Filter
Top Products
8-3
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 8 Managing Deployment
Understanding Deployment
During deployment, if Security Manager determines that the configuration on the device differs from the
last-deployed configuration, Security Manager overwrites the changes by default. You can control this
behavior using the deployment preferences; select Tools > Security Manager Administration, then
select Deployment, and look for the When Out of Band Changes Detected setting. You can also
control this for a specific deployment job by editing the deployment method for the job.
If you make changes to the device configuration outside of Security Manager, you have two choices for
bringing those changes into Security Manager:
1. You can rediscover policies on the device, in which case all policies for the device become local
policies, and any assignments of shared policies to the device are removed.
2. You can make the required changes in Security Manager and redeploy them to the device. During
deployment, do not select the option to force an error if out-of-band changes are found on the device.
This is the recommended approach.
For more information on how out-of-band changes affect deployment, see Understanding How
Out-of-Band Changes are Handled, page 8-12.
After configurations are deployed, you should make changes only through Security Manager for
configurations that Security Manager controls. This varies based on operating system. For IPS devices,
Security Manager controls the entire configuration. For IOS, ASA, PIX, and FWSM devices, you have
more control over which aspects of the device configuration Security Manager controls. If you do not
create policies for a feature in Security Manager, such as routing policies, Security Manager does not
control those features on the device. If you do create policies for these features, Security Manager
overwrites the settings on the device with the settings you defined in Security Manager. Through
administration settings, you can control the types of policies that will be available for these devices,
thereby preventing Security Manager from displaying or changing policies for these features. To see the
available features and control whether they are available for management in Security Manager, select
Tools > Security Manager Administration, then select Policy Management. Security Manager does
manage VPN-related policies.
Related Topics
• Deployment in Non-Workflow Mode, page 8-3
• Deployment in Workflow Mode, page 8-5
• Deployment Page, page 11-9
• Policy Management Page, page 11-45
Deployment in Non-Workflow Mode
These topics help you understand deployment in non-Workflow mode:
• Deployment Task Flow in Non-Workflow Mode, page 8-3
• Job States in Non-Workflow Mode, page 8-4
Deployment Task Flow in Non-Workflow Mode
The deployment task flow in non-Workflow mode consists of three simple steps:
1. Create the job: A deployment job is created for you when you do one of the following:
–
Click the Submit and Deploy Changes button on the main toolbar, or select File > Submit and
Deploy.