CSA Installation Requirements
In each of the operating systems in which CSA may be installed, you must satisfy minimum hardware and software requirements to ensure the deployment is supported by Cisco Technical Assistance Center (TAC). This section describes the software and hardware requirements and the communication requirements.
Software and Hardware Requirements
CSA has specific minimum requirements to load on an endpoint-protected server or workstation. Because the CSA is a software product, it only runs on appropriate operating systems. In version 4.5, the agent is supported on some Solaris, Linux, and Windows flavors. Future versions might provide you with an expanded operating system support base, but for version 4.5, follow the operating system requirements described in this section or refer to the latest CSA documentation for the most current guidelines, which are available at Cisco.com.
The hardware requirements for Windows, Solaris, and Linux agents differ slightly. Verify the requirements for your system before attempting installation and architecture implementation.
Table 6-1 shows the Windows agent minimum requirements.
Table 6-1 Windows Agent Requirements
|
System Component |
Requirement |
|
Processor |
Intel Pentium 200 MHz or higher. Note: Uni/dual/quad processors are all supported. |
|
Operating systems |
Windows 2003. Windows XP (Professional English 128 bit) with Service Pack 0, 1, or 2. Windows 2000 (Professional, Server, or Advanced Server) with Service Pack 0, 1, 2, or 3 or higher. Windows NT (Workstation, Server, or Enterprise Server) with Service Pack 5 or higher. Note: Citrix MetaFrame and Citrix XP are supported. Terminal Services are supported on XP and Windows 2000. Terminal Services is not supported on Windows NT. |
|
Memory |
128 MB minimum. |
|
Hard drive space |
15 MB or higher. |
|
Network |
Ethernet or dialup. Note: Maximum of 64 IP addresses supported on a single system. |
Table 6-2 lists the Solaris agent minimum requirements.
Table 6-2 Solaris Agent Requirements
|
System Component |
Requirement |
|
Processor |
UltraSPARC 400 MHz or higher. Note: Uni/dual/quad processors are all supported. |
|
Operating systems |
Solaris 8, 64-bit 7/01 edition or higher. Note: Solaris minimum core installation is not sufficient. You must also install the SUNWlibCx library. |
|
Memory |
256 MB minimum. |
|
Hard drive space |
15 MB or higher. |
|
Network |
Ethernet. Note: Maximum of 64 IP addresses supported on a single system. |
Table 6-3 shows the Linux agent minimum requirements.
Table 6-3 Linux Agent Requirements
|
System Component |
Requirement |
|
Processor |
500 MHz or higher x86 processor. Note: Uni/dual/quad processors are all supported. |
|
Operating systems |
RedHat Enterprise Linux 3.0 ES, AS, or WS. |
|
Memory |
256 MB minimum. |
|
Hard drive space |
15 MB or higher. |
|
Network |
Ethernet. Note: Maximum of 64 IP addresses supported on a single system. |
Additional Installation Requirements
For the CSA to become fully functional, you must address a few other points. Beyond the requirement to be loaded on a supported hardware and software platform, the agent must also support the necessary communication to be sure the agent remains current from a policy standpoint. The agent must also be able to resolve the IP address of the CSA MC server by its fully qualified domain name (FQDN) within Domain Name System (DNS).
CSA MC Server and Database
The CSA MC server contains the rules and policies that are required for agent enforcement. The MC is also where configuration changes and updates are maintained and is the focal point for the agents when they need to update their local policy enforcement rules. In addition, the MC serves as the destination for agent event messages that are transmitted and thus provides a centralized aggregation point for global event correlation and agent troubleshooting.
The default installation of the CSA MC includes the installation of Microsoft Data Engine (MSDE) database. This database is sufficient for smaller installations of 500 agents or fewer. The MSDE database has a database size limitation of 2 GB, which is not sufficient in larger deployments. When the enterprise agent deployment total increases to a number greater than 500 agents, it is recommended that you migrate the MSDE database to MS SQL.
In version 4.5, you can keep the MS SQL database local to the CSA MC server itself or you can use an externally loaded MS SQL server installation. It is important in either case that this database and server be secured from both a network and physical standpoint. You might decide to use an external MS SQL database in your enterprise for a number of reasons, as follows:
- Off-box SQL allows for cold standby CSA MC servers in case of a server failure.
- Fewer enterprise SQL deployments to maintain (regular maintenance and patching) because the SQL database can reside in your current enterprise SQL system.
- The ability to leverage highly effective SQL hardware, including server architectures and disaster recovery mechanisms such as storage-area networks (SANs).
Communication Security
For policy and rule changes created on the CSA MC to take effect on the CSA, the CSA must have the ability to contact and communicate with the CSA MC over the network. This communication path can take any transport necessary between the agent and MC machines as long as there is end-to-end IP reachability for the duration of the connection.
For the agent to request the update or transmit event log messages, the agent attempts to resolve the MC IP address using DNS or any other local resolution means available such as the local hosts file. It is important that this information be correct to facilitate both a successful connection and to verify the certificate used in the Secure Sockets Layer (SSL) communication.
SSL over the standard TCP port 443 is the protocol used for all MC-to-agent interaction. SSL ensures an authenticated and encrypted communication of the updates and event transmissions. Within an enterprise, name resolution is not typically an issue; however, if you have systems that will roam around disparate networks, you need to be certain that the machine resolves the correct address and that the CSA MC server is reachable from those locations.