Cisco website at this URL:
http://www.cisco.com/univercd/home/home.htm
The Product Documentation DVD is created and released regularly. DVDs are available singly or by
subscription. Registered Cisco.com users can order a Product Documentation DVD (product number
DOC-DOCDVD= or DOC-DOCDVD=SUB) from Cisco Marketplace at the Product Documentation
Store at this URL:
http://www.cisco.com/go/marketplace/docstore
Ordering Documentation
You must be a registered Cisco.com user to access Cisco Marketplace. Registered users may order
Cisco documentation at the Product Documentation Store at this URL:
http://www.cisco.com/go/marketplace/docstore
If you do not have a user ID or password, you can register at this URL:
http://tools.cisco.com/RPF/register/register.do

x
Cisco Secure Desktop Configuration Guide
OL-8607-02
About This Guide
Documentation Feedback
Documentation Feedback
You can provide feedback about Cisco technical documentation on the Cisco Technical Support &
Documentation site area by entering your comments in the feedback form available in every online
document.
Cisco Product Security Overview
Cisco provides a free online Security Vulnerability Policy portal at this URL:
http://www.cisco.com/en/US/products/products_security_vulnerability_policy.html
From this site, you will find information about how to do the following:
•Report security vulnerabilities in Cisco products
•Obtain assistance with security incidents that involve Cisco products
•Register to receive security information from Cisco
A current list of security advisories, security notices, and security responses for Cisco products is
available at this URL:
http://www.cisco.com/go/psirt
To see security advisories, security notices, and security responses as they are updated in real time, you
can subscribe to the Product Security Incident Response Team Really Simple Syndication (PSIRT RSS)
feed. Information about how to subscribe to the PSIRT RSS feed is found at this URL:
http://www.cisco.com/en/US/products/products_psirt_rss_feed.html
Reporting Security Problems in Cisco Products
Cisco is committed to delivering secure products. We test our products internally before we release them,
and we strive to correct all vulnerabilities quickly. If you think that you have identified a vulnerability
in a Cisco product, contact PSIRT:
•For emergencies only —[email protected]
An emergency is either a condition in which a system is under active attack or a condition for which
a severe and urgent security vulnerability should be reported. All other conditions are considered
nonemergencies.
•For nonemergencies— [email protected]
In an emergency, you can also reach PSIRT by telephone:
•1 877 228-7302
•1 408 525-6532
Tip We encourage you to use Pretty Good Privacy (PGP) or a compatible product (for example, GnuPG) to
encrypt any sensitive information that you send to Cisco. PSIRT can work with information that has been
encrypted with PGP versions 2.xthrough 9.x.
Never use a revoked encryption key or an expired encryption key. The correct public key to use in your
correspondence with PSIRT is the one linked in the Contact Summary section of the Security