IBM Tivoli and Cisco manual Performing remediation

SVIs. Each Shared RADIUS Authorization Component had a corresponding ACL defined on the NAD. The example below shows the configuration used for the Healthy Engineering VLAN and the Quarantine Sales VLAN.

access-list 120 remark **Healthy Engineering VLAN ACLs** access-list 120 deny ip any 192.168.13.0 0.0.0.255 access-list 120 deny ip any 192.168.14.0 0.0.0.255 access-list 120 deny ip any 192.168.15.0 0.0.0.255 access-list 120 permit ip any any

!

access-list 130 remark **Quarantine Sales VLAN ACLs** access-list 130 permit icmp any host 192.168.9.220 access-list 130 permit icmp any host 192.168.104.10 access-list 130 permit ip any host 192.168.9.220 access-list 130 permit ip any host 192.168.104.10 access-list 130 permit udp any eq bootpc any eq bootps access-list 130 deny ip any 192.168.11.0 0.0.0.255 access-list 130 deny ip any 192.168.12.0 0.0.0.255 access-list 130 deny ip any 192.168.14.0 0.0.0.255 access-list 130 deny ip any 192.168.15.0 0.0.0.255 access-list 130 permit tcp any any eq www access-list 130 permit tcp any any eq domain access-list 130 deny ip any any log

!

Note that the Healthy Engineering VLAN ACL has three deny entries before the permit statement. This is to stop any member of this VLAN trying to initiate any connections to any of the Quarantine VLANs, as an added security measure.

Similarly, note that the Quarantine Sales VLAN ACL allows the Security Compliance Manager and Tivoli Configuration Manager to be pinged, as a check for network connectivity, and also allows IP access to just the Security Compliance Manager and Tivoli Configuration Manager. This is for receiving an updated policy and other automated remediation tasks.

Performing remediation

Now that the Security Compliance Manager and ACS policies have been configured, the next step is to prepare the appropriate remediation workflows.

The operations team based on the names of the workflows assigned during policy creation have to design and deploy the set of software package blocks also known as remediation packages or workflows on Tivoli Configuration Manager server. These steps require the remediation server to be installed and operational. Detailed procedures for setting up the remediation server are described in Chapter 8, “Remediation subsystem implementation” on page 355.

Chapter 5. Solution design 115