BC MGMT Center Guide

Symantec Management
Center Configuration &

Management Guide
Management Center v1.9.1.1

Guide Revision: 11/24/2017
Management Center Configuration & Management
2
TOC
Management Center Overview 25
Web Console Overview 27
Dashboard 28
Network 28
Configuration 29
Jobs 29
Reports 29
Administration 30
Example 30
Log into the Web Console 32
Navigate the Web Console 33
Required Ports, Protocols, and Services 34
Inbound Connections to Management Center 34
Outbound Connections from Management Center 34
Required URLs 35
Verify Web Console Access 37
Move Items 38
Encrypt Sensitive System Data 39
Potential Data Loss 40
How Do I? 41
Add and Monitor Devices 41
Create and Manage Jobs 42
Upload Files to Management Center 43
Add Users and Grant Permissions 47
Monitor Device Health 49
Resolve Device Errors 53
Manage Dashboards 53
3
Notes 53
Integrate Reporter into Management Center 55
View Consolidated Reports 55
Migrate Device Metadata from Director as Management Center Scripts 56
Determine Your Next Step 63
View Audit Log 63
Regularly Back Up a Group of Devices 64
Manage Devices 67
Add a Device 68
Add a Device Group 73
Set the Device Polling Interval 74
Add Multiple Devices at Once 75
Import Devices Using a CSV File 75
Edit a Device 77
Procedure 77
View Effective Policy for Each Slot on the Device 77
Edit a Device Group 79
Launch a Device Console 80
View Device License Information 80
Upgrade System Images on Managed Devices 80
Troubleshooting 83
Back Up Device Configurations 84
Next Steps 86
Use Device Information for Backup Job Image Metadata 87
View Device Backups 89
Restore Device Backups 90
4
Export Device Backups 92
Restore Device Backups 94
Set the Number of Backup Slots 95
SSL Visibility Appliance - What is Backed up and Synchronized? 95
Policy 96
PKI 96
Users 96
Platform 96
Alerts 96
Remote authentication 96
Monitor Device Health and Statistics 97
Stop Managing a Device 102
About Pre-Deployed and Deactivated Devices 103
Restart a Device 103
Synchronize Devices 104
Prerequisites 104
Device Sync Details 104
Support for SSL Visibility Appliance 104
Support for Content Analysis 104
Support for Malware Analysis Appliance (MA) 105
Perform Device Synchronization 105
Configure Hierarchy for Devices and Device Groups 107
Hierarchical Configurations 107
Edit a Hierarchy 109
Delete a Hierarchy 109
Search for Managed Devices 110
Search by Name or IP Address 110
Browse the Hierarchy 110
Perform an Operation on a Managed Device 111
5
Ensure Devices Belong to Device Groups 112
Resolve Device Errors 116
Verify Device Details 117
Device Overview Tab 117
View System Metrics 119
The System Metrics Tab 119
The Health Checks Tab 119
The Backup Tab 120
RMA a Device 121
Put Device in Read-Only Mode 123
Use WAF Policy To Protect Servers From Attacks 128
Requirements 128
Recommended Reading 129
Solution Steps 129
About WAF Policy 130
About the Default Tenant 130
About Tenant Determination 131
Reference: Conditions and Examples 131
Manage Tenants 133
WAF Policy Use 133
Specify Tenant Determination Rules 136
WAF Policy Use 136
Configure WAF Security Rules 139
WAF Policy Use 140
Configure WAF Application Objects 143
WAF Policy Use 143
Analyze and Refine WAF Policy (Mitigate False Positives) 148
6
WAF Policy Use 148
Analyze and Refine WAF Policy Workflow 149
Manage WAF Security Policy 149
WAF Policy Use 149
Distribute Configurations to Devices 153
Create and Distribute Configurations Using Scripts 154
Compare Versions of the Script 157
Customize Object Filters 158
Execute Scripts 159
Filter by Attributes and Keyword Search 164
Search by Keyword 164
Procedure 165
Can quotes be used in a search? 165
How do you search for whole words? 165
How do you search for partial words? 165
Example Searches 165
IPv4 127.0.0.1 165
IPv6 “0:0:0:0:0:1” 165
Hostnames 165
What if the search finds no match? 165
What if the search succeeds in finding matches? 165
How do you clear the search results? 165
Import Script from a Device 166
Manage Attributes 168
View and Sort the Following Attributes Lists 168
Restore a Version of Script 169
View Script Information 170
Use Substitution Variables in Policies and Scripts 171
Use in Shared Policy 171
7
Syntax 172
Examples 172
Supported Variables 172
Specify a Default Substitution Value 174
Syntax 174
Example 174
Create and Distribute Policy 175
Use Content Policy Language (CPL) to Create Policy 179
Working with CPL Policy Fragments 180
Create a CPL Policy Object 181
Add or Edit CPL Policy Sections 183
Refine Existing CPL Policy 185
Manage CPL Policies 187
Work with CPL Policy Sections 188
Layout Modes 188
Single Pane Layout 188
Modular Layout 188
Navigate sections 189
Collapse a section 189
Collapse all sections 190
Move sections 190
Find a Policy Section 191
If the search finds no match 191
If the search finds matches 191
Clear the search results 191
Change the Order in which Policy Rules are Evaluated 193
8
Use Substitution Variables in Policies and Scripts 194
Use in Shared Policy 194
Syntax 194
Examples 195
Supported Variables 195
Specify a Default Substitution Value 197
Syntax 197
Example 197
Launch Visual Policy Manager 198
Set Up and Enable Java in Your Browser 200
Launch Visual Policy Manager 201
Select Reference Device for VPM Policy 203
View VPM Policy Source 204
Create SSL Visibility List Policy 205
Create SSL Visibility URL List Policy 212
Create SSL Visibility IP Address List 220
Enabling and Disabling IP Addresses 222
Deploy Tenant Policy 224
Manage Tenants 226
WAF Policy Use 226
Create a VPM Tenant Policy Object 230
Import VPM Tenant Policy from Source Device 231
Deploy Tenant Policy 234
Apply a Single Policy to Both On-Premises and Cloud Users 235
Prerequisites 235
SSL Requirements 235
Solution Steps 236
9
Add a Universal VPM Policy Object 236
Transform Existing VPM Policy into Universal VPM Policy 237
Refine and Validate Universal VPM Policy 238
Install or Import Policy 240
Preview Policy Before Installing It 240
Install Policy 242
Policy Installation Methods 242
Install... 242
Install to All... 246
Install to Device 246
Install Multiple Policies 247
Import Policy or Shared Objects 248
Universal VPM Policy Considerations 253
Import External Policy 255
Prerequisites 255
Procedure 255
View Policy 256
View Policy Versions 256
View Existing Policy Information 259
View Deployed Policy for each Device Slot 263
View Devices Associated with Policy 264
Configure Policy 265
Add or Remove Devices Associated with Policy 266
Add Targets 266
Remove Targets 268
Check Consistency between Policy and Devices 269
Compare Different Versions of the Same Policy 271
10
Compare the Device Policy Version with Current Policy Version 272
Export Policy or Shared Objects to Local Disk 273
Restore a Version of Policy 275
Use Specific Attribute Values to Control Access to Policy 275
Procedure 275
Create Shared Objects 276
Create a CPL Policy Fragment 278
Include a Policy Fragment 279
Create URL List (URL Policy Exceptions) 284
Enabling and Disabling URLs 286
URL List Example 287
Step One - Create the URL List Object 287
Step Two - Add Allowed URLs 287
Step Three - Add the URL List to the ASUP Policy 288
Manage URL and Category List Triggers 290
URL List Triggers 290
Category List Triggers 290
Work with Categories 292
Create Category Lists 292
Category List Example 295
Step One - Create the Category List Object 296
Step Two - Select Categories that Should be Denied 296
Step Three - Add the Category List to the ASUP Policy 298
Use Category List Templates 302
Create Custom Categories 305
Enabling and Disabling URLs 308
Custom Category Example 308
Step One - Create the Category Object 309
Step Two - Add URLs 309
11
Step Three - Add the Category to the ASUP Policy 310
Permissions Reference 311
Reference: Permissions Interdependencies 312
Reference: Permissions Filters Object and Attributes 321
Reference: Understanding Job Permissions 324
User runs a job immediately after configuring it or manually using Run Now 324
User configures a job scheduled in the future 324
Configure Users, Roles, and Attributes 325
Manage Management Center Users 326
Add Local Users 327
Add Users from an Existing Directory or Service 329
Authenticate Users Against LDAP 330
Authenticate Users Against Active Directory LDAP 333
Authenticate Users Against RADIUS 335
Authenticate Users with SSL Mutual Authentication 336
Note 339
Use Certificate Subject Alternative Name Data for Certificate Validation 340
Edit a Local or Imported User 342
Delete a User 342
Change and Reset Passwords 344
Change Your Password 345
Reset Password 346
Automate Password Reset Process 346
Manually Reset a User's Web Console Password 348
Expire a User's Web Console Password 348
Reset or Restore Admin Account Passwords 350
Manage User Groups 351
Add User Groups 351
Edit a User Group 353
12
Delete a User Group 353
Manage User Sessions 354
Define Roles 355
About Roles 355
Procedure 355
Duplicate an Existing Role 357
Edit an Existing Role 357
Grant Permissions 358
Update Access When a User's Job Changes 360
Update a User's Roles 360
Filter Devices or Device Groups in a Permission 361
Restrict Access to Reporter Reports 361
Procedure 361
Users Associated With Multiple Roles 364
Add Attributes 366
Mandatory Attributes 367
Edit Attributes 369
Set User-Defined Device Attributes for Access Control 370
Filter and Keyword Search 372
Procedure 372
Search by Keyword 372
Can quotes be used in a search? 373
How do you search for whole words? 373
How do you search for partial words? 373
Example Searches 373
IPv4 127.0.0.1 373
IPv6 “0:0:0:0:0:1” 373
Hostnames 373
13
Search 373
What if the search finds no match? 373
What if the search succeeds in finding matches? 373
How do you clear the search results? 373
Preview or Download Logs 374
Available Logs 374
Log Types 374
Manage User Sessions 376
Receive Error Notifications 377
Alert Notifications 377
Manage Alerts 377
Configure SMTP Alerts 389
Configure SNMP Alerts 390
Customize the Audit Log 392
Add a Job 395
Job Operations 397
Job Scheduling Options 400
Monitor Jobs 402
Edit a Job 403
View Current Jobs 404
Cancel a Currently Running Job 405
View Job History 406
View Job Progress 406
Management Center Reports 408
Statistics Monitoring Reports 408
Reporter Reports 408
14
View a Reporter Report 410
Customize Reporter Report Options 416
Add Report Filters 416
Filter Examples 418
Change the Report Summary 418
Reference: Report Descriptions 422
Create Custom Report Groups 430
Create a Custom Report 431
Edit Custom Reports 439
Additional Information 442
Search for Specific Report Data (Search and Forensic Report) 442
Reporter Graph Types and Views 446
Set Time Zone for Reporter Reports 447
Determine Why A Reporter Database Does Not Display 448
View Statistics Monitoring Reports 449
Reference: Statistics Monitoring Reports in Management Center 450
Modify Options for Statistics Monitoring Reports 453
Change the Scope of a Statistics Monitoring Report 455
Filter on Devices or Device Groups 456
Zoom In and Out on Reports 456
Statistics Monitoring Graph Types 456
Display a Full Report 457
View Statistics Monitoring Reports 458
Reference: Statistics Monitoring Reports in Management Center 459
Modify Options for Statistics Monitoring Reports 462
Change the Scope of a Statistics Monitoring Report 464
Filter on Devices or Device Groups 464
Zoom In and Out on Reports 465
Display a Full Report 465
15
Statistics Monitoring Graph Types 465
Work with Reports 466
Customize Report Widgets 467
Collapse Report Widgets 467
Move Report Widgets 467
Remove Report Widgets 467
Add Reports 467
Close a Report 467
Close the Active Report 467
Close a Report on Another Widget 467
Modify Display of Table Data 467
View Raw Report Data 470
Notes 471
Dashboards and Widgets 473
Add a Widget to the Current Dashboard 473
Add the Bookmarked Devices Widget 474
Edit or Duplicate Dashboards 475
Home 475
Statistics Monitoring Dashboard 475
Change the Dashboard Layout or Refresh Rate 475
Administrate Management Center 477
Configure General System Settings 477
Set Bandwidth Cost for Reports 479
Set the Device Polling Interval 479
Set the Number of Backup Slots 479
Specify Explicit Proxy Settings 480
Synchronize the System Clock using NTP 480
16
Configure Diagnostics Logging 481
Configure Housekeeping Settings 482
Configure Mail Settings 483
Configure the SNMP Agent Password 484
Configure Consent Banner 484
Procedure 485
Configure Hardware Monitor Settings 486
Upgrade/Downgrade System Images 487
Back Up the Management Center Configuration 489
Backup Requirements 489
Back Up Management Center 489
Back Up Management Center Using the CLI 490
Encrypt Sensitive System Data 490
Potential Data Loss 490
Restore a Management Center Backup Configuration 491
Restore Management Center Backup 491
Configure Management Center Failover 492
Replicated Data 493
Configuration Limitations 493
Device Limitations 493
Failover Prerequisites 494
Configure Failover 494
Switch to Secondary When the Primary is Unresponsive 496
Disable Failover 497
Update the Management Center License 498
Verify License Components from the Web Console 499
Troubleshoot and Resolve Issues 500
Audit Transactions 501
Understand Transaction Types 503
17
Customize the Audit Log 504
Configure Housekeeping Settings 506
Configure Diagnostics Logging 506
Required Ports, Protocols, and Services 509
Inbound Connections to Management Center 509
Outbound Connections from Management Center 509
Required URLs 510
Determine Which Version You are Using 511
Build Information Fields 512
Automate Password Reset Process 512
Prevent Licensing Issues on a Virtual Appliance 513
Duplicate Serial Numbers 513
Expiring Licenses 513
Stop or Restart Services 513
Stop Management Center Services 513
Restart Services 514
Test Network Connectivity 514
Upload System Diagnostics 515
View Hardware Diagnostics and Memory Resources 515
Problems and Errors 517
Read Messages and Alerts 518
"Could not enable statistics collection due to unexpected server failure" when activating a device 518
"Import batch contains duplicate device name violation" when importing multiple devices 519
"Local Changes Detected" error when installing policy 519
User has "access denied" error when running a job 519
"Multi-tenant policy support is not enabled for this device" when installing policy 519
Management Center REST API 521
Limitations 521
Documentation 521
18
Troubleshooting 521
CLI Command Reference 522
Access the Management Center CLI 523
CLI URL Syntax 524
Notes 524
Standard Mode Commands 525
> enable 525
Syntax 525
Example 525
> exit 525
Syntax 525
Example 525
> help 526
Syntax 526
Example 526
> ping 526
Syntax 526
Example 527
> show 527
Syntax 527
Subcommands 527
Example 527
Example 528
Example: 529
Example 529
Example 529
> tracepath 529
Syntax 529
Example 530
Privileged Mode Commands 531
19
# appliance-name 532
Syntax 532
Subcommands 532
Notes 532
Example of changing the appliance name to MC_One: 533
# backup 533
Syntax 533
Subcommands 533
Transfer Configuration and Data to Another Appliance 534
Example 534
# clock 534
Syntax 535
Subcommands 535
Examples 535
# diagnostic-systems 535
Syntax 535
Subcommands 536
# disable 536
Syntax 536
Example 536
# exit 536
Syntax 536
Example 536
# failover 537
Syntax 537
Subcommands 537
Example 537
# help 538
Syntax 538
Example 538
20
# http-proxy 538
Syntax 538
Subcommands 539
Example 539
# installed-systems 539
Syntax 539
Subcommands 540
Example of canceled image download: 540
Example 541
# license 541
Syntax 541
Subcommands 541
Example 542
# pcap 542
Syntax 542
Subcommands 543
Example 543
# ping 543
Syntax 543
Example 544
# restart 544
Syntax 544
Subcommands 544
Example 544
# restore-defaults 544
Syntax 544
Subcommands 545
Example 545
# rsyslog-output 545
Syntax 545
21
Subcommands 545
Examples 546
# security 546
Syntax 546
Subcommands 546
Example 551
# service 551
View Disk Usage 551
Syntax 551
Perform Disk Maintenance 552
Syntax 552
Enable Verbose Logging 552
Syntax 552
Start or Stop Service 552
Upload Diagnostics Data 553
Syntax 553
Subcommands 553
Purge VPM Cache 553
Syntax 553
# show 553
Syntax 554
Subcommands 554
Example 554
Example 554
Example 555
Example 555
Example 556
# shutdown 556
Syntax 556
Example 556
22
# snmp 556
Syntax 556
Subcommands 556
Example 557
# static-route 557
Syntax 557
Subcommands 557
Example of adding a static network route entry to nic0_0: 557
# statistics-monitoring 557
Syntax 558
Subcommands 558
Example 558
# subscriptions 558
Syntax 558
Subcommands 558
Example 559
# tracepath 559
Syntax 559
Example 559
# verify-hardware 560
Syntax 560
Example 560
# timezone 560
Syntax 561
Subcommands 561
Examples 561
Examples 562
Example 562
23
Legal Notice
Copyright © 2017 Symantec Corp. All rights reserved. Symantec, the Symantec Logo, the Checkmark Logo, Blue Coat, and
the Blue Coat logo are trademarks or registered trademarks of Symantec Corp. or its affiliates in the U.S. and other coun-
tries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only
and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are
disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice.
THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS,
REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE
EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL
NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING,
PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS
DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. SYMANTEC CORPORATION PRODUCTS,
TECHNICAL SERVICES, AND ANY OTHER TECHNICAL DATA REFERENCED IN THIS DOCUMENT ARE
SUBJECT TO U.S. EXPORT CONTROL AND SANCTIONS LAWS, REGULATIONS AND REQUIREMENTS, AND
MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS IN OTHER COUNTRIES. YOU AGREE TO COMPLY
STRICTLY WITH THESE LAWS, REGULATIONS AND REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE
THE RESPONSIBILITY TO OBTAIN ANY LICENSES, PERMITS OR OTHER APPROVALS THAT MAY BE REQUIRED
IN ORDER TO EXPORT, RE-EXPORT, TRANSFER IN COUNTRY OR IMPORT AFTER DELIVERY TO YOU.
Symantec Corporation
350 Ellis Street
Mountain View, CA 94043
www.symantec.com
11/24/2017
Management Center Overview
Management Center centrally manages and monitors the Symantec devices in your organization. You can organize
devices into hierarchical groups, monitor device health, install policies to ProxySG devices, back up device con-
figurations, and produce consolidated reports. In addition, you can control access to Management Center and devices by
adding system users manually or authenticating through an existing directory or service, such as RADIUS.
The following table summarizes some of the features and benefits of using Management Center.
Feature Benefit
Management Center provides cent- Eliminate the need to manage each remote device manually, reducing
ralized management for up to 500 management costs.
devices.
Groups devices based on location, Delegate administrative duties and deploy policies for specific groups. Enables
department, purpose, and other administrators to assign attributes for managed devices that have different pur-
attributes that you specify. poses within their network.
Roles have greater flexibility, User Groups with the same permissions access, manage, and can report
enabling user groups with the same on devices within their management area without overlapping job duties
permissions to access and manage and wasting time and resources. Apply roles to user groups that you need
policies and devices within their spe- to have homogenous results (for example user groups that are in specific
cific organization. locations or have a specific job function).
Manages internal and external user Users only access the functional areas and perform tasks required for their jobs.
accounts for Management Center.
Facilitates creating and deploying Ensure consistency amongst devices that have the same purpose or
policy to multiple devices sim- require standardized policy. Administrators can manage policy using the
ultaneously. Includes Visual Policy Visual Policy Manager on managed devices from within the Management
Manager and consistency checking Center web console.
between policies and devices
Manage attributes for devices, Use attributes to define custom metadata for devices, device groups,
device groups, policy and device policy and device scripts. Filter on attributes to refine searches for all
scripts objects.
Create, edit and execute scripts. Administrators can create and edit scripts as well as execute scripts on
Includes the ability to compare managed devices. Variable replacement is supported, as well as the abil-
script versions and to import a ity to check versions of a saved script and to import a script from a device.
script from a managed device
Audit log records user and system Be aware of all user actions in the system and support organizational account-
event history ability.
25
Feature Benefit
Default Reporting (Reports on device Management Center provides centralized reporting for managed devices. Stat-
performance) istics Monitoring reports are included by default and include:
l Devices
l WAN Optimization Reports

For advanced reporting features, you can add a Reporter Enterprise Server as a
Advanced Reporting (Reporter 10.x
managed device. After adding Reporter, four groups of reports are available for
integration)
viewing data:
l Security reports
l Web Application reports
l User Behavior reports
l Bandwidth Usage reports
Advanced Reporting provides visibility and a control point between employees
of your organization and the cloud services and SaaS applications that users
access (e.g., Box, Dropbox, Google Drive, Office 365, Salesforce, Facebook,
etc.). Using full Reporter integration enables the discovery of all of the web
applications in use, enabling you maximum visibility into all risky users, web
sites and potential threats. See how trends of risky users and sites affect your
company over time.
Storing device backups on an Enables administrators to export backups to external servers using any of
external server the following 4 protocols: FTP, HTTP, HTTPS, or SCP
Job scheduling to automate repet- Administrators can set up jobs to automate tasks that recur or are oth-
itive tasks erwise inefficient to perform manually. Additional permissions are
required to perform some jobs.
Hardware appliance support Hardware diagnostics information is available in the web console, such as
System Metrics, Storage Usage, Temperature, Voltage, RPM and other
sensors. From the CLI you can run hardware diagnostics, power off the
appliance and restore the appliance to factory defaults.
26
Web Console Overview
The web console is the user interface for Management Center.
Depending on a user's permissions, not all of the tabs may be visible to a particular user. See "Reference: Per-
missions Interdependencies" on page 312 for more information.
Banner
The banner is the area at the top of the Management Center web console; look for the title Management Center. The banner
is visible regardless of which tab or menu item you select. It provides you with a view of device health status and alert mes-
sages, access to your profile, global settings, and more. The following are options in the banner, from left to right (excluding
the title):
n Task Menu contains device management operations.
n Device Status Totals indicate the number of devices and colors indicate device health. See the table below for web
console color details.
n Messages display when you or other users complete certain tasks in Management Center. See "Read Messages
and Alerts" on page 518.
n System Menu contains the following options:
o Profile displays your user profile in Management Center. See Update Your Web Console Profile, Password
and Security Question.
o Log out of the system.
o Support links to https://bto.bluecoat.com/.
o Documentation links to the Management Center documentation on BTO.
o About displays the Management Center version and links to legal notices, including the EULA.
Tabs
Management Center divides functionality into tabs.
Dashboard
When you log in to Management Center, the web console displays the Home dashboard by default. From here, you can
"Manage Dashboards" on page 471 and customize the data that you want to monitor for managed devices. See "Change the
Dashboard Layout or Refresh Rate" on page 475,"Dashboards and Widgets" on page 473, and "Add the Bookmarked
Devices Widget" on page 474
Network
Network displays all managed devices in your hierarchy. For each device, you can view device overview information (such
as platform, OS and serial number), device health, system metrics, and the backups for each device.
28
Configuration
ProxySG configurations can be updated using Policy or Scripts. To create and manage policy or create and execute
scripts, see "Distribute Configurations to Devices" on page 153.
Jobs
The Jobs tab enables you to create and run jobs, view the progress of any currently running job, and provides a way to
schedule recurring jobs. You can also see the entire job history for each device. "Create and Manage Jobs" on page 394.
Reports
Management Center provides centralized reporting for managed devices. Statistics Monitoring includes reports on the fol-
lowing categories:
n Devices
n WAN Optimization (requires a Proxy or MACH5 Edition license)
For advanced reporting features, you can add a Reporter Enterprise Server as a managed device. After adding Reporter,
four groups of reports are available for viewing data about ProxySG devices:
n Security reports
n Web Application reports
29
n User Behavior reports
n Bandwidth Usage reports
n Log Detail
Administration
These settings enable you to add users, assign roles, and perform other administrative tasks. The tabs include Auditing,
Settings, Users, Groups, Roles, Attributes, Hardware Diagnostics, Logs, User Session, and License.
About Color-Coded Status Indicators
Colors represent the status of significant events in several areas in the web console:
n Alert colors
In alerts that pop up in the web console and are listed in the Messages list, colors indicate the severity level of the
event. If you have unread alerts, the Messages label in the banner displays the status of the message with the
highest severity level. For example, if you have an unread Message-level alert and an unread Error alert, the
Messages label displays a red Error status. See "Read Messages and Alerts" on page 518 for more information.
n Banner
On the web console banner, the Device Status Totals icons represent not only health status but the number of each
devices. Click a number to view the devices in the Network tab.
n Dashboard
Colors in the Device Health and Top Problem widgets indicate a device's health status. Select any part of the display
color in the Device Health widget to display the devices in the Network tab.
n Example
n Network
30
From the Network tab, a device's color indicates its health status. The colors of groups and hierarchies indicate the
health status of the devices with the highest-severity status. See "Monitor Device Health " on page 113.
n Jobs
When viewing a currently running job, the status of the job is displayed. If you are viewing the Job History, all jobs
are displayed with the completed job status. "View Current Jobs" on page 404.
The following table lists the statuses in Management Center, the colors associated with them, and descriptions of each
status.
Status Color How it applies to devices How it applies to alerts
Error A component on the device is failing, or is far out- An error occurred, preventing an

side normal parameters, and requires immediate event from completing.
attention. The job has not completed or has com-
red
pleted with errors. Red is also used for jobs that
Example: During the device
are running with errors. See "View Current Jobs"
registration process, the con-
on page 404.
nection test failed.

Example: The ProxySG appliance's Sub-
scription Communication Status metric is in crit-
ical state.
Warning A component on the device is outside normal An error might occur if you do not
operating parameters and might require attention. take preventative action.
Yellow is also used to show that an attribute on a
yellow
device is in a warning state. See "Monitor Device
Health " on page 113. Example: The Management
Center license will expire in 15
days or fewer. If you do not
Example: The ProxySG appliance's SGOS
renew the license within 15 days,
Base License Expiration is in warning state.
Error alerts display.
OK (device) Components on the device are operating within A task was completed or a
normal parameters. The job has completed suc- change was made.
Message (alert)
cessfully. See "View Job History" on page 406.
green

Example: A user account was
Example: The monitored device has no health added.
warnings or errors.
Inactive The device is pre-deployment or deactivated. Not applicable.
See "About Pre-Deployed and Deactivated
Devices" on page 103 for information.
gray
31
Log into the Web Console
Log into Management Center web console using a supported browser. For a list of supported browsers, refer to the Man-
agement Center Release Notes.
TLS 1.0 is disabled on Management Center. To securely connect to the Management Center web interface using
Internet Explorer 10 or later, you must enable TLS 1.1 and 1.2 on the browser. In the browser, select Internet
Options > Advanced, and enable Use TLS 1.1 and Use TLS 1.2.
1. In the web browser, enter one of the following URLs:
l http://IP_address:8080
l https://IP_address:8082
The browser displays the login screen.
When enabled, the consent banner page displays before the login screen. If the user recognizes both
the text and image, the user confirms that the system will be used for the purpose shown, by clicking
Accept. "Configure Consent Banner" on page 484.
2. Enter your username and password, and click log in.
The default username/password is admin/admin. To restore the default admin password, see "Reset or
Restore Admin Account Passwords" on page 350.
3. You can request a password reset. Click Reset Password. For more information, see "Reset Password" on
page 346. For added access control, administrators should enable password reset settings for users with the correct
permissions. See "Automate Password Reset Process" on page 512.
4. Upon successful login, Management Center displays the main Dashboard.
See "Web Console Overview" on page 27 and "Dashboards and Widgets" on page 473.
32
Navigate the Web Console
Refer to the following for an overview of navigational tools in the web console interface.
Tabs
The web console organizes information on tabs in two key areas at the top of the screen. The functional grouping of tabs
that include the Dashboards, Network, Configuration, Jobs, Reports, and Administration tabs are organized for man-
aging devices from Management Center.
l Functional areas in the web console are divided into tabs at the top of the screen, under the banner. Click a tab label
to perform specific tasks. For example, click Network to manage your devices.
l In Dashboards, you can see the Home and Statistics Monitoring dashboards. To close a report, click the X on
the tab.
The Administration tab has numerous sections that are specific to managing Management Center itself:
l Auditing
l Settings
l Users
l Groups
l Roles
l Hardware Attributes
l Logs
l Users Sessions
l License
Split Screens
In some areas of the web console, split bars divide screens into panes:
l From the Network tab, you can manage all devices in your network. The screens are divided into a left pane and a
right pane with a filters pane on the right. The top pane displays the filters and a search field if the Details drop-
down list has Details (rather than Tiles) selected.
If a split bar has an arrow on it, you can click the arrow to collapse or expand the split screen.
You can also move a split bar to resize panes: hover over the split bar until the pointer changes to divider. Then, drag the
bar to a new location.
Information on Multiple Pages
In the following areas of the web console, items display on multiple pages if more than 50 items exist:
l Logs in Auditing
l Policy and Script Objects in Configuration
l Device search results in Network
Use the following features of the navigation bar at the bottom of a page to navigate pages:
33
l Click < > to move back or forward one page at a time.
l Click << >> to go to the first page or the last page of results.
l Enter a page number in the Page field.
The right side of the navigation bar indicates which items are displayed and the total number of items in the list:
Required Ports, Protocols, and Services
Management Center uses the following ports while operating. Ensure that you allow these ports when setting up Man-
agement Center.
Inbound Connections to Management Center
Service Port Protocol Configurable? Source Description
SSL 8080 TCP No User's client Management Center web
8082 console
SSH 22 TCP No User's client Management Center CLI
SSL 8082 TCP No User's client Management Center API
Outbound Connections from Management Center
Service Port Protocol Configurable? Destination Description
LDAP 10389 TCP Yes LDAP server Authentication
LDAPS 389
636
Active Dir- 10389 TCP Yes Active Directory Authentication
ectory 389 server
636
RADIUS 1812 UDP/TCP Yes RADIUS server Authentication
RADIUS 1813 UDP/TCP Yes RADIUS server Accounting
SMTP 25 TCP Yes SMTP server SMTP alerts
SNMP Trap 162 UDP Yes Trap receiver SNMP traps
HTTP Proxy 8080 TCP Yes HTTP Proxy Updates
NTP 123 UDP/TCP No NTP server list Time sync to customer-
configured NTP time
server
34

HTTPS 443 TCP No Symantec bto.bluecoat.com
License activation,
Web Application Pro-
tection (WAP) sub-
scription, the latest
release information and
documentation
DNS 53 UDP/TCP No DNS server FQDN lookups
MA 443 TCP No Malware Analysis Health monitoring and
backup
PacketShaper 80/443 TCP No PacketShaper Health Monitoring (unen-
crypted/encrypted)
Reporter 8080/8082 TCP No Reporter Reporter API (unen-
crypted/encrypted)
ProxySG 22 TCP No ProxySG appli- ProxySG appliance mon-
ance itoring and management
Management 22 TCP No Management Management Center
Center Center communication with fail-
over partner
VPM 8082 TCP No ProxySG appli- Visual Policy Manager
ance
CAS 8080/8082 TCP No Content Analysis Health Monitoring (unen-
crypted/encrypted)
ProxySG 9009 TCP No ProxySG appli- ProxySG appliance Per-
ance formance Statistics.
Starting with Management
Center 1.7, Port 9009 is dis-
abled unless HTTP is
enabled via the security
http enalbe command.
ance formance Statistics over
HTTPS
SSL Visibility 443 TCP No SSL Visibility Health monitoring and
configuration synch
Required URLs
Ensure connectivity from Management Center to the following URLs.
35
URL Protocol Port Description

validation.es.bluecoat.com/phs.cgi HTTPS 443 Validates the license every 5 minutes. After successful
TCP validation, validation occurs every hour.
bto-services.es.bluecoat.com HTTPS 443 Validates the license.
TCP
device-services.es.bluecoat.com HTTPS 443 License related.
TCP
services.es.bluecoat.com HTTPS 443 License related.
TCP 443
abrca.bluecoat.com HTTPS 443 Symantec CA.
TCP
appliance.bluecoat.com HTTPS 443 Trust package downloads.
TCP
subscription.es.bluecoat.com HTTPS 443 Subscription services.
TCP
upload.bluecoat.com HTTPS 443 Upload diagnostic reports to Symantec support.
TCP
sgapi.es.bluecoat.com HTTPS 443 Universal VPM policy.
TCP
36
Verify Web Console Access
After you install a new license or update an existing license, verify that you can access the web console. Refer to the
Release Notes for a list of supported browsers.
TLS 1.0 is disabled on Management Center. To securely connect to the Management Center web interface using
Internet Explorer 10 or later, you must enable TLS 1.1 and 1.2 on the browser. In the browser, select Internet
Options > Advanced, and enable Use TLS 1.1 and Use TLS 1.2.
1. Open a web browser.
2. In the address bar, enter the URL.
https://ip_address:8082
You cannot change the port number.
The web browser displays the login screen.
If the web console does not load, run the # license view CLI command to determine if the license was installed

and is valid.
37
Move Items
To complete some tasks in the web console, you move items from one area or container to another. For example, you move
items to add devices to groups, associate devices with policy, remove users from groups, and remove roles from users.
The following example shows the Edit User dialog, where you can add or remove roles to a user:
If the list of items is long, you can scroll down to locate the item to move. You can also search using the search field above
it.
The web console allows several ways to move items:
Drag an item from one area to another. How to drag items
For example, to add a role to a user, select the role under Available Roles. Click and hold; the pointer turns into a hand
cursor . Drag the role to Assigned Roles. The dialog displays a green line under Assigned Roles and the pointer turns
into a pointer cursor , indicating that the role can be moved there.
38
Release the mouse button to move the role.
Drag a selected device to a device group. Associate Devices with Device Groups.
1. Click the Network tab. In the left pane, click Unassigned Devices. Unassigned devices display on the right pane.
See "Ensure Devices Belong to Device Groups" on page 112.
2. Selected the saved device.
3. To assign the device to a group, select the device and drag it into the device group into the tree on the left.
4. Drop the device into the device group. Confirm the move. Click OK.
Encrypt Sensitive System Data
In 1.6 and later, each Management Center appliance (hardware or virtual) has a unique encryption key that is used to
encrypt data in the system. The administrator generates this key in the Administration > Data Protection page. When
the key is generated, a recovery key is also generated in case you later need to restore the encryption key. Make sure to
save the recovery key in a safe place.
39
Potential Data Loss
n As part of this process, you should keep the recovery key in a safe place in the event that you need to restore the
encryption key later. DO NOT LOSE THE KEY. If you lose the key, you will not be able to recover your encrypted
data.
n You should not recover a key unless you are certain that you need to. If you use the Restore previous key feature
and the current data in the database was not encrypted with that key, that data will not be able to be decrypted and
you will have to reenter all of the device passwords.
n If the current passwords for the device were not encrypted with the previous key, you will not be able to access the
information with the current passwords. You will need to reenter the device passwords before accessing the backup
information.
New Management Center Appliance Recommendations
Upon receiving a new appliance, you should do the following:
1. Select Administration > Data Protection.
2. Click Generate Key.
A new encryption key is created and a recovery key is displayed.
3. Record the recovery key and secure it in a safe location.
4. Click Restart System.
5. Configure the appliance.
6. Run a Management Center backup. See "Back Up the Management Center Configuration" on page 489.
This process ensures that you can restore your configuration as necessary.
Upgrade Recommendations
If you are upgrading Management Center, Symantec recommends regenerating a new key and then taking a new backup.
Doing so will ensure that you have the latest protection schemes and a valid backup that can be restored to the device if
necessary.
This process ensures that you will be able to restore the previous configuration if the upgrade has issues.
40
How Do I?
What do you want to do in Management Center? See the following topics for assistance.
Add and Monitor Devices 41
Upload Files to Management Center 43
Add Users and Grant Permissions 47
View Consolidated Reports 55
Migrate Device Metadata from Director as Management Center Scripts 56
View Audit Log 63
Regularly Back Up a Group of Devices 64
Add and Monitor Devices
The Network dashboard presents data about managed devices and enables you to perform operations on them. Before you
can view appliance data, you must add the device to Management Center. To import multiple devices, see "Add Multiple
Devices at Once" on page 75 or "Migrate Device Metadata from Director as Management Center Scripts" on page 56.
To run operations on managed devices, see "Perform an Operation on a Managed Device" on page 111.
You can manage up to 500 devices in Management Center.
41

Click the call outs in the graphic above for more information.
Create Hierarchy and Group Views
You require a way to administer and monitor devices in your network, which might comprise a complex organizational or geo-
graphical scheme. In Management Center, you can manage the devices in your network within a hierarchical structure.
Management Center comes with a predefined structure for device management, as follows:
l Location (Hierarchy)
l World (Group)
l France, Canada, Germany, and others (Subgroups)
l Organization (Hierarchy)
l Company (Group)
l Finance, Sales, Legal, and others (Subgroups)
You can use these predefined hierarchies and groups, but if you must organize the devices in your network using different
criteria, you can create your own hierarchies and groups. Then, create device groups and subgroups to logically represent
the structure of your network.
Create and Manage Jobs
Management Center allows you to create jobs for running a variety of operations on a defined schedule. For example, you
can create jobs for backing up Management Center each day, installing policy on a group of ProxySG appliances
42
immediately, or executing a ProxySG script on a monthly basis. Jobs don't necessarily need a precise schedule, though; if
you don't define a schedule for a job, you can run the job manually. In addition, you may override the defined schedule for a
job and run it immediately.
Scheduling a job and running an operation require different permissions. See "Reference: Understanding Job Per-
missions" on page 324.
1. Plan the job:
n Determine which operation you want to create a job for. See "Job Operations" on page 397.
n Which devices do you want to perform the operation on? These will be the targets of the job.
n Decide how often the job should run. This will be the job schedule. See "Job Scheduling Options" on
page 400.
2. Create the job. See "Add a Job" on page 395.
3. Monitor scheduled jobs, and run unscheduled jobs as needed. See "Monitor Jobs" on page 402.
4. Monitor jobs as they are running. See "View Current Jobs" on page 404.
5. View job history. See Job History.
Upload Files to Management Center
Use the Configuration > Files page to add files to Management Center. These files can be used for various operations,
including upgrading Management Center.
All file types except .exe can be uploaded. If you upload a file with one of these extensions: .bcl, .bcsi, .nru, .nsu,
.pac, .patch, .si, .txt; the file is automatically associated with the proper file type—config, image, license, text. If
the file type is not one of the preceding, Management Center labels it as unknown.
You can limit the actions users are allowed to perform on this page by adding the File permission to a new or existing role.
Management Center replaces special characters in file names.
Upload Files
1. Select Configuration > Files.
2. Add the file using one of the following methods:
l By browsing:
a. Click Add File.
b. Click Select File and browse to the file(s).
c. Select the file.
d. Click Open.
e. Click Upload.
By dragging and dropping one or more files:
a. Click Add File.
b. Drag and drop the files into the Upload Files window
43
c. Click Upload. If a file with same name already exists, the system prompts you to choose whether to
upload and replace the existing file, skip the download, or to keep both and upload the file with a new
name. If the upload will exceed the available space on disk, you are prompted to delete files to make
room for the new file.
3. Management Center indicates the progress of the upload.
You can cancel the upload after it begins by clicking Cancel Upload or the icon.
Transfer Files
Click Transfer File to retrieve files from a URL.
44
1. Click Transfer File. The system displays the File Transfer window.
2. Enter the URL into the Server URL field.
3. Select the File Type.
4. Select the behavior to occur if the file already exists.
5. Click Run Now to start the job immediately or create a scheduled job.
Associate File with Device Type
If you upload an image file with the intention of upgrading one of your managed devices, you must associate the file with a
device type.
1. Select the file.
2. Right click the Device Type field in that row and click Edit.
The system displays the Edit File window.
3. Select the device type from the Device Type drop-down.
45
4. Click Save.
Edit Uploaded Files
To edit a file, select the file and click Edit. The system displays the Edit File dialog. Here, you can edit the following:
l Display Name
l File Type
l Device Type
l Description
Sort, Group, and Modify Uploaded File Data
Click the arrow to the right of the column headings to sort and group uploaded files.
46
Hover over Columns to change the displayed columns. Select Group by this field to group the table data in accordance
with that column heading. Deselect Show in groups to put data into a plain list.
Delete Uploaded Files
To delete a file, select the file and click Delete.
Copy File URL
To copy the file's URL, click Copy URL. The URL opens in a small sub-window. You can then right-click the
URL and select Copy or enter CTRL-C to copy the URL. you can then past the URL into Management Center
CLI commands (for example, installing a new image), and other options or operations that accept URLs.
Add Users and Grant Permissions
Management Center employs a role-based security model for access control, which consists of defining roles and then
adding users to roles rather than granting explicit rights to features and functions.
You should create a role structure that ensures:
l Users have enough access—and no more—to perform their day-to-day jobs.
l Only authorized users can access sensitive features and data.
47
l The permissions that a defined role requires.
l Enforcement of your organization’s access control policies.
To configure access control in Management Center, create a role structure that meets your technical and business require-
ments. As your organization changes, you may need to change role definitions and assignments to be certain that users con-
tinue to have appropriate access.
l Users (based on their role) should only manage specific devices, including reports on those devices.
l User roles control the actions that individuals within an organization should perform on devices for which they have
access.
l Users roles should be organized into a hierarchical control model to conform to an organization's IT structure.
Define Roles and Users
To control access to Management Center, you should first create each role to allow access to specific areas and the oper-
ations that users can perform there; then, you can assign these roles in accordance with users' functions and respons-
ibilities.
1. Define roles to provide access to different areas and functions in the Management Center.
l To create a new role, see "Define Roles " on page 355.
l To duplicate an existing role, see "Duplicate an Existing Role" on page 357
l (Optional) "Edit an Existing Role" on page 357.
2. "Add Local Users" on page 327 after you have created a role structure and defined roles.
(Optional) "Add User Groups" on page 351. If multiple users require the same type of access to Management Center,
user groups make it easy to apply roles and permissions to a large number of users at one time. User groups contain
48
users that control access to Management Center; you should first create each role to allow access to specific areas
and the operations that users can perform there; then, you can assign roles in accordance with users' functions and
responsibilities.
Grant Permissions
To grant permissions to Management Center that a role requires, you should understand how permissions work with roles.
Grant permissions to users based on the actions you need them to perform on specific objects. See "Reference: Per-
missions Interdependencies" on page 312.
l "Grant Permissions" on page 358 to users. See "Reference: Permissions Filters Object and Attributes" on
page 321.
l (Optional) Grant job permissions to users. See "Reference: Understanding Job Permissions" on page 324
(Optional) Filter Devices in Permissions
(Optional) Filter devices or device groups in permissions. Some permissions allow access at the device and device group
levels.
l To specify devices or device groups in specific permissions, see "Filter Devices or Device Groups in a Permission"
on page 361.
l To specify object filters, see "Reference: Permissions Filters Object and Attributes" on page 321.
(Optional) Add Users from External Directory Services
To authenticate users using RADIUS, LDAP or Active Directory services, see Add Users from an Existing Directory Ser-
vice. Available directory services to which you can authenticate users include:
l "Authenticate Users Against Active Directory LDAP" on page 333
l "Authenticate Users Against LDAP" on page 330
l "Authenticate Users Against RADIUS" on page 335
Monitor Device Health
Management Center collects health status information on device components including system resources, license valid-
ity, and user-defined health checks, and displays the aggregate health status in several areas.
Device health is always represented by status colors: Error (red), Warning (yellow), and OK (green). A device's health
status is determined by system-defined thresholds on the device: if a service or other monitored component exceeds a
threshold, the device goes into a Warning or Error state.
If you cannot get the device out of the Error state, regardless of what you try, you may need to RMA the device. See "Per-
form an Operation on a Managed Device" on page 111.
A gray status color indicates an absence of health status and represents an Inactive device. Some jobs and operations
cannot occur on inactive or pre-deployed devices.
See "About Color-Coded Status Indicators" on page 30 for more information on status colors in various areas of the web
console.
49
For more information on monitoring health status on the ProxySG appliance, refer to the SGOS Administration Guide.
View Device Health Status on the Dashboard
The Dashboard displays overall health status information in widgets. Two widgets display by default, but you can close
them by clicking the X in the top right corner.
The Device Health widget gives an overall picture of the health of monitored devices in a circle graph.
Click a status icon below the chart to see the devices that have that status.
The Top Problem Devices widget lists the devices that are consistently displaying with errors or warnings.
For example, if you click on the first SG300 Series device, the Device Overview displays the health status as red with the
specific errors and warnings for each device value.
50
If you have removed a widget from the Dashboard, you can display it again. See "Change the Dashboard Layout or
Refresh Rate" on page 475 for instructions.
View Health Status in the Banner
In the web console banner, look for the device status icons.
Click a status icon to see the devices that have that status. These totals are the same as the device status totals that dis-
play under the Device Health widget on the Dashboard; because these are in the banner, they are visible to you no matter
which tab you are working on.
View Device Health Status
1. Select the Network tab.
2. Select the device whose health you want to view. Overview, System Metrics, Dashboard, Health Checks and
Backup tabs display at the bottom of the screen.
3. Click Health Checks. The web console displays information about the system resources. Scroll to the bottom of
the screen to view the following:
51
View Device Dashboards
A dynamically generated dashboard is available for device monitoring. CAS and MA are currently supported.
2. Select the device whose health you want to view. Overview, System Metrics, >Dashboard, Health Checks and
Backup tabs display at the bottom of the screen.s
3. Click Dashboard. The web console displays system status metrics. The content available will vary with the device:
ProxySG/Advanced Secure Gateway Dashboard
MA Dashboard
CAS Dashboard
The metrics may be displayed in one of several different ways:
n Counters: Displays a count for a specific time period.
Examples: Object Count, Total Scan.
n State: Displays a text value.
52
Examples: Condition - Green/Yellow/Red condition indicator.
n Series: Displays values over a period; this presentation may be in an area display, a bar, a column, a pie chart, or a
donut chart.
Examples: CPU, ICAP Scan.
Resolve Device Errors
See Resolve Device Errors for more information.
Manage Dashboards
Dashboards allow you to quickly view important device data. This data is represented by widgets. Widgets represent data
from managed devices. Dashboards are highly customizable and can help you quickly view the information you deem
important.
To monitor devices from a single screen, add dashboards and add widgets to those dashboards using the options on the
Dashboards > Manage Dashboards page.
Order é Name Type Widget Description
1, 2, 3, etc. The name Reporter - displays only Reporter widgets on the dash- Each dash- The description

The order is of the dashboard. board can helps to dif-
displayed board as it WAF Reporter - displays only WAF widgets on the
display mul- ferentiate the
from left to appears on dashboard tiple wid- dashboard type,
right on the the Dash- gets. For a and the widgets
dashboard board tab. Mixed - Can display data from all widgets on the dash- quick ref- within the dash-
tab beginning board. erence of board.
with 1 on the Statistics Monitoring - displays only Statistics Mon- what is dis-
left. itoring widgets on the dashboard. played on
each dash-
board, view
the widget
count for
each dash-
board.
Notes
l Reporter Enterprise Server 10.1.x is required to access and view Reporter Reports and Dashboards.
l Dashboards are dependent on the reports that you can generate for each managed device. To generate advanced
reports and view advanced real-time data within dashboards, see Add Reporter as a Managed Device.
Add a Dashboard
To accommodate your screen size or personal preference, you can change the number of dashboards that display, as well
53
as define the layout of the dashboards. You must also define the dashboard type. Layouts arrange widgets in one to four
columns of equal width, with the columns expanding to fit the width of the screen. When you select a layout, your change
persists (beyond the current session) until you change the layout again.
Although you can add multiple dashboards, remember that dashboards display data from databases that may not be
the only database available. For example, a Reporter Enterprise Server can provide data from multiple databases.
When adding Reporter widgets to dashboards, you can choose from the available databases.
1. From Dashboards > Manage Dashboards, click Add Dashboard. An asterisk denotes fields that are mandatory.
2. Enter a descriptive Dashboard Name and Description.
3. Choose a Type:
n Mixed - A dashboard that displays both ProxySG appliance and Reporter widgets
n Reporter - A dashboard that displays Reporter widgets
If you select Reporter as the dashboard Type, from the Template drop-down list, select from the following
templates to pre-populate widgets:
n Web Application Usage
n Threat Detection
n Content Filtering
n WAF Reporter - A dashboard that displays Reporter Web Application Firewall (WAF) widgets.
If you select Reporter WAF as the dashboard Type, select Web Application Firewalll from the Template
drop-down list.
n Statistics Monitoring - A dashboard that displays ProxySG appliance widgets.
4. Select the auto-refresh rate. Specifies the amount of elapsed time before widget data is refreshed. The default
refresh rate is 5 minutes. This time is customizable from 1 to 59 minutes or 1 to 24 hours.
Select the Layout for the dashboard.
5. Click Save. The saved dashboard is displayed in the Dashboard drop-down with the name that you gave it.
After you have created a dashboard, you cannot edit the type.
Reorder Dashboard List
When you add a new dashboard, the most recently added dashboard is appended to the end of the list. For example if you
have three dashboards and add one, the new dashboard becomes the fourth dashboard on the list and will appear to the right
of the previously added dashboards. To change the order dashboards are displayed:
1. From Dashboards > Manage Dashboards, select the dashboard you want to move.
2. Click Move Up or Move Down to change the order.
Duplicate a Dashboard
To use a dashboard as a template for a dashboard that you may want to clone (and perhaps edit later), you can duplicate a
dashboard that already exists. You are unable to change the type of dashboard when you duplicate.
54
1. From Dashboards > Manage Dashboards, click Duplicate.
2. From the Duplicate Dashboard dialog, give the dashboard a unique name.
3. Click Duplicate. The duplicated dashboard is displayed under Manage Dashboards.
Integrate Reporter into Management Center
Reporter Enterprise Server 10.1.x is required to access and view Reporter Reports and Dashboards.
Prerequisites
n Obtain or verify administrator access to Reporter Enterprise Server 10.1.x or later.
n Verify that Reporter Enterprise Server is deployed inline with ProxySG appliances within your network.
n Ensure that you have access to a Reporter Enterprise Server (username and password).
n To be able to view Reporter reports on managed devices, you will need to add a Reporter Enterprise Server from the
Network tab.
Procedure
To integrate Reporter so that you can view Reporter reports in the Management Center web console:
1. Verify prerequisites above.
2. Add Reporter as a managed device in Management Center.
3. "View a Reporter Report" on page 410.
View Consolidated Reports
When using Management Center to manage and monitor ProxySG devices, you can produce reports that consolidate the
data from all these devices or a group of devices, allowing you to get a complete picture of activity on your network. For
example, you can view the bandwidth savings for all MACH5 appliances or get a list of the top web applications seen on
the networks your ProxySG appliances are connected to.
Device Reports
To view reports about the network traffic seen by a group of ProxySG devices, or by all ProxySG devices managed in Man-
agement Center:
1. (Optional) Create device groups for the ProxySG devices you want to report on. See "Add a Device Group" on
page 73.
2. Decide which Devices report to view (such as Traffic Mix or Traffic Statistics). For descriptions of each report, see
"Devices Reports" on page 459.
3. Select Reports > Statistics Monitoring and choose the report from the Devices panel. By default, the report
displays data from all ProxySG devices managed in Management Center.
4. (Optional) To narrow down the consolidated report to a group of devices:
55
a. Click Device Filter: All Devices or click the Options button. The Filters dialog displays.
b. From the Filter drop-down, select Device Group.
c. Click and select the device group.
d. Click Save.
WAN Optimization Reports
To display consolidated reports for ProxySG appliances with Proxy or MACH5 Edition licenses:
1. (Optional) Create device groups for the ProxySG devices you want to report on. See "Add a Device Group" on
page 73.
2. Decide which WAN Optimization report to view. For descriptions of each report, see "WAN Optimization Reports"
on page 460.
3. Select Reports > Statistics Monitoring and choose the report from the WAN Optimization panel. By default, the
report displays data from all ProxySG devices with a Proxy or MACH5 Edition license that are being managed in
Management Center.
4. (Optional) To narrow down the consolidated report to a group of devices:
a. Click Device Filter: All Devices or Options. The Filters dialog displays.
b. From the Filter drop-down, select Device Group.
c. Click and select the device group.
d. Click Save.
Reporter Reports
If you have integrated Symantec Reporter into Management Center, the following additional categories of reports are avail-
able: Security, Web Applications, User Behavior, Log Detail, and Bandwidth Usage. The Reporter reports consolidate data
from all ProxySG appliances in the selected Reporter database.
1. Make sure you have added Reporter as a managed device in Management Center. See "Integrate Reporter into
Management Center" on page 409.
2. Select Reports > Reporter > Database and select the database from which you want to produce a consolidated
report.
3. Decide which Reporter report to view. For descriptions of each report, see "Reference: Report Descriptions" on
page 422.
4. View the report. See "View a Reporter Report" on page 410.
Migrate Device Metadata from Director as Management Center
Scripts
To migrate a Symantec Director device hierarchy (including overlays) into Management Center, you need to export the
device metadata from Director, placing the migration file in a location that Management Center can access.
Prerequisites:
56
n Obtain or verify access to the Symantec Director CLI.
n Obtain or verify access to an HTTP, SCP, or FTP server, and ensure that you have access privileges to upload
data to it.
n Obtain or verify access to the Management Center web console.
Export Metadata from Director as an Encrypted File
1. Log into the Director CLI and go into config mode.
2. Type the following command to generate the migration file:
(config)# mc-migration generate
The CLI prompts you to enter a passphrase. You will be required to enter this passphrase to generate the metadata
and import it in the Management Center application.
3. Enter a passphrase consisting of at least four characters and press Enter.
The CLI generates the device metadata. The metadata is encrypted and compressed in a Gnu Privacy Guard
(GPG) encrypted (*.tgz.gpg) file. For example: SGME-Director-to-MC-Migration-2015.03.13-154907.tgz.gpg.
Make note of the filename.
4. Upload the compressed and secured file to an external HTTP, SCP, or FTP server. Enter the command:
(config)# mc-migration upload fileserver
where:
file is the filename you recorded in the previous step.
server is the hostname or IP address of an external server:
http://hostname_or_address[:port]/path_and_filename
ftp://hostname_or_address/path_and_filename
scp://hostname_or_address//path_and_filename
If necessary, copy or move the file to a location that Management Center can access.
Export Metadata from Director as an Unencrypted File
1. Log into the Management Center web console.
2. Click the Network tab.
3. Select Operations > Import from File. The web console displays the Import from File dialog.
57
4. On the Import from File dialog, select Download JSON Schema to download the schema to which the JSON file
must conform.
5. Log into Director and prepare the JSON file. To help you understand the schema, refer to the example bccm-data-
sample.json found in the download.
Symantec recommends that you familiarize yourself with the JSON Schema as defined by the IETF in draft 4
(see http://tools.ietf.org/html/draft-zyp-json-schema-04 ). This will help you understand Symantec's JSON
schema for import. Symantec is not yet strictly conforming to this standard, nor is the customer's JSON file
validated against this schema. However, the intention is that Management Center strictly conforms when the
IETF draft becomes a standard. In the meantime, should they exist in the JSON document, Management
Center returns helpful errors to indicate problem areas and errors.
6. After your JSON document is prepared, compress it in *.tar.gz or *.tgz format.
Linux Example: tar -cvzf myjsondata.tgz data.json
7. (Optional) Secure your compressed file.
a. To secure your compressed file with Gnu Privacy Guard (GPG) encryption (*.gpg format), use config mode in
Director.
Linux Example: echo 'password' | /usr/bin/gpg --batch --yes --no-tty --compress-

level 0 --cipher-algo AES256 --symmetric --passphrase-fd 0 myjsondata.tgz
(config)# mc-migration generate
The CLI prompts you to enter a passphrase. You will be required to enter this passphrase to generate the
metadata and import it in Management Center.
b. Enter a passphrase consisting of at least four characters and press Enter.
The CLI generates the device metadata into an encrypted and compressed file (*.tgz.gpg). For example,
SGME-Director-to-MC-Migration-2015.03.13-154907.tgz.gpg.
8. Make note of the filename.
9. Upload the compressed file to an external HTTP, SCP, or FTP server. Enter the command:
(config)# mc-migration upload fileserver
58
where:
file is the filename you recorded in the previous step.
server is the hostname or IP address of an external server:
http://hostname_or_address[:port]/path_and_filename
ftp://hostname_or_address/path_and_filename
scp://hostname_or_address//path_and_filename
If necessary, copy or move the file to a location that Management Center can access.
Import Director Metadata as Scripts into Management Center
From the Management Center web console, import the device metadata file that is currently saved on an external server.
1. Log into the Management Center web console.
3. Select Operations > Import from File. The web console displays the Import from File dialog.
4. Select the Import from file exported from an external system check box, then click Launch Import Wizard.
5. On the Import from File: Select File dialog, select the file that you want to import. The GPG encrypted file check
box is selected by default for (*.gpg) files. Clear the check box if your file is not encrypted (*.tar.gz or *.tgz format).
Files must have the extensions *.gpg(Gnu Privacy Guard [GPG] encrypted compressed file), *.tar.gz, or
*.tgz (unencrypted compressed files).
59
6. If necessary, enter the passphrase that you specified when generating an encrypted file, then click Next. An asterisk
denotes fields that are mandatory.
7. Select devices and device groups to import from a hierarchy. If any device is not a member of a hierarchy, a pseudo-
hierarchy is available, named Unassigned. If any errors or warnings exist, for any device, the status is shown on the
right. To select all devices in all hierarchies, select All Hierarchies.
60
A device can only exist in one group for a given, distinct hierarchy. Devices can be members of different
hierarchies.
8. The available scripts show on the Import from File: Select Scripts dialog. By default, all scripts are selected. Clear
the check box for any script you do not want to import. When finished selecting scripts, click Import.
61
Any ProxySG appliances that are running SGOS 5.x are imported in a deactivated (pre-deployment) status.
9. The Import from File wizard displays the Device Import Status dialog. The Overlays Summary and list of imported
overlays show at the bottom. When finished viewing the import status, click Close.
10. View the successfully migrated devices, device groups, and hierarchies in the Management Center Network tab.
62
11. View imported overlays by selecting Configuration > Scripts.
(Optional) Delete Migration File in Director
After you have successfully imported devices from Director, you can delete the migration metadata file from Director.
1. Log in to the Director CLI.
2. Type the following command:
(config)# mc-migration delete file
where file is the name of the migration file.
After the file is deleted, the CLI displays the (config)# prompt again.
Determine Your Next Step
What do you want to do next? Refer to this topic
Ensure that all devices belong to a hierarchy and group "Ensure Devices Belong to Device Groups" on page 112
Change device information "Edit a Device" on page 77
View Audit Log
You can view the history of all transactions in Management Center in the Audit Log. The log is a chronological record of
changes made by users of the system.
Audit Log records are:
l Comprehensive. Records are created automatically and cannot be deleted.
l Centralized. Multiple levels of transactions are logged and displayed on one screen.
l Security-oriented. The operating user for each transaction is logged.
Audit Log records can give you insight into daily activities at a high level as well as help you diagnose and troubleshoot
issues. For example, if a number of devices experience policy-related issues, you could check the log for policy-related
transactions within a selected date range. You can also examine records in the Audit Log to ensure process integrity.
The audit log displays system, web-access and web logs, if configured. To access remote system logs, from the
CLI enter "# rsyslog-output" on page 545.
Audit Log records can be printed in a user-friendly format. Before printing, check the bottom of the page of the Audit Log
Viewer to see how many pages of records will print.
1. Learn about the types of transactions recorded in the Audit Log. See "Understanding Transaction Types" on the
next page below.
2. Inspect the data recorded for transactions. See "Audit Transactions" on page 501.
3. (Optional) "Customize the Audit Log" on page 504 to focus on specific transaction data.
63
You can export the information in the audit log. From the Network > Export Data. You will be prompted to name the
.csv file that you are exporting. Click OK.
Understanding Transaction Types
The Audit Log records two levels of transactions:
l EVENT: High-level transactions that occur as a result of a user action, such as adding or deleting a device
l AUDIT: Low-level internal system actions, such as deleting connection information
Each record contains the target of the operation, the operation detected, the user who executed the operation,
and additional data depending on transaction type.
In the previous example, the Object Type is Role and the AUDIT transactions are changes at the system and admin levels.
Filters were applied to the record type. You might find that in most cases, EVENT records provide enough detail about trans-
actions and their effects on the system.
Regularly Back Up a Group of Devices
To be able to restore or roll back a configuration in case it gets corrupted, you need to back up your configurations on a reg-
ular basis. In this example, we will back up a device group on a weekly basis, during a time when the network is less busy
(such as a weekend).
Management Center supports configuration backup/restore/import/export of the following device types: ProxySG,
Content Analysis, Malware Analysis, and SSL Visibility.
64
1. Create a device group for the devices you want to back up on a schedule. See "Add a Device Group" on page 73.
2. Create a Backup Devices job. Select the device group you created in step 1, and schedule the job to run on a
Periodic basis, every 7 days starting on a weekend day. See "Back Up Device Configurations" on page 84.
3. Verify the backups are being created for each device in the group. See "View Device Backups " on page 89,
4. Restore a backup when necessary. See "Restore Device Backups" on page 94.
65
Manage Devices
Refer to the following topics for assistance.
"Add a Device" on the facing page
"Add a Device Group" on page 73
"Add Multiple Devices at Once" on page 75
"Edit a Device" on page 77
"Edit a Device Group" on page 79
"Launch a Device Console" on page 80
"Back Up Device Configurations" on page 84
"Use Device Information for Backup Job Image Metadata" on page 87
"View Device Backups " on page 89
"Restore Device Backups" on page 94
"Export Device Backups" on page 92
Import Device Backups
"Set the Number of Backup Slots" on page 479
"Monitor Device Health and Statistics" on page 97
"Stop Managing a Device" on page 102
"About Pre-Deployed and Deactivated Devices" on page 103
"Restart a Device" on page 103
"Synchronize Devices" on page 104
"Configure Hierarchy for Devices and Device Groups" on page 107
"Search for Managed Devices" on page 110
"Perform an Operation on a Managed Device" on page 111
"Ensure Devices Belong to Device Groups" on page 112
"Monitor Device Health " on page 113
Verify Device Details
"View System Metrics" on page 119
"RMA a Device" on page 121
"Put Device in Read-Only Mode" on page 123
Add Device Group Attributes
67
Add a Device
Before you can manage and monitor your devices, you must add them to Management Center. Devices that can be added
to and managed by Management Center include the following:
n Advanced Secure Gateway
n Content Analysis
n Malware Analysis
n PacketShaper
n ProxySG
n Reporter
n SSL Visibility
n Web Security Service
Configure how often devices are polled. See "Set the Device Polling Interval" on page 479.
About Public Key or Credential Authentication for ProxySG or Advanced
Secure Gateway
When adding a device, you must specify how Management Center will connect to it. Management Center can connect to a
device using the following methods:
l Credential authentication: Management Center uses the device's credentials to connect. Credential
authentication is considered less secure because the device's credentials are stored in Management Center.
Therefore, it is recommended that you use public key authentication.
Management Center always uses credential authentication when importing devices from Director.
l Public key authentication: Management Center inserts a copy of its public key onto the device. The device then
"trusts" Management Center connections. This authentication method is considered more secure because device
credentials are not stored on Management Center.
Management Center does not remove its public key from devices that are deleted and no longer managed.
You can manually delete the key using the following CLI command on the ProxySG or Advanced Secure
Gateway:
# (config ssh-console) delete director-client-key key-id
About Host Key Validation
Host key validation is a feature of the SSH protocol. It is designed to prevent devices from impersonating legitimate serv-
ers in an attempt to steal credentials and data (man-in-the-middle attack). To prevent this, each device has a unique host
key that can be used to establish a host's identity. If a device supports it, Symantec recommends that you enable host key
validation because the method can warn you of a man-in-the-middle attack. In that case, Management Center notes that
host verification failed and prompts you to verify the SSH host fingerprint.
You can verify the host fingerprint using one of the following methods:
68
l Enter the following command from a terminal that has a trusted network path to the device:
# ssh keygen-lf <(ssh-keyscan device_ip 2>/dev/null)
The system displays the host key.
l Do the following from the device's serial connection:
a. Enter the following command:
# (config ssh-console) view host-public-key sshv2
b. Copy the output to a file, for example, /tmp/hostkey.
c. Enter the following command from a system running OpenSSH 7.2:
# ssh-keygen -l -e sha256 -f /tmp/hostkey
The system displays the host key.
Add a ProxySG or Advanced Secure Gateway using Credential Authentication
2. (Optional) Browse to the hierarchy and folders/subfolders where you want to add the device.
3. Click Add Device. The system displays the Add Device wizard.
4. Select the device type.
5. Specify the Modes:
l Select Existing device if the device is already installed, or Unavailable (pre-deployment) if the device is not
available yet. See "About Pre-Deployed and Deactivated Devices" on page 103 for information on pre-
deployment devices.
l Select Read/Write or Read Only.
l Specify whether to monitor the health of the device. See "Put Device in Read-Only Mode" on page 123 for
more information.
l Specify whether to collect statistics for the device. See "View Statistics Monitoring Reports" on page 458.
6. In Connection, click Credentials. Set the following:
l The IP address or hostname of the device.
l The SSH port.
l The username and password you use to authenticate to the device.
l Your enable password for administrator actions.
l Confirm whether to Enable host key validation (recommended).
7. Click Connect. Management Center attempts to connect to the device using the information you entered.
8. If you enabled host key validation, verify the SSH Host Fingerprint and click Accept.
9. Management Center attempts to connect to the appliance. If the connection is established, the system displays
Successful.
If the connection test fails, you receive an error. Make sure that the information you entered is correct and try
again. If the connection test succeeds, you receive a success message.
10. Verify or change the Device Name.
11. Optional—Input any applicable attributes. See "Add Attributes" on page 366.
12. Click Save.
69
The Network tab displays the device and the web console displays an alert indicating that the device was added and activ-
ated.
Add a ProxySG or Advanced Secure Gateway using Public Key Authentication
deployment devices.
more information.
l Specify whether to collect statistics for the device. See "View Statistics Monitoring Reports" on page 458.
6. In Connection, click Public Key. Set the following:
l The SSH port.
l Your enable password for administrator actions.
l Confirm whether to Enable host key validation (recommended).
8. If you enabled host key validation, verify the SSH Host Fingerprint and click Accept.
9. Enter the username and password you use to authenticate to the device. You must do this so that Management
Center can install its public key onto the ProxySG appliance. The credentials are not saved.
Management Center attempts to connect to the appliance. If the connection is established, the system displays
Successful.
12. Click Save.
ated.
Add a Reporter
Symantec recommends that you create a new non-administrator Reporter role before adding Reporter to Man-
agement Center. If you choose to add a Reporter using the default Admin role, you must specify the role as "_
admin.”
70
deployment devices.
more information.
6. In Connection , specify the following:
l The protocol and port (HTTP or HTTPS).
l The Reporter role. Specify the role assigned to this user in Reporter. If this is an admin account, input _
admin.
Successful.
10. Click Save.
ated.
Add a Content Analysis, Malware Analysis, PacketShaper, or SSL Visibility
deployment devices.
more information.
6. In Connection , specify the following:
l The protocol and port (HTTP or HTTPS).
71
Successful.
10. Click Save.
ated.
Add Web Security Service (WSS)
deployment devices.
more information.
6. In Connection, do the following:
a. Click Connect.
b. Enter the username and password you use to authenticate to the device and click Register. After
successfully connecting, the system populates the Name fields.
After connecting to the WSS, Management Center deletes the credentials. They are not saved. For failover,
this has special implications.
ated.
Ensure that all devices belong to a hierarchy and "Ensure Devices Belong to Device Groups" on
group. page 112
Check information specific to the selected device. "Monitor Device Health " on page 113
Check device metrics. "View System Metrics" on page 119
72
Add a Device Group
A device group is a folder in the device organizational structure that exists below the hierarchy level and contains devices or
sub-folders.
1. Select the Network tab. In the left pane, select the hierarchy in which you want to create the device group.
2. (If applicable) Browse to the folder in which you want to create the device group. Select Add Group.
3. On the Add Group: Basic Info dialog, enter a name and a description. An asterisk denotes fields that are
mandatory.
4. Select a parent group from the Parent Group drop-down list. An asterisk denotes fields that are mandatory. Click
Next.
5. On the Add Group: Attributes dialog, use the up/down arrows to specify Bandwidth Cost. Bandwidth Cost is a
multiplier and is thus not expressed in a specific currency unit. For example, you can enter a value to represent on
average how you pay per gigabit for data usage on your network. "Set Bandwidth Cost for Reports" on page 479.
6. (Optional) Specify your Primary Contact for the device group, as well as the Location device group and the sub-
group.
7. Click Next. The Add Group wizard displays the Add Group: Membership.
8. Select devices from the Available Devices list and add them to the Associated Devices list.
9. Click Finish. The new device group is displayed under the network tab. If you cannot see the new device group,
select Unassigned Devices and "Ensure Devices Belong to Device Groups" on page 112 or "Configure Hierarchy for
Devices and Device Groups" on page 107.
You can define attributes for a particular a device, device groups policy and script objects. See "Manage
Attributes" on page 365.
73
Set the Device Polling Interval
You can specify the frequency with which Management Center looks for updates on managed devices. Specify an appro-
priate interval to ensure that device health statuses display accurately. The default interval is 10 seconds.
1. In the web console banner, select the Administration tab and select Settings.
2. Select General on the left. General fields display on the right.
3. Select Device Polling Interval (sec).
4. Enter a value in seconds.
5. Do one of the following:
n Click Reset to remove your current changes and revert to the default or last saved settings.
n Click Save to store the settings on the server.
n Click Activate to cause the server to load and apply the currently saved configuration.
If you have unsaved changes, the edited settings are marked with a red triangle. See the "Pending changes" text at the top
left of the dialog as an example.
74
Add Multiple Devices at Once
To add multiple devices using a CSV file, you can use Management Center's template CSV file, or you can create your
own. You can import multiple devices of various types, including:
l ProxySG appliances
l Content Analysis appliances
l Malware Analysis appliances
l PacketShaper appliances
l SSL Visibility appliances
l Reporter
Import Devices Using a CSV File
Before importing devices, ensure that the device groups that you want to assign the devices to have been created on Man-
agement Center. See "Add a Device Group" on page 73 for more information.
1. From the web console, click Network.
2. Select Operations > Import from File.
3. Select the Import devices from manually created CSV file.
4. Click Launch Import Wizard.The web console displays the Import Devices wizard.
5. From the Select Device Type dialog, select the device type that you want to import.Click Next.
6. You can either Download CSV Template or Select File and browse to the location of the import file containing all of
the devices. Click Next.
If you download the CSV template, open it and add your devices to it. Refer to the following table for
descriptions of the CSV file columns.
75
name deploymentStatus host port userName password enablePassw collectPdmSt

ord ats
Enter Specify the deployment Enter Enter Enter the Enter the Enter the Specify

the status: the IP the administrat administrat enable whether to
devic addres port or account or password to collect
DEPLOYED|UNDEPLO
e s. numbe for the password enter privileged statistics from
YED
name. r. device. for the mode on the the device for
Each device. device. reporting:
devic
TRUE|FALSE
e
name
must
be
uniqu
e.
7. After the devices are uploaded, they are displayed in the Import Devices: Assign Groups dialog.
8. Select the devices to assign to a device group.
To add an imported device to a group using a CSV file, the group must already exist in Management Center.
Therefore, ensure that you have created the desired groups before importing. You cannot create them using
the CSV file.
9. After the devices have been selected, from Device Group, select the object selector. From the available device
groups or hierarchies, select a device group. The selected device group is displayed when you select it. Click OK.
To apply the imported devices to the device group, click Apply.
10. (Optional) Repeat Step 9 until all imported devices belong to a device group or hierarchy.
11. When you are finished assigning the imported devices to device groups, click Finish.
group. page 112
View information about an imported device. "Verify Device Details" on page 117
Edit device information. "Edit a Device" on the next page
Check device metrics. "View System Metrics" on page 119
76
Edit a Device
You can edit device metadata, connection parameters, and the membership within a hierarchy and device group, and view
the effective policy for each slot.
Procedure
1. Select the Network tab. (Optional) Browse to the hierarchy and folders/subfolders where the device you want to edit
belongs. An asterisk denotes fields that are mandatory.
2. Select a Device.
3. Click Edit. Five tabs within the Edit Device wizard display editable fields:
l Basic Info
l Connection Parameters
l Membership
l Attributes
l Policies
4. Click the Basic Info tab. Edit the device name and description and view the deployment status, model number, serial
number, and OS version. See "About Pre-Deployed and Deactivated Devices" on page 103.
5. Click the Connection Parameters tab. The following fields are all required:
l The IP address or hostname of the device
l The username and password you use to authenticate to the device
l The enable password for administrator actions.
l The SSH port.
6. Click Test Connection. Management Center attempts to connect to the device using the information you edited.
7. Click the Membership tab. (Optional) Edit membership with the drop-down lists assigned to Hierarchy and the
following:
l Device Groups
l Location
l Organization
8. Click the Attributes tab. Mandatory attributes for the device are marked with a red asterisk (*). You can change the
value on mandatory attributes, but you cannot delete "Mandatory Attributes" on page 367.
9. Select the Policies tab. The Edit Device displays the effective policy for each slot. The Policy Name mapped to
each slot is displayed and the following assignments are displayed:
l Direct assignment - The policy was installed directly to the slot.
l Inherited from [Device Group Name] - The policy was inherited from device group that the device membership
is from.
The Local, Central, and Forward slots display CPL policy only. See "Create a CPL Policy Object" on
page 181 or see "Create a CPL Policy Fragment" on page 278
10. After you have completed editing the tabs for each device, click Save.
View Effective Policy for Each Slot on the Device
You can view the effective policy for each slot on the device from the Policies tab.
77
group. page 112
View information about the device. "Verify Device Details" on page 117
Choose Operations for a Device or Device Group. "Perform an Operation on a Managed Device" on
page 111
Edit device attributes. "Edit Attributes" on page 369
Edit policy attributes. "Edit Attributes" on page 369
78
Edit a Device Group
You can edit any device group, including the system's predefined parent groups (the top-level folders in the Location and
Organization hierarchies).
2. In either Tiles view or Details view, browse to the parent folder of the group you want to modify.
3. Select the group and click Edit. The web console displays the Edit Group wizard.
4. Edit the information on each tab as required:
l Basic Info - Change the device group name and description.
l Attributes - Under System, change the statistics collection option and bandwidth cost. For information on the
User-defined attributes, see "Filter Devices or Device Groups in a Permission" on page 361.
l Membership - Add or remove devices.
5. Click Save.
79
Launch a Device Console
Management Center offers a central location from which you can open the console of any managed Symantec device so
that you can log in to the device.
2. In the left pane, select the device group, and then select the device in the right pane.
3. Select one of the following:
l From the Operations drop-down list, click Launch Console.
or
l At the bottom of the web console, make sure the Overview tab is selected and click Launch Console.
4. Log in to the device.
View Device License Information
Management Center allows you to monitor the health status of a device's license and its associated components. Devices
are polled hourly for license changes.
Some unmonitored devices may show licensing information while others do not. If you disable statistics collection
on a device that was previously monitored, it will show the last license data. Devices that were never monitored
show no license data.
2. Select the device group in the left pane.
3. Select the Licenses tab. The system displays the license information for all applicable devices in the group,
including the licensed components, time to expiration, and the expiration date.
4. To review the license details for a specific device, click the + symbol next to the device's IP address.
The system then displays the same details for each associated license and component.
5. Optional: Click Export Data to save the data to a .csv file.
Upgrade System Images on Managed Devices
You can install system images to the following devices:
l ProxySG appliance
l Advanced Secure Gateway
l Content Analysis
80
l Malware Analysis
l SSL Visibility
To install system images on managed devices, complete the following steps.
1. Ensure that the system image has been uploaded to Management Center and that it has been associated with the
correct device type. See "Upload Files to Management Center" on page 43 for more information.
2. Select Jobs > Scheduled Jobs > New Job.
3. In the Basic Info dialog, enter a name for your job. An asterisk denotes fields that are mandatory.
4. Enter a description of the job. Good descriptions help to differentiate jobs when they have similar names. Click Next.
5. Select Install System Image from the Operation drop-down list.
81
6. Click the System Image field. The system displays the Select System Image dialog.
7. Select the system image and click OK.
8. Optional—Select Restart device(s) after installation to restart the target device after installation, which is required
to load the installed image on some device types.
82
9. Select the Delivery method:
l Upload image to targets
Choose this option to push the image to the target devices.
If the target devices are connected to the Management Center using SSH public key connections, enable the
if credential not available, pull image from Management Center check box. This option directs the target
device to pull the image from Management Center in the event that SSH authentication to the device fails.
Upload is supported for the Malware Analysis, SSL Visibility, Content Analysis, ProxySG, and Advanced
Secure Gateway appliances
Do not alter the file names for Malware Analysis images when uploading them to the Management
Center file server. This is required for successful installation of the image to the Malware Analysis
when the appliance has downloaded the image but installation was scheduled for another time.
l Download image from Management Center
Choose this option so that the target devices download the image from the Management Center file server.
This method is supported only by Content Analysis, ProxySG, and Advanced Secure Gateway.
l Optional (for download only)—Select pull over secure connection
This option determines whether the device will use HTTP or HTTPS to download the image from the
Management Center file server. Choose this option if Management Center has a certificate from a
trusted certificate authority (CA). If Management Center uses a self-signed certificate that is not
trusted (a common scenario), choosing this option may cause the download to fail.
If you choose the non-secure option, HTTP must be enabled on Management Center. To enable
HTTP, enter the following CLI commands:
#en
#security http enable
10. Click Next.
11. Select the target device(s) and click Next.
12. Select a job schedule and click Finish.
Troubleshooting
If the upgrade operation is not successful, check the following:
n Verify HTTP/HTTPS connectivity between Management Center and the target device(s).
n Verify that the image being installed is associated with the correct device type.
n Check Management Center and target device logs for errors.
83
Back Up Device Configurations
Management Center allows you to initiate and automate the configuration backup of supported devices. You can select one
or more devices or device groups to back up immedately or schedule a job for the backup.
1. From the Network tab, select the supported devices or device groups to back up.
2. From the Operations drop-down list, select Backup Devices. The devices that you selected appear in the Selected
list.
3. Click Next. The system displays the Backup Devices: Image Settings screen.
4. Enter the Backup Name and Backup Description. Optionally, you can use variables, as shown in the following
graphic. (See "Use Device Information for Backup Job Image Metadata" on page 87.)
5. To include private key data in the backup, select Include Private Data.
Currently, only the ProxySG and SSL Visibility appliances support this feature; the option is ignored for other device
backups. For the ProxySG appliance, key rings can only be backed up if they were configured to show (Show key
pair option) when created. Keys that were not configured to show are not included in backups, even if Include
Private Data is selected.
Note: Completed backups that include private key data include pki in the content details. ProxySG example:
6. To secure the backup with the data protection key, select Encrypt Backup. Encrypted backups are only decrypted
when the information is sent to the device. When you view the encrypted backup using the preview tab, only the
encrypted data shows.
Changing the Encryption Key may make any backups unrecoverable. See Encrypt Sensitive System Data for
more information.
l To immediately begin the backup of the selected devices, select Run Now.
85
l To execute the backup of the selected devices at a later time, select Create Job...
a. In the New Job: Basic Info dialog, enter a unique name and click Next.
b. Use the default name or enter a new one. Click Next.
c. Verify that the private key options are correct. Click Next.
d. Verify that the devices you selected appear in the Devices tab. Click Next.
e. Define when you want to schedule the device backup to occur. See "Job Scheduling Options"
on page 400 for descriptions of each option.
f. Click Finish.
Next Steps
Task Topic
List the configuration backups for a device and view the content of a "View Device Backups " on page 89
backup file
Restore a device configuration "Restore Device Backups" on
page 94
Export a device backup "Export Device Backups" on
page 92
Import a device backup Import Device Backups
86
Use Device Information for Backup Job Image Metadata
Administrators can control the name and description of the backup created by a job (based on the specific device that is
backed up). To use the device information in a backup job, administrators need to start a backup job from the Network tab
rather than the Jobs tab.
1. Select a device from the Network tab.
2. From the Operations drop-down list, select Backup Devices. Select the device(s) to back up. An asterisk denotes
fields that are mandatory.
3. Click Next. The web console displays Backup Devices: Image Settings dialog 'Manual Backup (04/04/15)' in the
Backup Name field.
Although the backup name is shown as mandatory, use "Use Substitution Variables in Policies and Scripts" on
page 194 to replace the words 'Manual Backup'. In the example shown, the device name variable will be replaced
when the job is run.
Use ${today} in the Description field of the backup to display the date that the backup is run. If you run the
backup now, today's date displays in the backup description.
4. Click Run Now. The Job Progress dialog displays the backup while it runs. You can select Continue in
Background or click Close when the backup Status is Complete. View all backups performed from the Backup tab
87
of the device.
88
View Device Backups
For any device whose configuration you have backed up, you can view a list of backup files as well as view the content of
the backup files. Once the list is displayed, you can delete or restore the backups.
2. Select a device group in the left pane, and then select the device name in the right pane.
To configure the maximum number of backups stored per device, see "Set the Number of Backup Slots" on
page 479.
3. Select the Backup tab displayed at the bottom of the screen. The web console displays all of the successful
backups, including each backup's name, description, date/time of the backup, device type, OS version, date/time it
was last exported, and date/time it was last restored.
4. Select a backup from the list.
5. Click View. The Manual Backup Viewer displays the backup in a text editor.
6. If the backup exceeds the text editor limit, a warning displays:
Click Download. The file will download to your local Downloads folder. When the file is finished downloading, you
can open it in Notepad or other text editor.
7. To pin or unpin a backup, click in the Pinned column. A checked box appears on pinned backups. A pinned backup
cannot be manually deleted or automatically pruned (replaced with another backup).
8. To delete an unpinned backup, select it and click Delete.
9. To apply a particular backup configuration to the device, select it and click Restore. See "Restore Device Backups"
on page 94 for more information.
89
Restore Device Backups
When you restore a device backup, Management Center replaces the device's current configuration with the backed up
configuration. You can restore a configuration immediately, or schedule the restore for a late date.
2. Select a device group in the left pane, and then select the device in the right pane.
3. Select the Backup tab at the bottom of your screen.
4. In the list of backups, choose the backup version you want to restore.
If the backup you want to restore isn't listed, it's possible that it was exported and pruned from the appliance.
In this case, you would need to import the backup before you can restore. See Import Device Backups.
5. Click Restore The web console displays the Restore Configuration dialog that displays the following information:
l Device - The device name
l Backup Image - The name of the backup
l Description - The description given at the time that the backup was made
l Created - The date and time of the backup
l Last Restored - The date and time that the backup was last restored
6. (Optional) To view the contents of the backup (configuration), click View Contents.
7. To restore the backup later, go to Step 9.
To restore the configuration immediately, click Restore. The web console displays the Job Progress dialog. The
Status column displays the running/completed job and more details about the job.
90
8. (Optional) To view the device output from the restored backup:
a. Select more details. The Device Output dialog displays the number and type of warnings.
b. You can navigate in between the errors and warnings.
c. Select Download as Text or Close.
9. To restore the backup later, click Create Job and follow the steps to configure the job. See "Add a Job" on page 395
for job options.
91
Export Device Backups
The Export Backup operation allows you to copy or move configuration backups to an external server. Copying backups
to another server provides extra insurance by essentially creating a backup of a backup. Or, if you move the backups off
Management Center and put them on an external server, you can make room for more backups on the Management Center
appliance.
1. From the Network tab, select a device or a device group whose configuration backup you want to export.
2. From the Operations drop-down list, click Export backups. If you have configured a location for the backup
already, Management Center immediately exports the backup to the configured location. However, if you have not
configured a location for the backup, the New Job wizard begins, displaying the New Job: Basic Info dialog.
3. Enter a unique name and a description for the Export. Click Next.
4. The New Job wizard displays the New Job: Operation dialog. The Operation is already displayed as Export
Backups.
l Operation(*) - Export Backups
l Export to Server(*) - Enter the server location using FTP, HTTP, HTTPS, or SCP
l Username - Enter the server username.
l Password - Enter the password for this user.
l Prune Backups - Select this option to remove the backups from the backup slots after exporting the
backups. You are essentially moving the backups if you select this option. If you leave this option cleared ,
you are copying the backups to an external server.
l Retention Count(*) - Enter the number of backups to keep for each device. This overrides the default
number of backup slots configured per device. (See "Set the Number of Backup Slots" on page 479.)
92
l Prune Pinned - Select this option to remove backups, even if they have been pinned (locked). Click Next.
5. In the New Job: Targets dialog, select additional devices or groups whose configurations you want to export.
Selected devices and groups display in Selected pane. Click Next.
6. Define when you want to schedule the export to occur or select Run Now to export the configurations immediately.
See "Job Scheduling Options" on page 400.
7. Click Finish.
93
Restore Device Backups
When you restore a device backup, Management Center replaces the device's current configuration with the backed up
configuration. You can restore a configuration immediately, or schedule the restore for a late date.
2. Select a device group in the left pane, and then select the device in the right pane.
3. Select the Backup tab at the bottom of your screen.
4. In the list of backups, choose the backup version you want to restore.
If the backup you want to restore isn't listed, it's possible that it was exported and pruned from the appliance.
In this case, you would need to import the backup before you can restore. See Import Device Backups.
5. Click Restore The web console displays the Restore Configuration dialog that displays the following information:
l Device - The device name
l Backup Image - The name of the backup
l Description - The description given at the time that the backup was made
l Created - The date and time of the backup
l Last Restored - The date and time that the backup was last restored
6. (Optional) To view the contents of the backup (configuration), click View Contents.
7. To restore the backup later, go to Step 9.
To restore the configuration immediately, click Restore. The web console displays the Job Progress dialog. The
Status column displays the running/completed job and more details about the job.
94
8. (Optional) To view the device output from the restored backup:
a. Select more details. The Device Output dialog displays the number and type of warnings.
b. You can navigate in between the errors and warnings.
c. Select Download as Text or Close.
9. To restore the backup later, click Create Job and follow the steps to configure the job. See "Add a Job" on page 395
for job options.
Set the Number of Backup Slots
By default, Management Center stores up to five backups per device, with each backup placed in a slot. After five backups,
Management Center prunes (deletes) an unpinned backup to make room for the new backup. (Backups that are pinned are
preserved and cannot be manually deleted or automatically pruned.) If you want Management Center to store more or fewer
backups per device, you can adjust the number of backup slots.
1. Click the Administration tab and select Settings.
2. Select General on the left.
3. In the Number of backup slots enter a new value.
4. Click Save.
You can override the default number of backups that are retained for a device by entering a Retention Count when
exporting backups. See "Export Device Backups" on page 92.
SSL Visibility Appliance - What is Backed up and Synchronized?
This page describes the SSL Visibility appliance configuration items that are backed up or synchronized.
95
Policy
l FIPS configuration and version
l Policy versions
l System options
l Rulesets
l Lists (IP address, cipher suites, certificates, etc.)
PKI
l RSA and ECDH data
l Certificate authority data
l Trusted and known certificate data
l HSM data
Users
l Usernames
l Passwords
l Roles
l User IDs
Platform
l Version information
l Network settings
l NTP settings
l Remote logging settings
l SNMP settings
l Login banner settings
Alerts
l Mail configuration and roles
Remote authentication
l TACACS settings
96
Monitor Device Health and Statistics
Devices can be activated or deactivated. Management Center actively monitors the health status of activated devices.
Deactivated devices are not monitored. Whether you choose to activate or deactivate a device depends on your business
requirements. For example, you might have already set up a pre-deployed device that is now ready to be activated, or want
to deactivate a device that must be taken offline for maintenance.
Appliance statistics collection over HTTP port 9009 is disabled by default in 1.7 and later. The new default is HTTPS
port 9010. See Statistics Monitoring Over HTTPS for more information.
Any of the Change Monitoring Status actions can be saved to a job and scheduled. See "Add a Job" on page 395
for more information.
Change Health Monitoring Status
Deactivating a device is NOT the same as deleting a device. See "Stop Managing a Device" on page 102.
2. Locate the device you want to activate or deactivate. See "Filter Devices or Device Groups in a Permission" on
page 361.
3. Select the device or group, and click the Operations drop-down list.
4. Select Change Monitoring Status...
5. Select one or more devices and click Next.
97
6. Verify that Change Health Monitoring state is selected and do one of the following:
a. To activate a deactivated device, select Activate Device.
b. To deactivate an activated device, select Deactivate Device.
Deactivating a device disables all statistics monitoring.
If you try to activate the device when the connection parameters are not specified, you receive an error. To specify
connections parameters, see "Edit a Device" on page 77.
7. Click Run Now. The system displays the Activate Devices - Job Results window.
98
The device status can take up to 30 seconds to change.
Enable or Disable Statistics Monitoring
Use these options to enable or disable statistics monitoring. You can disable statistics monitoring without deactivating the
device. However, Management Center can only collect statistics from activated devices.
2. Locate the device you want to activate or deactivate. See "Filter Devices or Device Groups in a Permission" on
page 361.
3. Select the device, and click the Operations drop-down list.
4. Select Change Monitoring Status...
99
5. Select one or more devices and click Next.
The system displays the Change Monitoring Status: Operation States dialog.
6. Verify that Change Statistics Monitoring state is selected and do one of the following:.
a. To enable statistics monitoring, select Enable Statistics Monitoring collections.
You can only enable statistics monitoring for activated devices.
b. To disable statistics monitoring, select Disable Statistics Monitoring collections.
7. Click Run Now. The system displays the Activate Devices - Job Results window.
100
The device status can take up to 30 seconds to change.
101
Stop Managing a Device
To stop managing a device in Management Center, you delete it. You should only delete a device from your network if you
are certain that you will not need to manage and it in the future.
When you delete a device, you remove it permanently from Management Center, and the only way to restore it is to
add it again. If you want to stop monitoring a device temporarily, deactivate it instead of deleting it.
2. Locate the device you want to delete. See "Search for Managed Devices" on page 110.
3. (Recommended) Verify that the device is the one you want to delete. See "Verify Device Details" on page 117.
4. Select the device, and then click Delete. The device and all related information, including reports is permanently
removed from the system.
Deletion cannot be undone. Once removed from the network, the device needs to be registered again.
5. Confirm that the device was deleted. Deleting a device configuration can take up to 60 seconds to complete.
102
About Pre-Deployed and Deactivated Devices
You can manage devices in Management Center even if you do not have the ability to monitor their activity and statistics.
These devices have an Inactive status in the system; when you select them, the System Metrics and Health Checks tabs
at the bottom of the screen display no data.
To look for inactive devices in the system, click the Network tab and clear all the statuses beside Filter by except Inactive:
The Network tab displays only the Inactive devices.
Inactive devices consist of two types: pre-deployed devices and deactivated devices. The following are examples of why
you might need to manage inactive devices:
l You add a device that has not arrived in your organization yet or is not set up. In this scenario, in the Add Device
wizard, you select Unavailable (pre-deployment) for the deployment status. Connection parameters are not
required when you select the pre-deployment status, so you must specify them before you activate the device later.
l To allow for scheduled maintenance or other scenarios where devices must be powered off. In this scenario, to
prevent error alert messages, you could deactivate the affected devices by selecting them and clicking Deactivate.
Then, reactivate the devices when maintenance is complete.
For more information about device status and the use of color in the web console, see "About Color-Coded Status
Indicators" on page 30.
Restart a Device
If you need to reboot a managed device, you can restart it from Management Center's web console.
2. In the left pane, select the device group, and then select the device in the right pane.
3. From the Operations drop-down list, click Restart.
4. Click OK to confirm the reboot.
103
Synchronize Devices
Management Center supports synchronization of the following device types: SSL Visibility, Content Analysis, and Mal-
ware Analysis.
When devices have similar or exact configurations, you can copy the configuration of one device (the source) to one or
more similar devices running the same or later OS versions. As an example, you can't synch from a non-FIPS image to a
FIPS image.
Prerequisites
n Determine which device has the configuration settings you want to synchronize to other devices. This device will
be your source device.
n Under Devices on the Network tab, identify the target devices and verify that their OS version is the same or later
than the source device. The OS version is displayed in the device's Overview tab. See "View System Metrics" on
page 119.
Device Sync Details
Different settings may be synched for each device.
Support for SSL Visibility Appliance
Management Center does not allow synchronization from a newer version of an operating system to an older ver-
sion. For example. you cannot synchronize a 3.8.3 operating system version to a 3.8.2 operating system.
What to synchronize:
n Alerts - alerting and notifications used on the device
n Users - names and passwords on the device
n PKI - certificate (or the database store)
n Policy - rules for decrypting traffic
n Remote authentication - controls the way the device authenticates, as for TACACS
SSL Visibility appliances do not report platform information in the device overview. Platform is displayed as N/A as
shown in the example.
Support for Content Analysis
Management Center does not allow synchronization from a newer version of an operating system to an older ver-
sion.
What to Synchronize:
l Select Configuration. Not all elements of your Content Analysis appliance configuration can be saved/restored.
Administration details and network information defined in the initial deployment of your appliance must be manually
104
assigned. The following components are included:
o Global Anti-Virus Policy
o Kaspersky Policy
o Sophos Policy
o Alert Settings
o Alert Templates
o SMTP Settings
o Consent Banner
o Custom Logo
o NTP Settings
o Timezone Configuration
o HTTP Settings
o SNMP Settings
o Sandboxing Settings
o Static Analysis Settings
Support for Malware Analysis Appliance (MA)
Management Center does not allow synchronization from a newer version of an operating system to an older version.
What to Synchronize:
l Settings - All settings within these groups are synced:
o File reputation (enabled/disabled)
o Cleanup daemon
o Proxy Server
o YARA state (enabled/disabled)
o Virus Total key
o Task Defaults
o Updates (enabled/disabled)
o WebPulse
l Pattern groups created by users
Perform Device Synchronization
Follow this basic procedure.
1. Click the Jobs tab.
2. Select New Job. The web console runs the New Job wizard. An asterisk denotes fields that are mandatory.
3. Enter a Name(*) and Description.
4. Click Next.
5. From the Operation(*) drop-down list, select Synchronize Devices.
6. Select a Source Device(*) from the list of available devices. After selecting a source device, click OK.
7. Select the check boxes to define What to synchronize(*). Available choices are specific to the device and are not
platform specific.
105
8. Click Next. Select target devices or device groups that you want to keep in sync with the source device. If you
select a device group that includes devices that are not supported, the synchronization job automatically filters out
any devices that are not the correct device type.
9. Click Next. Define a schedule to run the Synchronize Devices job. See "Job Scheduling Options" on page 400.
106
Configure Hierarchy for Devices and Device Groups
The Hierarchy is the highest level in the device structure in Management Center. Any hierarchies that you create are at the
same level as the predefined Location and Organization hierarchies. Because you can manage 500 devices, creating hier-
archies is critical in managing device health, status, deploying policy and handling large jobs.
The Hierarchical structure of Management Center enables users to manage policy across a large number of data centers in
a way that users can segregate the administration of policy.
Hierarchical Configurations
Management Center organizes its many managed devices into hierarchies with parent and child configurations. The key to
understanding Management Center hierarchical configurations is to remember the basic rules of managing device groups,
devices, and managing policies that can be deployed to all the devices in your organization.
Using the hierarchical structure, multiple devices can merge their policy attributes, devices can inherit policy attributes from
a parent device group, or child devices can be directly assigned policy.
Device Groups can belong to other Device Groups, but cannot belong to multiple Hierarchies (for example, you can-
not have the same Device Group in both Location and Organization).
Create hierarchies to represent geographical regions, organizational or departmental structure, deployment type, or anything
else appropriate for your network. You can then add device groups to as many hierarchies as needed.
1. Click the Network tab. In the left pane, to the right of the Group By drop-down list box, click the Manage Hierarchies
icon .
107
2. Click Add Hierarchy. In the Hierarchy Name field, enter a unique name.
3. In the Comments field, enter useful comments to differentiate this hierarchy from others. Fields marked with a red
asterisk (*) are required settings.
4. The name you entered in step 2 automatically populates the Root Folder Name field. Accept the name if you do
not want to create a root folder within the hierarchy.
5. To create a new root folder, enter a name for it in the Root Folder Name field. Click Save.
The root folder is the parent folder for all subfolders. For example, in the Beach Names hierarchy, Beach Names is
the parent folder for the subfolders (West Coast Beaches, East Coast Beaches and Gulf Coast Beaches).
108
Edit a Hierarchy
1. To edit a hierarchy, from Groups select a device group name, click Edit. The Edit Hierarchy dialog displays.
2. Edit the name, comments, and root folder name as needed. Fields marked with a red asterisk (*) are required
settings.
3. Click Save to save your hierarchy changes or click Cancel to return to the Manage Hierarchies dialog.
You can delete any hierarchy except for the Location hierarchy.
Delete a Hierarchy
1. To delete a hierarchy, from Groups select a hierarchy, click Delete. A Delete Confirmation displays.
2. Confirm the deletion; click Delete.
If you delete a hierarchy that contains devices, the devices are still members of any other hierarchies to which they
belong. If you delete the last hierarchy to which a device belongs, you can click Unassigned Devices to see the
device.
To add a device group to the Hierarchy, see "Add a Device Group" on page 73.
109
Search for Managed Devices
You can search for devices in your network using several methods.
Search by Name or IP Address
In most cases, searching by the name or IP address is the most efficient way to locate a device.
2. In the search field at the top of the tab, enter one of the following:
l Device name
l String in the device name
l IP address of the device
l Octet or part of an octet in the device IP address
3. Press Enter or click the search icon (magnifying glass).
The system returns a list of all devices that match the search criteria in a Search window.
Select a device to view it, or click the X in the top right corner of the window to close it.
Browse the Hierarchy
Select the Network tab and browse the hierarchy and folders for the device. This method is convenient if you know where
the device is located in the folder structure, or if the folder structure is not too deep or complex.
110
Perform an Operation on a Managed Device
The status of a managed device can control which operations are allowed on a device. See "Monitor Device Health " on
page 113.
Operations that are not available for the selected device or device group are grayed out in the Operations drop-down
list.
2. Select the device group in the left pane, and the device in the right pane.
3. Click Operations to display the drop-down list of options.
4. Select the desired option:
n View Licenses
n Launch Console
n Restart
n Delete
n Change Monitoring Status
n Backup Devices
n Export Backups
n Import Backups
n Import from File (Add Multiple Devices)
n RMA Device
n Purge Stats Monitoring
n Remove Unused Tenant Policy
111
Ensure Devices Belong to Device Groups
Symantec recommends that you periodically verify that all devices are assigned to groups. A device might become unas-
signed if no groups were selected when the device was added to Management Center, or if the groups to which the device
was assigned were deleted. See "Edit a Device Group" on page 79.
Because unassigned devices do not display in any groups, users might not manage them or even be aware of them if they
work only in device groups or only have access to specific device groups in their role filters.
A device group can be inside another device group, but a device group cannot be in multiple hierarchies.
1. Click the Network tab. From the left pane, click Unassigned Devices. Unassigned devices display in the right
pane.
2. Select a device you want to assign to groups and click Edit. The web console displays a wizard with the following
tabs:
l Basic Info
l Connection Parameters
l Membership
l Attributes
l Policies
An error message displays at the bottom, citing the reason why the device is not assigned to a device group.
3. Click Membership. Enter a location for the device.
4. Click Save. A message stating: [device name] was saved successfully.
5. (Optional) To assign by dragging and dropping the device to a device group, select the device and drag it into the
device group into the tree on the left. Drop the device. Confirm the move. Click OK.
112
Monitor Device Health
Management Center collects health status information on device components including system resources, license validity,
and user-defined health checks, and displays the aggregate health status in several areas.
Device health is always represented by status colors: Error (red), Warning (yellow), and OK (green). A device's health
status is determined by system-defined thresholds on the device: if a service or other monitored component exceeds a
threshold, the device goes into a Warning or Error state.
If you cannot get the device out of the Error state, regardless of what you try, you may need to RMA the device. See "Per-
form an Operation on a Managed Device" on page 111.
A gray status color indicates an absence of health status and represents an Inactive device. Some jobs and operations can-
not occur on inactive or pre-deployed devices.
See "About Color-Coded Status Indicators" on page 30 for more information on status colors in various areas of the web con-
sole.
For more information on monitoring health status on the ProxySG appliance, refer to the SGOS Administration Guide.
View Device Health Status on the Dashboard
The Dashboard displays overall health status information in widgets. Two widgets display by default, but you can close
them by clicking the X in the top right corner.
The Device Health widget gives an overall picture of the health of monitored devices in a circle graph.
Click a status icon below the chart to see the devices that have that status.
The Top Problem Devices widget lists the devices that are consistently displaying with errors or warnings.
113
For example, if you click on the first SG300 Series device, the Device Overview displays the health status as red with the
specific errors and warnings for each device value.
If you have removed a widget from the Dashboard, you can display it again. See "Change the Dashboard Layout or
Refresh Rate" on page 475 for instructions.
View Health Status in the Banner
In the web console banner, look for the device status icons.
Click a status icon to see the devices that have that status. These totals are the same as the device status totals that dis-
play under the Device Health widget on the Dashboard; because these are in the banner, they are visible to you no matter
which tab you are working on.
View Device Health Status
2. Select the device whose health you want to view. Overview, System Metrics, Dashboard, Health Checks and
Backup tabs display at the bottom of the screen.
114
3. Click Health Checks. The web console displays information about the system resources. Scroll to the bottom of the
screen to view the following:
View Device Dashboards
A dynamically generated dashboard is available for device monitoring. CAS and MA are currently supported.
2. Select the device whose health you want to view. Overview, System Metrics, >Dashboard, Health Checks and
Backup tabs display at the bottom of the screen.s
3. Click Dashboard. The web console displays system status metrics. The content available will vary with the device:
ProxySG/Advanced Secure Gateway Dashboard
MA Dashboard
CAS Dashboard
115
The metrics may be displayed in one of several different ways:
n Counters: Displays a count for a specific time period.
Examples: Object Count, Total Scan.
n State: Displays a text value.
Examples: Condition - Green/Yellow/Red condition indicator.
n Series: Displays values over a period; this presentation may be in an area display, a bar, a column, a pie chart, or a
donut chart.
Examples: CPU, ICAP Scan.
Resolve Device Errors
See Resolve Device Errors for more information.
116
Verify Device Details
To verify a device's information after you have added it, or to help identify a device, do the following:
1. Click the Network tab and select a device to view. Select the device whose details that you want to view.
2. At the bottom of the screen, click the up arrow . The monitor window expands from the bottom of the screen.
3. Overview, System Metrics, and Health Checks and Backup tabs display at the bottom of the expanded window.
4. Click Overview. The web console displays information about the system resources.
5. Inside the Overview tab, click Launch Console to launch the console of the device, or click Refresh to query the
device for the latest values to display within these device tabs.
After you upgrade or downgrade the device, use the Refresh button to display the latest values correctly. See
"Upgrade/Downgrade System Images" on page 487.
6. To close the device monitor window, click the down arrow .
Device Overview Tab
Value Description
Device Icon The icon used to depict a certain device type, for example a ProxySG appliance is depicted
by the icon.
IP Address The IP address of the device.
Last update The date and time of the last update starting with how long ago the last update began (in
seconds).
Example:
< 20 s ago
6/1/15 6:02 PM GMT-05:00
The example shown is when <6/1/15> equals the date in short format, <6:02 PM> equals the
time on a 12-hour clock and <GMT-05:00> equals the time zone <Greenwich Mean Time
minus 5 hours> which at the time of this documentation equals Central Daylight Time.
System started The date and time that the system started.
Example:
5/26/15 11:42 AM GMT-05:00
The example shown is when <5/26/15> equals the date in short format, <11:42 AM> equals
the time on a 12-hour clock and <GMT-05:00> equals the time zone <Greenwich Mean Time
minus 5 hours> which at the time of this documentation equals Central Daylight Time.
117
Value Description
Model The appliance model of the appliance.
Example:
VA
The example shown is where <VA> equals a virtual appliance.
Platform The Symantec platform information that the software is running on.
Example:
Symantec SGVA Series
The example shown is when Symantec <SGVA> Series equals ProxySG Virtual Appliance
Series.
Serial Number The serial number assigned to the selected device.
Host The host IP address of the selected device.
OS version The version of the operating system, including the version number and edition.
Example:
SGOS 6.5.5.410 SWG Edition
The example shown is when <SGOS> equals the ProxySG Operating System, <6.5.5.410>
equals the version number and <SWG> equals Secure Web Gateway Edition.
Build The build number of the software running on the selected device.
Example:
150788 64-bit, gbd, optimized
The example shown is when <150788> equals the build number, <64-bit> equals the capacity
at which bits can be processed and stored and <optimized> equals clock optimization for this
particular build number.
118
View System Metrics
In Management Center, device metrics refer to key hardware components such as CPU usage, disk status, fan status, and
motherboard temperature. Refer to these metrics to verify availability and performance of system resources.
1. Select the Network tab. Select a device to view metrics.
2. At the bottom of the screen, click the up arrow . The monitor window expands from the bottom of the screen.
3. The web console displays the O verview, System Metrics, and Device Health and Backup tabs.
4. (Optional) If the device is always is an error state (yellow or red) and you are unable to update the license or restore a
good configuration, you may need to perform an RMA for the device. See "RMA a Device" on page 121.
5. Click System Metrics. The web console displays information about the system resources. If available, scroll down
to see all of the metrics available for the selected device. To see device details in the overview tab, see Verify
Device Details.
Management Center can collect metrics only from activated devices. If you select a deactivated or pre-
deployment device, the Overview, System Metrics, Health Checks and Backup tabs display no
information.
The System Metrics Tab
The Systems Metrics tab provides a snapshot glance of the disk status as well as the percentage that both the CPU and
Memory are currently being used, and the threshold settings for both Warning and Critical. To configure warning and critical
thresholds displayed in the System Metrics tab, see "Configure Hardware Monitor Settings" on page 486 An example of a
ProxySG appliance is displayed in the table shown below.
Metric Description Status Current Value Warning Threshold Critical Threshold

CPU Utilization OK 3% 80% 95%
Memory Utilization OK 25% 90% 95%
Disk 1 Status OK present
Disk 2 Status OK present
The Health Checks Tab
The Health Checks tab displays information based on the type of device that you have selected. An example of an SSL Vis-
ibility appliance is displayed in the table shown below. The top row displays General with the number of health checks that
are routinely performed on the device. To see other places within the web console to view device health, see "Monitor
Device Health " on page 113.
Name Info State UP/DOWN

- General (4)
License OK Up
Load OK Up
Network OK Up
119
Name Info State UP/DOWN

System OK Up
The Backup Tab
The Backup tab displays all of the device backups for the selected device. The Backup tab also displays whether a
device backup has been exported to an external server, and whether it has been restored. Perhaps most importantly, you
can pin a backup to ensure that it doesn't get deleted when Management Center deletes old backups when performing
routine disk maintenance. When importing a backup, Management Center will not replace pinned backups unless spe-
cified when you "Restore Device Backups" on page 94. You must select a backup from the list to View, Restore, or
Delete a backup. See "Monitor Device Health " on page 113. An example of a ProxySG appliance backup information is
displayed in the table shown below.
Name Description Date/Time ê Device OS Ver- Exported Restored Pinned

Type sion Date Date
Device SG in Dallas 7/3/15 8:05 PM ProxySG SGOS ë
Name GMT 6.5.5.410
Device SG in Tuscon 6/3/15 7:58 PM ProxySG SGOS 7/11/15 7/12/15
Name GMT 6.5.5.410 1:58 AM 3:30 PM
GMT GMT
Device Joe's SG 5/3/15 8:01 PM ProxySG SGOS 5/23/15 5/27/15 ë
Name GMT 6.5.5.410 6:01 AM 4:12 PM
GMT GMT
Device Matt's SG 5/3/15 8:03 PM ProxySG SGOS
Name GMT 6.5.5.410
Export device backups to an external server. "Export Device Backups" on page 92
Verify device details in the Overview tab. Verify Device Details
View device backup in a text editor. "Monitor Device Health " on page 113
120
RMA a Device
If you need to return a device to Symantec using Return Merchandise Authorization (RMA), follow the procedure below to
replace the defective device with the replacement device in Management Center. This procedure assumes you have ini-
tiated the RMA process with Symantec.
1. Record the serial number of the defective device. You will need this number when performing the RMA Device
operation below.
2. (Optional) Deactivate the defective device. See "Monitor Device Health and Statistics" on page 97.
Deactivated devices show on the Network tab with a gray status. If you don't deactivate the device, it will
show on the Network tab with a red status.
3. Return the defective device to Symantec.
4. Install the replacement device in the network. If you assign it the same IP address and credentials, you do not need
to add the device into Management Center; otherwise, you will need to "Add a Device" on page 68.
5. Go to the Network tab and select the replacement device.
6. From the Operations drop-down list, select RMA Device. An asterisk denotes fields that are mandatory.
Management Center will attempt to connect to the device and retrieve its serial number. If it succeeds, it will
display it next to Serial Number detected on device.
7. In the Provide previous Serial Number field, enter the serial number of the defective device.
121
8. (ProxySGs only) Decide whether you want to apply existing Statistics Monitoring data from the defective device
and migrate it to the replacement device. Select the desired option:
n migrate Statistics Monitoring data
n ignore Statistics Monitoring data
9. Click Update Device.
10. From the Operations drop-down list, click Restart.
122
Put Device in Read-Only Mode
You might want to monitor some devices while also preventing configuration changes on them. Management Center dis-
plays a lock next to devices in read-only mode, as shown below.
Read-only devices can be selected as targets for jobs, scripts, etc., but that job step will fail.
Allowed Operations for Read-Only Mode
Operation Allowed?
Edit Metadata Yes
Edit Attributes Yes
RMA Yes
Purge Stats Monitoring Yes
Import from file Yes
Assign Group Membership Yes
Use as a policy target Yes
Install Policy No
Remove unused policy No
Execute script No
Backup Device Yes
Export Backup Yes
Restore Backup No
Launch Console Yes
Activate Device Yes
Deactivate Device Yes
Restart Device Yes
Device sync as a source Yes
Device sync as a Target No
123
Add a Device in Read-Only Mode
The Management Center system only allows existing devices to be set in read-only mode.
2. Select Add Device.
3. Select the type of device.
4. Select the Existing device from the Deployment status menu.
Devices added with the Deployment Status set to Unavailable (pre-deployment) cannot be set to Read
Only.
5. Set the Edit mode as Read Only.
6. Enter the connection details and follow the rest of the Add a Device process.
124
Put an Existing Device in Monitor-Only Mode
2. Locate the device, select it, and click Edit.
3. In the Edit mode field, select Read Only.
125
4. Click Save.
126
Use WAF Policy To Protect Servers From Attacks
As more and more organizations move to web applications, they are exposed to new and sophisticated threats. While tra-
ditional firewalls and IPS systems are effective for detecting threats in layers 3 and 4, they cannot interpret the logic inside
the application layer, making them ineffective against web application threats. Web Application Firewalls (WAF) were
designed for just this purpose. W AF devices protect web applications by inspecting traffic and controlling access to applic-
ations.
As the following diagram shows, the ProxySG WAF appliance is typically deployed behind the firewall and in front of the
back-end content servers. It is typically paired with the Malware Analysis and Content Analysis appliances, while Reporter
and Management Center provide reporting and remote management services.
In Management Center 1.5.x and later, you can use Management Center to construct Web Application Firewall (WAF)
policies for your ProxySG appliances. These WAF policies are designed to protect back-end web applications and servers
in a reverse proxy deployment from external security threats. The ProxySG WAF solution provides the following:
n OWASP top 10 threats protection
n Content Nature Detection
n Virtual Patching
n Cookie signing
n Denial of Service (DoS) protection
n Whitelisting and blacklisting
n Advanced policies (CSP, HSTS, HPKP, etc.)
n Analytics filter (heuristics anomaly detection)
n GEO location intelligence
n Normalization
n Signature versions per application
n JSON / XML security
Requirements
To use the WAF features, you must purchase the following:
128
l Web Application Protection (WAP) Subscription (included with Management Center but must be purchased for your
ProxySG appliances).
If you have purchased a subscription, it is automatically downloaded to Management Center. To manage your
subscription, see #subscriptions in the Management Center Configuration WebGuide.
In Management Center 1.6.1.1, the subscriptions command controls only the Web Application
Protection (WAP) subscription. To use Web Application Firewall (WAF) features, you must ensure that
Management Center can connect to https://subscription.es.bluecoat.com to download the WAP
subscription bundle. If the WAP subscription cannot be downloaded, the Blacklist and Analytics Filter rules
table in the Security Profile will not be available. However, all other WAF features should still be available
and functioning. The WAP subscription cannot currently be loaded when Management Center is in offline
mode.
l Multi-Tenant Policy License.
These licenses are purchased on a per ProxySG appliance basis.
Software Version Requirements
l ProxySG appliance: Must run SGOS 6.6.3 or later.
l Reporter: Must run 10.1.3 or later, which provides the new WAF database.
l Management Center: Must run 1.5 or later, which provides the new WAF interface.
Recommended Reading
Before using these WAF features, Symantec strongly recommends reading and familiarizing yourself with the following
ProxySG appliance documents:
l Web Application Firewall Solutions Guide
l Multi-Tenant Policy Deployment Guide
Solution Steps
1. Learn about WAF policy.
2. Select a tenant.
Tenants are administrative entities defined on ProxySG appliances. Each tenant has a unique instance of policy
governing its traffic. To begin, first deploy WAF policy to the default tenant. You can add additional tenants later if
you require WAF application objects with different security profiles.
3. Create a Tenant Determination File.
This object controls how requests are routed to the tenant slots in policy. A Tenant Determination File always
references the default tenant. Optional tenant references and rules controlling their selection can be added as
needed when additional tenant slots are created.
4. Deploy the Tenant Determination File to the appropriate ProxySG appliances.
5. Create and configure a WAF Security Profile.
129
A WAF Security Profile defines the security rules for the Web Application Firewall.
6. Create and configure a WAF application object, associating a tenant and WAF Security Profile.
A WAF application object represents a web application (or group of Web applications) and its associated WAF
security settings.
7. Add targets and deploy the WAF application object to those targets.
8. Run web application traffic through the WAF and review your logs for false positives.
The bcreporterwarp_v1 access log format is recommended for reverse proxy WAF deployments. For more
information, refer to the Web Application Firewall Solutions Guide.
9. Refine your WAF Security Policy:
a. Add exemptions to your WAF security policy.
b. Change WAF protections controls from Monitor-mode to Block-mode.
c. Optional—Configure Effective Date to intelligently handle subscription updates.
About WAF Policy
As described in "Use WAF Policy To Protect Servers From Attacks" on page 128, WAF policies are designed to protect
backend web applications and servers in a reverse proxy deployment from external security threats.
The Management Center WAF policy feature uses the following policy elements:
Tenants. Management Center WAF policy is centered around the concept of tenants. Tenants are administrative entities
defined on the ProxySG appliance that allow policy to be applied to a request matching specific properties or conditions. Ten-
ants represent one or more web applications. Each WAF application object (see below) is associated with a tenant.
Tenant Determination File. A Tenant Determination file includes policy conditions that control which tenant policy slot is
evaluated for an HTTP request. When policy matches a request, the tenant is identified and all policy associated with the
tenant ID is applied to the request. For example, a tenant's rules could indicate that all traffic to port 80 must have this ten-
ant's policy applied to it. After setting these rules on Management Center, you deploy this file to your ProxySG appliances.
WAF Security Profile. A WAF security profile is a shared object (a policy element that can be referenced by multiple policy
objects) that defines the Web Application Firewall settings for the associated WAF application object. For its rules to be
enforced, a WAF security profile must be associate with a WAF application object.
WAF Application Object. WAF policy is configured through the use of a WAF application object. A WAF application rep-
resents a tenant (a web application or group of web applications) and its associated WAF security profile settings. There-
fore, to create a WAF application, you must associate it with a tenant (web application) and a WAF security profile (security
settings).
About the Default Tenant
For new WAF deployments, you begin by associating a WAF application with the default tenant. The default tenant contains
the policy rules applied to all requests that do not match a specific tenant. This ensures that all requests have a base level of
WAF protection, and simplifies the deployment process.
After deploying policy to the default tenant, create additional tenants as needed. For example, you can define a tenant for
your Salesforce application and another tenant for your SharePoint application. Then, you can create and apply specific
policy to protect and control each of those tenants.
130
About Tenant Determination
The criteria that determines the correct tenant policy to apply to a request are called tenant determination rules. As shown
below, tenant determination is controlled through the use of a <tenant> layer in the Landlord CPL slot on the ProxySG
appliance.
On Management Center, you configure the Landlord slot by creating a Tenant Determination File. In other words,
the Landlord slot on the ProxySG appliance is referred to as a Tenant Determination File on Management Center.
The <tenant> layer in the Landlord slot specifies conditions and tenant() properties. Within this layer, a small subset
of CPL conditions are supported. These conditions are used like a switch statement (conditional logic flow) to specify
which tenant slot CPL should be evaluated for a given request. When the conditions on a line evaluate to true, the tenant
() property is set and evaluation of the current layer ends.
After tenant determination, the request is routed through a tenant, whose policy is evaluated for that transaction. When no
specific tenant is determined for a request, the default tenant policy is used. Tenant determination criteria governs which
tenant's policy applies to a given request.
Reference: Conditions and Examples
Supported Conditions
The following table shows the tenant conditions supported in Management Center.
Condition Available Qualifiers Example

Client Address matches Client Address matches 10.167.3.25
Client Effective Address matches Client Effective Address matches
10.167.0.87
Proxy Address matches Proxy Address matches 10.140.2.104
131
Condition Available Qualifiers Example

Proxy Port = Proxy Port = 8080
Port = Port = 80
URL equals URL equals http://www.example.com/test
contains
matches regex
URL Domain contains URL Domain contains example.com
URL Extension equals URL Extension equals .net
is not present
URL Host equals URL Host equals http://www.example.com
contains
matches regex
URL Path equals URL Path equals /example
contains
matches regex
URL Query equals URL Query contains ?name=
contains
matches regex
Tenant Determination CPL Example
The following CPL rules provide an example of tenant determination in the Landlord slot.
<tenant>
url.path.substring="/Webapp/portal" tenant(webapp_portal)
url="http://domain.com/mail" tenant(domain_mail)
tenant(default)
In the preceding CPL, the condition on each line is evaluated. If the condition is a match, the tenant() property on that line
is set appropriately and the evaluation of the <tenant> layer exits. If no tenant is determined, the tenant(default) is
used.
The tenant(default) property is implicit and does not actually need to be included in the CPL rules. Always
deploy WAF policy to the default tenant to ensure that all requests are processed by the WAF. Specific applications
(or groups of applications) that require different WAF security settings can then be split off into unique tenants as
required.
WAF Policy Evaluation Example
The example below describes WAF policy evaluation:
1. The ProxySG appliance intercepts a request.
2. The appliance examines the initial connection parameters (source, destination, port, URL).
3. The appliance applies policy to the traffic.
132
4. The Landlord policy (Tenant Determination File) is examined.
5. The request is set to a specific tenant slot, or to the default tenant slot.
6. The appliance re-evaluates the request using a CPL stack that contains the appropriate tenant policy.
7. If allowed by policy, the ProxySG appliance sends the traffic to the appropriate server.
Manage Tenants
Tenants are administrative entities defined on ProxySG appliances. Each request is routed through a tenant, whose policy
is evaluated for that transaction. When no specific tenant is determined for a request, the default tenant policy is used. Ten-
ant determination criteria governs which tenant's policy applies to a given request. Add these tenants to Management
Center to create and deploy tenant-specific policy.
On the ProxySG appliance, there are two options for controlling tenancy determination:
1. The #(config general) multi-tenant criterion command specifies a substitution expression that is

evaluated for tenancy determination.
2. Using the <tenant> layer in the Landlord CPL slot to specify conditions and tenant() properties.
The Management Center WAF interface leverages option #2 to control tenancy determination via the Tenant
Determination object. See "About WAF Policy" on page 130 for more information.
When evaluating an HTTP request, if the tenant determination rules produce a match against an installed tenant, then that
tenant's policy will be evaluated. If that fails to set the tenant() property, or the tenant() property setting does not cor-
respond to an installed tenant policy, then the default tenant policy is applied to this traffic. Default tenant policy applies to
all requests where tenancy couldn't be determined during the initial connection.
Obtain the tenant identifiers before you write multi-tenant policy in Management Center. For more information on multi-ten-
ant policy, refer to the Multi-Tenant Policy Deployment Guide.
WAF Policy Use
Selecting a tenant is step 2 in "Use WAF Policy To Protect Servers From Attacks" on page 128. A base-level of WAF
policy should be installed to the default tenant before any additional tenants are created. This ensures that all requests are
processed by the WAF.
Add a Tenant
An asterisk denotes fields that are mandatory.
133
1. Select Configuration > Tenants.
2. Click Add Tenant.
The web console displays the Add Tenant dialog.
134
3. Enter a Display Name.
4. Enter the Tenant ID. This controls the name of the tenant slot where policy will be installed. This ID is also used in
the tenant determination CPL using the tenant() property.
5. (Optional) Enter a Description (up to 1024 characters).
6. Click Save.
By default, the Tenants list is sorted in alphabetical order by Display Name. You can also sort by Tenant ID or Descrip-
tion by clicking the column headings. If the list is long, use the Keyword Search field to search for any string in the name,
ID, or description. The search is case-sensitive.
Modify a Tenant
2. From the Tenants list, select the tenant to modify and click Edit. The web console displays the Edit Tenant dialog.
3. Edit the Display Name or Description. An asterisk denotes fields that are mandatory.
4. Click Save.
Delete One or More Tenants
2. From the Tenants list, select one or more tenants to remove.
3. Click Delete.
4. Select Yes to delete the selected tenants.
135
You cannot delete the default tenant or any tenant that is currently referenced in Management Center policy. Attempt-
ing to delete the default or a referenced tenant results in a "Delete failed" error message.
Specify Tenant Determination Rules
A Tenant Determination file includes policy conditions that control which tenant policy slot is evaluated for an HTTP
request. When policy matches a request, the tenant is identified and all policy associated with the tenant ID is applied to the
request. On the ProxySG appliance, this file is called the "Landlord Policy." See "About WAF Policy" on page 130 for more
information about the Landlord policy.
WAF Policy Use
Specifying Tenant Determination rules is step 3 in "Use WAF Policy To Protect Servers From Attacks" on page 128.
Step 1 — Create a Tenant Determination File
1. Select Configuration > Policy and click Add Policy.
The web console displays the Create New Policy: Basic Information wizard. An asterisk denotes fields that are
mandatory.
2. Enter a name for the policy object.
3. Select Tenant Determination File for the Policy Type.
136
4. (Optional) In the Reference Id field, enter a Reference ID that you can filter on when building policy.
The Reference ID must begin with a letter, and must contain only letters, numbers and "_".
5. (Optional) Enter a description in the Description field. Although entering a description is optional, entering a
description can help you understand the purpose of the policy when you later refer to it.
6. Click Next.
7. Enter or select values for the defined attributes.
8. Click Finish.
The new tenant determination policy object appears in the Policy Objects editor. When installed on a ProxySG
appliance, this tenant determination file configures the policy in the ProxySG Landlord slot. Because no other
tenants have yet been defined, this policy object directs requests to the default tenant. (The default tenant contains
the policy rules applied to all requests that do not match a specific tenant.) For initial setups, WAF policy should be
installed to the default tenant. To proceed, deploy the tenant determination file to your ProxySG appliances and
continue to "Configure WAF Security Rules " on page 139 to create a Security Profile.
9. (Optional) Add Target Devices.
10. (Optional) Install Policy.
Step 2 — Optional: Add Tenant Determination Rules for Other Tenants
Use this optional procedure to add additional tenants after deploying WAF policy to the default tenant. You would only com-
plete these steps if you require WAF application objects with different security profiles.
Tenant determination rules specify the properties used to identify a tenant. You specify these properties using a simple,
natural language interface that generates equivalent CPL rules.
1. Select Configuration > Policy.
2. Click the policy name hyperlink or highlight the row and click Edit.
The selected file displays in the Editor tab.
3. Click Add Rule.
137
The system displays the Add Rule dialog.
4. Click the Tenant field and select a tenant from the Select Tenant dialog.
The Select Tenants dialog displays existing tenants in Management Center. For more information, see "Manage
Tenants" on page 226.
5. Click OK to exit the Select Tenant dialog.
6. In the Determination Rules field, use the natural language fields to create the tenant's determination rules:
a. Select All or Any of the following rules.
b. Select a rule condition, for example, URL Extension.
The following conditions are available: Client Address, Client Effective Address, Port, Proxy Address,
Proxy Port, URL, URL Domain, URL Extension, URL Host, URL Path, URL Query.
c. Select an operator, for example, equals.
The available operators may change based on the specified rule condition.
d. Enter a value, for example, .pdf.
Address fields support IPv4 and IPv6 single and subnet addresses. For example:
138
7. Use the icons to add more rules.
l To add another rule, click .
l To delete a rule, click .
l To add a nested set of rules, click .
8. When you are finished making changes, click Save.
Tenant determination rules are enabled by default. To disable a rule, highlight the rule and click Disable.
Tenant Determination Rule Example
Configure WAF Security Rules
A WAF security profile is a shared object (a policy element that can be referenced by multiple policy objects) that defines
139
the Web Application Firewall settings for the associated WAF application object. You associate the WAF security profile
with a WAF application object to define the security rules for that object. You can create as many WAF security profiles as
you need but a WAF application object can be associated with only one security profile.
WAF Policy Use
Configuring a WAF security profile is step 5 in "Use WAF Policy To Protect Servers From Attacks" on page 128.
Step 1 — Create a WAF Security Profile
1. Select Configuration > Shared Objects > Add Object.
The web console displays the Create New Shared Object: Basic Information wizard. An asterisk denotes fields that
are mandatory.
3. Select WAF Security Profile for the O bject Type.
140
5. Enter a description in the Description field. Although entering a description is optional, entering a description can
help you understand the purpose of the policy when you later refer to it.
6. Click Next.
8. Click Finish.
The new WAF security profile object appears in the Policy Objects editor.
Step 2 — Configure WAF Security Rules
1. Select Configuration > Shared Objects.
2. Click the W AF security profile hyperlink or highlight the row and click Edit.
The selected file displays in the Editor tab.
141
3. Review the following settings and adjust to create the desired security settings:
Refer to the Web Application Firewall Solutions Guide for information about these settings.
Controls general HTTP request properties such as size restrictions, WAF validation
Request Validation
properties, allowed methods, and allowed file types.
Enables the recommended normalization settings for each request part, and what action to
Request
take when normalization issues are encountered. For advanced normalization control,
Normalization
refer to the Content Policy Language Reference.
Enables/disables the blacklist engine and sets block/monitor behavior when a request
Blacklist triggers one of the blacklist rules. The signature-based blacklist discovers well-known
attack patterns quickly and efficiently.
Enables/disables the Analytics Filter engine and sets Analytics Filter block/monitor
Analytics Filter behavior. Analytics Filter is a scoring engine that detects attack characteristics and
triggers intelligently based on the sum of the anomalies.
Specifies security engine settings (these are known as WAF engines in the ProxySG
Security Engines documentation). The content nature detection engines include HTML Injection,
Command Injection, Code Injection, SQL Injection, XSS, and Directory Traversal.
XML Validation These options ensure the XML is valid and check for potentially malicious constructs.
These options ensure that requests are safe by checking for common attacks like
Request Security
HTML tag injection, buffer overflow, header injection, and request smuggling.
142
These options make server responses more secure by obfuscating the back-end
Response Security
technology and directing browsers to implement additional client-side security.
Exemptions Define exemptions to your WAF policy to handle false positives.
Disable WAF controls for POST requests consisting of binary data; bypass
Optimizations
WAF scanning for cache hits.
These options control the behavior that determines how the header and body of HTTP
Logging requests are logged to the x-bluecoat-request-details-header and x-
bluecoat-request-details-body access log fields.
Many of the options include a Block/Monitor/Ignore setting. This setting indicates the action taken when
suspicious content is identified. For new WAF deployments, Symantec recommends setting the action to
Monitor.
4. (Optional ) After making one or more changes, click Compare to review a side-by-side comparison of the changes.
5. Click Save.
To create exemptions to your WAF policy, set a security control to "Ignore," or create an appropriate exemption definition,
see "Manage WAF Security Policy" on page 149.
Configure WAF Application Objects
A WAF application object represents a web application (or group of applications) and its associated WAF security set-
tings. The WAF application object is associated with a specific tenant and WAF Security Policy. You install this policy on
ProxySG appliances to configure WAF settings.
WAF Policy Use
Configuring a WAF application object is step 6 in "Use WAF Policy To Protect Servers From Attacks" on page 128.
Create a WAF Application Object
The web console displays the Create New Policy: Basic Information wizard. An asterisk denotes fields
that are mandatory.
143
3. Select WAF Application Object for the Policy Type.
5. Click the Tenant field, select a tenant from the Select Tenant dialog or click Add to create a new one, and click OK.
If this is a new WAF deployment, select the default tenant.
A WAF application should first be deployed to the default tenant slot to ensure that all requests are processed
by the WAF. Additional WAF applications, security profiles, and tenants can then be created to handle
specific web application requirements.
6. Enter a description in the Description field. Although entering a description is optional, the description helps
differentiate versions of the same policy.
7. Click Next.
144
9. Click Finish.
The new WAF application object appears in the Policy Objects editor.
Configure the WAF Application Object
If you are not already editing the WAF application object, select Configuration > Policy and click the policy name hyper-
link or highlight the row and click Edit. The selected file displays in the Editor tab.
Step 1 - Confirm Tenant Selection
Confirm your tenant selection. To select a different tenant, select the pencil icon. Show screen.
Step 2 - Specify WAF Application Settings
The WAF Application Settings panel enables you to set policy generation controls.
145
1. Select a WAF Security Profile:
a. Click the WAF Security Profile text field or pencil icon.
b. In the Select Policy dialog, select the desired WAF Security Profile or click Add to create a new one.
c. Click OK to close the Select Policy dialog.
d. Specify the WAF Security Profile version to use. Select Always Use the Latest Version or specify a
specific version in the Use Specific Version: field.
2. (Optional) To override all WAF Security Profile settings, select Disable entire Security Profile.
3. (Optional) To globally change all Block/Monitor verdicts, select Change all WAF controls to: Monitor or Block.
To set the behavior to Ignore, disable the entire WAF Security Profile.
4. Specify the user notification (exception) page to use for blocked requests.
Step 3 - Set Compression
Select Enable compression level (Low, Medium, High) to allow WAF to compress data in transit.
Step 4 - Specify Allow Rules
Set the criteria for allowing traffic through the ProxySG appliance. Specify these rules using rules associated with
a tenant, a CPL fragment, or by manually entering them using the Custom Rules option. If you do not want allow
rules or want to add your own in CPL, select No Allow Rules.
146
Because reverse proxy deployments have a global Deny policy, you must specify rules to allow traffic. If this WAF
application is associated with the default tenant, you will receive an error (because the default tenant has no allow
rules) and must specify the allow rules using one of the other methods.
Step 5 - Add CPL Fragments
Adding a CPL fragment is optional. Add valid CPL layers only. Do not add individual CPL rules. Adding indi-
vidual rules can lead to errors and unpredictable results.
1. Click Add CPL Fragment. The web console displays the Add CPL Fragment dialog.
147
a. Click the CPL Fragment text field or pencil icon. The web console displays the Select Policy dialog.
b. Select the CPL Fragment. See "Create a CPL Policy Fragment" on page 278 for information about creating
CPL fragments.
c. Click OK.
d. Select Always Use the Latest Version or specify a specific version in the Use Specific Version: field.
If Always use the latest version is selected, Management Center will always include the latest available
version of the Security Profile when installing the WAF application to a ProxySG appliance. If you are
concerned about deploying untested changes, select Use Specific Version.
Save Changes and Next Steps
To finalize your settings, you must review your policy and save your changes.
1. (Optional ) After making one or more changes, click Compare to review a side-by-side comparison of the changes.
2. When you are finished making changes, click Save.
Analyze and Refine WAF Policy (Mitigate False Positives)
After installing an initial version of WAF policy on one or more target devices, you can analyze the results of the traffic to
determine what attacks have been detected. There is a chance that the detection engines have flagged a legitimate request
as an attack. For example, if a blog post includes an example of a cross-site scripting (XSS) attack, the appliance interprets
the example as an actual attack and blocks the post. This might be undesirable behavior and considered a false positive.
Address this and other kinds of false positives with the following workflow. Refer to the Web Application Firewall Solutions
Guide for more information.
WAF Policy Use
Analyze and Refine WAF Policy describes steps 8 and 9 in "Use WAF Policy To Protect Servers From Attacks" on
page 128.
148
Analyze and Refine WAF Policy Workflow
Step Overview References
1 Check access logs to determine which rules or engines you must "View a Reporter Report" on page 410
update to address false positives, false negatives, and other
"Reference: Report Descriptions" on
wanted behavior.
page 422
A useful search criteria is the transaction ID. For example, when
"Search for Specific Report Data (Search
a user tries to visit a page and receives an exception page, you
and Forensic Report)" on page 442
can use the associated transaction ID to run a forensics report.
The Full Log Detail report then displays the log line matching that
transaction ID.
2 Optional-Perform a policy trace. "Launch a Device Console" on page 80
To enable policy tracing on the ProxySG
appliance, select Configuration > Policy >
Policy Options. Under Default Policy Tra-
cing, select Trace all policy execution and
click Apply.
3 Based on your analysis of the access logs, create policy "Manage WAF Security Policy" below
exemptions to eliminate false positives and other unwanted
behavior.
4 Run traffic through the appliance and confirm through access logs Repeat steps 1 through 3 in this table as
(and optionally, other troubleshooting tasks) that requests match often as required.
both general rules and exceptions appropriately.
After confirming that false positives no longer occur, consider Repeat the previous steps as needed.
your next step. You can do any of the following according to your
Configure Monitor/Block actions: "Manage
needs:
WAF Security Policy" below
l Update policy actions from monitor to block. Then, move
to a production environment when your WAF policy is
stable and you observe no other issues with how the
appliance handles traffic.
l Continue to test and refine policy, move to production, and
then update policy actions to block.
l Continue to test and refine policy, move to production, and
gradually update each engine or policy’s actions to block.
Manage WAF Security Policy
As described in "Analyze and Refine WAF Policy (Mitigate False Positives)" on the previous page, you will need to refine
your WAF security policy to ensure it is working properly.
WAF Policy Use
Refining your WAF Security Policy is step 9 in "Use WAF Policy To Protect Servers From Attacks" on page 128.
Add Exemptions
149
After installing the WAF protection policy and reviewing the access logs, you will likely find several sites that were incor-
rectly characterized as threats. To troubleshoot this, add exemptions to your WAF security policy. You can add exemptions
using the available security options or define your own in CPL.
2. Click the hyperlink associated with the WAF security profile or highlight the row and click Edit.
3. Click Exemptions> Add Exemption.
The system displays the Add Exemption dialog.
4. Provide a name for the exemption in the Description field.
5. Add a URL Exemption from the available security options or a custom CPL exemption:
150
l Standard exemption:
a. In the Build exemption from:, click Security Profile Sections.
b. Enter the URL for this exemption.
c. Select the desired Validation, Normalization, Security Engines, Blacklist, and Analytics Filter
options.
You can exempt the URL from all Blacklist or Analytics Filter processing or per rule (by
specifying a CSV list of rule IDs).
d. Click Save to close the Add Exemption dialog.
l Custom CPL exemption:
a. in the Build exemption from:, click Custom CPL.
b. Add the CPL and click Save to close the Add Exemption dialog.
The system adds the exemption for the URL or CPL. If the exemption list is long, filter for specific exemptions
using the search box above the table. To clear the filter, delete the text and press Enter (or click the magnifying
glass).
6. In the policy editor, click Save.
Set Block/Monitor/Ignore Actions
When first implementing a WAF protection policy, it is important to observe the effects of rules before inadvertently block-
ing traffic. To begin, ensure that new rule actions are set to Monitor.Then review access logs to identify false positives,
create policy exemptions (as described above) to address those issues, and repeat until false positives no longer occur.
Then, update policy actions from Monitor to Block.
Options that support the Block/Monitor/Ignore action include an action drop-down menu. To set, select the appropriate
action and click Save.
For example, to set the Blacklist action to Block:
2. Select the WAF Security Policy and click Edit.
3. Click Blacklist.
4. Verify that Enable Blacklist is selected.
5. Select Block and click Save.
151
Some options allow you to be even more granular, allowing you to modify individual rules, as shown below.
Use Effective Date to Manage New Rule Updates
When Application Protection Subscription (APS) updates are published, the updated Blacklist and Analytics engine content
is immediately available. Because the updated engine rules can potentially change the behavior of the existing WAF secur-
ity policy, Management Center enables you to use this activation date as a decision point. The Effective Date option is that
decision point, enabling you to control rule selection based on the date the rules were added.
For example, rules qualified in a pre-production environment can be set to block-mode, and new rules can be set to monitor
mode. This functionality enables an organization to take advantage of new rules immediately, but in a manner that will not
introduce new false positives that cause requests to be blocked. After the new rules are sufficiently qualified, the effective
date can be migrated forward, thereby setting the new rules into block mode.
Additionally, by using multi-tenancy this can be controlled on a per-tenant basis. This facilitates different update strategies
and a tenant-configurable update cadence. For example, some tenants may choose to always use the latest rules, whereas
some risk-adverse tenants may employ a very deliberate APS update qualification process. Multi-tenancy provides flex-
ibility for diverse infrastructures where a one-size-fits-all approach may not be ideal.
Only Blacklist and Analytics Filter use the Effective Date option.
152
Distribute Configurations to Devices
The Symantec Management Center enables you to distribute common configurations and policies that you created and
want enacted across other managed ProxySG appliances. Your enterprise might have dispersed data centers that contain
hundreds of hierarchies, device groups and devices. Groups of devices might have different functions, thus requiring dif-
ferent sets of configurations or policies.
Two methods provide this ability.
n Script Method—Create scripts that contain common device configurations for specific managed devices. Give
various users (with the correct permissions) the ability to create and modify script objects.
Execute a ProxySG Configuration Script on Multiple Devices
n Policy Method—Use Symantec Content Policy Language (CPL) or the Visual Policy Manager (VPM) to define policy
and validate it before distributing to other managed devices.
Distribute ProxySG Policy to Multiple Devices
153
Create and Distribute Configurations Using Scripts
One method for distributing configurations is creating and modifying existing scripts to execute on command across dis-
persed data centers that contain hundreds of hierarchies (managed device groups and devices).
Create a Script.
1. Select Configuration > Scripts.
2. From the Script Objects page, click Add Script. The web console displays the Add Script dialog.
Enter the following information (a red asterisk (*) denotes a field that is mandatory).
a. Name the script.
b. Select a device Type from the drop-down list
c. (Optional) A Description helps to differentiate between similarly named scripts.
d. (Optional) Select Substitution Variables. The Management Center attempts to replace variables with the
values associated with the device where the policy is installed or the script is executed. For more information,
see "Use Substitution Variables in Policies and Scripts" on page 194.
3. Click Save. The new script displays in the Script Objects list.
4. Select the script and click Edit. The Management Center displays the script Editor.
5. Create the script.
6. Click Save.
Execute a Script on a Device.
The Management Center provides two places where you can run a script on a device now.
2. Select a script from the Script Object list. If needed, search for the object; see "Filter by Attributes and Keyword
Search" on page 164.
3. Click Execute on Device. Select the device Target and click Execute.
OR
4. Select Edit and click the Editor tab. At times, administrators with the correct privileges want to execute a script
immediately after updating a script. While in the rich text editor ensures that all edits have been saved and click
Execute on Device. Select the device Target and click Execute.
Each time you start a job manually, the Management Center displays a Job Progress dialog. To run the script
in the background (no window) while you perform other tasks, click Continue in Background.
Preview a Script With Variables Replaced
Management Center enables you to check the validity of a script before you execute the script to a device. Symantec recom-
mends that you preview scripts before executing a script. Devices that are in your network deployment should not be used
to test configurations. Previewing a script avoids inadvertently changing a device configuration.
154
For scripts that use commands not in configure mode, you must exit configure mode before executing the script. Most com-
mands are executed in configure mode. Licensing commands are the exception, and cannot execute in configure mode.
2. Open a script object.
3. From the Editor tab, click Preview.
4. Select a device to preview the script and click OK.
5. The Preview Script window displays the entire script.
155
6. Click Close.
(Optional) Create a Job to Execute a Script on a Schedule.
Management Center makes it easy to create a job to Execute a script without the hassle of going through the entire job wiz-
ard.
2. Select a script from the Script Object list. If needed, search for the object; see "Filter by Attributes and Keyword
3. Click Execute on Device. Select the device Target and click Create Job. The web console displays the New Job
dialog.
a. Name the job; click Next.
b. Select an Operation; for this example: Execute Script; click Next
c. Select the Devices to receive this configuration; click Next
d. On the Schedule screen, select a timing option: Periodic, Daily, Weekly, or Monthly. Each option presents
more granular options.
e. Click Finish.
Manage Scripts
Navigate to the following sections for more information.
n "Customize Object Filters" on page 158—Limit view of script objects.
n "View Script Information" on page 170—View versions and attributes.
n "Manage Attributes" on page 365—View current and add new attributes.
n "Filter by Attributes and Keyword Search" on page 164—Find a script by the attributes assigned to the script.
n "Import Script from a Device" on page 166—Import a configuration from a selected device.
n "Restore a Version of Script " on page 169—Roll back to a previous configuration while you perform modifications to
the current version.
n "Compare Versions of the Script" on the facing page—Useful for troubleshooting.
156
Compare Versions of the Script
As a troubleshooting step or as part of performance evaluation, you might want to identify the changes between an earlier
version and a later version of a script. Management Center shows the changes made.
1. Select Configuration > Scripts. From the Script Objects list, select the script name. If needed, search for the
object; see "Filter by Attributes and Keyword Search" on page 164.
2. After you select the script, click Edit. Click the Versions tab.
3. Select an earlier version of the script to compare with the current version.
4. Press and hold the CTRL key while selecting the later version of the script to compare.
5. Click Compare. The web console displays the Compare Scripts dialog.
The two scripts are displayed side-by-side; the web console displays the version you selected first (earlier version)
on the left and your second selection (later version) on the right.
n A script highlighted in red exists in the former version and was removed in the later version.
n A script highlighted in yellow indicates that a line exists in both versions of script, but there are differences in
the line.
n A script marked in green does not exist in the former version and was added in the later version.
See "Restore a Version of Script " on page 169.
157
Customize Object Filters
Filters control the specific objects that are searchable.
1. Select Configuration > Policy or Scripts.
2. The Filter panel contains the following fields.
l Name—Filters by the Object Name.
l Reference Id—Filters by the Operation type.
l Type—Filters by the Object Type.
l Description—Filters by the Object Description.
l Author—Filters by the user who last changed the Object.
To substitute variables in policies, policy fragments or scripts, see "Use Substitution Variables in
Policies and Scripts" on page 194.
3. The Filter panel also includes mandatory attributes. See "Manage Attributes" on page 365.
4. To customize filters, click Customize.
a. Select the filters to be visible on the Filter panel.
b. Click Save.
158
Execute Scripts
You can execute any script that is saved in Management Center in the Script Object list. Before executing a script, you
can "Preview a Script With Variables Replaced" on page 154. This shows the script variables without committing them to
a device and inadvertently causing a device configuration to change.
Scripts are automatically assumed to execute in configure mode on the ProxySG appliance. For scripts that use com-
mands not in configure mode, exit configure mode before executing the script. Licensing commands are the exception, and
cannot execute in configure mode. Example:
;;exit configure mode
exit
user-license queue
;;re-enter configure mode
configure terminal
Execute a Single Script
Direct from a Script
2. Select a script object and then click Edit.
3. To execute the script, click Execute on Device.
4. Select a target device or device group. Click Execute. (Optional) You can execute the script at a later time (on a
schedule) by clicking Create Job...See New Job (under Execute Multiple Scripts), starting with step 3, for details.
From a Job Operation
See New Job (under Execute Multiple Scripts) for details on executing a single script from a job.
Execute Multiple Scripts
New Job
1. Select Jobs > Scheduled Jobs.
2. Click Add New Job.
3. Enter a name (required) and a description. Click Next.
4. Select Execute Script from the Operation menu.
5. Select the Device Type from that menu.

159
Because a script is specific to a device, variable substitution requires that you select the appropriate device.
6. Click Add Script.

160
7. Select the desired script(s) and then click OK.
You can also set a job to run a single script.
8. (Optional) Use Delete, Move Up, and Move Down to edit the available scripts and their order.
Scripts run, one right after another, based on the order shown on the list. If one script fails, the next script
continues to execute. Be sure the scripts are ordered how you want them to run.
9. Click Next.
10. (Optional) Select a target device or device group.
11. Click Next.
12. Select a schedule to run the script(s). See Job Scheduling Options for more information. Click Finish.
Edit an Existing Job
2. Select a job and then click Edit.
3. Click the Operation tab.
161
4. Click Add Script.

162
5. Select the desired script(s) and then click OK.
6. (Optional) Use Delete, Move Up, and Move Down to edit the available scripts and their execution order.
7. Click Save.
(Optional for all script executions) While the Job Progress dialog displays the script executing, click more details to view
the Output, Download as Text, or Close the dialog.
163
Filter by Attributes and Keyword Search
You can search for existing objects by filtering on attributes and then using the keyword search. When you are managing
hundreds or policies and scripts across multiple devices, it is important to be able to find a particular a particular object
quickly.
You are not limited to the displayed Filter fields. See "Customize Object Filters" on page 158.
1. Click the Configuration tab and select Policy or Scripts. From the Filters list on the right pane, the following fields
are available by default.
l Name—Filters by the Object Name
l Reference Id—Filters by the Object Reference Id
l Type—Filters by the Object Type
l Description—Filters by the Object Description
l Author—Filters by who user who last changed the Object
Additional fields are created when you create a new attribute. See "Manage Attributes" on page 365.
l Tenant—Filters by tenant ID.
2. To filter by a particular type of policy, click the Type drop-down list and select a policy type.
3. Two options:
o Click Apply Filters. The Policy Objects and Script Objects lists only those objects you defined by Type.
~or~
o Filter by particular device type for which you created a script; select the device type from the Type drop-down
list.
5. Click Apply Filters. The Script Objects list displays only those scripts you defined by type.
Search by Keyword
When searching, Management Center breaks text into keywords and then searches for keywords entered. Management
Center's index system has a special case for dot. Although Management Center sees dots as separating letters within a
word (for example, Management Centerconsiders dots as a part of a word).
The wildcard symbol is *. Management Center automatically appends an * at the end of your search term but if you
want to start with a wildcard search, you have to enter it yourself.
Colons are treated like other non-letters by splitting keywords apart. IPv4 and IPv6 addresses work differently because of
colons.
You cannot search on special characters, such as ^%|~.
164
Procedure
1. From the Keyword Search field, enter your search term.
2. Press Enter or click the magnifying glass icon.
Can quotes be used in a search?
Use quotes when non letters are part of the search term. For example, your search term includes a colon.
The exception to this search rule is the use of a dot because a dot that is not followed by whites pace is considered
part of the keyword.
How do you search for whole words?
Enter the whole word. If there is more than one word, separate each word with a space. If using special characters,
enclose each word in double quotes.
How do you search for partial words?
Enter the partial term, and Management Center attempts to complete the search. For example, enter hi and Management
Center matches that to both highlight and high.
Example Searches
IPv4 127.0.0.1
l 127.0.0—Matches any IPv4 starting with 127.0.0.
l *.0.0.1—Matches any IPv4 ending in 0.0.1.
IPv6 “0:0:0:0:0:1”
Use quotes for IPv6 addresses because IPv6 uses colons instead of dots as the separator.
l “0:0:0”—Matches any IPv6 start with 0:0:0.
l *”0:0:1”—Matches any IPv6 ending with 0:0:1.
Hostnames
l abc.com—Matches a host named abc.com.
l *.com—Matches a hostname ending in .com.
l *”:8080”—Matches a hostname with :8080 as the port.
What if the search finds no match?
If the search finds no match, the right pane displays a message indicating that no objects match the keyword filter. You
can search again using a different keyword.
What if the search succeeds in finding matches?
If the search finds matches, the results display in alphabetical order in the Objects list.
How do you clear the search results?
To clear search results and display all objects in the system, click the X in the search field.
165
Import Script from a Device
Scripts are sequentially-running CLI commands for a device configuration. It makes sense to import device configurations
that are currently on a device because you know that the configuration is correct. Importing an entire device configuration is
essentially backing up a device into Management Center and may not exist as a whole such as in the following situations:
l You want to restore a previous version of script that exists only on a device. For example, you started editing script in
Management Center, but realize that the script on the device is correct and complete.
l A device has a full configuration that you want to use as a script (template) to execute on another like device. An
asterisk denotes fields that are mandatory.
2. Scripts can only be imported into an existing script object. Select a script name. Click Edit.
3. Click Import.
4. Select a device to import the script. Click OK. The web console displays the Import Script dialog.
5. From What to Import, select Entire Configuration or Only selected sub-sections.
166
6. Click Import.
The comment you enter is saved as script metadata.
What do you want to accomplish? Refer to this topic
View existing script information. "View Script Information" on page 170
Restore a version of the script. "Restore a Version of Script " on page 169
Execute the script, as is, to devices. "Execute Scripts" on page 159
167
Manage Attributes
You can define attributes that apply to the devices, device groups, policy and device scripts that you manage in your net-
work. Because you have different devices and appliances to manage, those devices require and are often restricted to cer-
tain attributes. Attributes are custom metadata used to refine and edit devices, device groups policy, and scripts. Attributes
can be used to filter on specific devices, device groups or objects.
1. Select Administration > Attributes.
2. From the Manage Attributes list, select one the following:
n Device
n Device Group
n Policy
n Device Script
3. To add an attribute, click Add Attribute. See "Add Attributes" on page 366.
4. To edit an attribute, select the attribute name and click Edit. See "Edit Attributes" on page 369.
5. To enable group inheritance, see Enable Attribute Group Inheritance .
View and Sort the Following Attributes Lists
n Name
n Display Name—The attribute name (with no spaces).
n Type—The format that users must enter or select values.
n Default Value—Select the default value that displays in the Attributes list. Default values can be substituted by other
variables. See "Use Substitution Variables in Policies and Scripts" on page 194.
n Mandatory—The value of attributes that are marked as mandatory is required when you create a new or add a
device, device group, create a policy, and create a script.
n Inheritable—Applies specifically to devices and device groups. When this is selected, the device or device group
inherits attributes from its parent device group.
n Description—Describes the attribute and must be specific to the device, device group, policy, or script to which you
are applying the attribute.
You are able to search for specific objects based on the attributes you define. See "Filter by Attributes and
Keyword Search" on page 164.
168
Restore a Version of Script
After time, you might find that the script executed on devices needs improvement or must change because of changes in
business requirements or practices. In such situations, you can modify scripts as needed, or revert to an earlier version of
a script that is appropriate. When you have determined which version of script to restore, you can restore it using the ver-
sion history.
1. Click the Configuration tab and select Scripts. From the Script Objects list, select the script name. If required,
search for the object; see "Filter by Attributes and Keyword Search" on page 164.
2. Click Edit. Click the Versions tab. Versions of the script are listed in descending numerical order.
3. From the Version Control page, verify that the version you want to restore is the correct one. Perform one or both
of the following as required.
l Check the version metadata. See "View Script Information" on the next page.
l Preview a script with the variables replaced.
4. After you have identify the version to restore, select it and click Restore. The web console displays the Restore
dialog.
5. In the Comment field, specify the reason for the restore.
6. Click Restore.
The restored version of the script is incremented to the latest version in the Script Objects list, and the comment
you entered in step 6 is displayed in the Comments column.
169
View Script Information
Whenever you create a script, Management Center automatically saves information about it. This information is called
metadata.
2. From the Script Objects list, select a script and click Edit. An asterisk denotes fields that are mandatory.
View Script Object Information
1. Click the Info tab.
2. Under General Information, the Overview displays the information you entered when creating the script object:
l Name(*)—The name of the script that you gave it when you created it
l Type(*)—The device type that the script applies to
l Description—This describes the script, but is not a required field
l Replace substitution variables
3. Metadata displays under Latest Revision. Click Save.
If you edited any of the fields in Overview, fields marked with a red asterisk (*) are required and cannot be left
blank.
View Script Versions
1. Click the Versions tab. The Version Control page lists all versions of the selected script. When a script object is
created it is assigned the version number 1.0. Every time that the script attributes change or the script is edited, the
version increases by increments of 0.1.
2. Select an early version of script to compare.
3. Press and hold the Ctrl key while selecting the newer version of the script.
l Version Number—When a script object is first created, its version is 1.0. Each subsequent time the object is
modified—for example, if the object properties are edited the version number increments by 0.1. For example, when
you add script text to the object and save it, the version becomes 1.1.
l Date—The time and date stamp indicates when the script was last updated.
l Author—The author is the user who saved the current version of the script displayed.
l Comments—If the author entered comments or a description about the script, they are displayed here. Metadata
displays automatically-generated comments as follows:
o "Script Object created"—When the script container is initially is created and script has not been added yet.
o "Name changed"—When the script name is edited.
o "Description changed - former script has been overridden"—When the script description is edited.
o "Name and description changed - former script has been overridden"—When both the name and
description are edited.
Of these metadata, the comments are usually the most important in helping you and other users understand the pur-
pose and intent of creating the specific script version. Symantec recommends that you always enter clear, helpful
comments when creating scripts.
170
View Script Attributes
Click the Attributes tab. The Attributes page displays all attributes currently assigned to selected script. The attributes are
custom attributes that you created. See "Manage Attributes" on page 365.
View Device Script Output
When you execute a script on a device, the Job Progress dialog displays the status of the executing script. You can view
the device output of currently executing scripts and scripts that have already executed on a device by clicking More
Details. Any output line that starts with "%" is considered a warning (and is standard for ProxySG appliances). Navigation
buttons enable you to jump between warnings and are useful when viewing the device output for long scripts. You can
view the raw output in a text editor by selecting Download as Text.
Set the Maximum Number of Script Revisions to Store in Management Center
After you create or import a script, you can edit the script to execute on devices of the same type. You can specify the num-
ber of revisions of scripts to store before Management Center begins to prune.You can specify up to 999 script revisions.
1. Select the Administration > Settings. Click General. General fields display on the right. An asterisk denotes
fields that are mandatory.
2. Select Maximum number of script revisions to store.
3. Enter a number (limit) from 0 to 999.
l Click Reset to remove your current changes and revert to the default or last saved settings.
l Click Save to store the settings on the server.
l Click Activate to cause the server to load and apply the currently saved configuration.
Use Substitution Variables in Policies and Scripts
Substitution variables are generic terms that you can include in policies and scripts. When Management Center installs
policy or executes a script that includes substitution variables, it attempts to replace them with values specific to the cur-
rent transaction—that is, the current device, policy, or script. For example, if you install policy that includes the substitution
variable ${device.name}, the variable is replaced with the device name set in Management Center.
Use in Shared Policy
When you include shared policy objects in your policy, you must enable variable substitution or the the shared object’s
CPL will not be substituted for the include variable. For example, if you create a URL list called whitelist and include
it in a policy object, the system creates the CPL entry ${include:whitelist}. The whitelist URL list will only be
included if Replace substitution variables is selected when the policy is installed.
While you may use substitution variables in CPL layers, Management Center performs the substitution when
installing the CPL to the device. The UI markup (XML) remains unchanged. Therefore, if you open the installed
VPM policy locally from the ProxySG appliance and try to install it, the substitution variables will not be replaced in
the resulting CPL (because this workflow bypasses Management Center). This could result in malformed or unex-
pected policy, depending on how the variables are being used.
To include and process substitution variables:
171
1. Enable Replace substitution variables in the policy object (see Create a CPL Policy Object) or script (see Create
and Distribute Configurations Using Scripts).
2. Include substitution variables in the CPL or script. See " Supported Variables" below below.
3. Install the policy or execute the script. As the target device processes the policy or script, it attempts to replace the
variables with the appropriate values.
If the policy or script is associated with a device group, Management Center inspects every device in the group
structure for the variable and attempts to replace all instances with specific values.
Syntax
Substitutions have the following form:
${name}
where name is an expression that expands to a string or block of text at runtime.
For example, the substitution ${device.description} expands to the description entered in the current device's prop-
erties in Management Center.
If the device does not have a description (because Description is an optional field), the substitution expands to an empty
string unless you also specify a default value. See "Specify a Default Substitution Value" on page 174 below for details.
Examples
Substitute the device's serial number.
${device.serialNumber}
Substitute the value of the device's Rack attribute.
${device.attributes.Rack}
Substitution variables are case-sensitive. To ensure that you have entered them with correct spelling and case, use
the Preview option before installing policies or executing scripts. The preview warns you if a substitution variable is
invalid.
Supported Variables
Device - ${device.field}
The following variables are available for policies and scripts.
Variable Description
${device.uuid} Internal ID of device
${device.modelNumber} Device model number
${device.description} Text in the Description field in device properties in Management
Center
${device.name} Text in the Device Name field in device properties in Management
Center
172
${device.serialNumber} Device's serial number
${device.osVersion} Operating system version running on the device
${device.attributes.name} System or user-defined device attribute value, including any values
inherited from the device group
where name is the attribute name
Policy - ${policy.field}
The following variables are available for policies only (not scripts).
${policy.author} Last user who edited and saved the policy
${policy.description} Text in the Description field in policy properties
${policy.name} Text in the Name field in policy properties
${policy.referenceId} Text in the Reference Id field in policy properties
${policy.revision} Policy's current Version number
${policy.revisionDescription} Comments entered for the last revision
${policy.attributes.name} User-defined policy attribute value
Policy Fragment- ${fragment.field}
The following variables are available for policy fragments.
${fragment.author} Last user who edited and saved the policy fragment
${fragment.description} Text in the Description field in policy fragment properties
${fragment.name} Text in the Name field in policy fragment properties
${fragment.referenceId} Text in the Reference Id field in policy fragment properties
${fragment.revision} Policy fragment's current Version number
${fragment.revisionDescription} Comments entered for the last revision
${fragment.attributes.name} User-defined policy fragment attribute value
Script - ${script.field}
The following variables are available for scripts only (not policies).
173
${script.author} Last user who edited and saved the script
${script.description} Text in the Description field in script properties
${script.versionDate} Date of last update
${script.name} Text in the Name field in script properties
${script.type} Selected Type in script properties
${script.revision} Script's current Version number
${script.revisionDescription} Comments entered for the last revision
${script.attributes.name} User-defined script attribute value
Specify a Default Substitution Value
Unless you specify a default value, some transactions can produce unsubstituted variables, resulting in empty strings. The
following are examples of such transactions:
l An optional field such as Description is empty
l An attribute that is not marked as mandatory has no value
l A field is not applicable, such as when a script or policy has not been revised
Syntax
A default substitution has the following form:
${name(default_name)}
where:
l name is an expression that expands to a string or block of text at runtime
l default_name is the value that will be used instead of an unsubstituted variable
Example
If a policy fragment was edited, use the comments entered for the last revision. If the fragment was never edited, use the
specified text "No revision".
${fragment.revisionDescription(No revision)}
174
Create and Distribute Policy
When you first configure Management Center, you can create new policies or import existing policies from managed
devices. When you have been managing devices from Management Center for a longer period of time, you might also want
to edit policies to change current device configurations. One of Management Center's most powerful features is the ability
to create and modify policy objects before deploying multiple policies across data centers containing hundreds of hier-
archies, device groups, and devices.
Policy Locking
Starting with Management Center 1.6, a policy file is automatically "locked" as soon as a user starts editing policy. If
another user tries to edit the same policy, that user will receive the following message.
The policy lock is released after the user saves or cancels the changes. When a policy lock is active, another user may
force that policy to unlock by clicking Unlock on the policy grid.
Policy locking affects the content of policy only. Other attributes (Targets, Info, etc.) can be changed even while the policy
is being edited by another user.
Create and Edit CPL Policies
Content Policy Language is a language for specifying the policy rules for the ProxySG appliance.
For complete information about the Content Policy Language, refer to the Content Policy Language Reference.
Another way to create CPL policy is to create CPL fragments (or building blocks) . See "Create a CPL Policy Frag-
ment" on page 278.
Management Center gives you great flexibility for creating and modifying CPL policies, as well as the power to deploy mul-
tiple policies to a range of devices or device groups. Use CPL to accomplish the following:
l Create and modify the CPL directly from the policy editor (Configuration > Policy > PolicyName > Edit). See
"Use Content Policy Language (CPL) to Create Policy" on page 179.
l Create policy without assigning it to devices immediately. See "Create a CPL Policy Object" on page 181
175
l Find and edit sections of the policy. See "Find a Policy Section" on page 191 and "Edit a Policy Section" on page 184
l Modify and test policy and group related rules together. See "Refine Existing CPL Policy" on page 185.
l Correct and modify the behavior of existing policy by re-ordering policy sections. See "Change the Order in which
Policy Rules are Evaluated" on page 193
l Create versions of policy, and restore previous versions when needed. See "Restore a Version of Policy " on
page 275
l View or compare policy versions.
l Enable substitution variables to be used, for any variable, so that you don't have to modify each attribute in each
policy if a configuration has changed. See "Use Substitution Variables in Policies and Scripts" on page 194
l Create policy attributes and apply them to policy objects. See "Add Attributes" on page 366.
l Add target devices and install policy to them.
l Deploy multiple policies to a group of devices by using Management Center's job feature. See "Install Multiple
Policies" on page 247.
l Import existing policy from a managed device. See "Import Policy or Shared Objects" on page 248
l Check the consistency of installed policy.
l View the deployed policy on a device.
l View existing policy information. See "View Existing Policy Information" on page 259.
Create VPM Policies
The Visual Policy Manager enables you to specify the policy rules using a GUI editor for the ProxySG appliance and install
the policy to the VPM slot. For complete information about the Visual Policy Manager, refer to the Visual Policy Manager
Reference and Advanced Policy Tasks.
You can:
l Use the Visual Policy Manager for both creating and editing VPM policies. See "Launch Visual Policy Manager" on
page 201.
l Select a reference device to edit VPM policy. See "Select Reference Device for VPM Policy" on page 203.
l Create versions of policy, backup and restore previous versions when needed. See "Restore a Version of Policy " on
page 275.
l View the CPL or XML source.
l Create or "Edit Attributes" on page 369 and apply them to policy objects.
l Import existing policy from a managed device. See "Import Policy or Shared Objects" on page 248.
l Clone to universal VPM policy.
Create Universal VPM Policies
Universal VPM policy is a set of global rules created on Management Center that can be applied to users in any location.
The policy can contain global rules that apply to both on-premises and Web Security Service (WSS) users, as well as indi-
vidual rules that apply to only one or the other. It can also contain location-specific policy when necessary. In essence, uni-
versal VPM policy comprises the various rules that reflect your organization’s acceptable use policy. Using Management
Center to create and distribute the policy to on-premises devices and the WSS makes it easy to apply the relevant policy to
all users in your organization.
176
l Deploy universal policy.
l Create a universal policy object.
l Import existing policy from a managed device. See "Import Policy or Shared Objects" on page 248.
l Transform existing VPM policy into universal policy.
l Use the Visual Policy Manager to apply policy to on-premises and remote users.
l Select a reference device to edit VPM policy. See "Select Reference Device for VPM Policy" on page 203.
l Create versions of policy, backup and restore previous versions when needed. See "Restore a Version of Policy "
on page 275.
l View the CPL or XML source.
l Create or "Edit Attributes" on page 369 and apply them to policy objects.
Create Tenant Determination Policies
A Tenant Determination File contains rules for routing request traffic to the proper tenant. This determination criteria con-
trols which set of tenant policy will be evaluated for a given request. If a tenant determination cannot be made, the "default"
tenant policy is used. You can:
l Create and edit tenant determination policies directly from the policy editor (Configuration > Policy > PolicyName
> Edit) (without assigning the policy to devices immediately).
l Use tenant determination rules to properly route traffic to the correct web application (or group of web applications).
See "Specify Tenant Determination Rules " on page 136 and "Use WAF Policy To Protect Servers From Attacks"
on page 128.
on page 275.
l Create policy attributes and apply them to policy objects. See "Add Attributes" on page 366
Create WAF Application Policies
A WAF Application Object represents a web application (or group of applications) and the associated WAF security set-
tings. The WAF application object is associated with a specific tenant and WAF Security Profile. You can:
l Use WAF Application policies to associate a Security Profile to a tenant, manage optional CPL fragments, and
control WAF Application settings. See "Configure WAF Security Rules " on page 139 and "Use WAF Policy To
Protect Servers From Attacks" on page 128.
on page 275.
l Create policy attributes and apply them to policy objects. See "Add Attributes" on page 366.
177
Create SSL Visibility URL List Policies
You can create policy in Management Center that manages URL lists for SSL Visibility appliances, and then deploy the
policy to a group of SSL Visibility appliances. See "Create SSL Visibility URL List Policy" on page 212.
178
Use Content Policy Language (CPL) to Create Policy
Before writing policies in CPL, Symantec strongly recommends that you understand the fundamental concepts
underlying policy enforcement in ProxySG appliances, as well as how to write correct CPL. For comprehensive
information on CPL, refer to the Content Policy Language Reference.
You can compose CPL directly in the web console editor .
1. Select Configuration > Policy. From the Policy Objects list, select the policy object to edit. Ensure that the
policy's object type is CPL. Select the policy. If you have a lot of policies narrow your search using "Filter and
2. Select Edit and the Editor tab. The other tabs available for viewing and editing purposes are the following:
l Targets
l Versions
l Attributes
l Info
3. The middle pane displays the sections in the policy, and the Quick Navigation pane on the right displays a summary
of the sections in the object.
4. In either the middle pane or in Quick Navigation, select the section you want to edit. If needed, expand the sub-
section (default, override, or mandatory) to edit.
A policy object is organized into sections. Each section has a name and a purpose, and can contain up to
three sub-sections of CPL that you can use to organize policy: Default, Override, and Mandatory. See "Edit
a Policy Section" on page 184.
If the modular sections perform slowly, you can select the Single Pane Layout icon . This is useful if
the CPL is particularly long or if you prefer working with a single pane of code. Note that switching to a
single pane and saving the policy erases all metadata about your sections. You cannot recover the
sections by switching back. However, you can either discard the changes without a save, or you can restore
a previous version.
5. Enter the CPL in the appropriate sub-section(s).
6. Repeat steps 3 and 4 as needed. An asterisk denotes fields that are mandatory.
7. Click Save. Management Center prompts you to enter a comment for the save operation.
8. (Optional) Click Compare to see the differences between the previous version and the version you are about to
commit. For information on comparing versions, see "Compare Different Versions of the Same Policy" on page 271
and "Compare the Device Policy Version with Current Policy Version" on page 272.
9. Enter a description of your changes and click Save.
The comment you enter is saved as policy metadata. For information on metadata, see "View Existing Policy
Information" on page 259.
179
Working with CPL Policy Fragments
A fragment is piece of CPL that you can include in a CPL policy. Fragments are meant to be reusable. For example, you can
create a library of policy fragments, and then include them into larger CPL policies later. For instance, you can define a host
black list using just a fragment, and then include that host black list fragment into a larger policy file later. See "Create a
CPL Policy Fragment" on page 278 and "Include a Policy Fragment" on page 279.
If you do NOT enable variable substitution in the CPL, variable substitution is not enabled for CPL Fragments as
well.
Enable variable substitution for CPL Policy and CPL Policy Fragments. "Use Substitution Vari-
ables in Policies and
Scripts" on page 194
Add new attributes that can be made available to the CPL Policy. "Add Attributes" on
page 366
Add or edit sections of a CPL Policy. "Add or Edit CPL
Policy Sections" on
page 183
Import a policy from a device to Management Center. "Import Policy or
Shared Objects" on
page 248
Modify/test policy and group related rules together. "Refine Existing CPL
Policy" on page 185
180
Create a CPL Policy Object
You can create policy in CPL to specify the behaviors that you want for devices. The first step to create policy in Man-
agement Center is to create the container for the CPL, or the policy object.
Before writing policies in CPL, Symantec strongly recommends that you understand the fundamental concepts
underlying policy enforcement in ProxySG appliances, as well as how to write correct CPL. For comprehensive
information on CPL, refer to the Content Policy Language Reference.
2. Click Add Policy. From the Create New Policy: Basic Information dialog, fill in the following fields: An asterisk
3. Enter the Policy name(*) - The name that displays in the Policy Object list.
4. Select CPL from the drop-down list.
5. Enter the Reference Id - Enter a Reference Id that you can filter on when building policy.
The Reference Id must begin with a letter, and must contain only letters, numbers and "_".
6. Select the Tenant to which this policy object will be applied.
7. Enter a Description. Although entering a description is optional, the description helps differentiate versions of the
same policy. For more information, see "View Existing Policy Information" on page 259.
8. To enable variable substitution, select the check box Replace substitution variables. See "Use Substitution
Variables in Policies and Scripts" on page 194 Click Next.
If you do NOT enable variable substitution in the CPL, variable substitution is not enabled for CPL
Fragments as well. See "Create a CPL Policy Fragment" on page 278.
9. From the Attributes page, select the attributes to apply to the CPL Policy. All attributes that are marked as
mandatory with a red asterisk are required. You can change the value of the required attribute before continuing.
Click Next.
10. Select the devices to install the CPL. You can associate devices with the policy at any time. See "Add or Remove
Devices Associated with Policy" on page 266
11. Choose the slot where your Policy will be installed. With CPL as the Policy type, the following slots are available:
n Local - Use this file to store policy specific to your organization, such as departmental policies and
company-wide policies. This option is selected by default.
n Forward - This file contains forwarding rules.
n Central - This slot contains policy common to your entire organization.
12. Click Finish. The newly created policy object displays in the Policy Objects list.
After you create a policy object, you can refine it or leave it as an empty object while you perform other tasks (for example,
associate devices with it or edit policy details). Refer to the following table to determine the next step to take.
What do you want to accomplish? Refer to
Refine an existing CPL policy. "Refine Existing CPL Policy" on page 185
181
Enable variable substitution for CPL Policy and CPL Policy "Use Substitution Variables in Policies and
Fragments. Scripts" on page 194
Validate existing policy. Preview Policy Before Installing It
Import an external CPL policy. "Import External Policy " on page 255
Create a new CPL policy section. "Add or Edit CPL Policy Sections" on the
facing page
Manage your CPL policies. "Manage CPL Policies" on page 187
182
Add or Edit CPL Policy Sections
You can add a policy section using one of two methods: you can use part of existing policy to create the section, or add a
new section and then add policy to it.
These features are only available if the Modular Layout is selected .
Add a Section Based on an Existing Policy Section
While composing the CPL or after importing policy from a device, you might find some policy rules that should be extracted
from their respective sections and put into a new section. You can select some or all of the text in a section and convert
the selection to a new section. When you convert a selection, the Policy Editor preserves the order of the CPL already writ-
ten.
2. In the Policy Objects list, select the CPL policy to which you want to add a section. Click Edit.
3. From the Editor tab, locate the policy section that contains the text you want to convert to a new section.
4. Select the text and click the Convert Selection to New Section icon . The Policy Editor displays the new

section.
5. Enter or modify the CPL as needed. Click OK.
6. Click Save.
Add a New Section
You can add more sections to a new or existing policy object. A new policy object has an empty section by default.
2. In the Policy Objects list, select the CPL policy that you want to add a section . Select the policy name. Click Edit.
3. Click the Editor tab. Locate the area that you want to add a new policy section. Click the New Section icon
.
183
4. In the Section name field, enter a name for the section.
5. From the Purpose drop-down list, select from the list of defined policy purposes or you can create your own Custom
Solution.
6. Click OK. The new section is added at the top of the Editor. Continue to edit the CPL as needed.
If you do not name the section, and only give it a purpose, the section appears as Untitled.
7. To commit your changes, click Save.
Edit a Policy Section
While creating a CPL policy or after importing a policy from a device, you might it useful to edit the policy rules within a sec-
tion. Because policy is applied to devices and can contain many types of rules, you can edit those rules within a section
making policy easier to navigate, organize and deploy.
2. In the Policy Objects list, select the CPL policy that you want to edit and click Edit.
3. Click the Editor tab. Locate the policy section that you want to edit. You can search for a section in the Quick
Navigation pane. Click Edit. The Policy Editor displays the Edit Section dialog. Although you can name the section
what best suits your needs, from the Purpose drop-down list, select from a defined list of rules that can be applied to
your policy section:
n Connection - Access Control
n Connection - Termination
n Authorization
n Threat protection - Outbound Policy - Forward Proxy
n Threat protection - Outbound Policy - Reverse Proxy
n Threat protection - Inbound Policy
n DLP Policy
n Privacy
n Content Filtering
n Quality of Service
n Caching
n Bandwidth Management
n Custom Solution
4. Click OK. The edited section is added at the top of the Editor.
If you do not name the section, and only give it a purpose, the section appears as Untitled.
5. To commit your changes, enter a comment for the commit operation and click Save. The comment you enter is
saved as policy metadata.
6. (Optional) To exit without saving your edits, click Cancel.
7. (Optional) Click Compare to see the differences between the existing policy version and the version you are about to
commit.
184
Refine Existing CPL Policy
The policy that you write is deployed to devices as it displays in the Policy Editor; Management Center does not
attempt to compile or otherwise validate the CPL. If the policy does not compile, the Policy Editor displays a
"Policy Install Failed" error message after you attempt to install it.
Much of the flexibility of managing policy in Management Center derives from the ability to organize policy rules in one or
more policy sections, which you can use to group similar or related rules together.
CPL Policy objects and sections
Policy in Management Center is structured thus:
l Policy object—The container for all policy that can be installed to a specific slot on a device. It has metadata and
can be versioned. Device association is done at this level.
l Policy section—A container for a high-level category of policy.
l Sub-section—A container for the CPL; it specifies the default, override, and mandatory behavior
affected by the policy.
If the modular sections perform slowly, you can select the Single Pane Layout icon . This is useful if the CPL is
particularly long or if you prefer working with a single pane of code.
Switching to a single pane and saving the policy erases all metadata about your sections. You cannot recover the
sections by switching back. However, you can either discard the changes without a save, or you can restore a pre-
vious version.
See "Work with CPL Policy Sections" on page 188 for more information.
After you have written CPL directly in the Policy Editor or imported policy from a device, you should attempt to refine it as
much as possible using these sections. Writing policy in sections, or breaking down an imported policy into sections,
makes policy easier to read and edit.
Configuring policy for specific devices or multiple devices at once involves several methods of creating, testing, and updat-
ing policy.
1. Search for policy objects that contain the CPL you want to edit; see "Filter by Attributes and Keyword Search" on
page 164.
Once you have found the policy object, you can determine the policy section to edit; see "Find a Policy Section" on
page 191.
2. (Optional) Make sure that the policy you are editing is the one you want. See "View Existing Policy Information" on
page 259.
3. (If applicable) Edit the CPL directly in the Policy Editor. See "Use Content Policy Language (CPL) to Create Policy"
on page 179.
Refer to the Content Policy Language Reference for information on CPL syntax.
4. (If applicable) If policy does not behave as intended or must be improved, modify it by moving sections within
policy. See "Change the Order in which Policy Rules are Evaluated" on page 193.
5. If the policy isn't working properly, you may want to compare the OS version on the associated device with the
policy version. See "Check Consistency between Policy and Devices" on page 269.
185
6. (If applicable) Add sections to contain policy for other purposes. See "Add or Edit CPL Policy Sections" on page 183.
7. (If applicable) Edit a section's name or purpose. See "Edit a Policy Section" on page 184.
8. Click Delete Policy, if you want to Delete a selected policy. A message displays "Are you sure you want to delete
the policy?" Click Yes or No.
186
Manage CPL Policies
When you are first setting up Management Center, you can create new policies or import existing policies from managed
devices; however, when you have been managing devices from Management Center for a longer period of time, you might
also want to edit policies to change current device configurations.
Management Center gives you great flexibility in both creating and modifying your policies. You can:
n Create and modify the CPL directly in the Policy Editor
n Correct and modify the behavior of existing policy by re-ordering policy sections
n Create versions of policy, and restore previous versions when needed
n Create policy without deploying it to devices immediately
Ensuring that devices are configured and behave as required could involve creating, modifying, and testing policy. For
example, you might create policy in your evaluation environment, install it to a small group of devices, observe the devices
in a test phase, and then edit the policy as needed based on your observations.
Learn about creating and maintaining policy in Management Center:
1. Create policy and deploy it to devices. You could do some or all of the following:
n "Use Content Policy Language (CPL) to Create Policy" on page 179in the Policy Editor.
n "Import Policy or Shared Objects" on page 248.
n "Add Attributes" on page 366
n "Install Policy" on page 242 to devices or device groups.
n "Install Multiple Policies" on page 247 to devices or device groups.
n "Compare the Device Policy Version with Current Policy Version" on page 272.
2. To add custom metadata to policies, see "Add Attributes" on page 366.
3. "View Existing Policy Information" on page 259 to see the revisions and policy information.
4. "Compare Different Versions of the Same Policy" on page 271 to find the edited version of a policy that you want to
use.
187
Work with CPL Policy Sections

Layout Modes
Single Pane Layout
If the modular sections perform slowly, you can select the Single Pane Layout icon . This is useful if the CPL is par-
ticularly long or if you prefer working with a single pane of code.
Switching to a single pane and saving the policy erases all metadata about your sections. You cannot recover the
sections by switching back. However, you can either discard the changes without a save, or you can restore a pre-
vious version.
Modular Layout
When you open a policy for editing, it defaults to the Modular Layout . If your policy contains numerous sections or
sub-sections, you can use features here to make writing and reviewing policy more manageable.
188
Navigate sections
These sections only appear in the Modular Layout .
The Quick Navigation pane displays an overview of all the sections in the policy object you are viewing. Each section is
represented thus:
Name
(Purpose)
default
override
mandatory
where Name is the section name and Purpose is the purpose you selected when you created or edited the section.
When you change the order of policy sections or change a section name or purpose, the Quick Navigation pane displays
the update immediately.
Collapse a section
Policy sections are expanded by default.
n To collapse a policy section, click the up arrow in the section title bar.
n To expand a collapsed section, click the down arrow in the title bar.
189
Collapse all sections
n To collapse all policy sections, click the Collapse all sections icon .
n To expand all sections, click the Expand all sections icon .
Move sections
You can move policy sections:
n Click the order up icon in a section title bar to move the section up.
n Click the order down icon in a section title bar to move the section down.
n Hover over the title bar of the section you want to move until the pointer changes to a . Drag the section to its
new location.
Moving policy sections affects how policy is evaluated. See "Change the Order in which Policy Rules are Evaluated" on
page 193 for information.
190
Find a Policy Section
You can search for an existing policy section using keywords. When you perform the keyword search, the system
searches policy sections and matches partial and full strings. The search does not include previous versions of policy.
1. Select Configuration > Policy. From Policy Objects, find the CPL Policy you want under Type. Or from the Filters
dialog on the right, go to the Type drop-down list and select CPL. Click Apply Filters. From the displayed CPL
policies, select the policy you want. Click Edit.
2. Click the Editor tab. Above the Quick Navigation pane, in the search field, enter your search term.
You can perform this search with all sections collapsed; any matches will cause sections to expand.
If the search finds no match
If the search does not find a match, the display does not change. You can search again using a different keyword.
If the search finds matches
If the search finds matches:
n To the right of the search field, the navigation arrows and the number of results display, as in the
following example:
n In the main Policy Editor pane, the first match is highlighted.
n In the Quick Navigation pane, the section that contains the first match is highlighted.
To go to the next search result, click the right navigation arrow . The result number shows the next match (for
example, "2 of 13") and the selections in the main pane and Quick Navigation update to reflect the match.
Clear the search results
To clear search results, click the X in the search field.
191
Manage Attributes
n Device
n Device Group
n Policy
n Device Script
3. To add an attribute, click Add Attribute. See "Add Attributes" on page 366.
n Name
192
Change the Order in which Policy Rules are Evaluated
You can change the order of the sections in policy, which in turn changes policy behavior. The CPL is evaluated from top
to bottom—lower layers override higher layers; thus, the order of sections affects the order in which policy rules in each sec-
tion are evaluated. Changing the order of policy sections can alter the effectiveness of policy, result in a rule overriding
other rules, or cause unintended behaviors. See the following examples.
2. In the Policy Objects list, select the policy. If needed, search for the object; see "Filter by Attributes and Keyword
3. (Recommended) To collapse a section, click the at the left of the title bar. You can click the on the
title bar of a collapsed section to expand it.
4. Hover over the title bar of the section you want to move. The pointer changes to a .
Drag the section to its new location.
Alternatively, you can use the selection arrows in the title bar to move the section up or down,
respectively.
5. Move sections around in the policy object until you are satisfied that the policy will evaluate as you intend.
If the policy has many sections, you can use the Quick Navigation pane on the right to quickly go to the section
you want. See "Work with CPL Policy Sections" on page 188 for instructions.
A red asterisk (*) beside the policy object name denotes pending changes.
6. Click Save.
Example
The following is a basic example of how changing the order of sections can change the behavior of policy.
Consider a policy section with the purpose Threat protection - Inbound Policy. It contains the following CPL:
; Deny EXE downloads
url.extension=.exe DENY
Another policy section has the purpose Access Control. It contains the following CPL:
; Users in specified subnet are allowed transactions
client.address=192.0.2.0/24 ALLOW
Refer to the following table to see how the order of policy sections can affect the behavior of policy.
Order of policy sec- How policy is evaluated Resulting behavior

tions
1. Threat protection - The Access Control section overrides the Threat pro- Everyone in the network
Inbound Policy tection section. is denied EXE down-
loads except for users in
2. Access Control the specified subnet.
193
Order of policy sec- How policy is evaluated Resulting behavior

tions
1. Access Control The Threat protection section overrides the Access Con- Users in the specified
trol section. subnet are allowed trans-
2. Threat protection -
actions with the excep-
Inbound Policy tion of EXE downloads;
everyone in the network
is also denied EXE
downloads.
Use Substitution Variables in Policies and Scripts
Substitution variables are generic terms that you can include in policies and scripts. When Management Center installs
policy or executes a script that includes substitution variables, it attempts to replace them with values specific to the current
transaction—that is, the current device, policy, or script. For example, if you install policy that includes the substitution vari-
able ${device.name}, the variable is replaced with the device name set in Management Center.
Use in Shared Policy
When you include shared policy objects in your policy, you must enable variable substitution or the the shared object’s CPL
will not be substituted for the include variable. For example, if you create a URL list called whitelist and include it in a
policy object, the system creates the CPL entry ${include:whitelist}. The whitelist URL list will only be
included if Replace substitution variables is selected when the policy is installed.
While you may use substitution variables in CPL layers, Management Center performs the substitution when
installing the CPL to the device. The UI markup (XML) remains unchanged. Therefore, if you open the installed VPM
policy locally from the ProxySG appliance and try to install it, the substitution variables will not be replaced in the res-
ulting CPL (because this workflow bypasses Management Center). This could result in malformed or unexpected
policy, depending on how the variables are being used.
To include and process substitution variables:
1. Enable Replace substitution variables in the policy object (see Create a CPL Policy Object) or script (see Create
and Distribute Configurations Using Scripts).
2. Include substitution variables in the CPL or script. See " Supported Variables" on the facing page below.
3. Install the policy or execute the script. As the target device processes the policy or script, it attempts to replace the
variables with the appropriate values.
If the policy or script is associated with a device group, Management Center inspects every device in the group
structure for the variable and attempts to replace all instances with specific values.
Syntax
Substitutions have the following form:
${name}
where name is an expression that expands to a string or block of text at runtime.
194
For example, the substitution ${device.description} expands to the description entered in the current device's prop-
erties in Management Center.
If the device does not have a description (because Description is an optional field), the substitution expands to an empty
string unless you also specify a default value. See "Specify a Default Substitution Value" on page 197 below for details.
Examples
Substitute the device's serial number.
${device.serialNumber}
Substitute the value of the device's Rack attribute.
${device.attributes.Rack}
Substitution variables are case-sensitive. To ensure that you have entered them with correct spelling and case, use
the Preview option before installing policies or executing scripts. The preview warns you if a substitution variable is
invalid.
Supported Variables
Device - ${device.field}
The following variables are available for policies and scripts.
${device.uuid} Internal ID of device
${device.modelNumber} Device model number
${device.description} Text in the Description field in device properties in Management
Center
${device.name} Text in the Device Name field in device properties in Management
Center
${device.serialNumber} Device's serial number
${device.osVersion} Operating system version running on the device
${device.attributes.name} System or user-defined device attribute value, including any values
inherited from the device group
Policy - ${policy.field}
The following variables are available for policies only (not scripts).
${policy.author} Last user who edited and saved the policy
${policy.description} Text in the Description field in policy properties
195
${policy.name} Text in the Name field in policy properties
${policy.referenceId} Text in the Reference Id field in policy properties
${policy.revision} Policy's current Version number
${policy.revisionDescription} Comments entered for the last revision
${policy.attributes.name} User-defined policy attribute value
Policy Fragment- ${fragment.field}
The following variables are available for policy fragments.
${fragment.author} Last user who edited and saved the policy fragment
${fragment.description} Text in the Description field in policy fragment properties
${fragment.name} Text in the Name field in policy fragment properties
${fragment.referenceId} Text in the Reference Id field in policy fragment properties
${fragment.revision} Policy fragment's current Version number
${fragment.revisionDescription} Comments entered for the last revision
${fragment.attributes.name} User-defined policy fragment attribute value
Script - ${script.field}
The following variables are available for scripts only (not policies).
${script.author} Last user who edited and saved the script
${script.description} Text in the Description field in script properties
${script.versionDate} Date of last update
${script.name} Text in the Name field in script properties
${script.type} Selected Type in script properties
${script.revision} Script's current Version number
${script.revisionDescription} Comments entered for the last revision
${script.attributes.name} User-defined script attribute value
196
Specify a Default Substitution Value
Unless you specify a default value, some transactions can produce unsubstituted variables, resulting in empty strings.
The following are examples of such transactions:
l An optional field such as Description is empty
l An attribute that is not marked as mandatory has no value
l A field is not applicable, such as when a script or policy has not been revised
Syntax
A default substitution has the following form:
${name(default_name)}
where:
l name is an expression that expands to a string or block of text at runtime
l default_name is the value that will be used instead of an unsubstituted variable
Example
If a policy fragment was edited, use the comments entered for the last revision. If the fragment was never edited, use the
specified text "No revision".
${fragment.revisionDescription(No revision)}
197
Launch Visual Policy Manager
Before using the VPM editor in Management Center, Symantec strongly recommends that you understand how the
VPM Editor works and underlying policy enforcement in ProxySG appliances. For comprehensive information on cre-
ating policy policy, as well as assigning and changing enforcement domains for policy rules in the VPM, refer to the
ProxySG Appliance Visual Policy Manager Reference and Advanced Policy Tasks.
To launch the VPM editor, clients using Java 7 must enable TLS 1.1 and TLS 1.2. In the Java Control Panel, select
Advanced. Then, select Use TLS 1.1 and Use TLS 1.2. See "Set Up and Enable Java in Your Browser " on
page 200.
1. Select Configuration > Policy. From the Policy Objects list, locate the VPM policy object you want to edit. To
narrow your search, you can do a "Filter by Attributes and Keyword Search" on page 164.
2. Click the policy name hyperlink or highlight the row and click Edit. Verify that you are in the Editor tab.
3. If necessary, iimport policy from the reference device. Click Import. See "Select Reference Device for VPM Policy"
on page 203.
4. Click Launch VPM Editor. When the system displays the following message, click Run.
5. If you see a Security Warning, check the IP address and click Continue.
6. The web console displays the Visual Policy Manager.
198
7. Add layers and rules, as required by your policy.
8. Click Save policy when finished. The edited policy displays in the Policy Objects list with an updated revision
number.
If Java is not enabled on your browser, the VPM Editor cannot launch. See "Set Up and Enable Java in Your
Browser " on the next page.
199
Set Up and Enable Java in Your Browser
The following is required to launch the Visual Policy Manager (VPM).
1. From your browser, install Java (the Java minimum required is Java 1.7.0_51). Enable Java in your browser.
Because every browser behaves differently, confirm that the correct Java version is installed and enabled by using
your browser to go to: https://www.java.com/verify
You may need to restart your browser after updating Java.
Note: Some browsers no longer support Java.
2. After you have verified that your Java version is correct and a reference device is available, the Launch VPM Editor
button is enabled.
3. Click Launch VPM Editor to open the Visual Policy Manager Editor. However, the following error can occur:
If you see this error after relaunching the VPM Editor it means that you need to allow java to run in your browser and
accept the certificates that Java requires.
200
Launch Visual Policy Manager
VPM Editor works and underlying policy enforcement in ProxySG appliances. For comprehensive information on
creating policy policy, as well as assigning and changing enforcement domains for policy rules in the VPM, refer to
the ProxySG Appliance Visual Policy Manager Reference and Advanced Policy Tasks.
Advanced. Then, select Use TLS 1.1 and Use TLS 1.2. See "Set Up and Enable Java in Your Browser " on the
previous page.
1. Select Configuration > Policy. From the Policy Objects list, locate the VPM policy object you want to edit. To
narrow your search, you can do a "Filter by Attributes and Keyword Search" on page 164.
3. If necessary, iimport policy from the reference device. Click Import. See "Select Reference Device for VPM
Policy" on page 203.
4. Click Launch VPM Editor. When the system displays the following message, click Run.
5. If you see a Security Warning, check the IP address and click Continue.
6. The web console displays the Visual Policy Manager.
7. Add layers and rules, as required by your policy.
8. Click Save policy when finished. The edited policy displays in the Policy Objects list with an updated revision
number.
201
If Java is not enabled on your browser, the VPM Editor cannot launch. See "Set Up and Enable Java in Your Browser
" on page 200.
202
Select Reference Device for VPM Policy
The reference device is the device you designate as the source device for VPM policy configurations. You must select a
reference device to launch the VPM editor.
1. Select Configuration > Policy. From the Policy Objects list, select a VPM policy. Click Edit.
A default reference device is not automatically populated. Associate a least one deployed device with the
policy or manually configure a reference device to enable editing.
2. While the Editor tab is selected, select a Reference Device, using the object selector .
Resolve displayed warnings before launching the VPM editor. The Launch VPM Editor button is grayed out if
warnings are present.
3. To associate a reference device, from the Select Device dialog, select the check box by the device that you want to
use as a reference. The selected device automatically displays in the Selected view. Click OK.
203
4. (Optional) You can create and edit a VPM policy as soon as you have selected a reference device and no warnings
are displayed. Click Launch VPM Editor.
Add or remove devices associated with the "Add or Remove Devices Associated with Policy" on
policy. page 266
Restore a version of the policy. "Restore a Version of Policy " on page 275
Create and edit a VPM policy using the VPM "Launch Visual Policy Manager" on page 201
Editor.
Import a policy configuration from a device. "Import Policy or Shared Objects" on page 248
View VPM Policy Source
Management Center enables you to view the CPL or XML policy source of a VPM policy.
2. From the Policy Objects list, select the VPM policy name.
If needed, search for the policy object; see "Filter by Attributes and Keyword Search" on page 164.
3. With the policy selected, click Editor. The system displays the editor.
4. View the policy:
204
l Click Generated CPL to view the CPL source.
l Click XML (UI Markup) to view the XML source.
5. (Optional) Edit the policy.
Create SSL Visibility List Policy
You can create policy in Management Center that manages URL or IP address lists for SSL Visibility appliances, and then
deploy the policy to a group of SSL Visibility appliances. The following options are available:
n Create IP address or URL lists in Management Center and add them to an SSL Visibility list policy.
n Import lists from an SSL Visibility appliance into a Management Center list.
n Map Management Center lists to SSL Visibility IP address or URL lists; when the SSL Visibility list policy is
deployed, the lists will be synchronized (with the Management Center list being the "master").
Step 1 - Create the List Object
Regardless of whether you are creating the list entries directly in Management Center or importing them from SSL Vis-
ibility, you first need to create an IP address or URL list object.
2. Click Add Object. The web console displays the Create New Shared Object wizard.
205
3. Fill in required fields. An asterisk denotes fields that are mandatory.
a. Object name (*) - Required name
b. Object type (*) - From the drop-down list, choose the type of list: URL List or IP Address List.
c. Reference ID (*) - Enter a Reference ID that you can filter for when building policy.
The Reference ID must begin with a letter and must contain only letters, numbers, and "_".
d. Description - Enter a meaningful description to help you when reusing this object.
4. Click Next. The Create New Shared Object wizard displays the Attributes dialog. If you defined a policy attribute as
mandatory, you can choose the attribute's value for this policy fragment. See "Add Attributes" on page 366.
5. Click Finish. The new list displays in the editor.
Step 2 - Add URLs or IP addresses to the List (Optional)
You can optionally add URLs or IP addresses to this list or if the list already exists on the SSL Visibility device, you can
import the list (see Step 3).
Step 3 - Import URLs or IP addresses from an SSL Visibility Appliance
If one of your SSL Visibility appliances already has URLs in a subject/domain name list or one or more IP address lists, you
can save time by importing the list into a Management Center list (instead of retyping the list in Management Center).
2. Select the URL or IP address list you created in Step 1.
206
3. Select Import Policy > From Device. The Source Device dialog lists all the SSL Visibility devices that have been
added to Management Center.
207
4. Enable the check box next to the SSL Visibility device containing the list you want to import into Management Center
and click Next. The Select Policy dialog displays the subject/domain name lists on the SSL Visibility device.
5. Select the list name you want to import and click Import.
6. Click Import and overwrite. The entries contained in the subject/domain name list in the SSL Visibility appliance
are now listed in the Management Center list.
7. Click Save.
Step 4 - Create the SSL Visibility Policy Object
Management Center has a policy type specific to SSL Visibility lists. You create the SSL Visibility lists policy as described
in this step and then add IP address or URL lists to it as described in Step 5.
2. Click Add Policy. The Create New Policy wizard opens.
208
3. Policy name: Enter a descriptive name for the policy.
4. Policy type: Choose SSLV Lists from the drop-down.
5. Reference ID: This is supplied automatically, based on the policy name (spaces are replaced with underscores).
6. (Optional) Description: Enter a description up to 1024 characters.
7. Click Next.
8. Click Finish.
Step 5 - Add Lists to the SSL Visibility List Policy
209
After you have created the SSL Visibility list policy, you can add one or more IP address or URL lists to it.
1. In the SSLV Lists policy screen, click Add List. The system displays the URL Lists window.
2. Select the check box next to the list you want to include in the policy.
3. Click OK. The list(s) are shown in the policy.
4. Click Save.
Step 6 - Mapping Management Center Lists to SSL Visibility Lists
When Management Center syncs policy to the SSL Visibility device, it needs to know which Management Center lists cor-
respond to which lists on the SSL Visibility device. This is accomplished by mapping the SSL Visibility list to the Man-
agement Center list. During the policy sync, Management Center compares the entries in the mapped lists. Any entries on
the Management Center list that aren't present on the SSLV list will be added to the SSL Visibility list. Any entries on the
SSL Visibility list that aren't in the Management Center list will be deleted.
1. In the SSLV policy, click Add List.
2. Select the list.
210
3. In the Subject/Domain Name List field, enter the name of the SSL Visibility list that you want to map to.
4. Click OK.
When the list policy is synched to SSL Visibility appliances, any lists that aren’t on the SSL Visibility appliance will
be created as subject/domain name lists. However, note that Management Center will not delete a subject/domain
name list on the SSL Visibility appliance if it isn’t present in the Management Center policy.
You can install the SSLV list policy directly on an SSL Visibility device or create a job to schedule the policy
installation.
211
Create SSL Visibility URL List Policy
You can create policy in Management Center that manages URL lists for SSL Visibility appliances, and then deploy the
policy to a group of SSL Visibility appliances. The following options are available:
n Create URL lists in Management Center and add them to an SSLV list policy.
n Import subject/domain name lists from SSLV into a Management Center URL list.
n Map Management Center URL lists to SSL Visibility subject/domain name lists; when the SSLV list policy is
deployed, the lists will be synchronized (with the MC list being the "master").
Step 1 - Create the URL List Object
Regardless of whether you are creating the list entries directly in MC or importing them from SSLV, you first need to create a
URL list object.
212
b. Object type (*) - From the drop-down list, choose URL List.
d. Description - Enter a meaningful description to help you when reusing this fragment.
4. Click Next. The Create New Shared Object wizard displays the Attributes dialog. If you defined a policy attribute
as mandatory, you can choose the attribute's value for this policy fragment. See "Add Attributes" on page 366.
5. Click Finish. The URL list displays in the editor.
Step 2 - Add URLs to the List (Optional)
You can optionally add URLs to this list or if the list already exists on the SSL Visibility device, you can import the URLs
from the subject/domain name list (see Step 3).
Step 3 - Import URLs from an SSL Visibility Subject/Domain Name List
If one of your SSL Visibility appliances already has URLs in a subject/domain name list, you can save time by importing
213
the URLs into a Management Center URL list (instead of retyping the URLs in MC).
2. Select the URL list you created in Step 1.
3. Select Import Policy > From Device. The Source Device dialog lists all the SSL Visibility devices that have been
added to Management Center.
214
4. Enable the check box next to the SSL Visibility device containing the URL list you want to import into Management
Center and click Next. The Select Policy dialog displays the subject/domain name lists on the SSL Visibility
device.
215
5. Select the list name you want to import and click Import.
6. Click Import and overwrite. The URLs contained in the subject/domain name list in the SSL Visibility appliance are
now listed in the URL list.
7. Click Save.
Step 4 - Create the SSL Visibility Policy Object
Management Center has a policy type specific to SSLV lists. You create the SSLV lists policy as described in this step and
then add URL lists to it as described in Step 5.
2. Click Add Policy. The Create New Policy wizard opens.
216
3. Policy name: Enter a descriptive name for the policy.
4. Policy type: Choose SSLV Lists from the drop-down.
5. Reference ID: This is supplied automatically, based on the policy name (spaces are replaced with underscores).
6. (Optional) Description: Enter a description up to 1024 characters.
7. Click Next.
8. Click Finish.
Step 5 - Add URL Lists to the SSLV List Policy
217
After you have created the SSLV lists policy, you can add one or more URL lists to it.
1. In the SSLV Lists policy screen, click Add List. The URL Lists window opens.
2. Select the check box next to each URL list you want to include in the policy.
3. Click OK. The list(s) are shown in the policy.
Step 6 - Mapping Management Center URL Lists to SSL Visibility URL Lists
When Management Center syncs policy to the SSL Visibility device, it needs to know which MC URL lists correspond to
which URL lists on the SSLV device. This is accomplished by mapping the SSL Visibility subject/domain name list to the
MC URL list. During the policy sync, Management Center compares the entries in the mapped lists. Any entries on the MC
218
list that aren't present on the SSLV list will be added to the SSLV list. Any entries on the SSLV list that aren't in the MC list
will be deleted.
1. In the SSLV policy, click Add List.
2. Select the URL list.
3. In the Subject/Domain Name List field, enter the name of the SSLV URL list that you want to map to.
4. Click OK.
219
When SSLV list policy is synched to SSL Visibility appliances, any URL lists that aren’t on the SSLV will be created
as subject/domain name lists. However, note that Management Center will not delete a subject/domain name list on
the SSLV if it isn’t present in the MC policy.
You can install the SSLV list policy directly on an SSL Visibility device or create a job to schedule the policy install-
ation.
Create SSL Visibility IP Address List
Using this feature, you can easily create IP address lists for use on the SSL Visibility appliance. IP address lists are shared
objects, and are similar to URL lists.
220
If you use shared objects in your VPM policy and install that policy onto an appliance, the policy will not function
properly if you later edit the policy locally (on the appliance) and save it. Explicit ${include} and substitution vari-
ables can result in invalid syntax errors. URL lists, category lists, IP address lists, etc., result in empty objects.
Step 1 - Create the IP Address List Object
b. Object type (*) - From the drop-down list, choose IP Address List.
5. Click Finish. The new IP address list displays in the editor.
Step 2 - Add IP Addresses
2. Select or edit the desired IP address list. The system displays the IP address list editor.
3. Enter the IP address in the IP Address field and click Add.
221
The system displays the text entered into the Description field as a comment in the generated policy.
4. Alternatively, paste in multiple IP addresses:
a. Create an IP address list and copy it in.
b. Click Paste IP addresses. The system opens the Paste IP addresses: Paste IP addresses dialog.
c. Copy the URLs into the Paste IP addresses: Paste IP addresses dialog. Press CTRL+V or right-click and
click Paste. The URLs are added to the list.
d. Click Next. The system opens the Paste IP addresses: Validate dialog.
e. Click Finish.
5. Click Save.
Enabling and Disabling IP Addresses
You can disable an individual IP address by selecting it and clicking Disable.
You can enable an IP address by selecting it and clicking Enable.
Step 3 - Include the IP Address List in Policy
When you have completed your changes, you can include the IP address list in your SSLV policy object, as described in
"Create SSL Visibility List Policy" on page 205.
222
You can then install your policy as described in "Install Policy" on page 242.
223
Deploy Tenant Policy
Tenant policy describes a framework that provides large organizations with high service availability, flexibility for multiple
tiers of administration, and ensures that all appliances in the network are used efficiently.
n Tenant Policy - An infrastructure that segregates the policy elements that effect users of each user network defined
within domains. Even though they use the same ProxySG appliance, two groups of users could have vastly different
policy sets.
n Role-Based Administration - A set of Management Center controls that allows a tiered-based approach to
managing ProxySG appliances and their associated policy. The top-tier administrators can view and manage all
levels of policy, second-tier (or branch) administrators can manage only their own level of policy and those beneath
them, and bottom-tier or tenant-level administrators can only view the policy for their own users.
All administrators control policy appropriate to their roles. Policy can be written specifically to route traffic from where users
are to one of several ProxySG appliances in your network, depending on load and availability.
Refer to the following deployment steps:
Step 1: Plan Network Configuration
Who performs this step: ProxySG administrator
Before proceeding, it is important to plan how your organization is structured. For example, determine the following:
l How user networks are grouped or separated (for example, by geographic location)
l What interfaces receive traffic from those users
l Why types of policy can be deployed to the tenant slot
Step 2: Configure Management Center
Who performs this step: Management Center admin/Super Admin
After configuring the appliance(s), add them to Management Center and define roles and administrators. Then, configure
default, group, and tenant policy to the appliances. User roles will dictate which users can see and manage policy for each
appliance or group of appliances.
1. Add a configured appliance to Management Center.
From the Management Center web console, access the online help and search for the topic entitled Add a Device
for the steps to add each ProxySG appliance to Management Center. Repeat this process for each configured
ProxySG in your network. To import many devices at one time, from the online help search for Add Multiple Devices
at Once.
2. To keep your devices organized, see the instructions for how to create hierarchies, device groups and sub-groups. A
device group is a folder in the device organizational structure that exists below the hierarchy level and contains
devices or sub-folders. Arrange device groups and devices in a way that makes sense.
l Configure Hierarchy for Devices and Device Groups
l Add a Device Group
l Drag and Drop Device Groups
3. Create device attributes to help manage your organization's network of appliances and groups of appliances. Device
attributes can be used to identify the location of a given appliance, the region or branch office it's associated with or
224
even which tenants are associated with each appliance. For more information, see the following topics in the online
help:
l Manage Attributes
l Add Device Attributes
l Add Device Group Attributes
3. Assign attributes to your configured appliances. For instructions, see "Edit a Device" on page 77.
4. Create administrator roles with different sets of permissions. After you "Define Roles " on page 355 see the types
of the permissions that are most valuable per role that you have created. This guide contains a reference topic
"Reference: Permissions Interdependencies" on page 312 that is invaluable when creating the roles in your
organization.
The following example shows how to create a role for managing a device group that you created ("Add a Device
Group" on page 73).
5. Create administrator groups. From the Administration tab, click Groups > Add Group.
6. Add admin users. For instructions on how to create administrator accounts, see "Grant Permissions" on page 358.
7. Create policy attributes. For instructions on how policy attributes can be used to organize and refine policy, see the
following online help topics:
l Manage Attributes
l Add Policy Attributes
l Mandatory Attributes
8. Define tenants. See "Manage Tenants" on the next page for instructions.
9. Create tenant policy in VPM ("Create a VPM Tenant Policy Object" on page 230 or CPL (see Create the Content
Policy Language).
10. Confirm that the correct policies are deployed to each device slot. See "View Deployed Policy for each Device
Slot" on page 263.
225
Manage Tenants
Tenants are administrative entities defined on ProxySG appliances. Each request is routed through a tenant, whose policy
is evaluated for that transaction. When no specific tenant is determined for a request, the default tenant policy is used. Ten-
ant determination criteria governs which tenant's policy applies to a given request. Add these tenants to Management
Center to create and deploy tenant-specific policy.
On the ProxySG appliance, there are two options for controlling tenancy determination:
1. The #(config general) multi-tenant criterion command specifies a substitution expression that is

evaluated for tenancy determination.
2. Using the <tenant> layer in the Landlord CPL slot to specify conditions and tenant() properties.
The Management Center WAF interface leverages option #2 to control tenancy determination via the Tenant
Determination object. See "About WAF Policy" on page 130 for more information.
When evaluating an HTTP request, if the tenant determination rules produce a match against an installed tenant, then that
tenant's policy will be evaluated. If that fails to set the tenant() property, or the tenant() property setting does not cor-
respond to an installed tenant policy, then the default tenant policy is applied to this traffic. Default tenant policy applies to
all requests where tenancy couldn't be determined during the initial connection.
Obtain the tenant identifiers before you write multi-tenant policy in Management Center. For more information on multi-ten-
ant policy, refer to the Multi-Tenant Policy Deployment Guide.
WAF Policy Use
Selecting a tenant is step 2 in "Use WAF Policy To Protect Servers From Attacks" on page 128. A base-level of WAF policy
should be installed to the default tenant before any additional tenants are created. This ensures that all requests are pro-
cessed by the WAF.
Add a Tenant
An asterisk denotes fields that are mandatory.
226
2. Click Add Tenant.
The web console displays the Add Tenant dialog.
227
3. Enter a Display Name.
4. Enter the Tenant ID. This controls the name of the tenant slot where policy will be installed. This ID is also used in
the tenant determination CPL using the tenant() property.
5. (Optional) Enter a Description (up to 1024 characters).
6. Click Save.
By default, the Tenants list is sorted in alphabetical order by Display Name. You can also sort by Tenant ID or Description
by clicking the column headings. If the list is long, use the Keyword Search field to search for any string in the name, ID, or
description. The search is case-sensitive.
Modify a Tenant
2. From the Tenants list, select the tenant to modify and click Edit. The web console displays the Edit Tenant dialog.
3. Edit the Display Name or Description. An asterisk denotes fields that are mandatory.
4. Click Save.
Delete One or More Tenants
2. From the Tenants list, select one or more tenants to remove.
3. Click Delete.
4. Select Yes to delete the selected tenants.
228
You cannot delete the default tenant or any tenant that is currently referenced in Management Center policy.
Attempting to delete the default or a referenced tenant results in a "Delete failed" error message.
229
Create a VPM Tenant Policy Object
A VPM Tenant policy object defines the policy for a VPM Tenant. When creating a VPM Tenant policy object, you select the
attribute values that apply to the policy (if attributes have been defined). Then, select the devices or groups to which you
deploy the policy; alternatively, you can define these device/group targets later.
To write tenant policy in CPL instead of using the VPM, see Create the Content Policy Language.
To write tenant policy in CPL instead of using the VPM, see Create the Content Policy Language.
The web console displays the Create New Policy: Basic Information wizard. An asterisk denotes fields that are
mandatory.
3. Select VPM Tenant for the Policy Type.
5. Select the Tenant to which this policy object will be applied.
8. Indicate whether to Replace Substitution Variables. See "Use Substitution Variables in Policies and Scripts" on
page 194 for more information.
9. Click Next.
11. Click Finish.
The new VPM Tenant policy object displays in the Policy Objects editor.
After you create a tenant policy object, you can either add policy to it immediately or leave it as an empty object while you
perform other tasks (for example, associate more devices with it or edit policy details). Refer to the following table to determ-
ine the next step to take.
Add policy. "Launch Visual Policy Manager" on
page 201
Import policy. "Launch Visual Policy Manager" on
page 201
230
Learn about deploying multi-tenancy policy on ProxySG Multi-Tenant Policy Deployment
appliances. Guide
Create and manage tenants from Management Center. "Manage Tenants" on page 226
View policies deployed to each slot on a device. "View Deployed Policy for each Device
Slot" on page 263
Import VPM Tenant Policy from Source Device
A VPM Tenant policy object can be used to define the policy used in a tenant slot. After creating the VPM Tenant (as
described in "Create a VPM Tenant Policy Object" on the previous page), you must add policy to it. You can add policy by
launching the VPM or by importing existing VPM policy from a source device.
Certain features available in normal VPM policy are not available in VPM Tenant policy. These include the Admin Access
and Admin Authentication layers. Any existing Admin Access or Authentication layers will not be present in the imported
contents.
To write tenant policy in CPL, see Create the Content Policy Language.
2. Select the VPM Tenant object and click Edit.
3. Select Import > From Device.
The system displays the Import Policy: Source Device dialog.
4. Select the source device and click Next.
231
5. Click Import.
The dialog closes and the following message is displayed in the editor:
232
The CPL for this VPM policy is out of date and needs to be regenerated before it can be deployed. Please
launch the VPM editor and save a new revision to update the CPL.
This is because only the VPM contents are imported, not the generated CPL.
6. To regenerate the CPL, click Launch VPM Editor.
7. Click Save Policy.
8. Enter a comment for your save and click OK.
9. Click Close.
The CPL now displays in the editor.
Refer to the following table to determine the next step to take.
Learn about deploying multi-tenancy policy on ProxySG Multi-Tenant Policy Deployment
appliances. Guide
Create and manage tenants from Management Center. "Manage Tenants" on page 226
View policies deployed to each slot on a device. "View Deployed Policy for each Device
Slot" on page 263
233
Deploy Tenant Policy
Tenant policy describes a framework that provides large organizations with high service availability, flexibility for multiple
tiers of administration, and ensures that all appliances in the network are used efficiently.
n Tenant Policy - An infrastructure that segregates the policy elements that effect users of each user network defined
within domains. Even though they use the same ProxySG appliance, two groups of users could have vastly different
policy sets.
n Role-Based Administration - A set of Management Center controls that allows a tiered-based approach to
managing ProxySG appliances and their associated policy. The top-tier administrators can view and manage all
levels of policy, second-tier (or branch) administrators can manage only their own level of policy and those beneath
them, and bottom-tier or tenant-level administrators can only view the policy for their own users.
All administrators control policy appropriate to their roles. Policy can be written specifically to route traffic from where users
are to one of several ProxySG appliances in your network, depending on load and availability.
Refer to the following deployment steps:
Step 1: Plan Network Configuration
Who performs this step: ProxySG administrator
Before proceeding, it is important to plan how your organization is structured. For example, determine the following:
l How user networks are grouped or separated (for example, by geographic location)
l What interfaces receive traffic from those users
l Why types of policy can be deployed to the tenant slot
Step 2: Configure Management Center
Who performs this step: Management Center admin/Super Admin
After configuring the appliance(s), add them to Management Center and define roles and administrators. Then, configure
default, group, and tenant policy to the appliances. User roles will dictate which users can see and manage policy for each
appliance or group of appliances.
1. Add a configured appliance to Management Center.
From the Management Center web console, access the online help and search for the topic entitled Add a Device
for the steps to add each ProxySG appliance to Management Center. Repeat this process for each configured
ProxySG in your network. To import many devices at one time, from the online help search for Add Multiple Devices
at Once.
2. To keep your devices organized, see the instructions for how to create hierarchies, device groups and sub-groups. A
device group is a folder in the device organizational structure that exists below the hierarchy level and contains
devices or sub-folders. Arrange device groups and devices in a way that makes sense.
l Configure Hierarchy for Devices and Device Groups
l Add a Device Group
l Drag and Drop Device Groups
3. Create device attributes to help manage your organization's network of appliances and groups of appliances. Device
attributes can be used to identify the location of a given appliance, the region or branch office it's associated with or
even which tenants are associated with each appliance. For more information, see the following topics in the online
234
help:
l Manage Attributes
l Add Device Attributes
l Add Device Group Attributes
3. Assign attributes to your configured appliances. For instructions, see "Edit a Device" on page 77.
4. Create administrator roles with different sets of permissions. After you "Define Roles " on page 355 see the types
of the permissions that are most valuable per role that you have created. This guide contains a reference topic
"Reference: Permissions Interdependencies" on page 312 that is invaluable when creating the roles in your
organization.
The following example shows how to create a role for managing a device group that you created ("Add a Device
Group" on page 73).
5. Create administrator groups. From the Administration tab, click Groups > Add Group.
6. Add admin users. For instructions on how to create administrator accounts, see "Grant Permissions" on page 358.
7. Create policy attributes. For instructions on how policy attributes can be used to organize and refine policy, see the
following online help topics:
l Manage Attributes
l Add Policy Attributes
l Mandatory Attributes
8. Define tenants. See "Manage Tenants" on page 226 for instructions.
9. Create tenant policy in VPM ("Create a VPM Tenant Policy Object" on page 230 or CPL (see Create the Content
Policy Language).
10. Confirm that the correct policies are deployed to each device slot. See "View Deployed Policy for each Device
Slot" on page 263.
Apply a Single Policy to Both On-Premises and Cloud Users
Universal VPM policy is a set of global rules created on Management Center that can be applied to users in any location.
The policy can contain global rules that apply to both on-premises and Web Security Service (WSS) users, as well as indi-
vidual rules that apply to only one or the other. It can also contain location-specific policy when necessary. In essence, uni-
versal VPM policy comprises the various rules that reflect your organization’s acceptable use policy. Using Management
Center to create and distribute the policy to on-premises devices and the WSS makes it easy to apply the relevant policy
to all users in your organization.
Prerequisites
To use the universal policy feature, you must first:
l Have a valid Web Security Services (WSS) account configured to accept policy from the Management Center via
the WSS on-boarding wizard. Existing WSS cloud customers may contact Customer Support for configuration
assistance.
l Configure your WSS account for on-premises policy enforcement.
l Enable enforcement domains and create policy on the reference ProxySG appliance. Although you can import
universal VPM policy from a source that does not have enforcement domains enabled, you cannot deploy the policy
unless you launch the VPM Editor and save a new revision of policy. This generates the CPL with enforcement
domains enabled.
SSL Requirements
Universal policy requires proper SSL certificate validation. You must:
235
l Ensure that Management Center is able to connect to https://sgapi.es.bluecoat.com
l Verify that no inline proxies will disrupt SSL connections to your devices.
l If Management Center uses the explicit HTTP proxy, ensure that it does not decrypt traffic
Software Version Requirements
Appliance Version
ProxySG appliance 6.7.1.1 or later; 6.5.9.14 or later (6.6.x is not sup-
ported at this time)
Web Security Service 6.9.5.1 or later
Management Center 1.8.1.1 or later
Solution Steps
1. Add the WSS as a device.
2. Create a new universal VPM policy object or transform an existing policy into universal policy.
3. If you created a new universal VPM policy object, import the policy from the reference ProxySG appliance.
4. Edit the universal policy:
a. Use the classifier to analyze the policy to determine if it's valid for WSS.
b. Using the classifier results, use the VPM to modify your policy. Determine if a rule should apply only to the
WSS, the appliance, or both (universal).
c. Save the policy.
d. Repeat as necessary until you are satisfied with the classifier results.
5. Add WSS and any on-premises devices as targets.
You cannot add WSS and other devices as targets in the same operation because they have different
deployment types. You must add WSS devices in a separate operation.
6. Install the policy to the targets.
Add a Universal VPM Policy Object
To add a universal VPM policy object, complete the following steps.
2. Click Add Policy. The system displays the Create New Policy: Basic Information dialog. An asterisk denotes fields
that are mandatory.
4. Select Universal VPM Policy for the Policy Type.
5. Enter a Reference ID. Although entering a reference ID is not required, it is useful for filtering objects when building
policy. If you do not enter a reference ID, the system assigns a default ID based on the policy name you enter.
Imported policy objects are assigned a default ID.
6. Enter a description in the Description field. Although entering a description is not required, the description helps
236
7. Indicate whether to Replace Substitution Variables. See "Use Substitution Variables in Policies and Scripts" on
8. Click Next.
10. Click Finish.
Transform Existing VPM Policy into Universal VPM Policy
To transform an existing VPM policy object into a universal policy object, you clone it as described below.
2. From the Policy Objects list, select the policy name or highlight the policy and click Edit.
3. Click Clone to Universal...
4. In the Clone and convert to Universal dialog, review the name and modify it if necessar. Then click Clone.
237
The system displays the new universal VPM policy. By default, the policy is titled with the original policy name with -
Universal appended. For example, if the original policy name is VPM Sunnyvale, the new universal policy name is VPM
Sunnyvale - Universal. You can now open the VPM and edit the universal policy.
Refine and Validate Universal VPM Policy
After creating universal VPM policy, you must refine your universal policy rules. Each policy rule can apply only to on-
premises users, only to remote users (Web Security Service - WSS), or to both (universal policy). These categories are
called enforcement domains. Before uploading the rules to the WSS, you must analyze the policy to ensure it will run as
expected.
VPM Editor works and underlying policy enforcement in ProxySG appliances. For comprehensive information on cre-
ating policy policy, as well as assigning and changing enforcement domains for policy rules in the VPM, refer to the
ProxySG Appliance Visual Policy Manager Reference and Advanced Policy Tasks.
Advanced. Then, select Use TLS 1.1 and Use TLS 1.2. See "Set Up and Enable Java in Your Browser " on
page 200.
1. Select Configuration > Policy. From the Policy Objects list, locate the universal VPM policy object you want to
edit. To narrow your search, you can do a "Filter by Attributes and Keyword Search" on page 164.
3. If necessary, import policy from the reference device. Click Import. See "Select Reference Device for VPM Policy"
on page 203.
4. Click Analyze Policy to open the policy classifier.
The system displays the policy classifier in a new tab. The classifier breaks down the policy to illustrate whether
each rule will perform as expected in the WSS.
238
5. Review the classifier recommendations:
l Examine the information displayed in the Overview tab. If the policy is not 100% enforceable on the WSS,
click the Recommendations tab for more information.
l If necessary, refer to the Migration, Policy, and Dependencies tabs for additional information.
l The WSS tab provides general information about the WSS.
Use this information to inform your policy edits.
6. Open the VPM:
a. Navigate back to the policy editing page and click Launch VPM Editor. When the system displays the
following message, click Run.
b. If you see a Security Warning, check the IP address and click Continue.
The web console displays the Visual Policy Manager.
7. Keeping both the classifier and VPM open, edit your policy rules.
If you use Windows, use ALT+Tab to switch between the VPM editor and the analysis tab. Displaying each
application in a separate monitor also works well.
For each rule, specify whether it should apply only to appliances (Appliance), both appliances and the WSS
(Universal), or the WSS only.
239
For details on enforcement domains, refer to "The Visual Policy Manager" chapter in the 6.7.1.1 Visual Policy
Manager Reference.
8. Save your VPM changes.
9. As you save your changes, the classifier notes that the data is stale, prompting you to refresh. Click Refresh to
update the classifier to reflect your changes.
You might notice blank lines in the classifier. Appliance-only rules are blanked out before sending to the WSS.
The rules are replaced with blank lines.
10. Review the new results. If the policy requires modification, repeat step 6.
11. Repeat steps 7 through 9 until you are satisfied with your changes.
You are now ready to add targets and install the universal VPM policy.
Install or Import Policy
To install or import policy, refer to the following.
"Preview Policy Before Installing It" below
"Install Policy" on page 242
"Install Multiple Policies" on page 247
"Import Policy or Shared Objects" on page 248
"Import External Policy " on page 255
Preview Policy Before Installing It
Management Center deploys policy to devices as it appears in the Policy Editor, and does not attempt to compile or oth-
erwise validate your CPL. To make sure that the CPL is correct and that the ProxySG appliance will process the policy as
intended, you can preview the policy for specific devices before installing it.
240
If the policy includes substitution variables, the policy preview displays the specific values that replace the variables for
each associated device.
1. Create policy (Create the Content Policy Language) or edit existing policy (Refine Existing CPL Policy).
2. (If policy includes substitution variables) On the Basic Information tab when creating policy, or on the Info tab when
editing policy, select Replace substitution variables.
3. Click Targets. The web console displays devices associated with the policy.
4. Select the device for which you want to preview policy.
5. Click Preview. The web console displays the CPL in a Preview dialog.
Inspect the CPL for any errors and edit it if needed. If the policy includes substitution variables, all variables are replaced
with appropriate values (except for cases where no value is available). For more information, see "Use Substitution Vari-
ables in Policies and Scripts" on page 194.
241
Install Policy
When you create policy, you do not have to install it to devices immediately; you can save it, continue to edit and test it, and
then deploy it to devices when it is complete and working as expected.
You cannot install a shared object. Shared objects are used to augment policy, not to replace policy. See "Create
Shared Objects" on page 276.
You can only install the latest version of policy; if you want to install an earlier version, restore that version first. See
"Restore a Version of Policy " on page 275.
Policy Installation Methods
Install policy using one of the methods described in the following table.
Type Location Notes

"Install..." Configuration > Policy Install policy using
below job wizard. You can
select more than
one script to install
in the same job.
"Install to Configuration > Policy > Policy_Name > Edit > Targets Install policy using
All..." on job wizard.
page 246
"Install to Configuration > Policy > Policy_Name > Edit > Targets One click policy
Device" on installation. Does
page 246 not use the job wiz-
ard.
Install...
1. Select Configuration > Policy. Select the policy name.
2. From the targets shown, select the device(s) to install the policy.
3. Click Install.... Fields marked with an asterisk (*) are required. The name of the policy is automatically filled in the
required field, though you can change it.
242
4. (Optional) Add a description. Click Next.
5. From Select Policies to Install, select the Object Selector . To choose the policies to install, click the check
box associated with each policy. This action immediately populates the Selected list. Click OK. Choose the Force
installation check box. Click Next.
243
6. Click All Predefined Targets to install the policy to all target devices or click Selected Targets to exclude some
target devices. Click Next.
If you select Selected Targets, you can select some members of a group and not others for policy installation. You
do not have to install policy to all group members.
244
7. Choose a schedule to install the policy. Click Finish.
The web console displays the following messages:
Depending on how many targets you selected, policy installation can take up to 60 seconds. During this time, the
web console displays a Job Progress: Install Dialog.
245
Install to All...
2. Select the policy name and click Edit.
3. Click the Targets tab and click Install to All...
4. Follow steps 3 to 6 in "Install..." on page 242
Install to Device
1. Select Configuration > Policy. .
2. Select the policy name and click Edit.
3. Click the Targets tab and click Install to Device.
246
Install Multiple Policies
When you create policy, you do not have to install it to devices immediately; you can save it, continue to edit and test it,
and then deploy it to devices when it is complete and working as expected. You can create multiple policies without having
to install the policies right away. This is particularly useful for large deployments of policies to multiple devices or device
groups.
You can schedule multiple policies to deploy to device groups , as long as the following are true:
n Each policy does not have unsaved changes. To ensure that the latest policy changes are installed, click Save
Changes in the Editor.
n Any devices you want to associate with the policy have been added and activated in Management Center.
It is a best practice to only schedule installation of policies that are the latest version. However, you can Force
Installation of Policies, by selecting the Force Installation check box. During installation of policies, Management
Center ignores the following installation warnings:
n Mismatched on-box policy object
n Mismatched OS versions
By forcing the Installation, you are ensuring that large deployments of policies DO NOT fail when
encountering devices that may have the above issues.
1. From the Jobs tab select the Scheduled Jobs section. Click Add Job. The Add Job Wizard displays the Add
Job: Basic Info dialog. Fields marked with an asterisk (*) are required.
2. Enter a unique Name (*) for this large policy deployment. Enter a Description.
For example, the unique Name can be Install Policies on All Active ProxySG Appliances, and the
Description can be Deploy policies to all activated ProxySG appliances.
3. Click Next. The Add Job wizard displays the Add Job: Operation dialog.
4. From the Operation drop-down, select Install Policy. The policy marked with a red asterisk is a mandatory policy
and is installed regardless of the other policies you select.
247
5. From Select Policies to Install, select the Object Selector . To choose the policies to install, click the check

box associated with each policy. This action immediately populates the Selected list. Click OK. Choose the Force
installation check box. Click Next. The Add Job wizard displays the Add Job: Targets dialog.
Each selected policy will be installed to targeted devices (excluding devices that are not active).
You cannot choose targets at this point. If you are not sure of the devices targeted by the selected policies,
click Back. Management Center has built in intelligence, so that only properly configured policies can only be
applied to appropriate targets.
6. Click Next to choose a Schedule. See "Add a Job" on page 395 and "Install Policy" on page 242.
Import Policy or Shared Objects
You can import policy into Management Center. For example, if a knowledge base article includes sample policy, you could
import it directly into Management Center. You could also share policies between Management Center instances.
You can import policy into Management Center in the following ways:
n "Import Policy from a File (Policy or Shared Objects Grid)" on the facing page
n "Import Policy from a File (Object Edit)" on page 252
248
n "Import Policy from a Device " on page 253
If you import a policy without a reference ID, the system assigns a reference ID with the format auto_gen-
erated_id_1. You can change the ID after importing the file.
Import Policy from a File (Policy or Shared Objects Grid)
You can import policy from the following file types:
n Management Center (.json)
n Content Policy Language (.cpl, .bpf, .txt)
n Visual Policy Manager (.xml)
Procedure
1. Select Configuration > Policy or Configuration > Shared Objects.
2. Click Import.
The system displays the Import Policy wizard.
3. Drag and drop the file into the Select File dotted-line area. Alternatively, browse to the file.
4. Click Next.
249
5. If the imported file contains multiple policies, you might want to exclude some from import. To do this, clear the
Import Policy check box.
In the preceding example, the VPM policy has been excluded from import.
6. Choose whether to create a new policy or to update an existing policy.
250
The wizard displays only policy objects that are relevant to the file type. If the policy uuid or reference ID in
the import file matches a policy already on the system, Update existing policy is the default (with the
matching policy prepopulated in the Policy field under Update Existing Policy). Otherwise, Create new
policy is the default.
l To create a new policy, click Create new policy and enter a meaningful name.
l To update an existing policy, ensure that Update existing policy is selected. Clear the Import Policy check
box for any policies you do not want to change.
l To update a different policy than the one shown, click the pencil icon , select the policy or policies to
251
replace, and click OK.
7. Click Import. The system displays the results of the import.
8. Click Close to exit the wizard.
Import Policy from a File (Object Edit)
2. Select the policy object and click Edit.
3. Click Import Policy and select From File.
4. Drag and drop the file into the Select File dotted-line area. Alternatively, browse to the file.
252
5. Click Import.
Import Policy from a Device
Importing policy from a device is useful in the following situations:
n You want to use a device's currently installed policy as the starting point for a managed policy.
n A device has a policy configuration that you want to use as a policy template to deploy on other like device(s).
Universal VPM Policy Considerations
Although you can import universal VPM policy from a source that does not have enforcement domains enabled, you can-
not deploy the policy unless you launch the VPM Editor and save a new revision of policy. This generates the CPL with
enforcement domains enabled.
Procedure
2. Select a policy object or CPL fragment and click Edit.
3. Click Import Policy and select From Device. The web console displays the Import Policy wizard.
4. From the Source Device drop-down list, select the device from which to import the policy configuration and click
Next.
5. Select the policy that you want to import. Depending on whether the policy is a VPM or CPL policy, the deployment
253
type is shown next to the policy:
n VPM - This policy contains policy created by the Visual Policy Manager and is deployed in the V slot.
n Central - This policy contains policy common to your entire organization and is deployed in the C slot.
n Local -This policy contains policy specific to your organizational structures, such as departmental policies or
local (geographic-specific) policies and is deployed in the L slot.
n Forward - This policy contains forwarding rules for the policy and is deployed in the "F" slot.
n Landlord - Policy rules for tenant determination.
n Default tenant - Policy rules for all requests where tenancy cannot be determined during the initial
connection.
n Tenant - Policy specifically for tenants.
For details on tenant policy, refer to the Multi-Tenant Policy Deployment Guide.
n WSS - Used for WSS targets (universal VPM policy) only.
6. Select Import Policy.
The web console prompts you to confirm the overwrite of the existing policy in Management Center.
7. Click Import and Overwrite to accept the import.
8. (Optional) Click Compare to view the differences between an earlier version of a policy and the current version. See
"Compare Different Versions of the Same Policy" on page 271.
9. Enter a comment for the commit operations and click Save. The comment that you enter is saved as metadata.
Export policy "Export Policy or Shared Objects to Local Disk" on page 273
View existing policy information "View Existing Policy Information" on page 259
Restore a version of the policy "Restore a Version of Policy " on page 275
Deploy the policy, as is, to devices "Install Policy" on page 242
254
Import External Policy
You can create a job to import a CPL fragment created in an external tool into Management Center. The job can be
executed immediately, manually, or on a schedule. This is useful if you want to regularly sync the policy with the version
on an external server.
Before you import an external policy, you need to create a policy object in Management Center into which to import the file.
Prerequisites
Before you create the Import External Policy job, you need to perform the following tasks:
1. Create the CPL in an external tool.
2. Create a policy object in Management Center. You will be importing the external file into this policy. See "Create a
CPL Policy Object" on page 181.
3. (Optional) If you intend to use the URL as an absolute path to the policy target file*:
a. Edit the policy object and go to the Info tab. Record the Unique ID; you must name the external CPL file with
this ID.
b. Name the external policy file with the Unique ID of the Management Center policy.
Example: 7B6F26F9-94FB-453C-B56F-8AE433ABDBBE.bpf
4. Store a file that contains the contents of the policy on a web, FTP, or SCP server.
5. Make note of the URL path to the file; you will need to specify the URL when defining the Import External Policy
job.
*When the URL is used as an absolute path to the policy target file, Management Center attempts to fetch a file at the URL
and store it as the content for the policy target(s) selected. If you have more than one target policy selected for the job, all
the targets will be updated with the same content of the file.
The Management Center default treats the URL as a directory and attempts to fetch files that match one of the IDs of the
policy target(s). W hen the job executes, Management Center appends {id}.bpf to the URL for each of the policy targets in
the job.
Procedure
To create a job for importing an external policy:
1. Click Jobs > Scheduled Jobs.
2. Select New Job. The web console runs the New Job wizard. An asterisk denotes fields that are mandatory.
3. Enter a Name(*) and Description.
4. Click Next. From the Operation(*) drop-down list, select Import External Policy.
5. Specify the location of the external policy file:
n Import from URL: The path to the file on the external web, FTP, or SCP server.
o Directory URL Example: ftp://company.com/policies/
o Absolute Path to File Example: ftp://company.com/policies/7B6F26F9-94FB-453C-
B56F-8AE433ABDBBE.bpf
n Username: If authentication to the server is required, enter the name of user with permission to access the
server.
n Password: Enter the user's password.
255
n Use URL as absolute path to file: This option is not selected by default.
o Leave this unselected if you want to load a large number of policies and do not wish to manage
separate jobs for each.
o Select this option to treat the URL as an absolute path to the policy target(s).
If you have more than one target policy selected for the job, all the targets will be updated with
the same content of the file.
6. Click Next. The New Job: Targets dialog displays.
7. For the Target, select the name of the policy object you created as a container for the imported external policy.
8. Click Next. Define a schedule to run the Import External Policy job. See "Job Scheduling Options" on page 400.
View Policy
To view policy, refer to the following.
"Preview Policy Before Installing It" on page 240
"View Existing Policy Information" on page 259
"View Deployed Policy for each Device Slot" on page 263
"View Devices Associated with Policy" on page 264
View Policy Versions
Management Center enables you to view CPL or VPM policy versions.
2. From the Policy Objects list, select the policy name.
If needed, search for the policy object; see "Filter by Attributes and Keyword Search" on page 164.
3. With the policy selected, click Edit. The system displays the editor.
4. Select the Versions tab.
5. Select the policy version you want to view.
6. Click View. The Preview dialog displays.
256
CPL example:
VPM example:
257
7. (Optional) To compare policy versions, see "Compare Different Versions of the Same Policy" on page 271.
8. (Optional) To restore an earlier version of the policy, See "Restore a Version of Policy " on page 275.
9. Click Close.
258
View Existing Policy Information
Whenever you create a version of policy, Management Center automatically saves information about it. This information is
called metadata.
1. You can view metadata by selecting Configuration > Policy.
2. Select a policy and click Edit.
View Policy Object Information
1. Click the Info tab. The Version Control page displays all versions of the selected policy. An asterisk denotes fields
that are mandatory.
2. Under General Information, the Overview displays the information you entered when creating the policy object:
n Policy name(*)—The name of the Policy that you gave it when you created it
n Policy type(*)—The Policy type can either be CPL or VPM.
n Description—This is the Description that you entered when you created the policy. If you edit this field,
make sure to click Save before leaving the Info tab.
n Replace substitution variables
Variable substitution is powerful and can be applied to policies and scripts. See "Use Substitution
Variables in Policies and Scripts" on page 194.
3. Metadata displays under Latest Revision:
259
View Available Policy Versions
1. Click the Versions tab. The Version Control page displays all versions of the selected policy. When a policy object
is created it is assigned the Version number 1.0. Every time that add attributes or edit it in any way, the version
increases by increments of 0.1.
2. Select an early version of policy to compare.
260
3. Press and hold the Ctrl key while selecting the later version of policy to compare.
n Version Number—When a policy object is first created, its version is 1.0. Each subsequent time the object
is modified—for example, if the object properties are edited or when policy is added to it—the version number
increments by 0.1. For example, when you add policy to an object and save it, the version becomes 1.1.
n Date—The time and date stamp indicates when the policy was last updated.
n Author—The author is the user who saved the current version of the policy.
n Comments—If the author entered comments about the policy, they are displayed here. Metadata displays
automatically-generated comments as follows:
o Policy Object created—When the policy container is initially is created and policy has not been
added yet.
o Name changed—When the policy name is edited.
o Description changed—When the policy description is edited.
o Name and description changed—When both the name and description are edited.
Of these metadata, the comments are usually the most important in helping you and other users
understand the purpose and intent of creating the specific policy version. Symantec recommends
that you always enter clear, helpful comments when creating policy.
View Associated Policy Attributes
1. Select the Attributes tab. The Attributes page displays all attributes currently assigned to this Policy. The
attributes are custom attributes that you created. See "Add Attributes" on page 366 or "Edit Attributes" on page 369.
2. You can edit the Associated attributes. If you do, you need to save your changes. Click Save. Doing this actually
increases the version number by an increment of 0.1.
Set the Maximum Number of Policy Versions to Store in Management Center
After you create a policy, you can edit it to make it specific for your specific device types. Each time you edit or import a
261
policy, a revision of the policy is stored. You can specify the number of revisions of policy to store before Management
Center begins to prune.You can specify up to 999 revisions.
1. Select the Administration > Settings. Click General. General fields display on the right. An asterisk denotes fields
that are mandatory.
2. Select Maximum number of policy revisions to store.
3. Enter a number (limit) from 0 to 999.
l Click Save to store the settings on the server.
262
View Deployed Policy for each Device Slot
1. From the Network tab, select a device.
2. Click Edit.
3. From the Edit Device wizard, select the Policies tab.
The deployment slots are not editable.
Policies are assigned to slots in the following ways:
l Direct assignment - The policy was installed directly to the slot and not inherited from the device group to which the
device belongs.
l Inherited from [Device Group Name] - The policy was inherited from the device group to which the device belongs.
Notes:
l Local, Central, and Forward are CPL policy slots.
l VPM Tenant and Landlord can be either CPL and VPM.
l Policy deployed to the Landlord slot overrides any previous policy deployed to the Landlord slot.
263
View Devices Associated with Policy
You can view the devices that are associated with a policy.
1. Select Configuration > Policy. From the Policy Objects list, select the policy you want to view. If needed, filter on
attributes. See "Filter by Attributes and Keyword Search" on page 164.
2. Click Edit. Select the Targets tab.
Only those devices that can support the policy selected are displayed. This helps to know which policies can
be installed on which devices.
3. For each device listed, verify the following:
n Enabled—If selected, the policy that is installed on the device is enabled.
n Name—The name that was entered in Management Center during device registration.
n Device Count—The number of devices available.
n Device Model—The device hardware model.
n Installed Version—The version of policy installed on the device. If no version is listed, the device is still
associated with policy, but policy has not been installed.
n OS Type—The operating system on the device.
n State—Displays historical association data for devices (whether deleted or not).
264
Configure Policy
Configuring policy for specific devices or multiple devices at once involves several methods of creating, testing, and updat-
ing policy.
What do you want to accomplish? What you can do Refer to this topic

Write new policy; the behavior that you want Create policy, which involves "Create a CPL Policy Object" on
is not yet expressed in policy in Man- first creating a policy object. page 181
agement Center.
Create a policy using the Visual Policy Create a VPM Policy "Launch Visual Policy Manager"
Manager. Object. on page 201
Create rules to route traffic to the proper Create tenant determ- "Specify Tenant Determination
tenant. ination rules. Rules " on page 136
Specify rules to protect your Create a WAF Application "Configure WAF Application
WAF applications. object. Objects" on page 143
Remove devices from policy or add Associate devices with, or "Add or Remove Devices Asso-
devices to policy; you want to keep the disassociate devices from, ciated with Policy" on the next
policy but change the devices that use it. a specific policy. page
Modify existing CPL policy because it Refine the existing policy. "Refine Existing CPL Policy" on
does not behave as intended or has to page 185
be improved. Change the order of policy "Change the Order in which
rules so that the device Policy Rules are Evaluated" on
evaluates correctly. page 193
Verify information about existing policy. Check information about "View Existing Policy Inform-
an existing policy. ation" on page 259
265
Add or Remove Devices Associated with Policy
Use the following procedure to add targets to associate with the selected policy.
Web Security Service (WSS) Target Considerations
Consider the following if you plan to add WSS as a target.
l You cannot add WSS and other devices as targets in the same operation because they have different deployment
types. You must add WSS devices in a separate operation.
l Management Center must have a connection to the reference device at the time of installation. When installing
policy, Management Center fetches data from the reference device, including non-policy configuration items like
ICAP server data, and exception pages referenced by policy.
l For universal policy, appliance-only rules are blanked out before sending to the WSS. The rules are replaced with
blank lines.
Add Targets
1. Select Configuration > Policy. From the Policy Objects list, select the policy you want to add to devices. If
needed, search for the object; see "Filter by Attributes and Keyword Search" on page 164.
2. Select the policy name. Click Edit.
3. Click the Targets tab. To add targets to associate with the selected policy, click Add Targets.
4. From the Add Targets wizard, select the Devices tab. Select the checkbox by the device(s) name (or click Add to
add a new device).
Only those targets that can support the policy selected are shown. This helps to know which policies can be
installed on which targets (devices).
266
5. (Optional) To associate device groups with the policy, click the Groups tab and select Devices. This action
immediately populates the Selected list.
6. To remove the selected devices, click Unselect or Unselect All. Click Next.The Add Targets wizard displays the
Add Targets: Configure Deployment dialog.
7. From the Deployment Type drop-down list, select one of the following:
l VPM Slot - Generated CPL (and the XML markup which persists the state of the VPM UI) pushed to the
target's VPM slot.
l Policy Slot - The ProxySG appliance's Local, Central, or Forward policy file.
l WSS - Used for WSS targets (universal VPM policy) only.
l Landlord Slot - Policy rules for tenant determination.
l Tenant Slot - Policy specifically for tenants.
If you select Tenant Slot and a tenant is not configured, a "Tenant not configured" warning appears in the
Deployment column on the Targets tab.
8. (If you selected Policy Slot) From the Slot drop-down list, select Local, Central or Forward.
9. Click Finish. A web console message displays the following:
267
Remove Targets
To remove devices associated with a policy, select the device name and click Remove Targets. You are asked to confirm
that you want to remove the associated device(s). Click Yes or No.
View associated devices (targets) "View Devices Associated with Policy" on page 264
Compare policy versions "Compare Different Versions of the Same Policy" on page 271
Install a policy "Install Policy" on page 242
Compare the policy version installed "Compare the Device Policy Version with Current Policy Version" on
on the device, with the most current ver- page 272
sion saved in Management Center
Schedule a policy installation "Add a Job" on page 395
Install multiple policies to multiple "Install Multiple Policies" on page 247
devices
268
Check Consistency between Policy and Devices
You can check if the policy saved in Management Center is different from the policy installed on devices.
1. To check the consistency of the installed policy with the devices, select Configuration > Policy and select a
policy object.
2. Select the option by the policy name. Click Edit, and then click the Targets tab.
3. Select the device that you want to check for consistency against the policy stored in Management Center. Click
Check Consistency. Select the base policy version by selecting the The latest policy version or the Version
check box.
If you don't select any devices, or you select a few and click Check Consistency, a consistency check is
done on those devices, not just one. No selection of a device is required.
4. Click Check Consistency.
If you receive a Mismatch error for a device, the policy is inconsistent: either the policy was changed in
Management Center and not installed to the device with the error, or the policy on the device was changed
outside of Management Center.
5. You can click Compare Policy to determine what has changed.
269
6. (Optional) For each device listed, verify the following:
The Management Center license contains all of the features for which you have purchased a subscription.
The documentation covers all features, including ones that you may not have purchased.
n Policy is enabled (if Enabled is selected).
n Device Name—The name that was entered in Management Center during device registration.
n Device Count—The number of managed devices is shown in the banner.
n Device Model—The device hardware model.
n Installed Version—The version of policy installed on the device. If no version is listed, the device is still
associated with policy, but policy has not been installed.
n OS Type—The operating system on the device.
n State—The status of the device. See "About Color-Coded Status Indicators" on page 30.
Add or remove associated devices. "Add or Remove Devices Associated with Policy" on
page 266
Compare different versions of the same policy. "Compare Different Versions of the Same Policy" on
the facing page
Install a policy or policies. "Install Policy" on page 242 or "Install Multiple Policies"
on page 247
View policy information. "View Existing Policy Information" on page 259
270
Compare Different Versions of the Same Policy
As a troubleshooting step or as part of performance evaluation, you might want to identify the changes between an earlier
version and a later version of policy. Management Center shows the changes made.
1. Select Configuration > Policy. From the Policy Objects list, select the policy name. If needed, search for the
policy object; see "Filter by Attributes and Keyword Search" on page 164.
2. Select the Versions tab.
3. Select the versions of policy to compare (press and hold the Ctrl key while selecting the policy versions).
4. Click Compare. The system displays the Compare Policy dialog.
n CPL Example.
n VPM example.
Starting in Management Center 1.6, you can diff the source code of VPM policy. To switch between the
271
Generated CPL and XML views, select the appropriate window.
The two policies are displayed side-by-side; the web console displays the version you selected first (earlier version)
on the left and your second selection (later version) on the right.
n Policy highlighted in red exists in the former version and was removed in the later version.
n Policy highlighted in yellow indicates that a line exists in both versions of policy, but there are differences in
the line.
n Policy marked in green does not exist in the former version and was added in the later version.
n Policy highlighted in white means the two copies are identical.
5. (Optional) To restore an earlier version of the policy, See "Restore a Version of Policy " on page 275.
6. Click Close.
Compare the Device Policy Version with Current Policy Version
You can compare the policy version installed on the device with the current policy version that is stored in Management
Center.
272
View all of the details about an existing policy, including policy object "View Existing Policy Information" on
information, the policy version, and the associated attributes. page 259
Compare different versions of the same policy. "Compare Different Versions of the
Same Policy" on page 271
Export Policy or Shared Objects to Local Disk
You can export policy objects from the Policy or Shared Objects grid. The policy is exported in JSON format. If you
export multiple policy objects, they are collected and exported in a single JSON file.
2. Select one or more policy objects.
3. Click Export.
273
4. Depending on your browser settings, you may be prompted to view or save the file. Click Save if prompted. In other
cases, the file is automatically saved to local disk (typically, the Downloads folder).
274
Restore a Version of Policy
After time, you might find that the policy pushed to devices needs improvement or must change because of changes in
business requirements or practices. In such situations, you can modify policy as needed, or revert to an earlier version of
policy that is appropriate. When you have determined which version of policy to restore, you can restore it using the ver-
sion history.
1. Select Configuration > Policy. From the Policy Objects list, select the policy name. If needed, search for the
object; see "Filter by Attributes and Keyword Search" on page 164.
2. Click Edit. Click the Versions tab. Versions of the policy are listed in descending numerical order.
3. From the Version Control page, verify that the version you want to restore is the correct one. Perform one or both
of the following as required.
l Check the version metadata. See "View Existing Policy Information" on page 259.
l Compare versions of policy. See "Compare Different Versions of the Same Policy" on page 271
4. After you identify the version to restore, select it and click Restore. The web console displays the Restore dialog.
5. In the Comment field, specify the reason for the restore.
6. Click Restore.
The restored version of the policy is incremented to the latest version in the Policy list, and the comment you
entered in step 6 is displayed in the Comments column.
7. To install the restored policy to associated devices, select the policy and click Install Policy. See "Install Policy"
on page 242.
Use Specific Attribute Values to Control Access to Policy
work. Attributes are custom metadata used to refine and edit devices, device groups policy, and scripts. These attributes
can be used to control access to policy, as described below.
Procedure
1. Create the Policy attribute.
2. Associate the attribute with a policy object.
a. Select Configuration > Policy.
b. Select the policy name and click Edit.
The system displays the policy editor.
c. Select the Attributes tab.
d. Select the attribute and click Save.
3. Add the permission rule to a new or existing role.
a. Select Administration > Roles.
b. Select an existing role and click Edit or click Add Role.
c. If this is a new role, provide a name and description, and click Next.
d.
Symantec recommends that you enter a list of the permissions for the defined role in the Description
field. This helps you and other users understand the permissions of a user's role including the intent
of their job function.
275
e. In the Add Role: Permissions dialog, click Add Permission.
f. In the Object list, specify Policy.
g. In the Action list, select All operations or a specific operation.
h. In the Filter section, click the Add Filter icon .
i. In the Filter Type section, select Attribute has specific value.
j. Select the attribute and assign a value to it.
k. Click Save, then Finish.
Create Shared Objects
Shared objects are policy elements that can be referenced by multiple policy objects. A shared object cannot be deployed
by itself; it must be included in another policy type, such as CPL or a WAF Application.
If you use shared objects in your VPM policy and install that policy onto an appliance, the policy will not function prop-
erly if you later edit the policy locally (on the appliance) and save it. Explicit ${include} and substitution variables can
result in invalid syntax errors. URL lists, category lists, IP address lists, etc., result in empty objects.
Users are warned if they attempt to delete a shared object currently assigned to a policy object. The error message
lists all policies to which the shared object is assigned. When presented with the message, the user must confirm
the deletion by selecting I understand that once I choose to delete the Object above, this action cannot be
undone.
Create CPL Fragments
CPL policy fragments are reusable building blocks of CPL policy. Because fragments are not complete CPL policy, you do
not deploy them to devices but include them within policy that you deploy to devices.
"Create a CPL Policy Fragment" on page 278
276
"Include a Policy Fragment" on page 279
Create a Category List
A category list is a named set of URL categories that can be easily referenced in policy, allowing you to assign an allow or
deny condition to all the categories in one simple rule, or reuse the list in multiple policy rules.
"Create Category Lists" on page 292
"Category List Example" on page 295
Create a Category List Template
A category list template provides a starting point for defining which categories to include in a category list. The template
contains a subset of the complete list of WebPulse categories, typically used to restrict the categories a less-priviledged
user can select when creating a category list.
"Use Category List Templates" on page 302
Create a URL List
URL lists allow you to easily create URL exceptions to your policy. The URL list can be easily included in your existing
policy.
"Create URL List (URL Policy Exceptions)" on page 284
"URL List Example" on page 287
Create WAF Security Profile
A WAF Security Profile is a shared object that defines the Web Application Firewall settings for the associated WAF
application object. The WAF Security Profile is assigned to one or more WAF applications that can be installed on
ProxySG appliances to set WAF policy.
"Configure WAF Security Rules " on page 139
Creating a WAF Security Profile is step 3 in "Use WAF Policy To Protect Servers From Attacks" on page 128.
277
Create a CPL Policy Fragment
CPL fragments are shared objects. Like other shared objects, Policy fragments are reusable building blocks of CPL policy.
Because fragments are not complete CPL policy, you do not deploy them to devices but include them within policy that you
deploy to devices. Create a CPL Policy Fragment in the same way that you create CPL Policy.
2. Click Add Object. The web console displays the Create New Shared Object wizard. Fill in required fields. An
asterisk denotes fields that are mandatory.
n Object name (*) - Required name
n Object type (*) - From the drop-down list, choose CPL Fragment.
n Reference ID (*) - Enter a Reference ID that you can filter on when building policy.
n Description - Enter a meaningful description to help you when reusing this fragment.
n Replace substitution variables - select this if you want to replace specific values within the policy fragment.
See "Use Substitution Variables in Policies and Scripts" on page 194.
If Replace substitution variables is NOT selected when creating a CPL Policy, the CPL Policy
278
Fragments will not be included in the CPL.
4. Click Finish. The fragment displays in the Policy Objects list.
5. To add the fragment to policy, see Include a Policy Fragment.
Include a Policy Fragment
Use the CPL or VPM to reference policy fragments (such as URL lists, categories, category lists, and CPL fragments).
Because fragments are not complete CPL policy configurations, you cannot associate or install fragments to any device.
They must be included in a policy.
CPL Policy Fragments
Include a CPL fragment, URL list, or category list as a building block of CPL Policy.
2. In the Policy Objects list, select the CPL policy to which you want to add policy fragment. The policy is displayed
in the Editor.
3. Click the Info tab.
4. Ensure Replace substitution variables is selected.
279
If you do NOT enable variable substitution in the CPL, the CPL Fragments will not be included.
5. Place the text cursor into the policy section where you want to include the policy fragment and select Insert Include.
You can only a include a fragment into an existing policy section. The web console displays the Select Policies
dialog.
If you have not placed your cursor where you want to insert the policy fragment, Management Center displays the fol-
lowing error:
6. From the available policy fragments, select the CPL fragment, URL list, or category list to include.
7. Click OK. The included policy fragment is displayed in the section where you placed your cursor. You can continue
editing the CPL policy.
280
8. To commit your changes, click Save and enter a comment for the commit operation. The comment you enter is
saved as policy metadata.
9. (Optional) To exit without saving your edits, click Cancel.
10. (Optional) Click Compare to see the differences between the existing policy version and the version you are about
to commit.
For more information about adding or editing CPL Policy sections, see "Add or Edit CPL Policy Sections" on
page 183.
VPM Shared Objects
Reference categories, category lists, and URL lists in a VPM policy. Categories added from Management Center are lis-
ted in under a custom Management Center provider. To view these click Configuration > Edit Categories... in the
VPM. Management Center categories can be selected in any VPM object that lists categories, such as Request URL Cat-
egory.
You cannot use this procedure to add CPL fragments. To add a CPL fragment, insert an include statement with the frag-
ment's reference ID into the VPM CPL layer. For example, ${include:whitelist}.
If you use shared objects in your VPM policy and install that policy onto an appliance, the policy will not function
properly if you later edit the policy locally (on the appliance) and save it. Explicit ${include} and substitution vari-
ables can result in invalid syntax errors. URL lists, category lists, IP address lists, etc., result in empty objects.
2. From the Policy Objects list, select the desired VPM policy.
3. Click the Included Objects tab.
281
4. Any lists already included in the policy show on the Included Objects list. You may only reference shared objects if
they are associated with the policy. To add available lists:
a. Click Add Object.
b. Select the additional lists to add to the policy, then click OK.
You can search for lists using the Keyword Search.
5. Make note of the reference ID for the object(s) you want to set.
6. (Optional) If you want to limit the lists to specific revisions in order to avoid unintentional changes, you can lock the
revision version.
a. Select an object.
b. Click Select Version.
c. Select Use specific version.
d. Select the version number from the menu.
e. Click Save.
7. (Optional) Select any lists to remove and click Delete.
If any of the lists are in use, you need to launch the VPM Editor to remove or change the rules that reference
them in the policy.
8. Once finished editing the available shared objects for the policy, click Save.
9. Click Launch VPM Editor.
10. Select or create the desired policy layer.
11. On the desired line number, right click the field under Destination and select Set from the menu.
12. Select the desired list:
282
l By the reference ID from the objects list.
l For a category, select any VPM object that lists categories. In this example, a new Request
URL Category object is selected.
283
Shared objects are read-only. You cannot use the Edit option when setting the destination object. If
you do try to edit it, it gets overwritten it the next time you open the VPM editor.
13. (Optional) Set the desired action condition by right-clicking under the Action field.
14. When finished setting the destination and conditions, click Save policy. (Optional) To exit the VPM Editor without
saving changes, close the VPM Editor and then click Do not Save Policy.
15. Enter a brief description of the policy changes in the Save Changes field, click OK, then click Close.
16. Close the VPM Editor.
17. Back in Management Center, on the VPM policy, click the Info tab.
18. Select Replace substitution variables, then click Save.
For more information about adding or editing VPM Shared Objects, see Create Shared Objects.
"Filter by Attributes and Keyword Search" on page 164
l "Edit a Policy Section" on page 184
l "Add or Edit CPL Policy Sections" on page 183
l "View Existing Policy Information" on page 259
Create URL List (URL Policy Exceptions)
URL lists allow you to easily create URL lists for use in policy. These lists can then be included in your existing policy for
ProxySG or SSL Visibility appliances. An example implementation is described here.
URL lists are shared objects. Because URL lists are not complete policy, you do not deploy them to devices but include
them within policy that you deploy to devices.
URL lists include policy triggers that you may want to disable to improve performance.
Step 1 - Create the URL List Object
b. Object type (*) - From the drop-down list, choose URL List.
284
d. Description - Enter a meaningful description to help you when reusing this fragment.
5. Click Finish. The URL list displays in the editor.
Step 2 - Add URLs
2. Select or edit the desired URL list. The system displays the URL list editor.
3. Enter the URL in the URL field and click Add.
285
4. Alternatively, paste in multiple URLs:
a. Create a URL list and copy the URLs.
b. Click Paste URLs. The system opens the Paste URLs: Enter URLs dialog.
c. Copy the URLs into the Paste URLs: Enter URLs dialog. Press CTRL+V or right-click and click Paste. The
URLs are added to the list.
d. Click Next. The system opens the Paste URLs: Validate dialog.
e. Click Finish.
5. Click Save.
Enabling and Disabling URLs
You can disable an individual URL by selecting it and clicking Disable.
You can enable a URL by selecting it and clicking Enable.
Step 3 - Include the URL List in Policy
When you have completed your changes, you can include the URL list in CPL, as described in "Include a Policy Fragment"
on page 279. The URL list will be included in the CPL as a named condition that can then be referenced using
condition=referenceId. See the example below for details.
286
Whitelist Scenario Example
URL List Example
In this example, the administrator has created a simple acceptable use policy and would like to allow some URLs that
would otherwise be blocked.
This CPL is stored in a policy object called ASUP. The ASUP policy object has Replace substitution variables enabled.
Though the URL filtering blocks all news sites, she would like to allow cnn.com, yahoo.com, and nytimes.com. To allow
these sites, the administrator does the following.
Step One - Create the URL List Object
1. Selects Configuration > Shared Objects.
2. Clicks Add Object. The web console displays the Create New Shared Object wizard.
3. Enters the following data:
a. Object name: whitelist
b. Object type: URL List
c. Reference ID: autofill
d. Description: List of allowed URLs
4. Clicks Next.
5. Clicks Finish.
Step Two - Add Allowed URLs
1. In the whitelist policy editor, the administrator enters cnn.com in the URL field and clicks Add.
2. Adds yahoo.com and nytimes.com, as described in the preceding step.
287
3. Clicks Save and enters a brief description of the change. The whitelist object now looks like this.
Step Three - Add the URL List to the ASUP Policy
1. Selects Configuration > Policy > ASUP. The ASUP policy opens in the editor. Remember that the administrator
has previously enabled Replace substitution variables.
2. Clicks Insert Include.
3. In the Insert Policy Include window, selects whitelist and clicks OK.
The ASUP CPL now looks like this:
When the administrator previews the policy, it looks like this:
288
The name of the condition corresponds to the shared object's reference ID, not its name. You can preview
the policy by going to the Targets tab, adding a target, selecting the target, and clicking Preview.
Though the URLs have been defined, they have not been added as a rule.
4. To create the rule, the administrator adds the following rule to the CPL to implement the whitelist:
condition=whitelist ALLOW
See example below.
5. Clicks Save.
The ASUP CPL is now ready to be pushed to target devices.
289
Manage URL and Category List Triggers
The policy rules that are created when you generate CPL for a URL or category list consist of a subcondition and a trigger.
A condition (or subcondition) is a boolean combination of trigger expressions. Triggers are individual tests that can be
made against components of the request. With a few notable exceptions, triggers test one aspect of request,
response, or associated state against a boolean expression of values. For more information about CPL conditions
and triggers, refer to the Content Policy Language Reference.
When you create a URL or category list, Management Center includes subconditions and associated triggers optimized for
the type of URL or category entered. These triggers are enabled by default but you have the option to disable some of them.
You might want to disable a trigger to improve performance for long lists, for example.
URL List Triggers
The included URL list subconditions and triggers are described in the following table.
Subcondition Associated Trigger Example

list_name/url.domains url.domain example.com/us
example.com
All URLs that have been entered are included in this subcondition.
198.51.100.10
You cannot disable this subcondition.
list_name/certificate_ server.certificate.hostname example.com
hostnames
URLs that do not specify a path are included in this subcondition. The
associated trigger examines the SSL certificate to detect the host that
is being visited.
Server.certificate.hostname is used to match policy against
HTTPS URLs, where the ProxySG can only see the SSL certificate
presented by the OCS. Transparent proxy deployments that don't use
SSL interception will need this to match policy against this URL list.
Without it, the ProxySG will never be able to match requests against
the standard url.domains subcondition, as the ProxySG only sees
the OCS IP address and certificate; not the hostname in the client's
request.
You can disable this subcondition.
list_name/addresses url.address 198.51.100.10
All IP addresses that have been entered are included in this sub-
condition.
url.address allows the ProxySG to compare an IP-address-based
URL list entry to the server's IPv4 address.
You can disable this subcondition.
Category List Triggers
The included category list subconditions and triggers are described in the following table.
290
Subcondition Associated Trigger Example

list_name/cat- category category='Adult/Mature Content'
egory
Matches the content categories using the
requested URL.
list_ server.certificate.hostname.category server.certificate.hostname.category='Adult/Mature
name/cert_ Content'
category Matches the category using the hostname in
the server certificate. This applies only to
SSL connections; the associated trigger
examines the SSL certificate to detect the
category associated with the hostname that
is being visited.
Disable URL or Category List Triggers
1. Select Configuration > Policy > Shared Objects and edit the URL or category list.
2. Click the gear icon to open the Advanced Settings dialog.
3. Disable the desired triggers and click Save.
291
Work with Categories
Refer to the following topics:
l "Create Category Lists" below
l "Category List Example" on page 295
l "Use Category List Templates" on page 302
l "Create Custom Categories " on page 305
l "Custom Category Example" on page 308
Create Category Lists
A category list is a named set of URL categories that can be easily referenced in policy, allowing you to assign an allow or
deny condition to all the categories in one simple rule, or reuse the list in multiple policy rules. Category lists are shared
objects, and are similar to URL lists.
Go to sitereview.bluecoat.com and click Descriptions to see a list of current categories recognized by Symantec
WebPulse. Note that the list of categories in Management Center may not exactly match the list on the website, but
will be updated in a future Management Center release as necessary. For more information about content filtering by
category, refer to the SGOS Administration Guide.
Category lists include policy triggers that you may want to disable to improve performance.
292
Step 1 - Create the Category List Shared Object
n Object type (*) - From the drop-down list, choose Category List.
n Reference ID (*) - Enter a Reference ID (or accept the default name) will be used when building policy. The
ID can be specified as the condition name in CPL.
n Template — If you (or someone else) has previously created a category list template, click and select
the template. The template will restrict what categories can be defined in the list. See "Use Category List
Templates" on page 302 for more information.
n Description - Enter a meaningful description to help you identify this category list when including in policy.
4. Click Next. The Create New Shared Object wizard displays the Attributes dialog. If you defined any policy
attributes, you can choose the attribute's value for this category list. See "Add Attributes" on page 366.
293
5. Click Finish. A tree of categories displays in the Editor tab. Note that the categories are grouped into folders
(Business Related, Legal Liability, Non-Productive, and so forth) for organizational purposes—these folder names are
not part of the policy.
If you selected a template, you may not see all folders and categories.
Step 2 - Select Categories
After you have created the category list object, you can select the categories associated with the list. The list should include
all categories that you want to treat the same way in policy. For example, the categories in the list should all be ones that
you would want to deny access to or allow access to; the actual policy action (deny/allow) will be defined in the policy.
1. The tree of category folders should be displayed in the Editor. If the list isn't currently displayed, select
Configuration > Shared Objects and click the defined list name to bring it up in the Editor.
2. Select the categories you want to include in your list. Follow these general guidelines:
n To see what categories are in a folder, click the + to expand.
n Selecting a folder's checkbox selects all categories in that folder.
n You can unselect any category within a selected folder by clicking its check box.
n When a folder is expanded to display its categories, Management Center displays the category descriptions
294
and examples as well.
3. To view the category names assigned to this list, look at the Selected Categories panel at the bottom of the
window.
4. Click Save and enter a brief description of the change.
Step 3 - Include the Category List in Policy
When you have defined the category list, you can include the object in CPL, as described in "Include a Policy Fragment"
on page 279. In addition, you must create an allow/deny condition using condition=referenceId. See the "Category List
Example" below for details.
If you want to check into which category Symantec WebPulse categorizes a URL, go to sitereview.bluecoat.com
and enter the URL.
Category List Example
In this example, the administrator has created a simple acceptable use policy and would like to deny access to a list of
295
categories that should not be allowed on the corporate network.
Step One - Create the Category List Object
3. Enter the following data:
a. Object name: blacklisted_categories
b. Object type: Category List
c. Reference ID: blacklisted_categories
d. Template: (leave blank)
e. Description: a list of categories that should be denied in policy
4. Click Next.
5. Click Finish.
Step Two - Select Categories that Should be Denied
The administrator would like to deny access to all legal liability categories and security threats, so she will select all the cat-
egories in the Legal Liability folder and Security Threats subfolder.
1. With a tree of available categories displayed in the Editor, click the Legal Liability check box. The Adult Related and
Liability Concerns folders are also checked.
2. Click the + next to the Adult Related and Liability Concerns folders to display the category names, descriptions, and
examples in these folders.
296
3. Expand the Security Threats folder to display the category names, descriptions, and examples in this folder.
4. Click the Security Threats check box to select all of its categories.
297
Step Three - Add the Category List to the ASUP Policy
1. Select Configuration > Policy > ASUP. The ASUP policy opens in the editor. Remember that the administrator has
previously enabled Replace substitution variables.
2. Place the text cursor into the policy section where you want to include the category list and click Insert Include.
298
3. In the Insert Policy Include window, select blacklisted_categories and click OK.
The inserted CPL now looks like this:
Though the category list has been defined, the condition still needs to be defined to deny access.
4. To create the condition to deny access to the category list named blacklisted_categories, the administrator adds
the following line to the CPL:
condition=blacklisted_categories DENY
299
5. Click Save.
6. To preview the code that is generated for this policy, go to the Targets tab, select a device, and click Preview.
300
You can see in the preview that two conditions are created. The first condition (blacklisted_categories/url_category)
just looks up the URL in WebPulse to find the category. The second condition (blacklisted_categories/cert_
301
category) is used for SSL connections—it can sometimes glean extra information by looking up the host name in the
SSL certificate.
The ASUP CPL can be pushed to target devices at the appropriate time.
Use Category List Templates
A category list template provides a starting point for defining which categories to include in a category list. The template con-
tains a subset of the complete list of WebPulse categories, typically used to restrict the categories a less-priviledged user
can select when creating a category list. For example, if you have a user with restricted permissions, you may not want him
to control policy for any category—just particular ones that are appropriate for his role.
Create a Category Template
n Object type (*) - From the drop-down list, choose Category List Template.
302
n Reference ID - Enter a Reference ID (or accept the default name).
n Description - Enter a meaningful description to help you when applying this category list template.
as mandatory, you can choose the attribute's value for this category list. See "Add Attributes" on page 366.
5. Click Finish. A tree of categories is displayed.
6. Select the categories you want to include in the template. Follow these general guidelines:
n To see what categories are in a folder, click the + to expand.
n Selecting a folder's check box selects all categories in that folder.
n You can unselect any category within a selected folder by clicking its check box.
n When a folder is expanded to display its categories, Management Center displays the category descriptions
and examples as well.
Example

7. To view the category names assigned to this template, look at the Selected Categories panel at the bottom of the
screen.
Use a Category List Template
To use the category list template, select it when creating a category list. The user can only select categories from this
303
restricted list.
n Object type (*) - From the drop-down list, choose Category List.
n Reference ID (*) - Enter a Reference ID (or accept the default name) that you can use when building policy.
The ID can be specified as the condition name in CPL.
n Template — Click and select the template. The template will restrict what categories can be defined in
the list.
n Description - Enter a meaningful description to help you when reusing this category list.
mandatory, you can choose the attribute's value for this category list. See "Add Attributes" on page 366.
5. Click Finish. The Editor displays just the categories in the template, and the user can create a category list by
choosing from the categories in the template.
304
6. Select the categories you want to include in the list.
7. To view the category names assigned to this list, look at the Selected Categories panel at the bottom of the
window.
This category list can now be used in policy. See "Include a Policy Fragment" on page 279.
To apply a category list template to an existing category list, edit the category list, go to the Info tab, select the tem-
plate, and then save the list.
When the CPL for a category list is generated and the list contains categories not present in the template (most
likely because the template had been changed since last saving the list), those categories are not included in the
condition definition CPL. If this occurs, a warning is included as a comment above the condition CPL, indicating
which categories were removed.
Create Custom Categories
The category shared object allows you to easily create custom categories for use in policy. These categories can then be
included in your existing policy for ProxySG appliances. An example implementation is described here.
Although a category object appears similar to a URL list, the category object generates a define category instruction
in policy instead of a condition and subcondition definition. For example, if you create a category called blacklist and add
example.com to it, the generated policy will look like this:
; Generated by Management Center from Category: Complex Category
define category blacklist
http://example.com/
end
305
As shown above, all custom categories created in Management Center are preceded by a comment noting the source of the
category. On the ProxySG appliance, these categories are treated as yet another category source, like WebFilter, for
example.
A category differs from a category list, which is a named set of URL categories that can be easily referenced in
policy.
Step 1 - Create the Custom Category
b. Object type (*) - From the drop-down list, choose Category.
mandatory, you can choose the attribute's value for this policy fragment. See "Add Attributes" on page 366.
5. Click Finish. The new category displays in the editor.
Step 2 - Add URLs
306
2. Select or edit the desired category. The system displays the category editor.
3. Enter the URL in the URL field and click Add.
4. Alternatively, paste in multiple URLs:
a. Create a category and copy the URLs.
b. Click Paste URLs.
The system opens the Paste URLs: Enter URLs dialog.
c. Copy the URLs into the Paste URLs: Enter URLs dialog. Press CTRL+V or right-click and click Paste. The
URLs are added to the list.
307
d. Click Next. The system opens the Paste URLs: Validate dialog.
e. Click Finish.
5. Click Save.
Enabling and Disabling URLs
You can disable an individual URL by selecting it and clicking Disable.
You can enable a URL by selecting it and clicking Enable.
Step 3 - Include the Category in Policy
When you have completed your changes, you can include the category in CPL or in the VPM, as described in "Include a
Policy Fragment" on page 279. The category will be included in the CPL as a category definition that you will then reference
in a proxy layer. See the example below for details.
News Whitelist Scenario Example
Custom Category Example
In this example, the administrator has created a simple acceptable use policy and would like to add a new whitelist category
for news.
308
Though the URL filtering blocks all news sites, she would like to allow cnn.com, yahoo.com, and nytimes.com. To allow
these sites, the administrator does the following.
Step One - Create the Category Object
1. Selects Configuration > Shared Objects.
2. Clicks Add Object. The web console displays the Create New Shared Object wizard.
3. Enters the following data:
a. Object name: News Whitelist
b. Object type: Category
c. Reference ID: autofill
d. Description: List of allowed URLs
4. Clicks Next.
5. Clicks Finish.
Step Two - Add URLs
1. In the News Whitelist policy editor, the administrator enters cnn.com in the URL field and clicks Add.
2. Adds yahoo.com and nytimes.com, as described in the preceding step.
3. Clicks Save and enters a brief description of the change. The News Whitelist object now looks like this.
309
Step Three - Add the Category to the ASUP Policy
1. Selects Configuration > Policy > ASUP. The ASUP policy opens in the editor. Remember that the administrator
has previously enabled Replace substitution variables.
2. Clicks Insert Include.
3. In the Insert Policy Include window, selects News Whitelist and clicks OK.
The ASUP CPL now looks like this:
4. To create the rule, the administrator adds the following rule to the Web Filter layer in CPL to implement the News
Whitelist:
category=News_Whitelist ALLOW
See example below.
The name of the category corresponds to the shared object's reference ID, not its name. You can preview the
policy by going to the Targets tab, adding a target, selecting the target, and clicking Preview.
5. Clicks Save.
The ASUP CPL is now ready to be pushed to target devices.
310
Permissions Reference
When defining users, groups, roles and grant permissions, refer to the following for important information.
"Reference: Permissions Interdependencies" on the next page
"Reference: Permissions Filters Object and Attributes" on page 321
"Reference: Understanding Job Permissions" on page 324
311
Reference: Permissions Interdependencies
When adding permissions to roles, remember that users can access an object as long as they have a role with the required
permission. For example, if a user is added to a role which allows access to only one device group and a role that has View
permissions for all devices, the user can see all devices in all groups.
Refer to the following permission objects to determine specific dependencies.
The View permission is implied in all higher permission levels except for Add. To reduce the number of permissions
in a role, you can remove the View permission if a higher-level permission for the same object exists in the role. For
example, if a role already has the Policy - Update permission for importing policy, you do not have to add the Policy
- View permission for adding policy jobs.
All objects
Permission action Allows access to these areas/functions Requires these permissions to
be useful
All operations Perform all functions in all areas of the web console None
View View all areas of the web console None
Attribute Definition
Permission action Allows access to these areas/functions Requires these permissions to
be useful
All operations Add, delete, and edit attributes None
Add Add attributes Attribute Definition - View
Delete Delete attributes None
Update Edit attributes None
View View attributes None
Audit
Permission action Allows access to these areas/functions Requires these per-
missions to be useful
All operations Perform all audit log functions None
View Read-only access to audit log records None
Backup Image
Permission action Allows access to these areas/functions Requires these permissions to be useful
All operations Import, export, delete, and restore image Management Center - View
backups
Management Center - Update
312
Permission action Allows access to these areas/functions Requires these permissions to be useful

Delete Delete backups
Export Export backups
Import Import backups
Update Restore backups Management Center - View
Management Center - Update
View View information about existing backups
View Contents View the backup contents
Device
When using filters with a specified value, make sure that the value exactly matches the value in the
device properties. See "Set User-Defined Device Attributes for Access Control" on page 370 and
"Reference: Permissions Filters Object and Attributes" on page 321.
Permission Allows access to Requires these per- Grant these permissions for more func-

action these areas/functions missions to be useful tions
All operations All device functions Hierarchy - View To see the effective policy for a device:
Policy - View
To change membership in device properties:
Device Group - Change Membership
To see groups to which the device belongs
(not needed if assigning Change Mem-
bership):
Device Group - View
Add Add devices Hierarchy - View To add devices by importing from a file:
Device Group - Change Device - Add
Membership
Device - Update
Device - View
Backup Back up devices Hierarchy - View
Device Group - View
Backup Image - Update
Delete Delete devices Hierarchy - View
Manage Activate and deac- Device Group - View
tivate devices
313
Permission Allows access to Requires these per- Grant these permissions for more func-

action these areas/functions missions to be useful tions
Restore Restore configuration Hierarchy - View
backups to devices
Device Group - View
Backup Image - Update
Update Edit device basic Hierarchy - View To change membership in device properties:
information, con-
Device Group - View Device Group - Change Membership
nection parameters,
and attributes To add devices by importing from a file:
Device - Add
Device - Update
View View device inform- Hierarchy - View
ation
Device Group - View
Device Group
When using filters with a specified value, make sure that the value exactly matches the value in the device group
properties. See "Set User-Defined Device Attributes for Access Control" on page 370 and "Reference: Permissions
Filters Object and Attributes" on page 321.
Permission action Allows access to these areas/- Requires these per- Grant these per-

functions missions to be use- missions for more
ful functions
All operations Perform all device group functions Hierarchy - View To see the devices in
groups:
Device - View
Add Add device groups Hierarchy - View To associate devices
while adding a group:
Device Group - Change
Membership Device - View
To add device groups or
hierarchies by importing
from a file:
Device Group - Add
Device Group - Update
Change Mem- Change associated groups in device Hierarchy - View
bership properties
Device - Update
314
Permission action Allows access to these areas/- Requires these per- Grant these per-

functions missions to be use- missions for more
ful functions
Delete Delete device groups Hierarchy - View
Device - View
Update Edit device groups' basic information and Hierarchy - View To add device groups or
attributes hierarchies by importing
from a file:
Device Group - Add
View Read-only access to device groups Hierarchy - View
Device Script
Permission action Allows access to these areas/functions Requires these permissions

to be useful
All operations All functions related to script None
Add Add script objects Device - View
Delete Delete script objects None
Edit Metadata Edit script object attributes and information None
Update Edit and execute script content Device - View
Device - Manage
View View script None
Note: "Compare Versions of the Script" on page 157 is
available at this level.
Hierarchy
Permission action Allows access to Requires these per- Grant these permissions for ancil-

these areas/functions missions to be useful lary functions
All operations Add, delete, and edit Device Group - All oper-
hierarchies ations
Add Add hierarchies Hierarchy - View To add device groups or hierarchies by
importing from a file:
Device Group - All oper-
ations Device Group - Add
315
Permission action Allows access to Requires these per- Grant these permissions for ancil-

these areas/functions missions to be useful lary functions
Delete Delete hierarchies Device Group - Delete
(except for the pre-
defined hierarchies)
Update Edit hierarchies Device Group - Update To add device groups or hierarchies by
importing from a file:
Device Group - Add
View View hierarchies Device Group - View To see devices:
Device - View
Management Center
to be useful
All operations Perform all Management Center functions. None
Backup Perform Management Center backup and restore. None
Policy
Permission action Allows access to these Requires these permissions to Grant these permissions

areas/functions be useful for more functions
All operations All functions related to None
policy
Add Add policy objects Policy - View To assign targets while adding
a policy object:
Policy - Assign Target
Device - View
Assign Targets Add and remove target Device - View
devices
CPL - Add Sec- Add policy sections to exist- None To add policy sections while
tion ing policy objects adding a new policy object:
Policy - Add
316
Permission action Allows access to these Requires these permissions to Grant these permissions

areas/functions be useful for more functions
CPL - Delete Sec- Delete policy sections None
tion

CPL - Edit Default Edit the default sub-section
* CPL - Edit Override - Consider
in policy sections granting this permission to senior
CPL - Edit Man- Edit the mandatory sub- roles only. Granting this permission
datory section in policy sections allows users to edit the Override
sub-section in all policy sections,
CPL - Edit Over- Edit the override sub-sec- which could have unintended res-
ride* tion in policy sections ults.
CPL - Move Sec- Move policy sections within None
tion policy objects
CPL - Update Edit the name and purpose None
Section of sections
Delete Delete policy objects None
Edit Contents Restore previous versions of None To select a reference device:
policy and edit policy
Device - View
Edit Metadata Edit policy object attributes None
and information
Import Import policy from devices Device - View
Policy - Update
Note: Because Management Center
imports policy as one section, it
might be useful to grant some policy
section permissions in some cases
(for example, to allow users to break
down the imported policy into sec-
tions and sub-sections).
Publish Install policy on target None To add/remove target devices
devices to policy before installing:

Device - View
Device - Manage
Policy - Assign Targets
View View policy None
Note: Edit > Check Con-
sistency is available at this
level.
Report
317
Permission Allows access to these areas/- Requires these Grant these permissions for

action functions permissions to more functions
be useful
All operations Perform all Appliance Monitoring None To filter reports and report widgets by
reports and functions device or device group:
Device Group - View
View Read-only access to reports
Device - View
Role
to be useful
All operations All role functions None
Add Users can add roles Role - View
Delete Users can delete roles None
Update Users can update roles None
View Read-only access to roles None
Scheduled Job
Job permissions are distinct from the operational permissions. If you have unexpected results or 'access denied'
errors when running jobs, see "Reference: Understanding Job Permissions" on page 324.
Permission Allows access to these areas/- Requires these permissions to Grant these per-

action functions be useful missions for
more functions
All operations Add, edit, delete, enable, disable, and None
run jobs; view job progress, current

jobs, and job history
Add Add jobs Scheduled Job - View
Caution: Scheduled Job - Add is an Device - View
elevated permission. See
(For policy jobs) Policy - View
"Reference: Understanding Job Per-
Cancel Running Cancel all active, running jobs Scheduled Job - View
Job
Device - View
(For policy jobs) Policy - View
Delete Delete jobs None
Run Manually Run jobs manually using the Run None
Now option
318
Permission Allows access to these areas/- Requires these permissions to Grant these per-

action functions be useful missions for
more functions
Update Edit jobs' information and schedule; None To view devices
enable/disable jobs and add/remove tar-
gets:
Caution: Scheduled Job - Update is an
elevated permission. See Device - View
"Reference: Understanding Job Per-
To add/remove
policies from a job:
Policy- View
View View all scheduled and current jobs and None
job history
Note: All users can see the Jobs tab in
the web console, even if they do not
have a Scheduled Job - View per-
mission.
Session
Session permissions are specifically to control access to user sessions.
Permission action Allows access to these areas/functions Requires these

permissions to be
useful
All operations View, kill, disable logins None
View View active sessions None
Kill Session Kill an active session None
Disable Logins Enable or Disable logins to Management Center None
Settings
Permission action Allows access to these areas/functions Requires these
permissions to be
useful
All operations Perform all settings functions in Administration Settings (Hardware None
Diagnostics is always read-only)
Update Edit Management Center Settings None
View View Management Center Settings, and Hardware Dia- None
gnostics
User
319
Permission action Allows access to these areas/- Requires permissions Grant these per-

functions to be useful missions for more func-
tions
All operations Perform all user functions None
Add Add users and specify basic inform- User - View To assign roles while
ation adding a user
Role - View
Delete Delete users None
Update Update users' basic information and None To add or remove roles
change/expire user passwords from a user:

Role - View
View View users None
User Group
Permission Allows access to these Requires per- Grant these permissions for more func-
action areas/functions missions to be use- tions
ful
All operations Perform all user group func- None
tions
Add Add user groups User Group - View To add or remove group roles while adding a
user group:
Role - View
To add or remove group roles while adding a
user group:
User - View
Delete Delete user groups None
Update Update user groups' basic None To add/remove users from groups:
information
User - View
View View user groups None
320
Reference: Permissions Filters Object and Attributes
Although you are not restricted to the user-defined system attributes of Location and Rack, the following helps to determ-
ine which filters to use for the Device and Device Group permissions.
Set Filters for Device Object
Specify Rack and Location attributes. See "Set User-Defined Device Attributes for Access Control" on page 370 for
information.
Select the Specify the Attributes What a user can access

Attributes type
Attribute has Attribute: Select Rack. Devices specified with this rack in device properties

specific value under Attributes > User-Defined.
Value: Specify the rack.
Click Save. The Filter field displays "Rack is
'<value>'".
Attribute: Select Location. Devices specified with this location in device prop-
erties under Attributes > User-Defined.
Value: Specify the location.
Click Save. The Filter field displays "Location
is '<value>'".
Attribute has Attribute: Select Rack. Devices specified with any rack specified in device
any value properties under Attributes > User-Defined.
Click Save. The Filter field displays "Rack is
not empty".
Attribute: Select Location. Devices specified with any location in device prop-
erties under Attributes > User-Defined.
is not empty".
Specific Device: Select a device from the drop-down This selected device.
Device list.
Click Save. The Filter field displays "Specified
Device".
Members of Hierarchy: Select a hierarchy. Your selection All devices in the specified group or its sub-groups.
specific group determines the values for device group.
Device Group: Select the device group.
Click Save. The Filter field displays "Members
of specified group".
Set Filters for Device Group Object
Specify Primary Contact and Location attributes. See "Set User-Defined Device Attributes for Access Control" on
321
page 370 for information.
Select the Fil- Specify the Attributes What a user can access

ter type
Attribute has Attribute: Select Primary Contact Groups specified with this primary contact in group

specific value properties under Attributes > User-Defined.
Value: Specify the contact.
Click Save. The Filter field displays "Primary is
'<value>'".
Attribute: Select Location Groups specified with this location in group properties
under Attributes > User-Defined.
Value: Specify the location.
is '<value>'"
Attribute has Attribute: Select Primary Contact Groups specified with any primary contact in group
any value properties under Attributes > User-Defined.
Click Save. The Filter field displays "Primary
Contact is not empty".
Attribute: Select Location Groups specified with any location in group properties
under Attributes > User-Defined.
is not empty".
Specific Device Hierarchy: Select a hierarchy. Your selection The specified device group.
Group determines the values for device group.
Click Save. The Filter field displays "Specified
Device Group".
Members of Hierarchy: Select a hierarchy. Your selection The sub-groups of the specified group (but not the
specific group determines the values for device group. group itself).
Click Save. The Filter field displays "Members
of specified group".
Set Filters for Policy Object
Filter permissions for specific policies. See "Edit Attributes" on page 369.
Select the Filter Specify the Attributes What a user can access

type
Specific Policy Policy: Select a policy. All policy objects that exist in Management The specified policy.

Center are displayed here.
Click Save. The Filter field displays Policy Attributes.
322
Select the Filter Specify the Attributes What a user can access

type
Attribute has spe- Select an attribute. You must create an attribute and associate it with The policy matching the

cific value policy before using this option. attribute details.
Click Save. The Filter field displays Policy Attributes.
For more information about user-defined attributes, see "Manage Attributes" on page 365.
323
Reference: Understanding Job Permissions
A job is distinct from the operation (such as backing up devices and installing policy) that the job executes. When a user cre-
ates a job, he/she defines its operation, targets, and schedule. If a user has permissions to add or update jobs, he or she can
configure and save any job.
Users can run jobs in Management Center in the following ways.
User runs a job immediately after configuring it or manually using Run Now
n The job executes as the user.
n The Audit Log displays the event as a Job Execution and lists the username as the Operating User.
n The job information shows that it was started by the user.
As long as the user has the job permissions, running a job immediately or manually always results in a completed
job. In the previous scenario, if the user has permissions to perform the operation, the job completes without errors; if
the user has insufficient permissions to perform the operation, the job completes with errors.
User configures a job scheduled in the future
n The job executes as the system.
n The Audit Log displays the event as a Job Execution and lists SYSTEM as the Operating User.
n The job information shows that it was started by the system.
Because the job executes as the system, which can perform all operations, users with permissions to schedule jobs can cre-
ate jobs for an operation that they do not have permissions to perform. Allowing more users than necessary to schedule jobs
is thus a potential security risk.
Consider granting the Scheduled Job - Run Now permission to most users who require the ability to run jobs.
Reserve the Scheduled Job - Add and Scheduled Job - Update permissions for the most senior users.
324
Configure Users, Roles, and Attributes
As the Management Center administrator, you can specify the following global settings after you set up Management Center
for the first time or when needed.
"Manage Management Center Users" on the next page
"Define Roles " on page 355
"Filter Devices or Device Groups in a Permission" on page 361
"Manage Attributes" on page 365
"Preview or Download Logs" on page 374
"Customize the Audit Log" on page 504
Manage Management Center Users
The Users tab allows you to manage access Management Center. Before adding users, make sure you have defined roles.
See the following topics for details:
n "Add Local Users" on the next page
n "Edit a Local or Imported User" on page 342
n "Manually Reset a User's Web Console Password" on page 348
n "Expire a User's Web Console Password" on page 348
Add Local Users
Use these setting to provide Management Center access to local users.
Security Considerations
The following items are supported today:
n Management Center logs all access attempts to the audit log and syslog.
n Administrators can manually expire a user’s password and force them to enter a new one.
n Starting with 1.7, Management Center tracks the last access attempt in the user record and displays the record when
viewing the user’s details (Administration > Users).
n Starting with 1.7, Management Center tracks the number of login failures a user has had in a row.
The following items are not supported:
n Management Center does not enforce password strengths.
n Passwords do not expire automatically. You can manually expire them.
n Management Center does not automatically disable accounts if the user does not enter their password correctly after
n attempts.
n Management Center does not track password history.
If the unsupported features are important to you, use an external authentication service like LDAP, Active Directory LDAP,
or RADIUS) instead.
Add Roles First
You can add local users to Management Center at any time, but it is good practice to set up the role structure before you
start adding users. After roles have been added, you can assign users the specific roles that they require to perform their
jobs. It is best practice to assign the most restrictive permissions possible so that users do not have more access than they
need. To import users from Active Directory, LDAP or RADIUS, see Authenticate Users and User Groups using Existing
Directory Service.
When you select an existing user record, user details open in the right pane. In the title bar, under the user name, the
local user account indicates a user that you manually added and the imported user account indicates a user that you
imported using an existing directory service.
To understand more about how permissions and filters work with users and roles in Management Center, see
"Reference: Permissions Filters Object and Attributes" on page 321 and "Reference: Permissions Interdependencies" on
page 312.
Add Users
Before you start adding users, devise the naming convention for usernames. Once a username is saved, it cannot be
changed. This does not apply to imported users—their usernames are set in LDAP, Active Directory, or RADIUS and
are thus read-only.
327
1. Select Administration > Users.
2. Click Add User. The Add User: Basic Info dialog displays. An asterisk denotes fields that are mandatory.
Field Description
Username * Usernames are case-sensitive and cannot be changed.
Note: Although the username/password combination successfully authenticates if the
username has a mixture of cases, Management Center recognizes the users as different
users. For example: A user signs in as “joe” and access is setup using that specific case
for username. Then later the user signs in as “Joe”. The login using “Joe” will have no
access because the account created is for the user “joe”.
Password * Example: admin1234
Verify Password * Example: admin1234
Password expired on: Does not expire
First Name The actual first name that the person uses.
Last Name The actual last name that the person uses.
Email The Email associated with this user and organization. Example [email protected]
Phone The Phone number associated with this user and organization (including extension, if
any)
Mobile The personal mobile or cell number associate with this person.
Description 1024 character description can include anything from what town she resides to average
commute time to security certifications in this user's possession.
3. In the Add User: Basic Info screen, enter the user's information.
4. Click Next. From the Add User: Assign Roles dialog, select a role from Available Roles and add it Assigned
Roles.The default roles are Administrator (with administrator rights) and viewOnly (with only viewing rights). You
must assign a role or the user will be unable to login to Management Center. See "Define Roles " on page 355 or
"Edit an Existing Role" on page 357.
5. Click Finish. The new user displays in the Users list and has access to Management Center based on their defined
role.
328
Add Users from an Existing Directory or Service
As the Management Center administrator, you can add from an existing directory or service.
"Authenticate Users Against LDAP" on the next page
"Authenticate Users Against Active Directory LDAP" on page 333
"Authenticate Users Against RADIUS" on page 335
Authenticate Users Against LDAP
These options configure LDAP or LDAPS (LDAP over SSL) authentication in Management Center.
A secondary failover LDAP server can be configured in case the primary LDAP server cannot authenticate. If the secondary
LDAP server cannot authenticate, authentication can only occur through Active Directory LDAP or RADIUS (if configured).
Prerequisites
If you are configuring LDAPS and the LDAP server SSL key uses a self-signed certificate or a certificate signed by a non-
trusted root certificate authority, you must import that certificate into Management Center. To import the certificate, use the
security ssl import external-certificate command.
Configure General Settings
1. Select Administration > Settings.
2. Click LDAP on the left. The web console displays fields on the right. An asterisk denotes fields that are mandatory.
3. Specify general LDAP settings as described in the following table.
Setting Description Input Value/Format
User must have permission A user must have a role with permissions or be a false | true

member of a group with a role that has
permissions in order to log in.
Role attribute Specify the roles to assign to imported users. Use businessCategory
the same name that exists in LDAP, ensuring that
the spelling and case are identical.
Display name attribute Specify the format of user names. displayName
Configure Primary Server Settings
2. Select LDAP. The web console displays fields on the right. An asterisk denotes fields that are mandatory.
2. Enter the Primary Server Settings described in the following table.
Is the authenticator Enable LDAP authentication. false | true

enabled*
LDAP URL* The URL used to connect to the Specify the LDAP host, port, and root.
LDAP directory server.
Example: ldap://localhost:10389/dc=example,dc=com
LDAPS example
ldaps://ldapserver1:3269/dc=example,dc=com
330
Login user If required, enter the username Specify the username.

used for browsing.
Login password If required, enter the password Specify the password.
used for browsing.
Configure Secondary Server Settings
You can also configure a Secondary LDAP Server to take over in case the Primary Server fails. The settings under Sec-
ondary Server are specific to the Secondary LDAP Server only. The settings under Secondary RADIUS Server are spe-
cific to the secondary server only.
2. Enter the Secondary Server Settings described in the following table.

Is the authenticator Enable LDAP authentication. false | true
enabled*
LDAP URL* The URL used to connect to Specify the LDAP host, port, and root.
the LDAP directory server.
Example: ldap://localhost:10389/dc=example,dc=com
Login user If required, enter the user- Specify the username.
name used for browsing.
Login password If required, enter the pass- Specify the password.
word used for browsing.
Configure Search Settings
2. Configure the LDAP Search Settings described in the following table.
Ignore partial results on search When set to true, ignores any partial results from false|true

LDAP searches. The default is false. When using
this authenticator to connect to Active Directory,
set this option to true.
Base DN for user search* Specify where in the LDAP directory tree to initiate Example: ou=users,
the username search. o=organization
User search* Specify the user search filter. Example: (uid={0})
331
Base DN for group search* Specify where in the LDAP directory tree to initiate Example: ou=groups

the username search.
Attribute to read group name* Specify the group name attribute. Use the same Example: cn
name that exists in LDAP, ensuring that the
spelling and case are identical.
Search sub-tree* Specify whether to search sub-tree. false|true
Finalize Your Changes
After setting your configuration options, you must do one of the following:
1. Reset or commit your changes.
l Click Save to store the settings on the server. If you are unable to save your changes, make sure that all
required settings are specified.
2. Instruct users to log into the web console with their existing username and password. After a user logs in, you can
manage their account in Management Center.
Supported LDAP Servers
Server Types Configuration Interface
Apache DS Apache Directory Studio™ user interface
Novell eDirectory Novell ConsoleOne user interface
Add LDAP Users
After LDAP is configured, have users log in with their LDAP credentials. The first time the user logs in, Management Center
adds them to the system. You cannot -external users at this time.
332
Authenticate Users Against Active Directory LDAP
Set up Active Directory LDAP authentication in Management Center. A secondary failover Active Directory LDAP server
can be configured in case the primary Active Directory LDAP server cannot authenticate. If the secondary Active Dir-
ectory LDAP server cannot authenticate, authentication can only occur through LDAP or RADIUS (if configured).
Prerequisites for enabling Sync the role membership and Sync the group membership:
n To sync role membership, you must define the role in Management Center before users assigned to the role in
Active Directory authenticate.
n To sync group membership, you must define the group in both Management Center and Active Directory. The group
names must match in order to map correctly.
After you define the roles and groups, and when a user authenticates in Management Center, the appropriate roles and/or
group memberships are set up in Management Center.
Specify General Active Directory LDAP settings.
2. Select Active Directory LDAP. The web console displays fields on the right. An asterisk denotes fields that are
mandatory.
2. Enter the General Active Directory LDAP Settings described in the following table..
Sync the role Specify whether to assign users to roles that match the false|true

membership Role Attribute setting. No roles are synchronized if the
Role Attribute is not set.
Sync the group Specify whether to assign users to a user group that false|true
membership matches a group in Active Directory. The spelling and
case must be identical to match.
User must have A user must have a role with permissions or be a member false|true
permission of a group with a role that has permissions in order to log
in.
Role attribute Specify the roles to assign to imported users. Use the Specify the department to
same name that exists in Active Directory, ensuring that which the role is assigned.
the spelling and case are identical.
Display name attribute Specify the format of user names. displayName
Specify Primary Server Settings
mandatory.
2. Enter the Primary Server Settings described in the following table.
333
Is the authenticator Enable AD authentication. false|true

enabled*
LDAP URL* The host URL for LDAP authentication. Example:
ldap://localhost:389
Specify Secondary Server Settings
You can also configure a Secondary Active Directory Server to take over in case the Primary Server fails. The settings
under Secondary Server are specific to the Secondary Server only. The settings under Secondary RADIUS Server are
specific to the secondary server only.
mandatory.
2. Enter the Secondary Server Settings described in the following table.
Is the authenticator Enable AD authentication. false|true

enabled*
LDAP URL* The host URL for LDAP authentication. Example:
ldap://localhost:389
334
Authenticate Users Against RADIUS
Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized Authentication,
Authorization, and Accounting (AAA) management for users who connect and use a network service. Authentication using
a RADIUS server acts much like authenticating against LDAP and runs in the application layer.
Refer to How to Set Up Cisco ACS for Management Center for an example RADIUS implementation.
Prerequisites
Prerequisites for enabling Sync the role membership and Sync the group membership:
n To sync role membership, you must define the role in Management Center before users assigned to the role
authenticate.
n To sync group membership, you must define the group in both Management Center. The group names must match
in order to map correctly.
n Install Symantec's latest dictionary of VSAs for Symantec on the RADIUS server. The latest version of the
dictionary file is available with the Management Center image on BTO.
n Define the Symantec attributes, as in the following example:
o Blue-Coat-Group = "mc_group_1"
o Blue-Coat-Role = "mc_role_1"
where mc_group_1 and mc_role_1 are the names you specify for the group and role, respectively, in
Management Center.
After you define the VSAs, and when a user authenticates in Management Center, the appropriate roles and/or group mem-
berships are applied to the permission set in Management Center.
Set up RADIUS authentication in Management Center.
2. Select RADIUS. The web console displays fields on the right. An asterisk denotes fields that are mandatory.
3. Configure general RADIUS settings.
RADIUS Settings Description Input Value/Format
Is the authenticator Enable RADIUS authentication. false|true

enabled*
Sync the role Specify whether to assign users to roles that match false|true
membership the Blue-Coat-Role VSA.
Sync the group Specify whether to assign users to roles that match false|true
membership the Blue-Coat-Group VSA.
User must have A user must have a role with permissions or be a false|true
permission member of a group with a role that has permissions in
order to log in.
Configure Secondary RADIUS Server
335
Supported RADIUS Servers
Server Types Configuration Interface Example User Credentials and Attributes
Steelbelted Windows XP VM user1/1resu
Note: You must cre- Note: Restart Windows services mcuser1/1resu (FirstName=MC1, LastName=User1)

ate a RADIUS client after making any modifications.
mcuser2/2resu (Role=Role_administrator)
for every device that
accesses the mcuser3/3resu (Group=MCAdministrator)
RADIUS server.
mcuser4/4resu (No vendor-specific attributes defined)
Important: The group and role attribute values should match the
Blue-Coat-Group and Blue-Coat-Role VSAs, respect-
ively.
Safeword Windows XP VM user1/password shown on token
user2/2resu (fixed password)
RSA Web - Use Internet Explorer 11 Configure users with a hardware or software token.
Linux VM
Authenticate Users with SSL Mutual Authentication
In mutual SSL authentication, an SSL connection between a client and a server is established only if the client and server
validate each other’s identity during the SSL handshake. The server and the client must each have their own valid X.509 cer-
tificate and the associated private key in order to perform SSL mutual authentication.
Certificates and private keys can be stored in multiple locations. On the client, one such location is a Common Access Card
(CAC). However, a CAC card or reader is not required for SSL mutual authentication, you can install the certificates on your
browser and into Management Center's truststore.
The following example describes an SSL mutual authentication transaction.
336
1. The user requests access to the Management Console.
2. Management Center presents its certificate to the browser.
3. The browser validates Management Center's certificate. This includes the following checks:
n The certificate subject must match the appliance’s hostname.
n The certificate must be issued by a CA listed in the browser’s Trusted Root Certificate store.
4. The browser confirms that the appliance has the certificate's private key by challenging the appliance to sign
random data. The browser validates the signature using the appliance's certificate.
5. If appliance authentication succeeds, the browser accesses the client certificate and private key using the installed
certificate or CAC. It then presents the certificate to the appliance.
6. The appliance validates the certificate that the browser presents. This includes the following checks:
n The certificate must be issued by a CA included in Management Center's truststore.
n The appliance confirms that the browser has the certificate's private key by challenging the browser to sign
random data. The appliance validates the signature using the browser’s certificate.
n The certificate must have a valid signature and not be expired.
7. If authentication succeeds, the appliance grants access to Management Center.
8. (If applicable) The appliance presents a Notice and Consent banner. The user provides consent.
Prerequisites
Before using SSL mutual authentication, you must meet the following prerequisites:
n The browser must have an X.509 certificate installed that will pass Management Center's trust validation. That is, if
the client is using its own Root Certificate Authority (CA) or a different CA, that CA must first be installed into
Management Center's truststore.
n The appliance certificate must be from a CA listed in the browser’s Trusted Root Certificate store. Install any
missing client certificates or custom root CA certificate into the browser. For browser installing instructions, refer to
http://wiki.cacert.org/FAQ/BrowserClients and select your browser of choice.
Set up SSL Mutual Authentication
337
1. Import the root CA certificate(s) and any intermediate certificate(s) required to validate the client certificates into
Management Center's truststore.
# security ssl import external-certificate <name> <URL>
# security ssl import server-certificate <URL>
2. Verify installation with the appropriate command:
# security ssl list external-certificate all
# security ssl list external-certificates system
# security ssl list external-certificates user
# security ssl list server-certificates
# #security ssl view external-certificate <name>
See "# security" on page 546 for more information on the certificate viewing commands.
3. Determine the client authentication method, mandatory or optional; client authentication is off by default.
4. Issue one of the following commands:
# security ssl client-authentication set-mandatory
# security ssl client-authentication set-optional
See "# security" on page 546 for more information on the client-authentication commands.
The flowchart below depicts the prerequisites, setup, and authentication process for mandatory and optional SSL
mutual authentication.
338
Note
l When SSL mutual authentication is enabled, all devices using Management Center as the host require
X.509 certificates. For example, to access file services and API's in a mandatory setting, a certificate is
required.
l Browsers retain the certificate used. If you have more than one X. 509 certificate installed and you want to
use a different certificate, you must close and reopen your browser to change certificates.
Allow Users to Bypass Password if Certificate is Valid
Starting with 1.9.1.1, you can use the following CLI commands to configure Management Center to trust X.509 certificates
so users do not have to enter their passwords after successful authentication:
# security ssl client-authentication password-requirement disable
# security ssl client-authentication set-regex
339
When the password requirement is disabled, a user does not have to enter a password to access Management Center if the
system determines the certificate is valid, and finds the user in the local user database or LDAP system, if configured. The
user is then automatically logged in with the permissions defined for that user in Management Center.
To validate certificates, you must create a regular expression to evaluate the information in the certificate's SubjAltName
field.The subjectAltName data is compared to a regex set by the security ssl client-authentication set-
regex command, which is used to extract the portion of the value to use as the user's identity. That value is then used to
find the user in the local or LDAP authentication service. Refer to "Use Certificate Subject Alternative Name Data for Cer-
tificate Validation" below and "# security" on page 546 for more information.
This method only supports the local or LDAP authentication schemes. You can use active directory but only if you
set it up using the LDAP settings (Administration > Settings > LDAP). This is because a service account is needed
to look up users because the system no longer has the user password.
HTTP Strict Transport Security (HSTS)
Starting with Management Center 1.7.1, HSTS support is included to make web browsers interact with the servers using
using HTTPS connections. To enable HSTS:
1. Have a DNS name (domain) for your Management Center appliance.
2. Purchase a HTTPS certificate from a trusted CA (using the DNS above) and have it installed.
3. Be able to access Management Center using HTTPS without any warnings or errors. In Chrome, you need to have a
green lock icon, showing the certificate is valid.
4. To enable the HSTS, use the CLI Command # security ssl hsts enable, or to disable, use # security
ssl hsts disable
With the HSTS activated, any attempted access using HTTP port 8080 gets an error instead of being rerouted to
HTTPS port 8082. If you deactivate it, the domain must be removed from the HSTS in each browser. See How to
Clear HSTS Settings in Major Browsers for more information.
If you change the SSL certificate, statistics monitoring will fail unless you install the certificate on your monitored
appliances. See Statistics Monitoring Over HTTPS for more information.
Use Certificate Subject Alternative Name Data for Certificate Validation
Management Center can search the certificate Subject Alternative Name (SAN) data so that it can be matched against a reg-
ular expression to validate the certificate and user. SAN is a X.509 extension that allows data to be associated with a secur-
ity certificate using a subjectAltName field. SAN data can include:
l Email addresses
l IP addresses
l URIs
l DNS names
340
l Directory names
l Object identifier (OID) followed by a value
Management Center scans the subjectAltName field for OID data. The format of the subjectAltName field data is as
follows:
{oid}, [{ASN.1 value type code}]{value}
For example:
The subjectAltName data is compared to a regex set by the security ssl client-authentication set-

regex command, which is used to extract the portion of the value to use as the user's identity. That value is then used to
find the user in the local or LDAP authentication service.
This enables Management Center to validate the certificate and allow users to bypass the password requirement, if the
system determines the certificate is valid and finds the user in the local user database or LDAP system. Refer to
"Authenticate Users with SSL Mutual Authentication" on page 336 for more information.
For example:

"'1\\.3\\.6\\.1\\.4\\.1\\.311\\.20\\.2\\.3,\\s\\[0\\](.*?)@\'"
Refer to "# security" on page 546 for more information about the client-authentication set-regex com-
mand.
341
Edit a Local or Imported User
To modify the user details (first name, last name, email address, phone numbers, description) or change the user's role, you
can use the Edit User wizard. You can edit both local and imported users.
2. In the list of users on the left, select the username to edit.
3. Click Edit. The web console displays the Edit User wizard.
4. Change desired information on the Basic Info tab. Note that you cannot change the username.
5. Click the Assign Roles tab to modify the user's role.
6. Click Save.
Delete a User
Organizations typically implement processes to deactivate and remove access to internal accounts—such as mailboxes,
intranet, and applications—when users leave the organization. As a best practice, include deleting the user account in Man-
agement Center to the exit procedures that your organization uses to reduce the risk of a security breach.
Deleting an imported user does not remove that user from Active Directory, LDAP or RADIUS.
2. In the list of users on the left, select the user you want to delete.
342
3. Click Delete. A Delete User dialog displays, prompting you to confirm the deletion.
4. Verify that it is the correct user, and then click Delete User. The user no longer displays in the Users list and is not
a registered user of Management Center.
343
Change and Reset Passwords
Select the topic for the applicable situation.
Situation Topic
User knows his/her password and wants to change it "Change Your Password" on the
next page
User forgot his/her password "Reset Password" on page 346
Admin wants to automate the password resetting process "Automate Password Reset Pro-
cess" on page 512
Admin needs to manually change a user's password because user forgot "Manually Reset a User's
answer to security question or password reset process isn't automated Web Console Password" on
page 348
Admin wants to expire a user's web console password. "Expire a User's Web Console
Password" on page 348
Admin forgot admin account password "Reset or Restore Admin Account
Passwords" on page 350
Change Your Password
You can change the password that you use to log into the web console.
If you log in to the web console using your LDAP or Active Directory credentials, you cannot change your password.
1. In the web console banner, click and select your username.
The username for the default admin login is "Management Center."
The web console displays the Profile dialog. Fields marked with an asterisk (*) are required settings.
2. Click Change Password.
3. In the Current Password field, enter your current password.
4. In the first New Password field, enter a new password.
As you type your password, the Password Strength meter indicates the strength of the password. Because the
system assesses the strength of the password with each character, the meter might fluctuate while you are typing.
Symantec recommends that you use a password with at least Secure strength. You can try a number of
different passwords until the Password Strength meter indicates Secure or higher.
5. In the Retype New Password field, enter your new password again.
6. Click Save.
The next time you log into the web console, use your new password.
345
Reset Password
If you have forgotten your password to log in to the Management Center web console, you can request a password reset.
This capability requires that the administrator has enabled the Management Center password reset feature; see "Automate
Password Reset Process" on page 512. The password reset is only good for the web console and not for the CLI console.
The password resetting process requires that you answer a security question, using the exact upper/lowercase you
entered when you initially defined it in your user profile. You also must have the correct email address in your pro-
file. If you forget the answer to your security question, or failed to define an email address, you will not be able to
use the automated password reset process.
1. If you have forgotten your password when logging in, click Reset Password.
2. Enter your Username and click Next.
3. In the Answer field, enter the answer to the Security Question, using the exact spelling and upper/lowercase you
entered when defining it. Click Next.
4. Check your email to retrieve your temporary password.
5. The next time you log in to the Management Center web console, use the temporary password.
6. Change your password because the temporary password will expire.
Automate Password Reset Process
As an administrator on Management Center, you need to configure settings so that users can request a password reset if
they forget their password.
346
1. Select Administration > Settings > General.
2. Set the Is Reset Password enabled? field to true.
3. For Reset Password Email Subject, modify the email subject line, if desired.
4. For Reset Password Email Message, modify the body of the email that is automatically sent to users when they
click the Reset Password link. For example, you can add a person's name to the signature instead of the generic
Management Center.
The message contains two substitution variables: {fullname} and {password}. Management Center
automatically replaces {fullname} with the user's first and last name and replaces {password} with a
temporary password.
5. Click Save to store the settings on the server.
6. Make sure an email server is configured. See "Configure Mail Settings" on page 483.
When the email is sent with the temporary password, the user's account is marked so the administrators know that
the password is only temporary. The temporary password will expire.
347
Manually Reset a User's Web Console Password
If users forget their web console password, you can manually reset the password for them. (Alternatively, if you have auto-
mated the process, the user can request a password reset when logging in. See "Automate Password Reset Process" on
page 512.) Even if you have automated the process, you may still need to manually change someone's password if the
user has forgotten the answer to his/her security question.
2. In the list of users on the left, select the username whose password you want to change.
3. Click Edit. The web console displays the Edit User wizard.
You cannot change the password for users authenticated against LDAP, Active Directory, or RADIUS
(authenticated users have the following icon: ).
4. From the Basic Info tab, click the Change password link.
The system displays two new fields: New Password and Verify New Password.
5. Enter a new password. If you do not enter identical text in both fields, you receive an error message.
6. Click Save. The dialog closes and the web console banner displays an alert indicating that the user's password
was saved.
7. Communicate the new password to the user and recommend a password change as soon as possible.
Expire a User's Web Console Password
For security reasons, you should regularly prompt users to change their passwords. You can expire a user's password, as
described below. You must have administrative privileges to expire passwords.
2. In the list of users on the left, select the username whose password you want to change.
3. Click Edit. The web console displays the Edit User dialog.
You cannot expire the password for users authenticated against LDAP, Active Directory, or RADIUS
(authenticated users have the following icon: ).
348
4. From the Basic Info tab, click Expire password. The system displays the expiration time and date.
After the password is expired, the user is prompted to change their password the next time they log in. If the user does not
log in within the next 24 hours, they are locked out of their account and instructed to contact their administrator. You can
then change the password for the user and allow them to log in again.
349
Reset or Restore Admin Account Passwords
You can reset the password for the CLI (serial console). You can also restore the default password for the admin UI (web
console). The admin account to access the CLI versus the admin account to access the web console are different
accounts (and thus the passwords are not the same).
To reset the CLI admin account password, use # security reset-password. This command is only available
through the serial console for hardware appliances and Management Center VMware console for virtual appliances.
1. "Access the Management Center CLI" on page 523.
2. Enter privileged mode by typing enable at the command prompt. See "Privileged Mode Commands" on page 531.
3. Enter your enable password and press Enter.
4. At the # prompt, type restore-defaults reset-admin and press Enter.
The CLI prompt displays the following:
This operation will restore admin password on UI to default. Management Center
service will be unavailable during this operation.
Are you sure you want to restore UI admin password? [y/N]
Resets the UI admin password to admin/admin.
350
Manage User Groups
To reduce the time and effort involved in assigning roles to users, you can create a user group, add users to it, and then
assign roles to the group. Creating user groups also helps ensure consistency among users who require the same access.
Before adding user groups, make sure you have defined roles.
Use the Groups tab to add, edit, and delete user groups. See the following topics for details:
n "Add User Groups" below
n "Edit a User Group" on page 353
Add User Groups
Although you can add users and assign roles to them individually, doing so can be labor-intensive if there are many users in
the system who require the same permissions. To reduce the time and effort involved in assigning roles to users, you can
create a group, add users to it, and then assign roles to the group. Creating user groups also helps ensure consistency
among users who require the same access.
Users inherit the roles and permissions assigned to them individually and to the groups in which they are members. If users
inherit permissions that seem to conflict, keep in mind that they can access an object as long as they have a role with the
required permission. For example, if one of a user's groups has a role with the View permission for policy objects but another
group has no policy permissions, the user can view policy objects.
Groups cannot be members of other groups.
1. Select Administration > Groups.
2. From the Groups section, click Add Group. The web console displays the Add Group wizard.
3. In the Add Group: Basic Info page, enter the group's information. An asterisk denotes fields that are mandatory.
Enter a Name for your group. This group name displays on the dashboard and other areas in the web console.
Before you start naming user groups, devise a naming convention. For example, a user group name can be
based on an organization, job function or geographical location.
4. In the Add Groups: Basic Info page, add a description (even though it is not required).
Although entering a description is optional, the description helps you and other users understand the purpose
or function of the group. This helps to understand the correct roles and permissions to apply within the group.
Symantec recommends that you always enter a clear, helpful description.
5. Click Next.
6. In the Add Group: Members dialog, select users from the Available Users and add them to the Members list using
the arrow buttons. Click Next.
7. In the Add Group: Assign Roles dialog, select a group role from the Available Roles it to the Assigned Roles list.
See "Define Roles " on page 355.
351
8. Click Finish. The name of the group that you just created will be displayed in the left pane.
352
Edit a User Group
To modify the user group details (name or description), add/remove group members, or change the role(s) assigned to the
group, you can use the Edit Group wizard.
2. In the list of groups on the left, select the group to edit.
3. Click Edit. The web console displays the Edit Group wizard.
4. Change desired information on the Basic Info tab.
5. To add a user to the group:
a. Click the Members tab.
b. Select the username in the Available Users list.
c. Click the right arrow button to add the user to the Members list.
d. Repeat for other users you want to add to the group.
6. To remove a user from the group:
a. Click the Members tab.
b. Select the username in the Members list on the right.
c. Click the left arrow button to remove the user. The user moves over to the Available Users list.
d. Repeat for other users you want to remove.
7. Click the Assign Roles tab to modify the role(s) associated with the group.
8. Click Save.
Delete a User Group
Deleting a group does not remove the members in the group.
2. In the list of groups on the left, select the group you want to delete.
3. Click Delete. A Delete Group dialog displays, prompting you to confirm the deletion.
4. Verify that it is the correct group, and then click Delete Group. The group no longer displays in the Groups list.
353
Manage User Sessions
Management Center tracks and logs each user session. Administrators can view and manage current user sessions from
Administration > User Sessions. As a super admin, the ability to log in will not be affected by what you do in this dialog.
You can delete (kill) any user session which will immediately log the user out of the Management Center web console.
As a best practice, Symantec recommends that all users log out of the web console after completing their tasks. As a Man-
agement Center administrator, you may need to enforce this practice. If a user has changed roles or has accepted a new
job that may change their access rights, you can manage all active or stored user sessions.
1. From the web console banner, select Administration > User Sessions.
2. To prevent users from logging in to the web console, select the Disable user login to Management Center check
box.
3. (Optional) To delete a user session:
a. Select a user session. Green denotes your session (you), not an active session.
b. Click Kill Session.
c. Confirm that you want to kill the session.
354
Define Roles
Roles are not necessarily associated with jobs or job titles; rather, each role should contain the permissions required to per-
form a specific task or set of tasks. Managing roles based on tasks is easier than managing permissions attached to fea-
tures or functions. Because multiple users in organizations often perform the same task (for example, two teams of 20
support engineers require a Device Admin role), and tasks are shared even across different teams (five product engineers
also require 'Device Admin'), the number of roles you need to define is in principle much lower than the number of users in
the system. See "Edit an Existing Role" on page 357 and "Duplicate an Existing Role" on page 357.
About Roles
The role structure in Management Center has two predefined levels:
n administrator, which has all permissions for all objects. The default admin account has the administrator role.
n viewOnly, which has the view permission for all objects.
You can create other roles that allow view access to some objects, add or update access to some objects, or a mix of dif-
ferent permissions as shown in the example below.

Symantec recommends that you create roles—with all necessary permissions and filters—before adding users.
Procedure
1. Select Administration > Roles and click Add Role.
2. In the Add Role: Basic Info dialog, enter a name for the role.
If you authenticate users against LDAP, Active Directory or RADIUS, create a role in sync with the directory
service.
355
3. (Optional) Enter a description.
Symantec recommends that you enter a list of the permissions for the defined role in the Description field.
This helps you and other users understand the permissions of a user's role including the intent of their job
function.
4. Click Next.
5. In the Add Role: Permissions dialog, click Add Permission.
6. From the Object drop-down list, select All objects or a specific object.
7. From the Action drop-down list, select All operations or one or more individual actions.
8. (Optional) In the Filter drop-down list, select a filter to apply to both the action and the object.
See "Grant Permissions" on page 358 for information on objects, actions, and filters.
9. To add more permissions, repeat steps 6 through 8.
10. Optional: Add Reporter permissions.
11. Click Finish.
356
Duplicate an Existing Role
To avoid spending an excessive amount of time on defining roles with similar permissions, you can define a role based on a
role that already exists in the system. For example, if you have already created a role that allows access to device groups,
you can base other roles on it with different attributes.
1. Click the Administration tab and select Roles.
2. Select the role on which you want to base the new role.
3. Click Duplicate Role. The Roles tab displays the new role, with the name of the original role followed by (1). For
example, if you duplicated the viewOnly role, the new role's name is viewOnly (1).
4. Select the role you just created and click Edit. The web console displays the Edit Role dialog containing two tabs:
n Basic Info
n Permissions
5. Update the name and description to reflect the purpose of the new role.
6. Click Permissions.
7. Edit the permissions for the new role; see "Grant Permissions" on the facing page for instructions.
8. Click Save. The role is saved and the Roles tab displays it with the new name and description.
Edit an Existing Role
You cannot directly assign permissions to users; thus, you must always edit a role to change a permission. You can edit a
role's basic information or the permissions that the role comprises.
Update basic information
1. Select Administration > Roles. From the Roles page you can perform the following actions:
n Add Role
n Edit
n Duplicate
n Delete
n Refresh
2. Select the role whose information you want to update and click Edit. The web console displays the Edit Role dialog.
3. On the Basic Info tab, edit the name of the role or the description as required. Click Save.
Update permissions
1. Select Administration > Roles. The web console displays the Roles page where you can perform the following
actions:
n Add Role
n Edit
n Duplicate
n Delete
n Refresh
2. Select the role whose permissions you want to update and click Edit. The web console displays the Edit Role dialog
357
containing two tabs:
n Basic Info
n Permissions
3. Click the Permissions tab. The web console displays the list of permissions.
4. To change only part of a permission, select Object or Action. See "Reference: Permissions Interdependencies" on
page 312. Do one or more of the following as needed:
n In the Object drop-down list, double-click and specify All objects or a specific object.
n In the Action drop-down list, double-click and select All operations or a specific operation.
n (If applicable) In the Filter drop-down list, click the plus sign (+) and select a filter. See "Filter Devices or
Device Groups in a Permission" on page 361.
5. Add or remove an existing permission:
n To add a permission, click Add Permission. See steps 7 through 10 in "Define Roles " on page 355 for
instructions.
n To remove a permission, select it and click Remove Permission. The permission is removed from the list.
6. Click Save.
Control Roles and Permissions through user sessions. If you edit a role's permissions while users are logged in to
the web console, users must log out and log in again to see the effects of the change. See "Manage User Sessions"
on page 376.
Grant Permissions
You can add, remove, and edit permissions for any role. A role must have at least one permission for the role to take effect.
1. Select Administration > Roles.
2. Select a role and click View. The web console displays the View Role dialog.
3. Click Permissions. You can add, remove, and edit permissions on this tab.
A permission consists of:
n The object, which describes the area, feature, or function that the user can access, such as devices and global
settings.
n The action, which is the scope of access to an object. It details what actions a user can do with the object, such as
the ability to add and edit devices, or view global settings. The actions that are available depend on the selected
object. Starting in Management Center, 1.6.x, you can add multiple actions per object.
n A filter, which dictates permissions to a sub-set or specific area of the object, such as certain attributes about a
device or policy. Filters are available for devices and device groups; for instructions on specifying filters, see "Filter
Devices or Device Groups in a Permission" on page 361.
The available filters correspond to the specified actions. That is, if multiple actions are defined, the filters list
includes all possible filters for those actions. If an action is subsequently deleted, the corresponding filter will also
be deleted if it does not apply to any remaining actions.
If the View permission for an object is not included in a role, users with the role are unable to see the object when
they log in to the web console. For example, if a role does not include a permission for the Device object, users
added to the role do not see the Network tab.
See "Define Roles " on page 355 for more information about setting roles and permissions.
358
359
Update Access When a User's Job Changes
When a user's job changes, you can adjust their information to reflect their new job or responsibilities.
2. (If applicable) Update a user's roles to reflect changes in position or responsibilities.
3. (If applicable) Update the user's basic details.
4. (If applicable) Update a role to apply changes to all users who have the role. See "Edit an Existing Role" on
page 357.
Update a User's Roles
When a user has a new job or responsibilities within the organization, you might have to update their roles to ensure that
they can perform their new tasks.
2. In the Users left pane, select the user whose roles you want to change. The user's details display.
Imported users have the following icon:
3. Click Edit. The web console displays the Edit User dialog.
4. Click Assign Roles. The dialog displays a list of all the roles in the system. Roles to which the user is not assigned
are listed under Available Roles. Roles to which the user is currently assigned are listed under Assigned Roles.
5. Update roles:
l To add a role, select it from Available Roles and using the arrow, add it to the Assigned Roles list.
l To remove a role, select it from Assigned Roles and using the arrow, add it to Available Roles list.
6. Click Save. The web console banner displays an alert indicating that the user was saved.
360
Roles are linked to user sessions. If you edit users' roles while they are logged in to the web console, instruct them to
log out and log in again to see the effects of the change.
Filter Devices or Device Groups in a Permission
You can control access to devices and device groups (folders) on a more granular level than with other objects in Man-
agement Center using permission filters. These filters are based on the attributes that you specify in device and device
group properties. See "Set User-Defined Device Attributes for Access Control" on page 370 for information.
1. Perform one of the following:
n Add a permission. See "Grant Permissions" on page 358.
n Edit a permission. See "Edit an Existing Role" on page 357.
2. In the Add/Edit Role dialog, select the permission and click the plus sign (+) in the Filter field. The Add/Edit Filter
dialog displays.
3. Select a filter from the Filter Type drop-down list and specify filter values. See "Reference: Permissions Filters
Object and Attributes" on page 321.
4. Click Save. The filter displays in the Filter field.
Restrict Access to Reporter Reports
When creating or editing roles, you can set permissions to limit the Reporter report fields the role has access to. The
choices you make limit the reports that users in that role are able to view and also preclude them from adding corresponding
widgets to a dashboard.
Procedure
2. Select a role and click Edit.
3. Click the Reporter Permissions tab.
4. Click Add Permission.
361
5. Select the Reporter database to apply permissions to.
If you select a database that includes All Databases in the title, the permissions you set will apply to all databases
(present and future) on that device. If you select All Reporters - All Databases, the permissions you set will
globally apply to all databases on all devices.
If you've already applied permissions to a database, it will not display in the Reporter-Database list.
6. Click Next. The system displays the Add Report Permissions - Restricted Fields, Reports dialog.
7. Restrict report fields.
362
8. To view the reports affected by your choices, select Show Restricted Reports.
9. When you are satisfied with your choices, click Close.
363
10. Click Finish, then Save.
Users in the specified role are now precluded from viewing reports in the selected fields.
Users Associated With Multiple Roles
If a user is associated with more than one role (or by group association), all applicable roles are displayed. For example,
when viewing reports, the user can choose a role and a corresponding database from the menu on the Reports
> Reporter page. If a role has no access to a database, that role does not display in the Role drop-down menu.
364
Manage Attributes
n Device
n Device Group
n Policy
n Device Script
3. To add an attribute, click Add Attribute. See "Add Attributes" on the facing page.
n Name
365
Add Attributes
work. Attributes are custom metadata used to refine and edit devices, device groups, policy, and scripts. Because you
have different devices and appliances to manage, those devices require, and are often restricted to, certain attributes. Use
these attributes to filter on specific devices, device groups or objects.
2. Select one of the following from the Manage Attributes list:
n Device
n Device Group
n Policy
n Device Script
3. Click Add Attribute. Define the properties of the attribute that you are creating. An asterisk denotes fields that are
mandatory.
Property Description or Purpose
Display Name (*) Name that displays throughout Management Center.
366
Name (*) This is the name with no spaces.
Type (*) The format in which users must enter or select attribute values.
Available Values(*) The Available Values depend on the Type you selected.
Default Value If this attribute has a default value, it is displayed here.
Mandatory All attributes that you check as mandatory will appear as options when you create a
new policy, device, device group, or device script. All mandatory attributes can be
filtered on when you "Filter by Attributes and Keyword Search" on page 164.
Inheritable This attribute applies to devices and devices groups. Attributes that are checked as
inheritable can "inherit" their attributes from a parent device group.
Displayed as a default When enabled, the attribute displays as a column in the Policy Object grid, Script
column Object grid, or Network dashboard. Even if this option is not enabled, you can still
display the attribute by right-clicking the column header, selecting Columns and
selecting the attribute to display. See Customize the Network View.
Description Give a useful description of this attribute to distinguish it from the others when
viewing all of the attributes in a list.
4. Click Save.
Mandatory Attributes
Attributes are metadata that you can apply to objects. Nothing changes to the existing devices, device groups,
policy, or scripts when an attribute is marked mandatory. However, marking a attribute as mandatory means that
whenever you create a new or add a device, device group, policy or device script object, you will be forced to
enter a value for that mandatory attribute.
367
When you mark an attribute as mandatory, then the attribute's value is required. You can enable variable sub-
stitution only if you save the attribute with a default value. See "Use Substitution Variables in Policies and Scripts"
on page 194
368
Edit Attributes
After you have defined an attribute, you can refine and edit that attribute to apply to any of the devices, device groups, policy
and device scripts within your network. Editing an attribute changes the way devices, device groups, policy or script objects
can be filtered and searched.
1. Select the Administration > Attributes section.
2. From the Manage Attributes list, select an attribute to edit from the following attribute types:
n Device
n Device Group
n Policy
n Device Script
3. Select an attribute from the list and click Edit.
4. Change the properties for the attribute. An asterisk denotes fields that are mandatory.
Display Name (*) Name that displays throughout Management Center.
Name (*) This is the name with no spaces.
Type (*) The format in which users must enter or select attribute values.
Available Values(*) The Available Values depend on the Type you selected.
Default Value If this attribute has a default value, it is displayed here.
Mandatory All attributes that you check as mandatory will appear as options when you create a
new policy, device, device group, or device script. All mandatory attributes can be
filtered on when you "Filter by Attributes and Keyword Search" on page 164.
Inheritable This attribute applies to devices and devices groups. Attributes that are checked as
inheritable can "inherit" their attributes from a parent device group.
Displayed as a default When enabled, the attribute displays as a column in the Policy Object grid, Script
column Object grid, or Network dashboard. Even if this option is not enabled, you can still dis-
play the attribute by right-clicking the column header, selecting Columns and select-
ing the attribute to display. See Customize the Network View.
Description Give a useful description of this attribute to distinguish it from the others when view-
ing all of the attributes in a list.
5. Click Save.
369
Set User-Defined Device Attributes for Access Control
User-Defined attributes can either be custom attributes that you create from the Administration tab (or if you edit the attrib-
utes system attributes of Location and Rack). System attributes contain values that Management Center collects for
reporting purposes.
n Connection Parameters - IP or hostname, Username, Password, Enable Password and SSH Port number.
n Name - Device Name
n Membership - The hierarchy and device group that the device belongs. See "Configure Hierarchy for Devices and
Device Groups" on page 107.
n Attributes - Customized Location and Rack attributes or new custom attributes (or metadata) that administrators
can create. See "Add Attributes" on page 366.
1. Collect statistics for the device by clicking the check box. See "View Statistics Monitoring Reports" on page 458.
2. Use the up/down arrows to specify a Bandwidth Cost. "Set Bandwidth Cost for Reports" on page 479.
The bandwidth cost is a multiplier and is thus not expressed in a specific currency unit. For example, you
can specify a value to represent on average how you pay per gigabit for data usage on your network.
3. If the User-Defined attribute has a red asterisk * it is required. You must specify a value before continuing.
Administrators can create attributes in addition to the user-defined attributes of Location and Rack. To define
your own device and device group attributes, see "Add Attributes" on page 366 and "Edit Attributes" on the
previous page.
For more fine-grained control of a device or device group, you can add permissions for the specified attributes.
See "Reference: Permissions Filters Object and Attributes" on page 321.
370
371
Filter and Keyword Search
Apply filters to any object within Management Center. Objects can include:
n Attributes
n Audited Objects
n Authentication
n Devices
n Policy Objects
n Policy Device Assignment
n Roles
n Script Objects
Filter on attributes and then use the keyword search. When you are managing hundreds or thousands of policies across
multiple devices, it is important to be able to find a particular policy or configuration quickly.
You are not limited to the Filter fields displayed. You can customize your filters.
Procedure
Default fields are dependent upon the type of object that you are filtering. For example:
n Name - Filters by the object name
n Type - Filters by the object type
n Description - Filters by the object Description
n Author - Filters by who created the object
1. To filter by a particular type of policy, click the Type drop-down list. Select a Policy Type:
n CPL
n CPL Fragment
n VPM
2. Click Apply Filters.
3. The Object list displays all of the Objects by Type. After you have applied filters, search for specific objects using
the Keyword Search.
4. From the Policy Objects listed by Type, search for a specific Policy using the Keyword Search.
The logic is Filter *and* Keyword Search.
Search by Keyword
When searching, Management Center breaks text into keywords and then searches for keywords entered. Management
Center's index system has a special case for dot. Although Management Center sees dots as separating letters within a
word (i.e. Management Center considers dots as a part of a word).
You cannot search on special characters such as ^%|~.
Colons are treated like other non-letters by splitting keywords apart. IPv4 and IPv6 addresses work differently because of
colons.
The wildcard symbol is *. Management Center automatically appends an * at the end of your search term but if you
want to start with a wildcard search, you have to enter it yourself.
372
Can quotes be used in a search?
Use quotes when non letters are part of the search term. For example, your search term includes a colon. The exception to
this search rule is the use of a dot because a dot that is NOT followed by white space is considered part of the keyword.
How do you search for whole words?
Enter the whole word. If there is more than one word, separate each word with a space. If using special characters, enclose
each word in double quotes.
How do you search for partial words?
Enter the partial term, and Management Center attempts to complete the search. For example, enter hi and Management
Center matches that to both highlight and high.
Example Searches
IPv4 127.0.0.1
l 127.0.0 – matches any IPv4 starting with 127.0.0
l *.0.0.1 - matches any IPv4 ending in 0.0.1
IPv6 “0:0:0:0:0:1”
Use quotes for IPv6 addresses because IPv6 uses colons instead of dots as the separator.
l “0:0:0” – matches any IPv6 start with 0:0:0
l *”0:0:1” – matches any IPv6 ending with 0:0:1
Hostnames
l abc.com - matches a host named abc.com
l *.com – matches a hostname ending in .com
l *”:8080” – matches a hostname with :8080 as the port
Search
1. From the Keyword Search field, enter your search term.
What if the search finds no match?
If the search finds no match, the right pane displays a message indicating that objects match the keyword filter. You can
search again using a different keyword.
What if the search succeeds in finding matches?
If the search finds matches, the results display in alphabetical order in the Objects list.
How do you clear the search results?
To clear search results and display all objects in the system, click the X in the search field.
373
Preview or Download Logs
You can sort and preview a log by file name or log type. You can preview one log or download multiple logs.
1. Select Administration > Logs.
2. Select a log to view. Click Preview. For example, to view the localhost_access.log in a text viewer, click Preview.
3. To download multiple logs, select the check boxes of logs that you want to download and then click Download.
Management Center downloads a .zip archive file to the default download location.
Available Logs
The following table list the available logs.
Name Type Description

localhost_access.log WEB-ACCESS Tracks users requests to the Management Center UI.
These logs roll over weekly for a maximum of 4 weeks.
log.log WEB Primary Management Center log.
The primaryManagement Center log rolls over when it reaches 10 MB
and maintains a maximum of 9 history logs for a total of 1 GB.
debug.log DEBUG This log provides diagnostics information to help with debugging. The
log only displays if a user enables debug diagnostics (Administration
> Settings > Diagnostics).
The DEBUG logs roll over when it reaches 10 MB and maintains a
maximum of 9 history logs for a total of 1 GB.
journal.txt PDM Primary log for the performance data collector of Management Center.
This log is useful for determining why performance data is not showing
up in Management Center or is being delayed.
These logs roll over weekly for a maximum of 4 weeks.
clp_services.log SYSTEM Internal CLP OS log.
These logs are very small and roll over every day for a maximum of 30
days.
Rollover log formats are similar to the following:
n name.zip
n name.log-data
Log Types
The following table describes the log types.
Type Description
WEB Logs related to Management Center and its operation.
374
Type Description
WEB- Logs that track user requests to Management Center web UI.
ACCESS
DEBUG As the name implies, these are debugging logs.
SYSTEM Internal core OS logs.
PDM Performance Data processing logs. These correspond to anything related to the appstat pro-
cessing of PDM logs from the ProxySG or other systems.
375
Manage User Sessions
Management Center tracks and logs each user session. Administrators can view and manage current user sessions from
Administration > User Sessions. As a super admin, the ability to log in will not be affected by what you do in this dialog.
You can delete (kill) any user session which will immediately log the user out of the Management Center web console.
As a best practice, Symantec recommends that all users log out of the web console after completing their tasks. As a Man-
agement Center administrator, you may need to enforce this practice. If a user has changed roles or has accepted a new
job that may change their access rights, you can manage all active or stored user sessions.
1. From the web console banner, select Administration > User Sessions.
2. To prevent users from logging in to the web console, select the Disable user login to Management Center check
box.
3. (Optional) To delete a user session:
a. Select a user session. Green denotes your session (you), not an active session.
b. Click Kill Session.
c. Confirm that you want to kill the session.
376
Receive Error Notifications
Configure how you will be notified when errors occur in Management Center.
Manage Alerts 377
Configure SMTP Alerts 389
Configure SNMP Alerts 390
Alert Notifications
Description Message Example
Hardware monitor warnings or <monitor_name> has exceeded <level_name> level of <#>%, current usage
critical errors. is <#>%.
Critical repository messages. Unable to create/start the repository, <repository_name>. The system is stopping.
Unable to initialize the <repository_name> repository.
Internal critical errors. Subscription URLs are not installed.
Errors with auditing user Unable to write audit record, user: <username>, event: <action>.
actions.
Management Center license License error <message_string>.
errors due to duplicate serial or
server avoidance.
Migration errors during an Migration step: <step_name> failed. Changes made by the step have been
upgrade. rolled back, but migration steps that have completed successfully have been
retained. Subsequent steps have been canceled.
Database disk quota warning. Statistics Monitoring DB exceeded allowed disk quota. Collector to reject
upload requests.
Manage Alerts
Management Center provides an area for administrators to store and manage various alerts. Whether you need to set the
state of an alert, change the owner, provide feedback, or find a specific alert, you can do it all in one place. This is different
from the message viewer. You are still able to view messages in the Recent Messages pane. See "Read Messages and
Alerts" on page 518.
To get to the Alerts management page:
n Select Administration > Settings.
n Click the Alert Notification icon. This shows the number of open (or unresolved) alerts.
Overview
The landing page shows the current alerts and the options available for management.
n Sorting options allow you to view the alerts based on various criteria.

n Details and Filters Tabs give quick information about the alert(s).

n Navigation options at the bottom allow you to go to specific pages.

n Management options allow you to take action on specific alert(s).
Sorting Alerts
The primary element on the landing page is the list of available alerts. These can sorted by different columns.
*Indicates columns that are NOT shown by default

Sort By... Description
Severity Impact level of an alert on the affected category.
Priority Importance level of resolving an alert.
Message Current status of an alert. Alerts are either considered open or closed.
Count* Number of times an issue is reported.
Source* System reporting an alert.
Note: This field is populated only if an external network is reporting an issue.
Category Element affected by an alert.
State Current status of an alert.
Received Date and time an issue is reported as an alert
Acknowledged Received status of an alert.
Owner Person currently responsible for an alert.
Sort and view the alerts with these options:
378
n Adjust the length of columns by hovering between two columns to get the adjustment cursor
n To sort the list, you have two options:
o Click on a column header. The first click sorts the list by that column in ascending order. A second click
sorts it in descending order.
o Hover over a column header, then select Menu Arrow > Sort Ascending or Sort Descending.
n To customize which columns show, hover over any column header, then select Menu Arrow > Columns.
n To reset the columns back to the default columns and width, hover over any column header, then select Menu
Arrow > Reset Columns.
Details and Filters Tabs
Get an overview of a specific alert or use filter options in order to find specific alerts.
If you need more space to view the alerts list, collapse this pane by clicking the arrow tab on the left of it.
See Filters Panel for an example image.
Preview Details Panel
Gives a brief summary of the selected alert. If you need to view more details, such as the history of the alert, see Editing
Alerts.
Select only one alert to preview the details.
Filters Panel
Find specific alerts with various filters. Once applied, the Filters tab shows how many active filters there are. Example:
(Active 3).
379
Apply/Clear
Save or delete any filter changes selected.

Customize
380
Select the filters that show in the Filter Panel .
Time Range
Select the time range you want to search in.

Hour Options Day Options
Last 1 Hr Last 24 Hrs
Last 12 Hrs Last 3 Days
Last 24 Hrs Last 7 Days

State
Select the alert current status(es).

Option Description
New New or unworked issues.
Pending Already known issue, but resolution hasn't started.
Assigned Assigned to a specific user.
In Progress A resolution has been started.
Resolved The issue has been resolved.
The issue has been closed. This can be used whether or
Closed
not the issue has been resolved.

Acknowledge
Select the receipt status(es).

381
Option Description
Alert received by
Acknowledge
owner.
Alert not received
Unacknowledge
by owner.

Category
Select the element(s) affected.

Option Element(s)
Policy Policy specific.
Configuration Scripts, Shared Objects, Tenants, and Files.
Alerts related to the function of a device or Management
Operational
Center.
Networks linked to Management Center, including files,
System
software, hardware, and firmware.
Security Security related alerts.
Other For an issue not listed in any other category.

Priority
Select the importance level of resolution.

Priority Level
Low
Medium
High
Urgent

Owner
Select the current owner.
Alerts that are not assigned (in the Owner sorting column) will not show up if an owner is selected.
Keyword Search
Next to the Preview/Filter pane is the keyword searching option. If you know keywords in the alerts you are look-
ing for, enter them into the search box and click the magnifying glass or press Enter. To clear the search terms,
click the ( ) within the search box.

382
Navigation
Navigate between pages and set navigation options.

Option Icon Description
Beginning Go to the first page.
Back Go back a page.
Current page number and total page count. Type a
Page Number number to go to a specific page.
Forward Go forward a page.
End Go to the last page.
Refresh Refresh the list.
Number of alerts displayed per page.
Page Size
Alert Management
Create, edit, delete, or acknowledge receipt of alert(s).
Creating New Alerts
Use Raise Alert to create a new alert.
383
Message*
Enter in the message for the alert. *This field is required.

Severity
The impact level on the affected category. *Indicates default

Option Icon Severity Definition
Level
Info* Low Little or no impact.
Warning Medium Potential to cause

errors.
Error High Errors found.
384
Option Icon Severity Definition

Level
Fatal Critical System failure.

Priority
The importance level of resolving the alert. *Indicates default

Priority Level
Low*
Medium
High
Urgent

State
The current status of the alert. Alerts are either considered open or closed. *Indicates default

Option Description Status
New New or unworked issues. Open

Pending Already known issue, but resolution hasn't started. Open
Assigned* Assigned to a specific user. Open
In Progress A resolution has been started. Open
Resolved The issue has been resolved. Closed
Closed The issue has been closed. This can be used Closed
whether or not the issue has been resolved.

Owner
The administrator currently logged in is set as the default owner. You may assign it to a different owner as long as the per-
son has previously been added as a user. See "Add Local Users" on page 327.
Alerts created by the system will show as not assigned in the Owner sorting column.
Category
The element affected by the alert. *Indicates default

Option Element(s)
Policy Policy specific.
385
Option Element(s)
Configuration Scripts, Shared Objects, Tenants, and Files.
Operational Alerts related to the operation of a device or Management
Center.
System Networks linked to Management Center, including files, soft-
ware, hardware, and firmware.
Security Security related alerts.
Other* For an issue not listed in any other category.
Description
(Optional) Enter a more detailed description of the alert and/or the reasons for it.
If you forget any information for the detailed description, you can always Edit it or add note to the Journal tab at a later
time.
Save/Cancel
Save or Cancel the new alert.

Editing Alerts
You can edit the alerts using one of two methods:
n To edit all the information for an alert, select a message and then click Edit. Alternately, right-click a message to get
the Edit option.
Only one message can be selected for editing at a time.
Edit Details Tab
The basic information, normally set in Raise Alert, can be edited in the Details tab. A summary of the current saved
status of the alert shows in a box below the editable details. The action buttons include:
n
Save Alert for any changes you make.
n
Acknowledge or Unacknowledge the receipt of the message.
n
Discard any changes.
n
Take Ownership to instantly assign it to yourself.

Journal Tab
A history of the changes made to the alert are logged in the Journal tab beneath the Notes field. Actions you can
386
take include:
n Add more information in the Notes field.
n Add Noteto the alert.
n Clear any information typed.

Back
Return to the list of alerts. Alternately, you can click on the Alerts link above the Back button to return to the list.

n Select message(s) to access the available quick Operations. These allow you to edit information on an alert
without having to open the Edit screen.
Assign Users
Select a user to have ownership. You may assign it to a different owner as long as the person has previously been
added as a user. See "Add Local Users" on page 327.
Alerts created by the system will show as not assigned in the Owner sorting column.
Take Ownership
Instantly assigns the alert to yourself.

Change State
The current status. Alerts are either considered open or closed.
*Indicates default
387
Option Description Status
New New or unworked issues. Open

Pending Already known issue, but resolution hasn't Open
started.
Assigned* Assigned to a specific user. Open
In Progress A resolution has been started. Open
Resolved The issue has been resolved. Closed
Closed The issue has been closed. This can be used Closed
whether or not the issue has been resolved.
Change Priority
The importance level of resolution. *Indicates default
Priority Level
Low*
Medium
High
Urgent
Other Alert Management Options
n Select message(s) to Delete them. Alternately, right-click the message(s) to get the Delete option.
n Messages are automatically removed by the system after a set time. The default is 120 days. See "Configure
Housekeeping Settings" on page 506 for more information.
To change the amount of days alerts are retained:
1. Select Administration > Settings > Housekeeping.
2. Change the value in Number of days of closed alert records to keep.
3. Click Save.
4. (Optional) Click Activate to push your changes to the server immediately.
n Select message(s) to Acknowledge or Unacknowledge the receipt of them. Alternately, right-click the message(s)
to get the acknowledgment options.
Only messages of the same receipt status can be selected at the same time for the button to work.
Example: Under the Acknowledged column, all messages marked not yet.
n Refresh the list of available alerts.
388
Configure SMTP Alerts
Configure the mail server for sending health monitoring notifications from Management Center and specify which admin-
istrators receive the alerts.
2. Click SMTP Alerts on the left. SMTP fields display on the right. An asterisk denotes fields that are mandatory.
3. Specify SMTP settings.
What to send* Specify OFF to turn off e-mail notification OFF|ERROR

or ERROR when errors occur with mail
delivery.
Mail Server* The SMTP mail server to use for outgoing Example: smtp.organization.com
mail.
Send to address* E-mail addresses to which alerts are A comma-separated list of valid e-mail
sent. For example, enter administrators' addresses.
e-mail addresses or a distribution list.
From address* The e-mail address from which e-mails Example: [email protected]
are sent.
If you are unable to save your changes, make sure that all required settings are specified.
389
Configure SNMP Alerts
The Simple Network Management Protocol (SNMP) itself does not define which variables a managed system should offer.
Rather, SNMP uses an extensible design, where the available information is defined by Management Information Bases
(MIBs).
Configure SNMP settings for Management Center. If you want to enter a password for the SNMP traps, see " Configure the
SNMP Agent Password" on page 484.
The MIBs are available on the BTO Downloads page. Refer to the Management Center Release Notes for inform-
ation on MIBs.
2. Select SNMP Alerts. SNMP fields display on the right. An asterisk denotes fields that are mandatory.
3. Specify SNMP settings.
What to send* Specify OFF to turn off SNMP notifications or OFF|ERROR

ERROR when errors occur with the SNMP traps.

SNMP Destination IP* Specify an IP address for the listener. Example: 192.0.2.0
SNMP Destination port* Specify the port for the listener. Example: 155
SNMP Version* Specify the protocol version for the 1|2|3
SNMP listener.
Community A password that allows access to a device's Enter the password.
statistics (transmitted in plaintext).
See " Configure the SNMP
Agent Password" on page 484.
Engine ID The unique SNMP engine ID based on the device Click generate to generate the
IP. This engine ID is associated with the specific engine ID.
Management Center installation and displays in
each SNMP packet to identify the source of the
packet.
Applies to SNMPv3 only.
Security Use name used to access the management Enter the username.
module.
Auth Protocol The authentication protocol algorithm to use. SHA|MD5
SHA is the default.
390
Auth Passphrase Passphrase to use for authentication. Enter the passphrase.
Priv Protocol The protocol to use for SNMP message AES|DES
privacy. AES is the default.
Priv Passphrase Passphrase to use when encrypting messages. Enter the passphrase.
391
Customize the Audit Log
Because the Audit Log records all transactions on multiple levels, the log can grow very quickly—especially if you many
devices are managed in Management Center and there is a high level of user activity. Although the Audit Log is designed to
make it easy for you to locate the records you want, you can customize the display further to help you locate specific
records, isolate records from a certain date or time, filter records pertaining to specific users or objects, and more.
Use the following methods in conjunction to customize the Audit Log display to suit your purposes.
When you make the following changes in the Audit Log Viewer, the changes do not persist beyond the current
browser session; the next time you log in to the web console, you must go through the same steps to change the
viewer again.
Show or hide columns
You can show columns that you hid, or columns that are not visible by default, such as Record Type and Info 3 through
Info 5. You can hide some columns if you want a more general look at the log or if your screen size is limited.
To see all information available in the Audit Log and ensure that you can see an appropriate level of detail, you can show all
columns first and then choose which ones, if any, you want to hide.
1. On any column header, click the arrow. The web console displays a list of options.
2. Select an option to show the column.
Clear an option to hide the column.
3. Click anywhere outside of the list to close it.
The Audit Log shows/hides the columns you specified.
Sort columns
Because the Audit Log displays records in descending chronological order by default, you can re-arrange them to analyze
the data more effectively. By default, the records are sorted in descending order of Operation Time (latest to earliest).
1. Click the header of the column you want to sort.
n If the header displays an up arrow, the data is arranged in ascending order (A-Z, earliest to latest).
n If the header displays a down arrow, the data is arranged in descending order (Z-A, latest to earliest).
2. Click the header again to reverse the sort order.
In the following example the columns are sorted by Operation Type, so all Authentications are displayed first.
Filter records
To limit the amount the data that the log displays and focus only on specific records, apply filters using the drop-down lists
on the right. Depending on the transaction level, you may need to filter pages of records. The filters limit the record type. To
narrow the search, apply one or more filters.
392
If applying a filter results in too few records or not the right records, remove or change some filters. To reset the filters to
default, click Clear.
393
Create and Manage Jobs
Management Center allows you to create jobs for running a variety of operations on a defined schedule. For example, you
can create jobs for backing up Management Center each day, installing policy on a group of ProxySG appliances imme-
diately, or executing a ProxySG script on a monthly basis. Jobs don't necessarily need a precise schedule, though; if you
don't define a schedule for a job, you can run the job manually. In addition, you may override the defined schedule for a job
and run it immediately.
Scheduling a job and running an operation require different permissions. See "Reference: Understanding Job Per-
1. Plan the job:
n Determine which operation you want to create a job for. See "Job Operations" on page 397.
n Which devices do you want to perform the operation on? These will be the targets of the job.
n Decide how often the job should run. This will be the job schedule. See "Job Scheduling Options" on page 400.
2. Create the job. See "Add a Job" on the next page.
3. Monitor scheduled jobs, and run unscheduled jobs as needed. See "Monitor Jobs" on page 402.
4. Monitor jobs as they are running. See "View Current Jobs" on page 404.
5. View job history. See Job History.
Add a Job
The Management Center New Job wizard prompts you for information required to create a job: name, operation, targets (indi-
vidual devices or groups), and schedule. The fields vary for each type of operation.
The basic steps for adding a job are described below.
2. Click New Job.
3. In the Basic Info section, enter a name for your job.
4. Enter a description of the job. Good descriptions help to differentiate jobs when they have similar names.
5. (Optional) Email the job results. Click Email results and select the condition. Then, enter the email(s) of the recipient
(s) and click Next.
6. In the Operation section, select Single Job or Multistep Job.
n Single Job:
a. Select an operation from the menu.
b. Additional fields may display, depending on which operation you select. See "Job Operations" on
page 397.
c. After filling in the fields required for the operation you selected, click Next.
n Multistep Job:
a. Click Select Jobs.
b. Select the jobs to add to the execution list, then click Apply.
Only single jobs are available to embed into a multistep job. Management Center does not allow
nested multistep jobs.
c. (Optional) Use Remove, Move Up, and Move Down to edit the available jobs and their execution
order.
d. (Optional) Select Stop on Fail for any job to stop the execution of the rest of the multistep job should a
that specific job produce an error. Jobs are executed in the order listed, so you can select as many jobs
to stop on as you would like.
7. In the Targets section, do one of the following depending on what the system displays:
l Select the Devices or Group tab. Add multiple devices or device groups by selecting the check box next to
the names of devices or device groups. All selected targets appear in Selected Targets. When you have
added all of the targets for the job, click Next.
l Select All Predefined Targets or Selected Targets. The system displays this dialog when targets have
already been assigned. Choose Selected Targets if you want to execute a job on some targets but not
others. You can choose to execute the job on individual devices within a group or some groups but not others,
etc.
For a Multistep Job, no targets are selected in this step. Multistep jobs are system jobs and run single jobs
that have their own targets.
8. In the Schedule section, define a schedule for the job. See "Job Scheduling Options" on page 400 for more
information.
395
n Immediate—automatically runs the job after it is created
n No Schedule—no specific time or day is specified; when you are ready to run the job, use the Run Now
button to manually execute the job
n Run Once Only—specify the date and time to run the job
n Periodic—runs the job every x number of minutes, hours, or days, starting at the specified time and date
n Daily—runs the job every day at the specified time
n Monthly—runs the job once a month on the specified day of the month and specified time of day
9. Click Finish.
The new job is available in the Scheduled Jobs section, or if you run the job immediately, the Job Progress window dis-
plays until you close it or select Continue in Background.
Schedule jobs to run when network performance is not impacted or jobs that recur often. Scheduling a job and
executing a job (run now) apply different permissions. See "Reference: Understanding Job Permissions" on
page 324
The Jobs tab is one way to add a job in Management Center. Some operations have alternative methods for creating jobs.
See the topics in the table below.
Operation Refer to this topic
Execute Script "Execute Scripts" on page 159
Export Backups "Export Device Backups" on page 92
Install Policy "Install Policy" on page 242
396
Job Operations
When defining a job, additional fields may display, depending on which operation you select. The list below describes each
operation and its associated fields.
* designates a required field
Operation Description Fields

Backup Devices Backs up the configuration of the selected device(s) on Backup Name *
a defined schedule; any supported type of device can be
Backup Description *
backed up.
Include Private Data
Management Center supports configuration
backup/restore/import/export of the following Encrypt Backup
device types: ProxySG, Content Analysis, Mal-
ware Analysis, and SSL Visibility.
See also "Back Up Device Configurations" on page 84.
Backup Man- Stores a backup of the Management Center con- Export to Server - Select the check box.
agement Center figuration to the specified server on a defined schedule.
Server URL * - Supported protocols
See also "Back Up the Management Center Con- include scp, ftp/ftps, and http/https.
figuration" on page 489.
Encryption Phrase * - 1 or more char-
acters, alphanumeric.
User name
Password
Change Mon- Activate or deactivate devices. Management Center act- Change Health Monitoring state -
itoring State ively monitors the health status of activated devices. Select the radio button and Activate
Devices or Deactivate Devices.
Deactivated devices are not monitored. Whether you
choose to activate or deactivate a device depends on Change Statistics Monitoring state -
your business requirements. Select the radio button and Enable Stat-
istics Monitoring collection or Disable
You can also disable statistics monitoring without deac-
Statistics Monitoring collection.
tivating a device.
See also "Monitor Device Health and Statistics" on
page 97.
Check Con- Checks whether the policy installed on selected devices Policy* - Click to select the ref-
sistency matches the reference policy. erence policy to use for comparison.
See also "Check Consistency between Policy and Select policy version* - Select the radio
Devices" on page 269. button for either The latest policy ver-
sion or specify a previous Version.
397

Execute a Script Runs the designated script on the selected target Device Script * - Click to select
ProxySG appliances on a defined schedule. the script to execute
See also "Execute Scripts" on page 159.
Export Backups Saves backup files of the selected target device(s) to Export to Server - Select the check box.
the specified server on a defined schedule. Exporting
Server URL * - Supported protocols
device backups is necessary to save space and is man-
include scp, ftp/ftps, and http/https.
datory if you are upgrading the device to a new image.
Encryption Phrase * - 1 or more char-
Management Center supports configuration acters, alphanumeric.
backup/restore/import/export of the following
device types: ProxySG, Content Analysis, Mal- User name
ware Analysis, and SSL Visibility. Password
See also "Export Device Backups" on page 92. Prune Backups - Select this check box
if you want to remove the backup from
Management Center supports the following key the backup slot when you export the
exchange algorithms for SSH/SCP connections: backup.
DHGex, DHG, and Curve25519.
Retention Count * - Enter the number of
If a user attempts to export a
backups to keep.
backup to a server via SCP and the target server
does not support the at least one of those.key Prune Pinned - Select this check box if
exchange algorithms, the export may fail with the you want to prune backups that have
message A connection could not be been pinned (or saved).
established or The secure handshake
failed during key exchange. This also
applies to other Management Center operations
that use SSH/SCP.
File Transfer Transfers a file to the system. If you have previously Server URL* - Enter the URL of the file.

downloaded a file, such as a configuration, image, Supported protocols include http/https.
license, text, or other file, and you want it on the new
File Type - Specify the file type.
system, this option loads it.
If the file already exists - Choose what
to do if the file already exists.
Import External Imports the designated ProxySG policy or policy frag- Import from URL * - Supported protocols
Policy ment from a web, FTP, or SCP server and merges it into include scp, ftp/ftps, and http/https. The
the selected target policy fragment in Management filename must be the ID assigned to the
Center. target policy.
See "Import External Policy " on page 255. Username
Password
Install Policy Runs the designated policy on the selected target Policies* - Click to select the
ProxySG appliances on a defined schedule. policies to install.
See "Install Policy" on page 242. Force Installation - Select this check
box to override any warnings.
398

Install System Upgrades the selected device to the specified image. System Image - Select the image to
Image The file must be uploaded to Management Center (Con- install. The file will only be listed here if
figuration > Files) and the device type must be spe- it has been uploaded to Management
cified. Center (Configuration > Files ).
See Remove Unused Tenant Policy.
Remove Unused Removes tenant policy when there is no policy assigned No additional fields.
Policy to the tenant on the appliance.
See Remove Unused Tenant Policy.
Synchronize Synchronizes configuration settings from one device Source Device * - Select the device
Devices (the source) to one or more similar devices running the whose settings you want to copy to other
same or later OS versions. devices.
Management Center supports synchronization of the fol- What to synchronize (*) - Varies by
lowing device types: SSL Visibility, Content Analysis, source device.
and Malware Analysis.
See also "Synchronize Devices" on page 104.
399
Job Scheduling Options
Define a schedule for each job that you create or edit from the Schedule dialog in the Job wizard.
Verify that the time zone is configured for the region in which the job will occur. See "Synchronize the System Clock using
NTP" on page 480.
Consider the following scheduling options.
Immediate
If you select Immediate , the job runs immediately after you finish creating or editing the job. To have the job listed on the
Scheduled jobs page, select Save this job in Scheduled Jobs.
The job displays in Job History and Scheduled Jobs (if you selected the check box).
No Schedule
To run a on-demand job or to define the schedule later, select No Schedule.
Although the job does not have a schedule, it still displays in the Scheduled Jobs section. When you are ready to run the
job, initiate the job manually by selecting Run Now. Management Center displays the Are you sure you want to run the
selected job now? message. Click Yes. The Job History page displays the completed job.
Run Once Only
Certain jobs only need to be run once (for example, when you install policy to a device).
Select Run Once Only and then specify the date and time to run the job:
n In the Run at field enter the time (using a 24-hour clock) you want to run the job, or use the arrows to adjust the
time.
n Click the calendar icon and select the day.
The job is listed in the Scheduled Jobs section until it runs at the scheduled time.
400
Periodic
You can schedule a job to run periodically, such as every two weeks or every three days. To specify a periodic schedule,
you indicate the frequency the job should run and when you want the first job to run:
n Run every (number) of (minutes, hours, or days)
n Starting at (time) on (a specific date). Enter the time using a 24-hour clock.
The job will be listed in the Scheduled Jobs section.
Daily
You can schedule a job to run every day at a certain time. Specify the time using a 24-hour clock:
n Run at (hh) : (mm)
The job will be listed in the Scheduled Jobs section.
Monthly
You can schedule a job to run monthly. To specify a monthly schedule, you indicate which day of the month to run the job as
well as the time of day:
n Run on the (first, second, third, fourth, fifth) (Monday, Tuesday, Wednesday, Thursday, Friday, Saturday, Sunday)
of the month.
n Run on day(1-31) of the month.
n Run on the last day of the month.
n Run at (hh):(mm) Enter the time using a 24-hour clock.
The scheduled job will display in the Scheduled Jobs section.
It is important to remember that if the job that you are scheduling is big (meaning it will take a lot of time and
resources), it is recommended you schedule the job to run during off-hours or on weekends.
401
Monitor Jobs
Scheduled Jobs list all the jobs that have been created and are either scheduled to run or have no schedule and must be
run manually. Use this screen to see when scheduled jobs will run next, when jobs have last run, how many times each job
has run, and who created the job.
2. From this list of scheduled jobs, you can select a job and perform any of the following tasks on the job:
n Edit—Change any of the job parameters (basic information, operation parameters, targets, schedule). See
"Edit a Job" on the next page.
n Delete—Permanently remove the job from the list of scheduled jobs
n Enable—Re-enable a job that has been disabled
n Disable—Disable the job so that it will not run as scheduled
n Run Now—Initiate the operation of the job; any job can be manually run — unscheduled as well as scheduled
You can also right-click a job and select the task from the menu.
By default, jobs are sorted alphabetically by name. To sort by a different column:
1. Hover the mouse on the column heading you want to sort by, on the right edge of the column.
2. Click the triangle and select Sort Ascending or Sort Descending.
402
Edit a Job
You can edit any job listed on the Scheduled Jobs page.
1. Select Jobs > Schedule Jobs.
2. Select the name of the job that you want to edit. Click Edit. The web console displays the Edit Job Wizard.
3. Edit the information on each tab as needed to complete the job:
n Basic Info—Change the job name, description, and whether to email job results. An asterisk denotes fields
that are mandatory.
n Operation—
n For a Single Operation job, you can change any of the fields specific to the operation. (See "Job
Operations" on page 397 for details.) However, you cannot modify the operation itself; if you want to
change the operation, you will need to create a new job.
n For a Multistep Operation job, you can add more jobs (Select Job), Remove jobs, Move Up/Move
Down jobs in the execution order, and/or select the job to Stop on Fail for a specific job.
This requires you to first create the Single Operation jobs you want to execute before they can
be used in a Multistep Operation job.
n Targets—Based on the operation, you can either add or remove targets, or a message displays stating that
the job will run on the targets already specified.
n Schedule—From Schedule, you can choose from the following schedule types. (See "Job Scheduling
Options" on page 400).
o Immediate
o No Schedule
o Run Once Only
o Periodic
o Daily
o Weekly
o Monthly
4. Click Save.
403
View Current Jobs
The Current Jobs section displays all currently running jobs. To view jobs that have already occurred, "View Job History"
on page 406. To view all scheduled jobs, see "Monitor Jobs" on page 402. To cancel a currently running job, see "Cancel a
Currently Running Job" on the next page.
1. Select Jobs > Current Jobs. The top pane displays the following details:
Column Description
Name This is the name you gave the job when you created it. See "Add a Job" on page 395.
Status This is the current status of the job. The status of a job changes from Running to Complete.
Progress This progress bar is constantly updating. You can view in real-time the progress of the current job.
The color of the progress bar correlates with the top of the web console banner.
Start Time This shows the start time (in a 24-hour clock format) of the current job.
End Time The shows the end time (in a 24-hour clock format) of the current job.
Description This is the description you gave the job when you created it. Although entering a description is
optional, the description (and name) help differentiate versions of the similar jobs. For example, a
common job is "Backup", but without a good description it is difficult to see which devices are
currently being backed up.
Each time you start a job manually a Job Progress window displays. If you want to run the script in the
background (and get rid of the window) while you do other tasks in Management Center, click Continue in
Background.
2. If you select a name of a currently running job in the top pane, the details of that job appear in the two bottom panes.
3. The Job Progress Summary pane includes filters for the device on which the job is currently running. To cancel a
currently running job, click Cancel.
If you have too many jobs going to keep track of, you can filter the results by:
n Complete = Green
n Error = Red (Hover your mouse over all jobs with errors to view the details of the error)
n Warning = (Hover your mouse over all jobs with warnings to view the details of the warning)
n Running = Grey (Grey signifies inactivity)
For more information on colors and status indicators, see "About Color-Coded Status Indicators" on
page 30.
404
Cancel a Currently Running Job
To cancel a currently running job, select Jobs > Current Jobs.
1. Select the job you want to cancel.
2. Click Cancel.
Some steps of a job that are currently in progress will run to completion instead of being canceled.
3. Ensure that the job running is canceled by checking the Status column and the Job Results pane. Check for errors,
which appear with a red exclamation mark in the Status column:
4. All jobs that you successfully cancel are obvious in the web console. Canceled jobs appear as such in the Status
column.
Some jobs have multiple commands running on multiple devices. The more complex a job is, the more errors
may occur when you choose to cancel a running job.
405
View Job History
View all past jobs and their status. The Job History section is similar to the Current Jobs list, but the Job History displays
thousands of results of jobs that have already occurred. The Current Jobs section displays currently running jobs. To view
currently running jobs, see "View Current Jobs" on page 404. To view all scheduled jobs, see "Monitor Jobs" on page 402.
You can view more details of a completed job from Job History.
1. Select Jobs > Job History.
2. The Job History top pane displays the following details about each completed job:
Column Description
Name This is the name you gave the job when you created it. See "Add a Job" on page 395.
Status This is the status of the job. More details are available about the job.
Progress This progress bar is displays completed jobs, with the latest job that was run always on top.
Start Time This shows the start time (in a 24-hour clock format) of the selected job.
End Time The shows the end time (in a 24-hour clock format) of the selected job.
Description This is the description you gave the job when you created it. Although entering a description is
optional, the description (and name) help differentiate versions of the similar jobs. For example, a
common job is "Backup", but without a good description it is difficult to the different backups that
occurred.
3. If you select a name of a job in the top pane, the details of that job appear in the two bottom panes. The Job Name
and the Job Results are detailed in the bottom panes. You can copy and paste the text in these panes. The text in
the Status field is especially useful for debugging.
Management Center can be down while a job is running. The jobs that run while Management Center is down
never appear in Current Jobs but they will appear in Job History when Management Center is back up and
running.
View Job Progress
The Job Progress Summary pane includes filters for the device on which the jobs have run or are currently running. If you
need to filter the Job History results, you can filter the results by:
n Complete = Green (Green indicates that the job is running or has already run successfully)
n Error = Red (Red signifies that the job did not run because of an error. Select the job name to drill down for the
details)
n Warning = Yellow (Yellow signifies the job ran, but issues occurred. Select the job name to drill down for the
details)
n Running = Green or Grey (Grey signifies inactivity)
When the Job Progress window displays a currently running job that is taking a long time, you have the option to
Continue in Background.
For more details on the use of color and status indicators, see "About Color-Coded Status Indicators" on page 30.
406
You cannot delete a job from Job History, you can only "Cancel a Currently Running Job" on page 405.
407
Management Center Reports
Management Center allows you to consolidate data from all, or a group of, ProxySG appliances you have added as managed
network devices. Management Center offers Statistics Monitoring and Reporter reports.
Statistics Monitoring Reports
Statistics Monitoring reports consolidate statistics from your managed ProxySG devices. There are two categories of Stat-
istics Monitoring reports:
l Devices: a variety of reports about the network traffic seen by a single ProxySG device, ProxySG appliances in a
device group, or all ProxySG devices
l WAN Optimization: reports for ProxySG appliances with a Proxy or MACH5 Edition license.
"View Statistics Monitoring Reports" on page 458
For descriptions of each report, refer to "Reference: Statistics Monitoring Reports in Management Center" on page 459.
Reporter Reports
If you have integrated Symantec Reporter into Management Center, additional sets of reports are available to you. Reporter
reports are grouped into the following categories:
l Security: reports that reveal activity on the network that may pose security or liability concerns.
l Web Applications: reports that provide insight into the web applications being accessed on your network, as well as
the riskiness of these applications.
l User Behavior: reports that give you insight into the websites and categories of web traffic users are viewing or are
blocked from viewing, and the amount of web traffic for different time periods.
l Bandwidth Usage: reports that analyze hourly, daily, and monthly bandwidth usage on the network, and estimate
the time and data cost of that usage.
"Integrate Reporter into Management Center" on the next page
For descriptions of each of these reports, see "Reference: Report Descriptions" on page 422.
Integrate Reporter into Management Center
Prerequisites
n Obtain or verify administrator access to Reporter Enterprise Server 10.1.x or later.
n Verify that Reporter Enterprise Server is deployed inline with ProxySG appliances within your network.
n Ensure that you have access to a Reporter Enterprise Server (username and password).
n To be able to view Reporter reports on managed devices, you will need to add a Reporter Enterprise Server from the
Network tab.
Procedure
To integrate Reporter so that you can view Reporter reports in the Management Center web console:
1. Verify prerequisites above.
2. Add Reporter as a managed device in Management Center.
3. "View a Reporter Report" on the facing page.
409
View a Reporter Report
Reporter reports can only be viewed if you have already added the Reporter Enterprise Server as a managed device.
You can view one of the built-in reports as described below, or create your own custom reports and groups.
The procedure below documents an example of how to view a Reporter report. This example uses the Security report
Trend of Blocked Requests.
1. Select Reports > Reporter.
2. Select a role and the Reporter database from the Database drop-down list at the top of Reports Home. The
database you select determines the list of available reports.
If the database you want is not available, see "Determine Why A Reporter Database Does Not Display" on
page 448.
Reporter has the following report categories:
l Security
l User Behavior
l Log Detail
l Bandwidth Usage
l Web Applications
3. In this example, select Trend of Blocked Requests in the Security list. A default line graph is displayed with
Average Requests and a Normal Request Range. Line graphs show how data for the trend changes over time.
Average Requests represent the average number of blocked requests specific to your organization. The Normal
Request Range is a calculation that produces a "normal" range of blocked requests specific to your organization.
4. (Optional) Change the date filter to display a different time range on the report. The default time range for this report
is 7d (7 days).
410
You can also use the arrows and to filter the date and time. When you change the date range, the dates are

expanded or contracted along the bottom of the report.
5. (Optional) Most report data is generated in UTC time. To ensure the report you're viewing is relevant to the time zone
where the users are located, you can set a time zone by clicking . The Profile dialog appears, with Reporter
Time Zone selected. Select your preferred time zone from the drop-down menu and click Save.
6. (Optional) From the Quick Pick drop-down, select a type of relative date filter, for example, Before or Since.
7. (Optional) Change the graph type by selecting the button next to Actions
Graph types include:
n Area - An area graph displays graphically quantitative data. It is based on the line chart. The area between
axis and line are commonly emphasized with colors and textures. Commonly used area graphs compare one
area with two or more areas.
n Bar - A bar graph presents grouped data with rectangular bars with lengths proportional to the values that they
represent. The bars are plotted horizontally and show comparisons among categories. One axis of the graph
shows the specific categories being compared, and the other axis represents a discrete value. Grouped bar
graphs display bars clustered in groups of more than one bar graph.
n Column - A column graph presents grouped data with rectangular bars with lengths proportional to the values
that they represent. The bars are plotted vertically and show comparisons among categories. One axis of the
graph shows the specific categories being compared, and the other axis represents a discrete value. Grouped
column graphs display bars clustered in groups of more than one column graph.
n Line - Line graphs show how data for one data type changes over time.
n Pie - A pie graph is a circular statistical graphic, divided into slices to illustrate numerical proportion. In a pie
graph, the arc length of each slice (and thus the central angle and area), is proportional to the quantity it
represents. The pie chart displays the value name and metric when a user hovers the mouse over a section.
8. The default overlay for the Trend of Blocked Requests report is Requests. (Optional) To add or change overlays,
select an overlay from the legend on the right of the report. Each overlay is represented by a different color and
pattern. For example:
411
9. (Optional) Click each data type, (Requests, Page Views, Browse Time, etc.) to have them appear in the open
report. To remove data types from the graph, click the appropriate entry again.
10. (Optional) Save the customized report you have open by clicking Actions > Save As. The Save As Dialog
appears.
412
11. (Optional) Save the current report view in HTML format for offline viewing by clicking Actions > Download. The
system displays the Download dialog.
Select HTML, then the number of rows you want included in the offline HTML report, then click Download. Leave
the default value, Visible, if you would like the report to contain only the data that appears on screen. Click Close to
cancel.
12. (Optional) To view a report that is currently open, select that report from the menu on the left of the page. When
multiple databases are available, open reports are separated by database.
413
13. (Optional) In addition to a graph, each report includes a table that displays the data used in the graph. You can drill
down into this data to display additional reports. For example, if a Category report is displayed, you can click one
of the categories in the data grid and drill down to find out what sites are being viewed and who is viewing them.
There are two ways to drill down in a report:
a. Click the text in the data field that you want to drill down into. The Overview report for that element, (URL,
Category, User, etc.) displays.
b. Right-click any field in the table at the bottom of a report to display a list of fields. The menu will display
fields common to the type of report you are viewing. In the below example, a Category report offers Site as
the most common option, to display the sites listed in the selected category. Select your preferred field from
414
the More Fields menu item to view drilled-down reports for other data fields.
14. (Optional) Generate an an Overview report of items in the data grid. To see more information about an item in the
report, click the hyperlink to launch an Overview report for that item. For example, if you click the hyperlink for CNN,
the Overview report will show a daily trend of traffic to CNN, the top users and Client IPs accessing CNN, and a
breakdown of the protocols used to access CNN.
415
15. (Optional) Filter or change the report criteria.
Customize Reporter Report Options
Starting with Management Center 1.6, you can now customize every Reporter report. In some cases, these reports can
take significantly take longer to run than the standard reports available on Management Center. Although these reports can-
not be saved for later use, you can create your own custom reports; see "Create a Custom Report" on page 431.
You can alter what is reported in the following ways:
l "Add Report Filters" below
l "Change the Report Summary" on page 418
Add Report Filters
1. Select a Reporter database.
2. Select the desired report.
3. Optional—adjust the report settings (date range, format, and so on).
4. To customize the report, select the gear icon in the upper right corner.
416
5. Add a filter.
a. In the Filters section, click Add Filter.
b. Select a field.
c. Select the appropriate operator. The available operators change depending on the selected action.
417
d. Select or enter a value.
6. Optional—Add another filter by repeating step 5. You can add any number of filters.
7. Click Run Report.
Filter Examples
Example 1: If the administrator selects the filter Site, the operator contains, and enters facebook for the value, the report
returns only sites that contain the string "facebook."
Example 2: If the administrator selects the filter Client IP, the operator matches, and enters the IP address range
10.1.1.0/22, the report includes all addresses in that network mask.
Example 3: If the administrator selects the filter Hours of Day, the operator in between, and selects the hours 9 a.m. and
5 p.m, the report includes data only for the time between 9 and 5.
Change the Report Summary
This section describes how to change the report summary.
418
Change the number of items displayed per page
1. In the Summarize By section, change the Display value.
2. Change other options as desired.
Change the report summary (that is, change the focus of the report)
1. In the Summarize By section, choose the field you want to focus the report on from the Summarize By drop-down
list. This field is the main metric that Management Center will use to present the data.
419
If a Reporter administrator had created custom log fields in Reporter 10.x, these fields will be displayed in
the list along with the standard built-in fields.
When you change the Summarize By field, a new report is generated and the name of the report is changed to match your
selection. The previous report is still available in the left pane.
420
Create a two-level report
1. In the Summarize By section, click Two Level for the Summary Type.
2. Select the two values to report. In the following example, the report is summarized by Day and then by Verdict.
421
Reference: Report Descriptions
The following report groups are available if you have integrated Reporter 10.1.x or later with Management Center:
Some reports require Reporter versions later than 10.1.2.x. These requirements are noted in the report description.
n Security
n User Behavior
n Bandwidth Usage
n Web Applications
n Log Detail
From the Database drop-down list, select the Reporter database to use in your reports. The information displayed in the
report group will differ according to the database selected. For example, WAF database reports contain an Actions report
in the Security group. That report is not displayed for other databases.
The following tables briefly describe the default graph in each of the Reporter reports. In addition to a graph, each report
has a data grid displaying the statistics used in the graph, you can drill-down into this data for more details. Note that you
have many options for customizing reports: displaying just the graph, displaying just the data grid, changing the graph
type, specifying a date filter, and selecting/unselecting overlays. See "View a Reporter Report" on page 410 for details.
Reporter reports in Management Center are derived from Reporter database log files, and these reports may be dif-
ferent or enhanced from similar reports in Reporter Enterprise Server.
Security
The Security reports reveal activity on the network that may pose security or liability concerns. The available reports may
differ depending on the selected database type.
Report Description of Default Graph
Potentially To view this report, you must add a Reporter appliance running 10.1.4.x or later and select a unified data-
Infected Cli- base.
ents - Uni- Reporter 10.1.4 introduces the ability to create a database that includes malware scanning and sand-
fied boxing results from the Symantec Content Analysis (CA) appliances and Malware Analysis (MA) appli-
ances that are deployed as part of your SGOS proxy security solution. These reports are called Unified
reports.
Displays an area, bar, column, or pie chart of the client IP addresses that might be infected by malicious
content, as found by sandboxing, file reputation, predictive analysis score, anti-virus, and WebPulse. By
default, the report lists each IP address, sorted by the number of risky requests.
Potential To view this report, you must add a Reporter appliance running 10.1.3.x or later.
Malware
Displays a bar chart of the client IP addresses that might be infected by malicious content, as found by
Infected Cli- sandboxing, file Reputation, anti-virus, WebPulse. By default, the report lists each IP address, sorted by
ents the number of risky requests.
422
Malware Displays a bar chart of the names of the malware detected by CAS / Proxy AV. To view this report, you
Detected must add a Reporter appliance running 10.1.3.x or later.
Names
Note: This report will be blank if user name data isn’t available in the Reporter log file.
Blocked For each user, this report shows a bar chart of the number of requests that were blocked due to the URL
Users being from one or more of the following categories: Spyware, Suspicious, Phishing, or Malicious.
Blocked For each user agent (browser + version), the report shows a bar chart of the number of blocked
Request by web requests to URLs from one of the following categories: Spyware, Suspicious, Phishing, or
User Agent Malicious.
Threat Displays a a bar chart of the websites that had blocked web requests to URLs from any of the fol-
Sites lowing categories: Spyware, Suspicious, Phishing, or Malicious. The sites with the most blocked
Blocked web requests appear at the top of the report.
Trend of Displays a line graph that shows the number of risky web requests (for example, requests to
Risky URLs of malware categories) over the specified time period. The graph contains a shaded area
Requests that represents the normal requests range, which is a range based on the organization's web
traffic history over the last month. In addition, a dotted horizontal trend line indicates the average
number of risky web requests during the last month.
Trend of Displays a line graph that shows the number of users making requests to URLs of risky categories (Spy-
Risky Users ware, Suspicious, Phishing, or Malicious) over the specified time period. The graph contains a shaded
area that represents the normal count range, which is a range based on the organization's web traffic his-
tory over the last month. In addition, a dotted horizontal trend line indicates the average number of users
making risky web requests during the last month.
Note: User drill-downs are blank if user name data isn’t available in the Reporter log file.
Trend of Displays a line graph that shows the number of web requests that were blocked over the spe-
Blocked cified time period. The requests could be blocked for a variety of reasons, such as due to deny
Requests policies on the ProxySG. The graph contains a shaded area that represents the normal requests
range, which is a range based on the organization's web traffic history over the last month. In
addition, a dotted horizontal trend line indicates the average number of risky web requests
blocked during the last month.
Trend of Displays a line graph that shows the number of users who were blocked over the specified time period.
Blocked The users could be blocked for a variety of reasons, such as due to deny policies on the ProxySG. The
Users graph contains a shaded area that represents the "normal count range," a range based on the organ-
ization's web traffic history over the last month. In addition, a dotted horizontal trend line indicates the
average number of users blocked during the last month.
Note: User drill-downs are blank if user name data isn’t available in the Reporter log file.
Trend of Displays a line graph that shows the number of client IP addresses that accessed URLs in the fol-
Risky Cli- lowing categories: Spyware, Suspicious, Phishing, or Malicious. The graph contains a shaded
ents area that represents the "normal count range," a range based on the organization's web traffic
history over the last month. In addition, a dotted horizontal trend line indicates the average num-
ber of client IPs that were potentially infected during the last month.
423
Threats To view this report, you must add a Reporter appliance running 10.1.3.x or later.
Displays a bar chart that provides details for the number of threats discovered by each detection method
(Sandboxing, File Reputation, Anti-virus, WebPulse).
Threats - To view this report, you must add a Reporter appliance running 10.1.4.x or later and select a unified data-
Unified base.
Reporter 10.1.4 introduces the ability to create a database that includes malware scanning and sand-
boxing results from the Symantec Content Analysis (CA) appliances and Malware Analysis (MA) appli-
reports.
Displays an area, bar, column, or pie chart that provides details for the number of threats discovered by
each detection method (sandboxing, file reputation, predictive analysis score, anti-virus, WebPulse).
If Malware Analysis processing results in a detonation, the Malware Analysis sends that result to
the Content Analysis, which notifies the SGOS proxy device. The SGOS proxy device caches the
result and blocks subsequent requests that match. However, the log entries for these cache block
actions do not contain the sandboxing vendor or score. Because of this, you might not see the Mal-
ware Analysis benefits reflected in the reports. For example, the SGOS proxy device might block
20 requests that match a cached result; the Malware Analysis is credited with only one result (the
one that resulted in the cache entry). However, when the SGOS proxy device receives a clear
cache action (for example, when new AV patterns are loaded), the Malware Analysis action re-
occurs on the next request.
Trend of To view this report, you must add a Reporter appliance running 10.1.3.x or later.
Threats
Displays a column chart that shows the trend over time for each detection method (Sandboxing, File Repu-
tation, Anti-virus, Web Pulse).
Trend of To view this report, you must add a Reporter appliance running 10.1.4.x or later and select a unified data-
Threats - base.
Unified Reporter 10.1.4 introduces the ability to create a database that includes malware scanning and sand-
boxing results from the Symantec Content Analysis (CA) appliances and Malware Analysis (MA) appli-
reports.
Displays an area, bar, column, or pie chart that shows the trend over time for each detection method (sand-
boxing, file reputation, predictive analysis score, anti-virus, WebPulse).
Threats - To view this report, you must add a WAF database from a Reporter appliance running 10.1.3.x or later.
WAF
Displays an area, bar, column, or pie chart that shows the number of threats by category (attack family or
anti-virus). Each colored section represents a threat type and corresponding number of incidents.
Trend of To view this report, you must add a WAF database from a Reporter appliance running 10.1.3.x or later.
Threats -
Displays an area, bar, column, or pie chart that shows the trend over time for anti-virus and attack family
WAF threats.
424
Actions To view this report, you must add a WAF database from a Reporter appliance running 10.1.3.x or later.
Displays an area, bar, column, or pie chart that shows action-related data. This data includes requests,
page views, browse time, cost (time), cost (bytes), total bytes, bytes sent, bytes received, cache bytes,
server bytes, bytes saved.
Methods To view this report, you must add a WAF database from a Reporter appliance running 10.1.3.x or later.
Displays an area, bar, column, or pie chart that shows data per HTTP method. These actions include
requests, page views, browse time, cost (time), cost (bytes), total bytes, bytes sent, bytes received,
cache bytes, server bytes, bytes saved.
Attack Fam- To view this report, you must add a WAF database from a Reporter appliance running 10.1.3.x or later.
ilies
Displays an area, bar, column, or pie chart that shows the number of requests per attack type (for
example, SQL injection). The data corresponds to that recorded for the x-bluecoat-waf-attack-
family log field. Each slice represents an attack type. The chart displays only the top ten attack types.
Attack Fam- To view this report, you must add a WAF database from a Reporter appliance running 10.1.3.x or later.
ilies Per
Displays an area, bar, column, or pie chart that shows the total number of attacks per country. The bar is
Country segmented; each color represents a different attack type. The chart displays only the top ten countries.
The data is based on geolocation data and is only shown when either x-bluecoat-waf-attack-fam-
ily or x-virus-id does not include “-“.
Sandboxing To view this report, you must add a Reporter appliance running 10.1.3.x or later.
Risk Score
Displays a pie chart that shows the number of requests in each risk score. Each slice represents a risk
score.
Sandboxing
Displays an area, bar, column, or pie chart that shows the trend over time for each risk score.
Predictive
Displays an area, bar, column, or pie chart that shows the trend over time for each predictive analysis
Analysis score.
File Repu-
Displays an area, bar, column, or pie chart that shows the trend over time for each file reputation score.
tation
File Risk To view this report, you must add a Reporter appliance running 10.1.3.x or later.
Score
score.
File Risk To view this report, you must add a Reporter appliance running 10.1.3.x or later.
Score
score.
URL Threat To view this report, you must add a Reporter appliance running 10.1.5.4 or later.
Displays a pie chart that shows the risk threat level (a rating between 1 and 10) of URLs. Malicious sites
rank higher (for example, a 9 or 10) while a site that may be questionable, yet not malicious, may rank
lower (for example, a 4 or 5). You can use the report to filter out specific risk levels. You can also see the
users who visit the higher risk sites more frequently.
425
User Behavior
The User Behavior reports give you insight into the websites and categories of web traffic users are viewing or are
blocked from viewing, and the amount of web traffic for different time periods.
Blocked Displays a bar graph that shows the number of web requests that were blocked on each website.
Requests The sites with the most blocked requests appear at the top of the report.
by Site
Blocked Displays a bar graph that shows the number of web requests that were blocked in each
Requests URL category. The categories with the most blocked requests appear at the top of the report.
by Category
Blocked Displays a bar graph that shows the number of web requests that were blocked for each user. The users
Requests with the most blocked requests appear at the top of the report.
by User Note: This report will be blank if user name data isn’t available in the Reporter log file.
Filtering Displays a stacked column graph that shows the number of web requests that triggered specific
Verdict policy verdicts. By default, all verdicts are selected; you will want to select just the policy verdicts
Trend by you are interested in (such as connect_method_denied and policy_denied).
Day
Sites Displays a bar graph that lists the websites with the most page views. For each website, the graph
illustrates the number of page views during the specified time period. The site with the most page
views appears at the top of the report.
Categories Displays a pie chart that shows the categories with the most page views; all other categories are
combined into an Other slice.
Categories Displays a bar graph that lists the names of the most active users and indicates the most accessed URL
per User categories for the pages they viewed. The graph shows the number of pages viewed in each category for
each user.
Users A bar graph that shows the users with the most page views during the specified time period. The user with
the most page views appears at the top of the report.
Client IPs Displays a bar graph that shows the client IP addresses with the most page views during the spe-
cified time period. The client IP with the most page views appears at the top of the report.
User Agent In releases prior to 1.9.1.1, you must add a WAF database from a Reporter appliance running 10.1.3.x or
Families later to view this report. In 1.9.1.1 and later, this report is available for Main and Unified databases if you
are using a Reporter 10.1.5.x database.
Displays an area, bar, column, or pie chart that shows the top 10 client user agent families (not user agent
strings). For example, Firefox.
Countries To view this report, you must add a WAF database from a Reporter appliance running 10.1.3.x or later.
Displays an area, bar, column, or pie chart that shows the top ten countries per number of requests (based
on geolocation data).
426
Protocols To view this report, you must add a Reporter appliance running 10.1.3.x or later.
Displays an area, bar, column, or pie chart that shows the number of number or requests per protocol. The
chart shows only the top 10 protocols.
Days Displays an area graph that shows the number of web requests for each day in the selected time
period.
Days of Displays a column graph that shows the number of web requests for each day of the week in the
Week selected time period. For example, the Monday column reflects the total of all requests that were
made on Mondays during the time period. This report allows you to see how the trends in web
browsing differ by day of the week.
Hours of This column graph totals web requests for each hour of the day. For example, every Web page
Day request that occurred at 9am, 10am, and so on. This allows you to analyze which hours are con-
sistently the heaviest with Web requests. Network administrators might use this data to adjust
bandwidth policy.
Months This report totals web requests for each month. For example, every web page request that
occurred in January, February, and so on. This allows you to drill down each month and analyze
trends.
Trend of Displays the number of unique users per day over the selected time period. To view this report,
Discovered you must add a Reporter appliance running 10.1.2.x or later.
Users
Bandwidth Usage
Use the Bandwidth Usage reports to analyze hourly, daily, and monthly bandwidth usage on the network, and to estimate
the time and data cost of that usage.
The cost-related reports calculate bandwidth cost based on the Cost per MB and Cost per Hour settings in Reporter. For
example, if Cost per Hour is set to $10, the Cost (Time) value is calculated by multiplying the time spent web browsing by
$10 . Or if Cost per MB is set to $4, the Cost (Bytes) value is calculated by multiplying the number of megabytes of traffic by
$4.
Cost per The data in this bar graph approximates the cost accrued per user based on total bytes of throughput and
User time spent web browsing. Reporter lists each user, sorted by the total cost of bandwidth.
Note: This report are blank if user name data isn’t available in the Reporter log file.
Cost per Displays a bar graph that shows the total bandwidth cost for the websites each user visited during the selec-
User and ted time period. The users with the highest bandwidth cost appear at the top of the graph.
Site Note: This report are blank if user name data isn’t available in the Reporter log file.
Cost per Displays a column chart that shows the total cost of time and bandwidth for each hour of the day.
Hour of For example, total cost at 9am, 10am, and so on. This allows you to analyze which hours have the
Day most traffic and are therefore most expensive. Network administrators might use this data to adjust
bandwidth policy.
427
Cost per Displays an area chart that shows the cost of time and bandwidth each day in the specified time
Day period.
Cost per Displays a column graph that shows the total cost of time and bandwidth each day of the week in the
Day of selected time period. For example, the Monday column reflects the total cost on Mondays during
Week the time period. This report allows you to see how the cost of web usage differs by day of the week.
Cost per This area graph totals time and bandwidth costs for each month. For example, total costs in Janu-
Month ary, February, and so on. This allows you to drill down each month and analyze trends.
Bandwidth This column chart shows the total bytes sent and received for each hour of the day. For example,
per Hour total bandwidth usage at 9am, 10am, and so on. This allows you to analyze which hours have the
of Day most traffic. Network administrators might use this data to adjust bandwidth policy.
Bandwidth This area chart shows the total bytes sent and received each day in the specified time period, allow-
per Day ing you to see a trend of bandwidth usage over time.
Bandwidth This column graph shows the total bytes sent and received each day of the week in the selected
per Day of time period. For example, the Monday column reflects the amount of bandwidth used on Mondays
Week during the time period. This report allows you to see how the trends in web usage differ by day of the
week.
Bandwidth This area chart shows total bandwidth used each month. For example, total bytes in January, Febru-
per Month ary, and so on. This allows you to drill down each month and analyze trends.
Server IPs To view this report, you must add a WAF database from a Reporter appliance running 10.1.3.x or later.
Displays an area, bar, column, or pie chart that shows the number of requests per server IP address. You
can also select other data, including requests, page views, browse time, cost (time), cost (bytes), total
bytes, bytes sent, bytes received, cache bytes, server bytes, and bytes saved.
Log Detail
The Log Detail reports provide information about the bcreporterwarp_v1 access log fields.
Full Log Details To view this report, you must add a Reporter appliance running 10.1.3.x or later.
Displays a grid report of the access log fields associated with the selected database. For example, if
a WAF database is selected, this report shows data for the bcreporterwarp_v1 access log.
Blocked Log To view this report, you must add a Reporter appliance running 10.1.3.x or later.
Details
Displays a grid report of the access log fields for blocked requests associated with the selected data-
base. For example, if a WAF database is selected, this report shows data for the bcreporterwarp_v1
access log.
Web Applications
The Web Application reports provide insight into the web applications being accessed on your network, as well as the risk-
iness of these applications.
428
Web Applic- A bar graph that shows the number of requests for each web application during the specified time
ations period. The web applications having the most web requests appear at the top of the report. Use
this report to see what types of web application traffic are running on your network.
Web Applic- Displays a pie chart of the top web applications as calculated by the number of users accessing
ations by the content over the selected time period. To view this report, you must add a Reporter appliance
Users running 10.1.2.x or later.
Web Applic- Displays a pie chart of the top web applications as calculated by the number of unique IP
ations by Cli- addresses accessing the content over the selected time period. To view this report, you must add
ent IPs a Reporter appliance running 10.1.2.x or later.
Blocked Displays a bar graph that shows the number of web requests denied by a policy verdict (that is,
Web Applic- blocked) for each web application during the specified time period. The web applications with the
ations most blocked requests appear at the top of the report. Use this report to confirm that policies are
being enforced properly.
Trend of Act- Displays the number of unique web applications per day over the selected time period. To view
ive Web this report, you must add a Reporter appliance running 10.1.2.x or later.
Applications
Trend of Displays total bytes sent, bytes received, and the number of requests per day over the selected
Web Applic- time period. To view this report, you must add a Reporter appliance running 10.1.2.x or later.
ation Traffic
Web Applic- Displays a bar graph that shows the number of requests for different web application operations
ation Oper- (such as Play Video, Download Files, Upload Media) during the specified time period.
ations
Users of Risky applications are those with risk scores greater than 70. (You can change the filter to make the num-
Risky Applic- ber higher or lower.) Ranked by total bytes received, this report lists users who have accessed web applic-
ations ations that are widely deemed as risky for business network use.
Web Applic- Displays a pie chart that shows the number of requests for web applications at each risk score (1 to 10).
ations per For example, the report shows a bar for each risk score with different color segments representing different
Risk web applications. The length of each segment corresponds to the number of requests for that application.
Tips:
l Sort the values in the Web Application column to alter the pie chart to show the corresponding data.
l You may want to turn off the Other overlay, if this segment has a significant number of requests.
Users Per Shows the number of users per risk score (1 to 10) over the selected time period. To view this
Risk Score report, you must add a Reporter appliance running 10.1.2.x or later.
Risk Dis- Displays a pie chart that shows the percentage of requests at each risk level. Each slice rep-
tribution resents a risk level.
Risk Dis- Displays a color-coded bar chart that shows the amount of traffic (hits and bytes) for each risk
tribution Per score (1 to 10) per user over the selected time period. To view this report, you must add a
User Reporter appliance running 10.1.2.x or later.
429
Trend of Displays a color-coded bar chart representing the amount of traffic (hits and bytes) for each risk
Risk Dis- score (1 to 10) per day over the selected time period. To view this report, you must add a Reporter
tribution appliance running 10.1.2.x or later.
Social Displays a bar graph that shows the number of requests for each operation (such as Post Mes-
Media Activ- sages and Upload Media) used in social networking web applications. The operations that have
ity the most activity appear at the top of the report.
Social Displays a bar graph that shows the number of requests for each social networking application
Media (Facebook, Twitter, Pinterest, and so on). The social networking applications with the most
Applications requests appear at the top of the report. With this report, you can see how much social media
traffic your network has and which applications are most popular. Depending on company policy,
you may decide to put controls on social networking after viewing this report.
Facebook Displays a bar graph that shows the number of Facebook requests by each user. The names of the users
Users with the most Facebook requests appear at the top of the report. This report allows you to see who the
most active Facebook users are.
Facebook Displays a bar chart that shows the amount of traffic attributed to different categories of Facebook
Categories traffic (other than social networking). For example, you can see the number of Facebook requests
that are for games or messaging.
Mail Activity Displays a bar graph that shows the number of requests for various email operations. For
example, you can see the number of requests for Send Email, Download Attachment, and Upload
Attachment operations for email web applications.
Mail Applic- Displays a bar graph that shows the number of requests for web mail applications (Gmail, Yahoo
ations Mail, Hotmail, and so on). The email applications with the most requests appear at the top of the
report. This report allows you to determine the most popular web mail applications on your net-
work.
Top Mail Displays a bar graph that shows, for each user, the number of requests for Send Email or Send
Senders Attachment operations. This report allows you to see which users are the biggest web mail con-
sumers. The IP addresses of the users with the most web mail traffic appear at the top of the
report.
Search Displays a bar graph that displays top search terms that users enter in browser search engines
Terms (Google, Yahoo, Bing, and so forth). You can drill down to find the user(s) who searched for the
term and which search engine was used.
Search Displays a bar graph that displays the number of requests for each search engine (Search
Applications Engines/Portals category).
Create Custom Report Groups
Reporter-based reports are grouped into five groups: Security, Bandwidth Usage, User Behavior, Log Detail, and Web
Applications. These groups are static and cannot be modified. However, you can create your own report groups and save
custom reports you create into these new groups.
430
2. Click New Group. The New Report Group dialog opens.
3. Enter a Name for the report group.
4. (Optional) Enter a Description up to 1024 characters.
5. Click Save. The container for the new group displays at the bottom of the Reporter page, underneath the built-in
groups. You can now create and save custom reports to this group.
Additional Information
n To modify the name or description of a custom report group, click the gear icon in the group's title bar.
n To delete a custom report group, click the delete (X) icon in the group's title bar. Note that you cannot delete a group
that contains custom reports; you must delete the reports before you can delete the group.
n To move a custom report from one group to another, select the check box next to the report name and issue the
Operations > Move command.
Create a Custom Report
If you can't find a standard Reporter report that suits your needs, you can design and save a custom report using
431
Management Center's flexible and powerful report designer. When designing your report, you choose one or two metrics to
report on, select the type of chart (such as pie or bar), define the report time frame (such as one day or one year), select the
columns of data (for example, Page Views and Bytes Sent), and configure one or more filters (such as a particular
URL category or a range of risk scores). As you design your report, it dynamically displays in the preview window with
sample data so that you can get a good picture of what it will look like.
Once you have finished designing the report, you can save it for future use and run it at any time.
Step 1: Create the Report
2. Select a Reporter database.
3. Click New Report. The six-step report designer displays in the left pane, and the report preview displays in the
right pane.
4. (Optional) To enlarge the Preview window, hover on the divider line between panes and drag to the left.
5. From the Summarize By drop-down list, select the main metric that Management Center will use to present the
data.
432
If a Reporter administrator had created custom log fields in Reporter 10.x, these fields will be displayed in the
list along with the standard built-in fields.
6. In the Display field, specify the number of items to display in the chart.
7. If you want to report on two metrics:
a. Select Two Level for the Summary Type. An additional row displays so that you can choose a second
metric.
433
b. In the Then By drop-down, select the secondary metric to report on.
c. Select the number of items to Display.
8. As you set options, watch the report build in the Preview window pane.
Step 2: Select the Chart Type
Horizontal bar is the default chart type. The following chart types are available:
n Area - An area graph displays graphically quantitative data. It is based on the line chart. The area between axis and
line are commonly emphasized with colors and textures. Commonly used area graphs compare one area with two
or more areas.
represent. The bars are plotted horizontally and show comparisons among categories. One axis of the graph shows
the specific categories being compared, and the other axis represents a discrete value. Grouped bar graphs display
bars clustered in groups of more than one bar graph.
n Column - A column graph presents grouped data with rectangular bars with lengths proportional to the values that
they represent. The bars are plotted vertically and show comparisons among categories. One axis of the graph
shows the specific categories being compared, and the other axis represents a discrete value. Grouped column
graphs display bars clustered in groups of more than one column graph.
n Pie - A pie graph is a circular statistical graphic, divided into slices to illustrate numerical proportion. In a pie graph,
the arc length of each slice (and thus the central angle and area), is proportional to the quantity it represents. The pie
chart displays the value name and metric when a user hovers the mouse over a section.
After you click a chart type, the Preview window pane displays the report with the selected type of chart.
434
If you selected a two-level report in Step 1, be sure to choose bar or column for the chart type. These are the only
chart types that represent both levels of data in two-level reports. When a two-level report is selected, the column
and bar charts display as stacked columns and stacked bars.
Step 3: Define the Time Frame
Define the reporting period for the report using any of the methods below:
n Choose one of the standard time periods, such as 30d or 1y. The default time period is 24h.
n Use the arrows and to select the date or date range.
n From the Quick Pick drop-down, select a type of relative date filter, for example, Before or Since.
n To specify a custom range of dates, choose Custom from the Quick Pick drop-down, enter the beginning and ending
date, and click Apply.
Step 4: Choose Report Columns
A statistical table appears below the chart in the custom report. For example, if User is the metric selected in the
Summarize By field, the table includes statistics for each user.
435
The default statistics are Requests and Total Bytes. Note that the Preview window only shows two statistical
columns, but the full report when generated will show all selected columns.
Step 5: Add Filters
You can narrow down what is displayed in the report by setting up filters. Here are several examples of filters you can
436
create:
Example 1: If the administrator selects the filter Site, the operator contains, and enters facebook for the value, the report
returns only sites that contain the string "facebook."
Example 2: If the administrator selects the filter Client IP, the operator matches, and enters the IP address range
10.1.1.0/22, the report includes all addresses in that network mask.
Example 3: If the administrator selects the filter Hours of Day, the operator in between, and selects the hours 9 a.m. and
5 p.m, the report includes data only for the time between 9 and 5.
For each filter you want to add to the report, follow the steps below.
1. In the Filters section, click Add Filter.
2. Select a field.
3. Select the appropriate operator. The available operators change depending on the selected field.
437
4. Select or enter a value.

Step 6: Save the Custom Report
So that you can run the report in the future, without having to recreate it, you should save it into a report group.
438
1. In the Save Report section, select Save report for running later.
2. Enter a Name for the report.
3. (Optional) Enter a Description up to 1024 characters. In the description mention the report settings such as the type
of chart, the time period, filters used, and so forth.
4. Select the Group to save the report in. If you haven't created the group yet, you can select the New Group option
from the Group drop-down and define the group name at that time.
5. Click Save and Run to save the settings and view the full report.
Edit Custom Reports
After designing and saving a custom report, you may want to tweak some of the settings.
For more information about any of these settings, see "Create a Custom Report" on page 431.
Modify Report Settings
2. Click the name of the custom report you want to modify; this will run the report.
3. To modify the Summarize By fields and/or Filters, click the gear settings icon.
439
4. To modify the chart type, click the chart icon and select the desired type.
5. The Time Frame can be changed using the time tool bar at the top of the report.
6. To modify the columns:
a. In the report table below the chart, hover the mouse on the right side of a column heading until you see the
triangle, then click.
440
b. Select Columns.
c. Select the columns you want to include in the report.
7. To save the custom report modifications, select Actions > Save.
Delete a Custom Report
2. Select the check box by each report name you want to delete.
3. Select Operations > Delete.
4. Click Delete to confirm.
441
Additional Information
n To rename a custom report, select the check box next to the report name and issue the Operations > Rename
command.
n To copy a built-in or custom report, run the report and issue the Actions > Save As command.
Search for Specific Report Data (Search and Forensic Report)
Management Center enables you to search for specific report data using a simple search or by executing a forensic report.
Use Simple Search
The Reports > Reporter page includes a simple search field in the top right -hand corner, as shown below.
1.
2. Select a search type from the menu. The available criteria differs, depending on the selected database.
3. Enter a search term and click the magnifying glass (or press Enter).
4. The search results display in a new tab on the left.
442
5. Click the search result to view detailed data about that item.
Run Forensic Report
Use the Forensic Report feature to drill down into the database to find specific information based on the source, destination,
and verdict properties of one or more requests. The Forensic Report button is located directly beneath the Management
Center banner.
443
1. Click Forensic Report. The system opens the Run Forensic Report window.
2. Select (or enter) the search criteria from the available data or enter a transaction ID.
3. Select a time duration.
444
4. Click Run Report. The system displays the search results in the Full Log Details report.
5. Click links in the search result to view detailed data about that item.
445
Reporter Graph Types and Views
Reporter graph types depend on the type of data represented in the report. The available graph types are:
n Area - An area graph displays graphically quantitative data. It is based on the line chart. The area between axis and
line are commonly emphasized with colors and textures. Commonly used area graphs compare one area with two
or more areas.
represent. The bars are plotted horizontally and show comparisons among categories. One axis of the graph shows
the specific categories being compared, and the other axis represents a discrete value. Grouped bar graphs display
bars clustered in groups of more than one bar graph.
n Column - A column graph presents grouped data with rectangular bars with lengths proportional to the values that
they represent. The bars are plotted vertically and show comparisons among categories. One axis of the graph
shows the specific categories being compared, and the other axis represents a discrete value. Grouped column
graphs display bars clustered in groups of more than one column graph.
n Pie - A pie graph is a circular statistical graphic, divided into slices to illustrate numerical proportion. In a pie graph,
the arc length of each slice (and thus the central angle and area), is proportional to the quantity it represents. The pie
chart displays the value name and metric when a user hovers the mouse over a section.
Drill down on specific data within a report by selecting a line the column portion in the report, right-click, and selecting from
the available options. Drilling down is most helpful when you know what you are looking for. For example, if you are view-
ing a Trend of Risky Users report, you can drill down on the username or risk categories to find the sites that the user is
visiting the most. The following is an example of data that can is available when you are drilling down in a report:
446
Set Time Zone for Reporter Reports
Associate a custom time zone with your user profile. That time zone is then used for all Reporter reports. Each user can set
a different time zone without affecting other user's views.
1. In the web console banner, click and select your username.
The username for the standard Admin login is "Management Center."
2. Select the Reporter Time Zone tab.
447
3. Select the new time zone.
4. Click Save.
5. When you open a Reporter report, verify your settings by opening a Reporter report and hovering over the time zone
icon.
6. (Optional) Once set, you can change the time zone by clicking the time zone icon.
Determine Why A Reporter Database Does Not Display
If you try to run reports and the database you want is not available in the Database: drop-down menu (Reports >
Reporter), click Status to display that database's current status.
1. Click Reports > Reporter.
2. Click the Database: drop-down. The system displays the available databases.
3. If the database you want is not in the menu or you want to see the current status of the Reporter servers and all
associated databases, click Status.
4. If a Reporter server is available (and you have permissions to view it), you can click the plus symbol to display the
448
associated database(s).
Use the status information to help you determine why the database is not available.
View Statistics Monitoring Reports
An organization without an effective monitoring system is susceptible to issues such as unplanned downtime and per-
formance degradation; thus, the ability to monitor network activity is crucial for capacity planning and quick responses to
potential problems. By analyzing report data, organizations can plan for scalability and anticipate future requirements.
Appliance statistics collection over HTTP port 9009 is disabled by default in 1.7 and later. The new default is HTTPS
port 9010. See Statistics Monitoring Over HTTPS for more information.
Management Center keeps up to 12 months of per hour data and 7 days of per minute data for all devices that have
statistics monitoring enabled. To purge this data from Management Center, see Purge Statistics.
As an administrator, it is critical that you be aware of issues, changes, and trends that could arise in your network. In Man-
agement Center, you can report on key metrics such as CPU usage, connection counts, bandwidth gains and losses, and
other statistics of managed appliances. Statistics Monitoring reports provide you with visibility into network performance.
With reports, you can identify trends such as:
n Usage patterns
n Bandwidth savings
n Peak numbers of concurrent users
n Statistics averaged over weeks and months
To ensure that your data analysis is accurate and timely, identify the metrics that are most important to you and run reports
regularly.
You can monitor the health of your devices without generating a report. See "Monitor Device Health " on page 113.
Prerequisites
You can report on ProxySG appliances that:
n Run SGOS 6.3.x and later
n Have a Proxy or MACH5 Edition license (Note: this is a requirement for WAN Optimization reports, not Device
reports)
n Have the latest trust package installed
n Do not have Federal Information Processing Standards (FIPS) mode enabled
n Have statistics collection enabled in device properties (see "Add a Device" on page 68)
You can still manage ProxySG appliances that do not meet these requirements, but their statistics will be unavailable from
Statistics Monitoring.
Procedure
To view Statistics Monitoring reports:
449
1. Select Reports > Statistics Monitoring.
2. Select a report from Devices or WAN Optimization. See "Reference: Statistics Monitoring Reports in
Management Center" on page 459 for descriptions.
3. From a dashboard widget, you can also "Display a Full Report" on page 465.
4. Refine reports to make them more useful:
n Display data for a specific time period. See "Change the Scope of a Statistics Monitoring Report" on
page 464.
n Add metrics to focus on specific data. See "Modify Options for Statistics Monitoring Reports" on page 462.
Reference: Statistics Monitoring Reports in Management Center
The following Statistics Monitoring reports are available in Management Center.
Devices Reports
Device reports show statistics on network traffic seen by a single ProxySG device, ProxySG appliances in a device
group, or all ProxySG devices.
Report Description Report Field Overlays

Format
CPU Displays the percentage of CPU being used. By default, Line Memory,
data shown in this report is an average of CPU usage graph Users
across all devices.
Memory Displays the percentage of memory being used. By Line CPU,
default, data shown in this report is an average of memory graph Users
usage across all devices.
Current Displays the total number of users that currently have Line CPU,
Users traffic going through the ProxySG appliance. By default, graph Memory
data shown in this report is the number of current users
across all devices.
Interfaces Displays the total number of bytes or packets sent or Circle Bytes
received through ProxySG appliance network ports. Select graph Received,
the device for which you want to view interface information; Bytes Sent,
the data renders as a pie chart, where each segment rep- Packets
resents one interface. Received,
Packets Sent
Interfaces Displays the bytes sent and received and packets sent and Table
Detail received through ProxySG appliance network ports. The chart
information is presented in a grid; you can sort data by
column headers or hide some columns to limit the inform-
ation displayed.
450

Format
Trend of Displays the trend of bytes or packets sent or received Stack Bytes
Interfaces through ProxySG appliance network ports over the spe- graph Received,
cified period of time. Bytes Sent,
Packets
Received,
Packets Sent
Devices Displays a comparison of the traffic through specified Circle Bypassed
ProxySG appliances measured in bytes. graph Bytes, Server
Bytes, Client
Bytes
Devices Displays bandwidth savings in bytes, actual bandwidth, Table
Detail effective bandwidth, and the bandwidth gain for traffic chart
through ProxySG appliances.
Intercepted Displays bandwidth savings in bytes, actual bandwidth, Table
Traffic Sav- effective bandwidth, and the bandwidth gain for inter- chart
ings cepted traffic through different ProxySG appliances.
Traffic Mix Displays the distribution of traffic and bandwidth statistics. Line
graph,
circle
graph,
and
table
chart
Traffic Stat- Displays the effective bandwidth, actual bandwidth, and Line
istics bandwidth savings for different services. graph
and
table
chart
The WAN Optimization reports display statistics for ProxySG appliances with a Proxy or MACH5 Edition license.

Format

Bandwidth Displays bandwidth savings Line CPU,
Savings in bytes received from mon- graph Memory,
(bytes) itored devices. Users
451

Format

Savings expressed in terms of cost. graph Memory,
(cost) Users
Savings expressed as a percentage. graph Memory,
(percent) Users
Bandwidth Displays bandwidth gains Line CPU,
Gain (including negative gains) for graph Memory,
a specified interval. Users
Effective Compares effective and Line CPU,
Bandwidth actual bandwidth, measured graph Memory,
in bytes. Users
Services Compares specified ser- Circle Bypassed Bytes, Bandwidth Savings, Band-
vices. graph width Savings Percentage, Bandwidth Gain,
Effective Bandwidth, Client Bytes, Server
Bytes, New Intercepted Connections, Peak
Intercepted Connections
Services Displays bandwidth savings Table
Detail for different services in chart
bytes, actual bandwidth,
effective bandwidth, and the
bandwidth gain.
Trend of Displays the trend of the spe- Stack Bypassed Bytes, Bandwidth Savings, Band-
Services cified service over a period graph width Savings Percentage, Bandwidth Gain,
of time. Effective Bandwidth, Client Bytes, Server
Proxies Breaks down the total num- Circle Bypassed Bytes, Bandwidth Savings, Band-
ber of server bytes through graph width Savings Percentage, Bandwidth Gain,
different proxies. Effective Bandwidth, Client Bytes, Server
Intercepted Connection
Proxies Displays bandwidth savings Table
Detail in bytes, actual bandwidth, chart
bandwidth gain.
452

Format

Trend of Displays the trend of proxies Stack Bypassed Bytes, Bandwidth Savings, Band-
Proxies versus the Server Bytes by graph width Savings Percentage, Bandwidth Gain,
default aggregated across Effective Bandwidth, Client Bytes, Server
all devices. Bytes, New Intercepted Connections, Peak
ADN History Displays the number of Line
optimized and unoptimized graph
bytes for different peer IP and
addresses. table
chart
Modify Options for Statistics Monitoring Reports
By default, a Statistics Monitoring report displays data for the last seven days for all ProxySG devices but you can cus-
tomize the report by changing the start date and interval, choosing which devices or device group to report on, and adding
overlays of additional statistics.
To have the reports on the Statistics Monitoring dashboard to automatically refresh the displayed reports, select
Options and click the Auto-refresh box to select it. The default is set to 5 minutes, though you can set it to any
desired interval of minutes (up to 59) or hours (up to 24).
To customize the reports:
2. Select a report from Devices or WAN Optimization. See "Reference: Statistics Monitoring Reports in Management
Center" on page 459 for descriptions.
3. After you select the report, the report opens in a new tab.
4. To open the Filters dialog, click the gear settings icon within the report.
453
5. Filter the report data using the options described in the following table.
Option Description
Start Date The date and time from which report data begins.
The interval you select is based on the start date. For example, if you specify the 13th of
the month for the start date and an interval of 7 days, the report shows data from the 13th
through the 19th.
Specify the date in MM/DD/YY format, or click the calendar to pick a date.
Interval The number of hours or days after the start date for which the report shows data.
Note: The start date and interval in conjunction might result in future days on the report.
For example, if you want data from only the last four days, selecting a start date from four
days ago results in three future days on the report. To avoid confusion, you can select a
start date that is earlier than required so that future days do not display.
Select the interval from the drop-down list. Intervals can include 60 minutes, 24 hours, 7
days or 31 days.
If you select 60 minutes, the time field is available. Select a time from the drop-down list.
Times are available in one-hour increments.
Filter Select a filter from the drop-down list. If you select Device or Device Groups, use the
to select multiple ProxySG devices or a single device group.
Graph Changes how the data is displayed. You can graph the data as the mean average for all
devices (single data line) or as individual metrics for each device (one line per device).
(This option is not
Hover the mouse cursor over a graph line to get additional information.
available for all
reports)
454
Option Description
Field The source for which to show trending data.
(This option is not Select the specific item that you want to report on (by default, the first item in the drop-
available for all down list is displayed when you first open the report). The report displays the data for your
reports) selection.
Overlays Metrics that you can add to the report to help you interpret the data. You can add overlay(s)
to the report.
(This option is not
When you add overlays, the additional data displays in a legend at the bottom of the
available for all
report. Use the legend to identify the appearance and color of each data type.
reports)
The following is an example of the legend for the Bandwidth Savings (bytes) report:
6. Click Save.
The web console displays the Statistics Monitoring report with the options you selected. The name and number of devices
will display next to Device Filter at the top of the report . If a filter isn't defined, the Device Filter will say All Devices.
Change the Scope of a Statistics Monitoring Report
By default, Statistics Monitoring reports and report widgets display data for the last seven days. For example, if you select a
report on April 14th, the report opens with L ast 7 Days selected for the date range at the bottom left corner. The start date or
time of the selected rate range is displayed between < >. The bottom right of the reports indicates the specific date range of
the data shown in the report, such as Displaying days for 04/14/15 - 4/21/15.
To view data from a broader or narrower time frame, select an interval from the Date Range drop-down list. The report data
updates immediately to reflect your selection.
Refer to the following table to understand how the date range affects the report data; assume that the current date and time
is Tuesday, October 15th at 09:05.
Selected Date Description Report shows data for this

Range period
Current Hour The current hour. 09:00 - 10:00

Today The current day. October 15th
Current Week The current calendar week, starting on Monday. October 14th - October 20th
Current Month The current calendar month, starting on the 1st. October 1st - 31st
Yesterday The previous day. October 14th
Previous Week The previous calendar week, starting on Monday. October 7th - 13th
Previous Month The previous calendar month, starting on the 1st. September 1st - 30th
455

Range period
Last 7 Days The period of time starting 7 days ago and ending October 8th - October 15th

today.
Last 31 Days The period of time starting 31 days ago and ending September 14th - October 15th
today.
To view data from different points in time, use the date range and < > in conjunction. Using < > causes the report to go
back and forward, respectively, at the interval specified in Date Range. For example, if the date range is Last 7 Days and
the report shows data from October 8th to October 15th, clicking < causes the report to display data from October 1st to
October 8th. If you change the date range to Today and click <, the report displays data from the previous day. You can
use > to return to more recent dates and times.
For more information about report dates, see Date Filters.
It is possible to display future days in reports if you use >. If a report abruptly shows no data while you are changing
the dates or times, check the dates/times that have no data and exclude them from your analysis (or change the
date range again).
Filter on Devices or Device Groups
To view a report of data from multiple devices or from a particular device group:
1. Display the desired Statistics Monitoring report.
2. Click the Options button.
3. Change the Start Date and Interval, if desired.
4. Use the Filter drop-down list to select individual devices or specify a device group.
5. To choose from the available devices or device groups, click .
n Device: Select one or more devices and click OK.
n Device Group: Select one group and click OK.
6. Click Save.
After you save your changes, the report data updates immediately. The Device Filter displays the names (or IP
addresses) of the devices filtered in the reports. See "Modify Options for Statistics Monitoring Reports" on page 462.
Zoom In and Out on Reports
In reports that display changes over time, it is useful to see more detail on a specific data point. For example, if you are
looking at a report with Current Week as the date range, zooming in on a specific day displays the report for the day at
hourly intervals. Zooming in on a specific hour displays the report for the hour at five-minute intervals.
1. In the report, hover over the data point you want to see in greater detail. The data point expands slightly.
2. Click the data point and select Zoom In. The report displays the data at the new level.
3. To return to the previous level, click any data point and select Zoom Out.
Statistics Monitoring Graph Types
Statistics Monitoring graph types depend on the type of data represented in the report. Some reports consist of a com-
bination of these formats.
456
n Line graphs show how data for one data type changes over time. You can hover over the line graphs for extra tool
tips that can include data such as the date, percentage, total number, etc.
n Stack graphs show changes in a set of data, for both for the individual data types and the total of the individual
items. Each color in a stack graph represents one type of data changing over time.
n Circle graphs show the proportions of specific data with a set of data.
Example: The Effective Bandwidth graph in the Traffic Mix report shows the proportion (in percentage) of effective
bandwidth for different traffic types. Hover over a segment in the graph to display the number of bytes for each traffic
type.
n Table charts arrange data in rows to compare data from multiple sources.
Example: The Devices Detail report widget shows the actual bandwidth versus effective bandwidth for all devices in
the system.
Display a Full Report
Display a full report from a statistics monitoring widget.
1. Select Dashboards > Statistics Monitoring. The web console displays the Statistics Monitoring Dashboard.
n If the report you want has a widget on the dashboard, expand the widget if necessary and then click View Full
Report at the bottom of it.
n If the report does not have a widget on the dashboard, click Report > Statistics Monitoring. Available reports
are displayed in two lists: Devices and WAN Optimization.
3. Select the report you want to view. The report opens in a new tab.
If you leave a report open for an extended period of time, you can refresh it to ensure that no stale data is displayed.
To refresh a report, click at the bottom of the report.
Learn about different graph types. "Statistics Monitoring Graph Types" on page 465
See the report for different dates or times. "Change the Scope of a Statistics Monitoring Report" on page 464
Change the metrics and other data that display on "Modify Options for Statistics Monitoring Reports" on page 462
the report.
457
View descriptions of the Statistics Monitoring "Reference: Statistics Monitoring Reports in Management Center" on
reports. the next page
View Statistics Monitoring Reports
An organization without an effective monitoring system is susceptible to issues such as unplanned downtime and per-
formance degradation; thus, the ability to monitor network activity is crucial for capacity planning and quick responses to
potential problems. By analyzing report data, organizations can plan for scalability and anticipate future requirements.
Appliance statistics collection over HTTP port 9009 is disabled by default in 1.7 and later. The new default is
HTTPS port 9010. See Statistics Monitoring Over HTTPS for more information.
Management Center keeps up to 12 months of per hour data and 7 days of per minute data for all devices that have
statistics monitoring enabled. To purge this data from Management Center, see Purge Statistics.
As an administrator, it is critical that you be aware of issues, changes, and trends that could arise in your network. In Man-
agement Center, you can report on key metrics such as CPU usage, connection counts, bandwidth gains and losses, and
other statistics of managed appliances. Statistics Monitoring reports provide you with visibility into network performance.
With reports, you can identify trends such as:
n Usage patterns
n Bandwidth savings
n Peak numbers of concurrent users
n Statistics averaged over weeks and months
To ensure that your data analysis is accurate and timely, identify the metrics that are most important to you and run reports
regularly.
You can monitor the health of your devices without generating a report. See "Monitor Device Health " on page 113.
Prerequisites
You can report on ProxySG appliances that:
n Run SGOS 6.3.x and later
n Have a Proxy or MACH5 Edition license (Note: this is a requirement for WAN Optimization reports, not Device
reports)
n Have the latest trust package installed
n Do not have Federal Information Processing Standards (FIPS) mode enabled
n Have statistics collection enabled in device properties (see "Add a Device" on page 68)
You can still manage ProxySG appliances that do not meet these requirements, but their statistics will be unavailable from
Statistics Monitoring.
Procedure
To view Statistics Monitoring reports:
458
2. Select a report from Devices or WAN Optimization. See "Reference: Statistics Monitoring Reports in Management
Center" below for descriptions.
3. From a dashboard widget, you can also "Display a Full Report" on page 465.
4. Refine reports to make them more useful:
n Display data for a specific time period. See "Change the Scope of a Statistics Monitoring Report" on
page 464.
n Add metrics to focus on specific data. See "Modify Options for Statistics Monitoring Reports" on page 462.
Reference: Statistics Monitoring Reports in Management Center
The following Statistics Monitoring reports are available in Management Center.
Devices Reports
Device reports show statistics on network traffic seen by a single ProxySG device, ProxySG appliances in a device group,
or all ProxySG devices.

Format
CPU Displays the percentage of CPU being used. By default, Line Memory,
data shown in this report is an average of CPU usage graph Users
across all devices.
Memory Displays the percentage of memory being used. By default, Line CPU,
data shown in this report is an average of memory usage graph Users
across all devices.
Current Displays the total number of users that currently have traffic Line CPU,
Users going through the ProxySG appliance. By default, data graph Memory
shown in this report is the number of current users across all
devices.
Interfaces Displays the total number of bytes or packets sent or Circle Bytes
received through ProxySG appliance network ports. Select graph Received,
the device for which you want to view interface information; Bytes Sent,
the data renders as a pie chart, where each segment rep- Packets
resents one interface. Received,
Packets Sent
Interfaces Displays the bytes sent and received and packets sent and Table
Detail received through ProxySG appliance network ports. The chart
information is presented in a grid; you can sort data by
column headers or hide some columns to limit the inform-
ation displayed.
459

Format
Trend of Displays the trend of bytes or packets sent or received Stack Bytes
Interfaces through ProxySG appliance network ports over the spe- graph Received,
cified period of time. Bytes Sent,
Packets
Received,
Packets Sent
Devices Displays a comparison of the traffic through specified Circle Bypassed
ProxySG appliances measured in bytes. graph Bytes, Server
Bytes, Client
Bytes
Devices Displays bandwidth savings in bytes, actual bandwidth, Table
Detail effective bandwidth, and the bandwidth gain for traffic chart
through ProxySG appliances.
Intercepted Displays bandwidth savings in bytes, actual bandwidth, Table
Traffic Sav- effective bandwidth, and the bandwidth gain for intercepted chart
ings traffic through different ProxySG appliances.
Traffic Mix Displays the distribution of traffic and bandwidth statistics. Line
graph,
circle
graph,
and table
chart
Traffic Stat- Displays the effective bandwidth, actual bandwidth, and Line
istics bandwidth savings for different services. graph
and table
chart
The WAN Optimization reports display statistics for ProxySG appliances with a Proxy or MACH5 Edition license.

Format

Savings in bytes received from mon- graph Memory,
(bytes) itored devices. Users
Savings expressed in terms of cost. graph Memory,
(cost) Users
460

Format

Savings expressed as a percentage. graph Memory,
(percent) Users
Bandwidth Displays bandwidth gains Line CPU,
Gain (including negative gains) graph Memory,
for a specified interval. Users
Effective Compares effective and Line CPU,
Bandwidth actual bandwidth, measured graph Memory,
in bytes. Users
Services Compares specified ser- Circle Bypassed Bytes, Bandwidth Savings, Band-
vices. graph width Savings Percentage, Bandwidth Gain,
Effective Bandwidth, Client Bytes, Server
Services Displays bandwidth savings Table
Detail for different services in chart
bytes, actual bandwidth,
bandwidth gain.
Trend of Displays the trend of the spe- Stack Bypassed Bytes, Bandwidth Savings, Band-
Services cified service over a period graph width Savings Percentage, Bandwidth Gain,
of time. Effective Bandwidth, Client Bytes, Server
Proxies Breaks down the total num- Circle Bypassed Bytes, Bandwidth Savings, Band-
ber of server bytes through graph width Savings Percentage, Bandwidth Gain,
different proxies. Effective Bandwidth, Client Bytes, Server
Intercepted Connection
Proxies Displays bandwidth savings Table
Detail in bytes, actual bandwidth, chart
bandwidth gain.
Trend of Displays the trend of proxies Stack Bypassed Bytes, Bandwidth Savings, Band-
Proxies versus the Server Bytes by graph width Savings Percentage, Bandwidth Gain,
default aggregated across Effective Bandwidth, Client Bytes, Server
all devices. Bytes, New Intercepted Connections, Peak
461

Format

ADN History Displays the number of Line
optimized and unoptimized graph
bytes for different peer IP and
addresses. table
chart
Modify Options for Statistics Monitoring Reports
By default, a Statistics Monitoring report displays data for the last seven days for all ProxySG devices but you can cus-
tomize the report by changing the start date and interval, choosing which devices or device group to report on, and adding
overlays of additional statistics.
To have the reports on the Statistics Monitoring dashboard to automatically refresh the displayed reports, select
Options and click the Auto-refresh box to select it. The default is set to 5 minutes, though you can set it to any
desired interval of minutes (up to 59) or hours (up to 24).
To customize the reports:
2. Select a report from Devices or WAN Optimization. See "Reference: Statistics Monitoring Reports in
Management Center" on page 459 for descriptions.
3. After you select the report, the report opens in a new tab.
4. To open the Filters dialog, click the gear settings icon within the report.
462
5. Filter the report data using the options described in the following table.
Option Description
Start Date The date and time from which report data begins.
The interval you select is based on the start date. For example, if you specify the 13th of
the month for the start date and an interval of 7 days, the report shows data from the 13th
through the 19th.
Specify the date in MM/DD/YY format, or click the calendar to pick a date.
Interval The number of hours or days after the start date for which the report shows data.
Note: The start date and interval in conjunction might result in future days on the report. For
example, if you want data from only the last four days, selecting a start date from four days
ago results in three future days on the report. To avoid confusion, you can select a start
date that is earlier than required so that future days do not display.
Select the interval from the drop-down list. Intervals can include 60 minutes, 24 hours, 7
days or 31 days.
If you select 60 minutes, the time field is available. Select a time from the drop-down list.
Times are available in one-hour increments.
Filter Select a filter from the drop-down list. If you select Device or Device Groups, use the
to select multiple ProxySG devices or a single device group.
Graph Changes how the data is displayed. You can graph the data as the mean average for all
devices (single data line) or as individual metrics for each device (one line per device).
(This option is not
Hover the mouse cursor over a graph line to get additional information.
available for all
reports)
Field The source for which to show trending data.
(This option is not Select the specific item that you want to report on (by default, the first item in the drop-down
available for all list is displayed when you first open the report). The report displays the data for your
reports) selection.
Overlays Metrics that you can add to the report to help you interpret the data. You can add overlay(s)
to the report.
(This option is not
When you add overlays, the additional data displays in a legend at the bottom of the
available for all
report. Use the legend to identify the appearance and color of each data type.
reports)
The following is an example of the legend for the Bandwidth Savings (bytes) report:
6. Click Save.
The web console displays the Statistics Monitoring report with the options you selected. The name and number of devices
will display next to Device Filter at the top of the report . If a filter isn't defined, the Device Filter will say All Devices.
463
Change the Scope of a Statistics Monitoring Report
By default, Statistics Monitoring reports and report widgets display data for the last seven days. For example, if you select
a report on April 14th, the report opens with L ast 7 Days selected for the date range at the bottom left corner. The start
date or time of the selected rate range is displayed between < >. The bottom right of the reports indicates the specific date
range of the data shown in the report, such as Displaying days for 04/14/15 - 4/21/15.
To view data from a broader or narrower time frame, select an interval from the Date Range drop-down list. The report
data updates immediately to reflect your selection.
Refer to the following table to understand how the date range affects the report data; assume that the current date and time
is Tuesday, October 15th at 09:05.

Range period
Current Hour The current hour. 09:00 - 10:00

Today The current day. October 15th
Current Week The current calendar week, starting on Monday. October 14th - October 20th
Current Month The current calendar month, starting on the 1st. October 1st - 31st
Yesterday The previous day. October 14th
Previous Week The previous calendar week, starting on Monday. October 7th - 13th
Previous Month The previous calendar month, starting on the 1st. September 1st - 30th
Last 7 Days The period of time starting 7 days ago and ending October 8th - October 15th
today.
Last 31 Days The period of time starting 31 days ago and ending September 14th - October 15th
today.
To view data from different points in time, use the date range and < > in conjunction. Using < > causes the report to go
back and forward, respectively, at the interval specified in Date Range. For example, if the date range is Last 7 Days and
the report shows data from October 8th to October 15th, clicking < causes the report to display data from October 1st to
October 8th. If you change the date range to Today and click <, the report displays data from the previous day. You can
use > to return to more recent dates and times.
For more information about report dates, see Date Filters.
It is possible to display future days in reports if you use >. If a report abruptly shows no data while you are changing
the dates or times, check the dates/times that have no data and exclude them from your analysis (or change the
date range again).
Filter on Devices or Device Groups
To view a report of data from multiple devices or from a particular device group:
1. Display the desired Statistics Monitoring report.
2. Click the Options button.
464
3. Change the Start Date and Interval, if desired.
4. Use the Filter drop-down list to select individual devices or specify a device group.
5. To choose from the available devices or device groups, click .
n Device: Select one or more devices and click OK.
n Device Group: Select one group and click OK.
6. Click Save.
After you save your changes, the report data updates immediately. The Device Filter displays the names (or IP addresses)
of the devices filtered in the reports. See "Modify Options for Statistics Monitoring Reports" on page 462.
Zoom In and Out on Reports
In reports that display changes over time, it is useful to see more detail on a specific data point. For example, if you are look-
ing at a report with Current Week as the date range, zooming in on a specific day displays the report for the day at hourly
intervals. Zooming in on a specific hour displays the report for the hour at five-minute intervals.
1. In the report, hover over the data point you want to see in greater detail. The data point expands slightly.
2. Click the data point and select Zoom In. The report displays the data at the new level.
3. To return to the previous level, click any data point and select Zoom Out.
Display a Full Report
Display a full report from a statistics monitoring widget.
1. Select Dashboards > Statistics Monitoring. The web console displays the Statistics Monitoring Dashboard.
n If the report you want has a widget on the dashboard, expand the widget if necessary and then click View Full
Report at the bottom of it.
n If the report does not have a widget on the dashboard, click Report > Statistics Monitoring. Available reports
are displayed in two lists: Devices and WAN Optimization.
3. Select the report you want to view. The report opens in a new tab.
If you leave a report open for an extended period of time, you can refresh it to ensure that no stale data is displayed.
To refresh a report, click at the bottom of the report.
Learn about different graph types. "Statistics Monitoring Graph Types" below
See the report for different dates or times. "Change the Scope of a Statistics Monitoring Report" on the pre-
vious page
Change the metrics and other data that display on "Modify Options for Statistics Monitoring Reports" on page 462
the report.
View descriptions of the Statistics Monitoring "Reference: Statistics Monitoring Reports in Management Center"
reports. on page 459
Statistics Monitoring Graph Types
Statistics Monitoring graph types depend on the type of data represented in the report. Some reports consist of a
465
combination of these formats.
n Line graphs show how data for one data type changes over time. You can hover over the line graphs for extra tool
tips that can include data such as the date, percentage, total number, etc.
n Stack graphs show changes in a set of data, for both for the individual data types and the total of the individual
items. Each color in a stack graph represents one type of data changing over time.
n Circle graphs show the proportions of specific data with a set of data.
Example: The Effective Bandwidth graph in the Traffic Mix report shows the proportion (in percentage) of effective
bandwidth for different traffic types. Hover over a segment in the graph to display the number of bytes for each
traffic type.
n Table charts arrange data in rows to compare data from multiple sources.
Example: The Devices Detail report widget shows the actual bandwidth versus effective bandwidth for all devices
in the system.
Work with Reports
Reporter
See the following for information about working with Reporter reports:
l "View a Reporter Report" on page 410
l "Customize Reporter Report Options" on page 416
l "Reporter Graph Types and Views" on page 446
l "Date Filters" on page 1
l "Search for Specific Report Data (Search and Forensic Report)" on page 442
l "Set Time Zone for Reporter Reports" on page 447
Statistics Monitoring
See the following for information about working with Statistics Monitoring reports:
l "View Statistics Monitoring Reports" on page 458
l "Change the Scope of a Statistics Monitoring Report" on page 464
l "Statistics Monitoring Graph Types" on the previous page
466
l "Modify Options for Statistics Monitoring Reports" on page 462
l "Date Filters" on page 1
467
Customize Report Widgets
Widgets on the Dashboard and Reports tabs can be customized based on the type of data that you want to view.
Collapse Report Widgets
You can collapse report widgets if you have limited room on the dashboard, or if you prefer not to see all of the widgets
expanded at once.
n To expand a report widget, click the down arrow in the widget title bar.
n To collapse a collapsed widget, click the up arrow in the widget title bar.
Move Report Widgets
You can move report widgets. Because widgets align themselves automatically when you move them, you can put them in
groups.
1. Hover over a widget title bar. The pointer changes to a multi-directional arrow .
2. Drag the widget to its new location.
Remove Report Widgets
To remove a report widget, click the X on the top right corner of the widget.
To add the widget to the dashboard again, click Add Report and select the widget from the list.
Add Reports
The amount of report widgets that you can add and customize is wholly dependent upon whether you have integrated
Reporter 10.x into your network.
Close a Report
When you no longer need to view a report, close it using one of the following methods.
Close the Active Report
Click Close to close the report.
Alternatively, close the report by clicking the X on the tab at the bottom of the screen.
Close a Report on Another Widget
If you have multiple reports open, you can close a report other than the active one by clicking the X on the appropriate tab
at the bottom of the screen.
Modify Display of Table Data
You can modify the view of table data as described below. Each table supports specific actions; all actions may not be
available.
468
Show Available Actions
Click the arrow to the right of the column headings to show the available actions.
Change Columns
Hover over Columns to change the displayed columns.
Group Table Data
Select Group by this field to group the table data in accordance with that column heading.
469
The data is then grouped. In the example below, the Type column was grouped.
Deselect Show in groups on the dropdown menu to put data back into a plain list.
470
View Raw Report Data
The Source Data Viewer displays a report in raw data format, which breaks down specific data types that Management
Center collects from devices. If the interaction of data in a standard report seems wrong or misleading, you can view the
data in isolation from other metrics.
2. Click Source Data Viewer. The Source Data Viewer opens on a new tab.
3. In the tree on the left, browse to the data you want to display and select it. The report opens on a new tab on the right.
471
Manage Dashboards
Dashboards allow you to quickly view important device data. This data is represented by widgets. Widgets represent data
from managed devices. Dashboards are highly customizable and can help you quickly view the information you deem import-
ant.
To monitor devices from a single screen, add dashboards and add widgets to those dashboards using the options on the
Dashboards > Manage Dashboards page.
Order é Name Type Widget Description
1, 2, 3, etc. The name Reporter - displays only Reporter widgets on the dash- Each dash- The description

The order is of the dashboard. board can helps to dif-
displayed board as it WAF Reporter - displays only WAF widgets on the
display mul- ferentiate the
from left to appears on dashboard tiple wid- dashboard type,
right on the the Dash- gets. For a and the widgets
dashboard board tab. Mixed - Can display data from all widgets on the dash- quick ref- within the dash-
tab beginning board. erence of board.
with 1 on the Statistics Monitoring - displays only Statistics Mon- what is dis-
left. itoring widgets on the dashboard. played on
each dash-
board, view
the widget
count for
each dash-
board.
Notes
l Reporter Enterprise Server 10.1.x is required to access and view Reporter Reports and Dashboards.
l Dashboards are dependent on the reports that you can generate for each managed device. To generate advanced
reports and view advanced real-time data within dashboards, see Add Reporter as a Managed Device.
Add a Dashboard
To accommodate your screen size or personal preference, you can change the number of dashboards that display, as well
as define the layout of the dashboards. You must also define the dashboard type. Layouts arrange widgets in one to four
columns of equal width, with the columns expanding to fit the width of the screen. When you select a layout, your change per-
sists (beyond the current session) until you change the layout again.
Although you can add multiple dashboards, remember that dashboards display data from databases that may not be
the only database available. For example, a Reporter Enterprise Server can provide data from multiple databases.
When adding Reporter widgets to dashboards, you can choose from the available databases.
1. From Dashboards > Manage Dashboards, click Add Dashboard. An asterisk denotes fields that are mandatory.
2. Enter a descriptive Dashboard Name and Description.
3. Choose a Type:
If you select Reporter as the dashboard Type, from the Template drop-down list, select from the following
templates to pre-populate widgets:
n Web Application Usage
n Threat Detection
n Content Filtering
n WAF Reporter - A dashboard that displays Reporter Web Application Firewall (WAF) widgets.
If you select Reporter WAF as the dashboard Type, select Web Application Firewalll from the Template
drop-down list.
n Statistics Monitoring - A dashboard that displays ProxySG appliance widgets.
4. Select the auto-refresh rate. Specifies the amount of elapsed time before widget data is refreshed. The default
refresh rate is 5 minutes. This time is customizable from 1 to 59 minutes or 1 to 24 hours.
Select the Layout for the dashboard.
5. Click Save. The saved dashboard is displayed in the Dashboard drop-down with the name that you gave it.
After you have created a dashboard, you cannot edit the type.
Reorder Dashboard List
When you add a new dashboard, the most recently added dashboard is appended to the end of the list. For example if you
have three dashboards and add one, the new dashboard becomes the fourth dashboard on the list and will appear to the right
of the previously added dashboards. To change the order dashboards are displayed:
1. From Dashboards > Manage Dashboards, select the dashboard you want to move.
2. Click Move Up or Move Down to change the order.
Duplicate a Dashboard
To use a dashboard as a template for a dashboard that you may want to clone (and perhaps edit later), you can duplicate a
dashboard that already exists. You are unable to change the type of dashboard when you duplicate.
1. From Dashboards > Manage Dashboards, click Duplicate.
2. From the Duplicate Dashboard dialog, give the dashboard a unique name.
3. Click Duplicate. The duplicated dashboard is displayed under Manage Dashboards.
473
Dashboards and Widgets
A dashboard provides a simplified view of data in widgets. A widget is a graphical representation of information, designed
to provide a quick overview of statistics or other important information. The variety of widgets available to add to dash-
boards is dependent upon dashboard Type. See "Manage Dashboards" on page 471.
The web console displays the Home dashboard after users log into the web console. The dashboard displays Device
Health and Top Problem Devices widgets by default, but you can add and remove widgets to any dashboard.
When you open or view the Statistics Monitoring dashboard it does not display filtered data from the last session.
Each new session opens with no filters applied.
Add a Widget to the Current Dashboard
1. Select the Dashboards tab.
2. Click Add Widgets.
The available widgets are controlled by the report permissions associated with a user's role. Users cannot
add widgets for restricted fields.
3. (Optional) From the report groups in the left pane, select the group that contains the report widget you want to add:
Bandwidth Usage, Devices, Health, Security, User Behavior, WAN Optimization, Web Applications. The right
pane updates with the list of report widgets for the selected report type.
4. Select the report widget you want to add.
5. For Reporter widgets, select the Role, Database, and the Layout.
6. Click Add Widget Now.
7. Repeat steps 3 to 6 to add more widgets, and then click Close.
474
Add the Bookmarked Devices Widget
The Home dashboard displays the Device Health and the Top Problem Devices widgets by default after you log in. To add a
widget specifically to view real-time data for favorite devices, add the Bookmarked Devices widget to a dashboard.
1. From the Home dashboard, select Add Widgets. The web console displays the Add Widgets wizard.
2. Scroll to Health and select Bookmarked Devices.
3. Select Add Widget Now. Click Close. The dashboard displays an empty widget.
4. Select Add Devices. Give the widget a name and select the devices that you want to monitor in the dashboard.
5. Select the devices that you want to "bookmark" as your favorite devices and click OK. The new widget displays the
475
selected devices.
Edit or Duplicate Dashboards
Management Center displays the following default dashboards after users "Log into the Web Console" on page 32.
Home
The home dashboard displays when you log into the web console by default. Default widgets displayed are the Device
Health and Top Problem Devices widgets.
The home dashboard displays Device Health and Top Problem Devices widgets by default, but you can add and remove
widgets based on:
n The type of data that you want to monitor (such as statistics)
n Reporter server integration
1. Select the Dashboards tab.
2. Click Add Widgets.
Statistics Monitoring Dashboard
The web console displays the Statistics Dashboard when you select Dashboards > Statistics Monitoring. It displays
widgets that provide a simplified view of the statistics monitoring data in a full report.
To customize the layout and widgets of your Statistics Dashboard, see "Change the Dashboard Layout or Refresh Rate"
below.
Change the Dashboard Layout or Refresh Rate
To accommodate your screen size or personal preference, you can change the layout of the main Dashboard tab and
define the dashboard type and refresh rate. Layouts arrange widgets in one to four columns of equal width, with the
columns expanding to fit the width of the screen.
When you select a layout, your change is saved beyond the current session until you change the layout again.
1. Select the Dashboard tab. To customize the layout and type, click Options. The web console displays the Layout
Options dialog. You can change the following:
476
l Dashboard name
l Description
l Dashboard Type
n Statistics Monitoring - A dashboard that displays ProxySG appliance widgets
l Auto-refresh rate. Specifies the amount of elapsed time before widget data is refreshed. The default refresh
rate is 5 minutes. This time is customizable from 1 to 59 minutes or 1 to 24 hours.
l Layout
2. Click Save.
After you add a dashboard, you cannot change the dashboard type.
477
Administrate Management Center

n "Configure General System Settings" below
n "Upgrade/Downgrade System Images" on page 487
n "Back Up the Management Center Configuration" on page 489
n "Encrypt Sensitive System Data" on page 490
n "Restore a Management Center Backup Configuration" on page 491
n "Configure Management Center Failover" on page 492
Configure General System Settings
Configure Management Center general settings about bandwidth cost, the number of backup slots for Management Center
backups and the maximum number of policy and script revisions to store. You can also create a password reset email and
configure settings to apply to Management Center users.
1. Select Administration > Settings. An asterisk denotes fields that are mandatory.
2. From System Settings, select General on the left.
3. Specify General settings.
Setting Input Value/Format
Bandwidth Cost per GB*
See "Set Bandwidth Cost for Reports" on page 479
Device Polling Interval*
See "Set the Device Polling Interval" on page 479
Raise alerts on device errors* false|true
See Resolve Device Errors
Number of backup slots*
"Set the Number of Backup Slots" on page 479
Maximum number of policy revisions to store*
"Set the Maximum Number of Policy Versions to Store in
Management Center" on page 261
Inactivity timeout (minutes)*
Specifies the number of minutes before an inactive user is
logged out. Users are warned 30 seconds before they are logged
out.
478
Setting Input Value/Format
Inactivity timeout exclusions text: Enter comma-separated usernames
The list of usernames that should be excluded from the
Inactivity timeout setting.
Maximum number of script revisions to store*
"Set the Maximum Number of Script Revisions to Store in
Management Center" on page 171
Is Reset Password enabled?* false|true
See "Reset Password" on page 346
Reset Password Email Subject* text: Management Center Reset Password
Reset Password Email Message* text: Enter the body text of the email that will be
sent upon a user's request of a password reset.
Click OK.
5. Instruct users to log into the web console with their existing username and password.
After a user logs in, you can manage their account in Management Center.
479
Set Bandwidth Cost for Reports
Statistics Monitoring reports require that you specify a bandwidth cost to display data. The bandwidth cost is a multiplier
and is thus not expressed in a specific currency unit. For example, you can enter a value to represent on average how you
pay per gigabit for data usage on your network.
1. Select Administration > Settings. Select General. General fields display on the right.
2. Enter a decimal value.
Set the Device Polling Interval
You can specify the frequency with which Management Center looks for updates on managed devices. Specify an appro-
priate interval to ensure that device health statuses display accurately. The default interval is 10 seconds.
1. In the web console banner, select the Administration tab and select Settings.
2. Select General on the left. General fields display on the right.
3. Select Device Polling Interval (sec).
4. Enter a value in seconds.
Set the Number of Backup Slots
By default, Management Center stores up to five backups per device, with each backup placed in a slot. After five
backups, Management Center prunes (deletes) an unpinned backup to make room for the new backup. (Backups that are
pinned are preserved and cannot be manually deleted or automatically pruned.) If you want Management Center to store
more or fewer backups per device, you can adjust the number of backup slots.
1. Click the Administration tab and select Settings.
2. Select General on the left.
3. In the Number of backup slots enter a new value.
4. Click Save.
You can override the default number of backups that are retained for a device by entering a Retention Count when
exporting backups. See "Export Device Backups" on page 92.
480
Specify Explicit Proxy Settings
If you have configured an explicit proxy server in your environment, you can specify the settings in Management Center.
These settings are used for all outgoing HTTP requests and other functions such as licensing, heartbeats, and support case
reports.
1. Select Administration > Settings > HTTP Proxy. Fields marked with a red asterisk (*) are required settings.
2. Specify explicit proxy settings.
Enable* Specify whether an explicit proxy is false|true

configured.
HTTP Proxy IP or hostname Specify the IP address or hostname of proxy Example:
server.
https://<IP_address>
HTTP Proxy Port Specify the port for the proxy server. Example:
8082
Username If necessary, enter the username to Example:
authenticate to the proxy.
admin
Password If necessary, enter the password to Example:
authenticate to the proxy.
admin123
Synchronize the System Clock using NTP
Network Time Protocol (NTP) synchronizes the clocks of computers over a network. To ensure that timestamps displayed
in Audit Log records, Appliance Monitoring reports, and other system changes are accurate and consistent, you can define
NTP servers in Management Center.
2. Click Network Time Protocol. NTP fields display on the right. An asterisk denotes fields that are mandatory.
3. Specify NTP settings.
Is the NTP service enabled* Specify whether to enable the NTP service. false|true
481
NTP Server You can specify up to five NTP servers. Example: server.ntp.org

Management Center attempts to connect to the
servers in the specified order.
When you "Add a Job" on page 395, remember that the schedule is run off of the server's time zone.
4. Perform one of the following tasks.
If you have unsaved changes, the edited settings are marked with a red triangle. See the "Pending changes" text at
the top left of the dialog as an example.
Configure Diagnostics Logging
Use this page to set the logging levels. The Master Log includes all of the General and Device Plugin data. To reduce the
size of the Master Log or to produce a targeted log, configure the levels accordingly. The level you choose determines the
amount of information provided in each log. For example, debug logs can later be used to send diagnostic information to
Support. The logging levels are described in the following table.
Log Description
Level
DEBUG Logs detailed informational events and is most useful when you are attempting to diagnose prob-
lems.
INFO Logs high-level informational messages only.
WARN Logs potentially harmful events.
ERROR Logs all errors that do not cause the system to restart.
OFF Disables logging. The Master Log cannot be disabled.
ALL Logs everything. Applicable only to the Master Log.
When you enable a log, data is written to a specific log file. For example, if the Master log is set to INFO or above, mes-
sages are written to log.log. If the Master Log is set to DEBUG, all messages are written to debug.log and also to
log.log (messages for INFO and above). All other logs send data to a log of the same name, for example, secur-
ity.log and network.log.
Configure Diagnostic Logging
1. Select Administration > Settings > Diagnostics.
The system displays the Diagnostics window. An asterisk denotes fields that are mandatory.
482
2. Specify the Master Logging Level, General, and Device Plugin settings.
Configure Housekeeping Settings
Configure general housekeeping settings. When these settings are activated, they affect what is displayed in the Audit Log
Viewer and how big audit logs can grow.
2. Click Housekeeping on the left.
483
3. Select the default housekeeping settings. An asterisk denotes fields that are mandatory.
Run every n hours.* Default is 12. The value represents (in hours) how numeric using up and down

often to run a full audit. arrows
Number of days of audit records to keep.* The value represents the number of numeric using up and down
Default is 120. days that audit records are kept. arrows
Number of days of job execution records to The value represents the number of numeric using up and down
keep.* Default is 120. days that job executions records are arrows
kept.
Number of days of closed alert records to The value represents the number of numeric using up and down
keep.* Default is 120. days that alerts are kept after being arrows
closed.
Configure Mail Settings
In order to receive notifications via email, you must configure SMTP alerts. Management Center stores the settings
so that SMTP alerts (emails) can be transmitted and received correctly. See "Configure SMTP Alerts" on page 389.
2. Select Mail Settings. Mail settings display on the right. An asterisk denotes fields that are mandatory.
3. Specify email settings.
Mail Server* The SMTP mail server to use for Example: smtp.organization.com

outgoing mail.
Mail Server Port* The Port that the SMTP mail server Example: 25
uses.
From address* The e-mail address from which e-mails Example: [email protected]
are sent.
Username The User name used to access the Example: joe.admin
SMTP mail server.
Passphrase The password required to access the Example: admin123
SMTP mail server
484
Configure the SNMP Agent Password
The Simple Network Management Protocol (SNMP) itself does not define which variables a managed system should offer.
Rather, SNMP uses an extensible design, where the available information is defined by Management Information Bases
(MIBS).
The MIBs are available on the BTO Downloads page. Refer to the Management Center Release Notes for inform-
ation on MIBs.
Configure the agent's password:
2. Select SNMP Settings on the left.
3. Enter the password in the Community text field. This password must be entered as alpha-numeric with no special
characters.
n Click Activate to cause the server to load and apply the new password for SNMP agent. See Community in
"Configure SNMP Alerts" on page 390.
Configure Consent Banner
A Notice and Consent banner provides notice to users of computer networks, computers, and other systems and resources.
Users are required to accept the terms in the banner prior to authentication. The banner is presented to users before a login
process, and it requires users to acknowledge and agree to the message before they can log in or access resources on the
network.
Implement the consent banner to do some or all of the following:
n Obtain users' notice of, and consent to, lawful monitoring of usage and data collection.
n Notify users that they must concede certain expectations of privacy in order to access the network.
n Ensure users' compliance with organization-specific policies.
The logo displays centered above the banner text. The banner text displays within an uneditable text box. A blue Accept but-
ton displays below and to the right of the banner text, as shown in the example below.
485
Procedure
2. Click Consent Banner. Consent Banner fields display on the right.
3. In Show consent banner , click the and select true.
4. In the Consent text box, enter the text to present to users upon login to Management Center.
5. Click in the Consent image field. You can select a file from your local system to upload.
6. After selecting an image file, click download.
7. (Optional) Click remove to delete the downloaded image.
n Click Save to store the settings on the server. If you are unable to save your changes, make sure that all
486
Configure Hardware Monitor Settings
To better understand how each device is reporting disk and memory usage, configure hardware monitor settings and the
Disk and Memory Critical and Warning Levels.
2. Select Hardware Monitor Settings. Hardware monitor fields display on the right. An asterisk denotes fields that are
mandatory.
3. Specify the hardware Hardware Monitor threshold settings.
Monitor Enabled* Enable or disable hardware monitor true/false

Monitor Interval (min) The threshold at which the hardware 5
monitor polls the device (in minutes).
Disk Usage - Warning The threshold at which the monitor polls 85
the device for disk usage events.

Disk Usage - Critical The threshold at which the monitor polls 95
the device.
Disk Usage - Shutdown on critical? Shuts down the web console when the true/false
threshold for Critical is reached.
Memory Usage - Warning The threshold at which the monitor polls 95
the device for memory usage events.
Memory Usage - Critical The threshold at which the monitor polls 99
the device for memory usage events.
If you enable the hardware monitor and also enable Disk Usage - Shutdown on critical?, the web
console shuts down when the threshold for critical is reached. The Management Center CLI is still
available.
487
Upgrade/Downgrade System Images
When new features and improvements are made to Management Center, you can download a system image from
Symantec and upgrade the appliance. If you ever experience issues with a new image, you can activate an older image to
downgrade the appliance.
Manage System Images
Management Center stores up to six images on the system. For Management Center virtual appliances, this number also
depends on the image size and boot partition (limited to 2 GB by default). The image that is marked as the default image
will be loaded the next time that the appliance is rebooted.
If the maximum number of images are stored on your system and you download another image, Management Center
deletes the oldest unlocked image to make room for the new image. To prevent an image from being deleted or replaced,
you can lock the image.
You perform image management using Management Center CLI commands. See "# installed-systems" on page 539 for a
description of the commands for adding, deleting, locking, unlocking, and viewing images.
Install a New System Image
To install a new system image, you first download the image from Symantec, place the file on a web server the Man-
agement Center appliance can access, then use a CLI command to add the file. The final step is to reboot to activate the
image.
1. (Optional, but recommended) "Back Up the Management Center Configuration" on page 489.
2. Log into Blue Touch Online (BTO): https://bto.bluecoat.com/
3. Download the desired image from BTO.
a. Transfer the image directly to Management Center. Select Configuration > Files and transfer the image
using the Transfer File button.
b. Download the image to a local drive, select Configuration > Files, and upload the image to Management
Center.
Alternatively, you can store the image file on a web server that the Management Center appliance can
access. The add image process works with any HTTP server, and HTTPS servers configured with trusted
certificates. If your HTTPS server does not have a trusted certificate, place the file on an internal HTTP
server.
4. Add the system image using the #installed-systems add <URL> command.
where <URL> is the location of the image on a web server, in the following format:
http://host/path, for example http://webserver.mycompany.com/images/542386.bcsi
If the image was uploaded to Management Center, do the following:
a. Copy the file URL. In the Configuration > Files page, select the image and click Copy URL. The file will
have a format similar to the following:
488
https://10.131.38.36:8082/fs/download/6c80d3a2cc124347aedb2a688da3859e
b. Change the protocol to HTTP and the port to 8080. The URL should now look like this:
http://10.131.38.36:8080/fs/download/6c80d3a2cc124347aedb2a688da3859e
If HTTP access to Management Center is disabled, you should change the URL to the following:
http://localhost:8080/fs/download/6c80d3a2cc124347aedb2a688da3859e
c. Execute the installed-systems add command.
5. Make sure the new image is the default image. (Rebooting will install whichever image is marked as the default.)
# installed-systems view
A plus (+) sign indicates the default system image. If the new image is not the default, make note of the index value
next to the image you want as the default.
6. If necessary, make the new image the default system image:
# installed-systems default <index_number>
Replace <index_number> with the image's index ID value.
7. Reboot the hardware appliance to run the new image:
# restart reboot
When the appliance restarts, the network connection closes. If boot failure occurs upon an upgrade, Management
Center downgrades to the previous version automatically.
View the progress of downloads in progress or the status of the last download using the # installed-systems
view-downloads command. If you need to cancel an image download, use the # installed-systems can-
cel-downloads command.
Downgrade to an Earlier Management Center Version
If you are running an upgraded version of Management Center, you can downgrade (revert) to a previous version. Down-
grading has the following special guidelines you must follow:
n Downgrades can be performed down two dot releases (e.g., from 1.6 to 1.4).
n All maintenance/patch releases of a version will be treated as equivalent. For example, 1.6.2.1 would be the same as
any other 1.6.x release.
n Upon downgrade, newer data (data from the upgraded image that is not handled in the older version) is lost.
n Upon downgrade, newer configuration settings (settings from the upgraded image that are not handled in the older
version) are lost.
n Data and configuration settings that are common to the upgraded image and downgraded image are seamlessly
maintained, regardless of schema differences between versions.
n Administrator access and permissions are needed to downgrade Management Center.
To downgrade:
1. "Back Up the Management Center Configuration" on the facing page.
2. Decide which installed image to revert to. (Make sure to follow the guidelines listed above regarding release
489
numbers.)
Make note of the index value next to the image you want to revert to.
3. Make an older image the default image. (Make sure to follow the guidelines listed above regarding release
numbers.)
Replace <index_number> with the image's index ID value.
4. Reboot the hardware appliance to activate the default image:
# restart reboot
5. Before trying to use the older version, restore the Management Center backup immediately. See "Restore a
Management Center Backup Configuration" on page 491.
Back Up the Management Center Configuration
Symantec recommends that you back up the Management Center configuration often. The backup contains Management
Center database, settings, and, optionally, device reporting statistics. To save disk space on the appliance, you can
export the backup to an external server as part of the backup job. Exporting backups to an external server is required
before upgrading or downgrading the software image. See "Upgrade/Downgrade System Images" on page 487.
Backup Requirements
Backing up the Management Center configuration requires specific permissions. See "Reference: Understanding Job Per-
missions" on page 324. Additionally, sensitive data in the backup will be encrypted with an encryption key. You must have
the recovery key to restore the encrypted data in the backup. See "Encrypt Sensitive System Data" on the next page for
more information.
Back Up Management Center
To back up the Management Center configuration, you must create a job for it. You can either schedule the job to run on a
regular basis, run immediately, or on demand at a time that you want to create a backup.
1. From Jobs > Scheduled Jobs, select New Job. The web console displays the New Job wizard. An asterisk
2. Enter a unique Name.
3. Enter a Description (perhaps the reason why a backup of Management Center is needed). Click Next.
4. From the Operation drop-down list, select Backup Management Center.
5. (Optional) Select the Exclude Statistics Monitoring Trend Data check box to exclude device reporting statistics.
By excluding these statistics, the backup will be substantially smaller (perhaps by hundreds of gigabytes). Keep in
mind, however, that the restored backup will not have any statistics data.
6. If you want the backup file to be exported to an external HTTP, FTP, or SCP server, select the Export to Server
check box and fill in the server details:
n Server URL: Enter the protocol (SCP, FTP, FTPS, HTTP, HTTPS) and server name and path. For
example: ftp://mycompany.com/backups
490
n Encryption Phrase: This is required for exporting the archive.
n Username
n Password
7. In the Targets screen, click Next. (No targets are required for this operation.)
8. In the Schedule screen, define a schedule for the job. See "Job Scheduling Options" on page 400 for explanations of
each option. Click Finish.
Management Center retains only five backups. When the sixth backup occurs (such as in a recurring job), the oldest
backup is deleted. This is a rolling five backup retention and cannot be configured. To retain additional backup con-
figurations, you can export the backup to an external server as part of the backup job, or you can export backups later
using the backup export CLI command.
Back Up Management Center Using the CLI
1. Log in to the CLI. See "Access the Management Center CLI" on page 523
2. Enter privileged mode. See "Privileged Mode Commands" on page 531.
3. At the command prompt, type the following command and press Enter:
# backup create
The CLI indicates that the backup is being created. You should see a response similar to the following:
Creating backup ...
Backing up runtime configuration and plugins ...
Backing up database ..
Completed backup, Wed Jun 3 11:01:33 CMT 2015.
Encrypt Sensitive System Data
In 1.6 and later, each Management Center appliance (hardware or virtual) has a unique encryption key that is used to
encrypt data in the system. The administrator generates this key in the Administration > Data Protection page. When the
key is generated, a recovery key is also generated in case you later need to restore the encryption key. Make sure to save
the recovery key in a safe place.
Potential Data Loss
n As part of this process, you should keep the recovery key in a safe place in the event that you need to restore the
encryption key later. DO NOT LOSE THE KEY. If you lose the key, you will not be able to recover your encrypted
data.
n You should not recover a key unless you are certain that you need to. If you use the Restore previous key feature
and the current data in the database was not encrypted with that key, that data will not be able to be decrypted and
you will have to reenter all of the device passwords.
n If the current passwords for the device were not encrypted with the previous key, you will not be able to access the
information with the current passwords. You will need to reenter the device passwords before accessing the backup
information.
New Management Center Appliance Recommendations
Upon receiving a new appliance, you should do the following:
491
5. Configure the appliance.
This process ensures that you can restore your configuration as necessary.
Upgrade Recommendations
If you are upgrading Management Center, Symantec recommends regenerating a new key and then taking a new backup.
Doing so will ensure that you have the latest protection schemes and a valid backup that can be restored to the device if
necessary.
This process ensures that you will be able to restore the previous configuration if the upgrade has issues.
Restore a Management Center Backup Configuration
You can restore a configuration backup after reinstalling, upgrading, or downgrading Management Center or if you want to
revert to a previous configuration. You perform this operation using the command-line interface.
Restoring a backup requires shutting down services; you should perform the restore during off-hours.
Restore Management Center Backup
Before you restore a backup, you should view the backup files currently stored on the system to make sure that you
restore the correct version. If the backup you want to restore was exported to an external server, you should import the
backup file before the restore process.
2. Enter privileged mode. See "Privileged Mode Commands" on page 531.
3. At the command prompt, type the following command and press Enter:
# backup view
The CLI displays a list of all the backups that were created for this instance of Management Center. You should see
492
a response similar to the following:
Available Backups:
Timestamp Version
1 | 2015-May-29 03:33:00 UTC 1.4.1.1 (555156)
2 | 2015-Apr-15 09:02:00 UTC 1.3.3.1 (555000)
The backups are listed in descending chronological order; for example, the backup with index number 1 is more
recent than index 2. Each backup indicates the date and time when the backup was created, the build version, and in
parentheses, the build number.
4. Once you identify the backup you want, make note of the index number.
5. (Optional) If the backup you want to restore was exported to a server and is not on the list of backups stored on the
appliance , you can import it to Management Center.
# backup import <URL>
<URL> is the URL of the server and path to the backup file. Supported protocols are FTP, FTPS, HTTP, HTTPS,
and SCP.
6. At the command prompt, type the appropriate command.
l To restore the latest version (the backup with the most recent timestamp):
# backup restore latest
l To restore a specific version:
# backup restore <index_number>
where <index_number> is the index number of the backup.
7. Press Enter. The CLI indicates that you are about to restore a backup and asks you to confirm the action:
Warning, restoring a backup replaces all Management Center configuration.
Do you wish to proceed with restoring the backup taken on 2015-May-29 03:33:00
UTC? [Y/N]
8. Type Y to proceed. The CLI displays the progress of the restore:
Restoring backup ...
Decompressing ...
Verifying backup contents ...
Shutting down services ...
Restoring database ...
Restoring configuration ...
Restarting services ...
Completed restoring backup.
Configure Management Center Failover
Management Center supports failover using two physical appliances. One appliance is delegated as the primary and the
other as the secondary. After failover is configured, the secondary replicates data from the primary appliance. During con-
tinuous replication, users can perform all normal operations on the primary failover partner. Users cannot access the sec-
ondary failover partner—its sole purpose is to replicate actions occurring on the primary node so that it can take over if
something happens to primary node.
Licensing information and system settings are not transferred during failover replication.
493
Because the secondary failover partner replicates the primary partner's data, it is ready to take over at any time. When the
primary failover partner becomes unresponsive, you configure the secondary to take over and start servicing requests.
For systems setup in failover, the data encryption key is kept in sync between the primary and secondary devices.
Replicated Data
The following data is replicated on the failover partner:
l Device data stored in the database.
l Files in the Management Center file store
l Policy and scripts (along with historical versions)
l Device backups
l PDM data from ProxySG appliances
l Data protection key
l Trusted certificates for servers; root CA installed by a user
The following data is not replicated on the failover partner:
l Management Center system settings
l Management Center backup images on the device itself
Configuration Limitations
During replication, configuration for both the primary and secondary failover partners is limited. Replication requires that
both the primary and secondary partners run the same version of Management Center. To enforce this, the installed-
systems CLI command is disabled on both failover partners (to deny installing and changing system images). If, for any
reason, the system images do not match on the primary and secondary partners – replication is paused until the problems
are resolved.
The secondary failover partner has stricter restrictions on what can be configured. In addition to not being able to manage
system images, the following CLI commands are disabled on the secondary partner:
backup (all commands)
license (all commands)
http-proxy (all commands)
service db-maintenance
service purge-vpm-cache
snmp (all commands)
statistics-monitoring (all commands)
Device Limitations
Because W eb Security Service (WSS) devices are initially registered through a connection established only with the
primary partner (which subsequently discards the credentials), WSS connections will fail if an event causes a failover to
the secondary partner. In that event, you must re-authenticate to those WSS devices (Network > Edit Device > Con-
nection Parameters).
494
Failover Prerequisites
To prepare for failover:
l Identify a Management Center appliance to act as the primary failover partner. Record the IP address and password
of the "admin" account of this device.
l Identify a Management Center appliance to act as the secondary failover partner. Record the IP address of this
device.
l Ensure that port 22 is open between the primary and secondary partners. Management Center failover employs an
SSH connection.
Configure Failover
You must enable failover using the CLI.
Step 1—Configure the Primary Appliance
1. Use an SSH client to log into the CLI of the Management Center appliance that is to be the primary failover partner.
2. Enter Enable mode:
# enable
3. Confirm that failover has not already been configured on the appliance:
# failover view
Failover:
Status: Disabled
4. Make this appliance the primary failover partner:
# failover make-primary
At this point, the secondary is not configured so the command output is similar to the following:
Failover
Status: ERROR: Secondary not configured
Primary*: 198.51.100.20
Secondary: not configured
Last status update 1 second(s) ago
(*) this Management Center
Because the secondary failover partner has not been configured, the failover icon displays with an exclamation mark:
This icon also displays if failover has been configured and the secondary is unresponsive.

495
Step 2—Configure the Secondary Appliance
Before beginning this procedure, complete all tasks required for the secondary appliance to service requests (set up
authentication, etc.).
1. Use an SSH client to log into the CLI of the Management Center appliance that is to be the secondary failover
partner.
2. Enter Enable mode:
# enable
3. Confirm that failover has not already been configured on the appliance:
# failover view
Failover:
Status: Disabled
4. Make this appliance the secondary failover partner:
During this process, the services on both the primary and secondary appliances are unavailable.
# failover make-secondary
Enter the IP address for primary server []: 198.51.100.20

Warning: Initial failover data transfer may take a long time to complete. To
complete the failover
setup, allow for transfer to finish and do not disable failover on 10.169.21.81
(primary) or
10.169.21.82 (secondary) during this operation. Services on 10.169.21.81
(primary) will not be
available while initial failover setup is performed.
Are you sure you want to continue? y
Please authenticate to primary server...

[email protected]'s password:
Shelving operational data on secondary...done.
Stopping services on secondary...done.
Stopping services on primary...done.
Retrieving snapshot of primary's data...
The password is not saved and is not reused for further replication process.
5. Verify that failover has been successfully configured:
# failover view
Failover:
Status: Healthy (0 second replication delay)
Primary: 198.51.100.20
496
Secondary*: 198.51.100.24
If failover has been successfully configured, the failover icon displays in the web UI banner:
You can also mouse over the failover icon to review the failover status.
Switch to Secondary When the Primary is Unresponsive
If the primary failover partner is unresponsive, you must:
1. Make the secondary failover partner active. Do this by entering the command:
2. Reactivate statistics monitoring.
At this point, the secondary is active and is now the primary failover partner.
3. Fix the problems with the original primary device.
4. Make the original primary device (the device that was unresponsive) the new secondary failover partner:
#failover make-primary
Failover is now successfully reconfigured.
Step 1—Make Secondary Partner Active
Issue the failover make-primary command to make the secondary appliance the primary failover partner. If the ori-
ginal primary device later becomes responsive, you can make it the secondary failover partner, thus preserving the failover
capability.
System is configured as secondary, promoting state to primary will break replication.
Are you sure you want to promote state to primary? [y/N]
Restoring operational data...done.

Failover:
Status: ERROR: Secondary not configured
Primary*: 198.51.100.24
497
Secondary: not configured

Step 2—Reactivate Statistics Monitoring
After making the secondary failover partner active, you must reactive the statistics monitoring job. This job instructs
devices that have PDM Export (statistics monitoring) enabled to send updates to the new primary device.
2. Click New Job. The system displays the New Job: Basic Info dialog.
3. In the Basic Info dialog, enter a name for your job. An asterisk denotes fields that are mandatory.
4. Enter a description of the job. Good descriptions help to differentiate jobs when they have similar names.
5. Click Next.
6. In the Operation dialog, select Reactivate Statistics Monitoring.
7. Click Next.
The system displays the Targets dialog. Management Center automatically finds all applicable targets.
8. Click Next.
The system displays the Schedule dialog. Optionally, enter a schedule.
9. Click Finish.
Disable Failover
Use the failover delete command to disable failover.
#failover disable
Failover:
Primary: 198.51.100.20
Secondary*: 198.51.100.24

Are you sure you want to disable failover? [y/N]
Restoring operational data...done.

Failover:
Status: Disabled
498
Update the Management Center License
The Management Center license contains all of the features for which you have purchased a subscription. The doc-
umentation covers all features, including ones that you may not have purchased.
You can update your existing license from BTO, download the license from a web server or workstation, or install it manu-
ally.
1. To view license status or to update or install a license, select Administration > License.
2. To view detailed license component information, select the License Components tab.
Use the passphrase field when you are installing a license you generated with a passphrase; the passphrase
is required for VA Offline licensing.
3. To determine how you will install the license, select the Install New License tab. See the following sections for
instructions.
4. (Optional) To troubleshoot the license installation, do the following:
n To check the status of a license, run the CLI command #license view.
n To verify network settings, run the CLI command #show interface.
n To verify site accessibility, run the CLI command >ping with the following sites:
o ping bto-services.es.bluecoat.com
o ping validation.es.bluecoat.com
n To update the license, run the CLI command #license get-from-bluecoat.
n Try to update the license again, after running the CLI command #restart reboot.
5. (Optional) From a web browser, log into Management Center. If the web console loads, the license was installed
successfully.
If the web console does not load, run the CLI command # license view to determine if the license was installed
and is valid.
Install the license from BTO
You must install the license from BTO using the #license get-from-bluecoat CLI command at least once
before you can install it from BTO using the web console.
1. Select Install from BTO.
2. Enter your BTO User ID and BTO Password.
3. Click Install License.
4. Click Refresh to display the updated license information in the License Components table.
Install from URL
Before you can install your license you must first get the license file (*.bcl or *.bin) and save it to a location on a web server
or workstation that the VA can access.
499
1. Select Install from URL. The web console displays a text field.
2. Enter the location (a valid URL) of the license file into the field.
Paste license text from a text editor
Before you can install your license you must first get the license file (*.bcl or *.bin) and save it to a local directory. Open the
license file in a text editor (such as Notepad) and make sure you save the file.
1. Select Paste license text. The web console displays a text box.
2. Copy and paste the license from the text editor to the box.
Verify License Components from the Web Console
Management Center has a flexible license model. Components can be licensed, and are exposed dependent upon the
license type and component name. You can view the validity of licensed components, add more devices to your license,
and view the serial number and appliance model of the hardware appliance. Install or update your licenses directly from
BTO while logged into the web console.
1. To verify the license components, type and status, log in to the web console.
2. Select Administration > License. From the License Component tab you verify the following General
Information about the license:
n Manufacturer (Symantec Corporation)
n Number of Maximum Devices allowed
n Serial Number
n Appliance Model
n Status
n Component Name
n Activation date
n Expiration date
n License Type
500
Troubleshoot and Resolve Issues
This section discusses troubleshooting steps and advanced procedures for Management Center.
The following topics provide information for resolving common issues:
l "Reset or Restore Admin Account Passwords" on page 350
l "Upgrade/Downgrade System Images" on page 487
l "Encrypt Sensitive System Data" on page 490
l "Back Up the Management Center Configuration" on page 489
l "Restore a Management Center Backup Configuration" on page 491
Audit Transactions
To access the Audit Log Viewer, click Administration > Auditing.
By default, recent transactions are displayed on the first page of records. If they are not on the first page, or if you are look-
ing for historical data, you can navigate to different pages or limit the number of records to locate the correct ones. For
instructions, see "Customize the Audit Log" on page 504.
Records do not display in the Audit Log Viewer immediately after transactions occur; refresh the web console to
see most recent records. You can click the Refresh icon at the bottom of the screen to update the most recent
entries.
To understand and analyze the data recorded for each transaction, refer to the following table.
Column Description
Operation The date (in YYYY-MM-DD format) and time (in 24-hour notation) the transaction was completed.
Time
Operating The user who performed the operation. If no user is associated with the operation, SYSTEM is displayed.
User
502
Column Description
Record Type The transaction level: AUDIT or EVENT. An audit record is a system-level transaction; an event record is
a user-level transaction. For more information, see "Understand Transaction Types" on the next page.
This column is hidden by default.
Object Type The type of object on which the operating user performed the action.
Operation The operation that was completed.
Type
Info 1 - Info 5 Additional reference fields for the record. Not all transaction types have additional information.
Columns Info 3 through Info 5 are hidden by default.
503
Understand Transaction Types
The Audit Log records two levels of transactions:
n Event—High-level transactions that occur as a result of a user action, such as adding or deleting a device
n Audit—Low-level internal system actions, such as deleting connection information
Each record contains the target of the operation, the operation detected, the user who executed the operation, and additional
data depending upon transaction type.
In the previous example, the Object Type is Role and the AUDIT transactions are changes at the system and admin levels.
You might find that in most cases, EVENT records provide enough detail about transactions and their effects on the sys-
tem. Filters were applied to the record type.
504
Customize the Audit Log
Because the Audit Log records all transactions on multiple levels, the log can grow very quickly—especially if you many
devices are managed in Management Center and there is a high level of user activity. Although the Audit Log is designed
to make it easy for you to locate the records you want, you can customize the display further to help you locate specific
records, isolate records from a certain date or time, filter records pertaining to specific users or objects, and more.
Use the following methods in conjunction to customize the Audit Log display to suit your purposes.
When you make the following changes in the Audit Log Viewer, the changes do not persist beyond the current
browser session; the next time you log in to the web console, you must go through the same steps to change the
viewer again.
Show or hide columns
You can show columns that you hid, or columns that are not visible by default, such as Record Type and Info 3 through
Info 5. You can hide some columns if you want a more general look at the log or if your screen size is limited.
To see all information available in the Audit Log and ensure that you can see an appropriate level of detail, you can show all
columns first and then choose which ones, if any, you want to hide.
1. On any column header, click the arrow. The web console displays a list of options.
2. Select an option to show the column.
Clear an option to hide the column.
3. Click anywhere outside of the list to close it.
The Audit Log shows/hides the columns you specified.
Sort columns
Because the Audit Log displays records in descending chronological order by default, you can re-arrange them to analyze
the data more effectively. By default, the records are sorted in descending order of Operation Time (latest to earliest).
1. Click the header of the column you want to sort.
n If the header displays an up arrow, the data is arranged in ascending order (A-Z, earliest to latest).
n If the header displays a down arrow, the data is arranged in descending order (Z-A, latest to earliest).
2. Click the header again to reverse the sort order.
In the following example the columns are sorted by Operation Type, so all Authentications are displayed first.
Filter records
To limit the amount the data that the log displays and focus only on specific records, apply filters using the drop-down lists
on the right. Depending on the transaction level, you may need to filter pages of records. The filters limit the record type. To
narrow the search, apply one or more filters.
505
If applying a filter results in too few records or not the right records, remove or change some filters. To reset the filters to
default, click Clear.
506
Configure Housekeeping Settings
Configure general housekeeping settings. When these settings are activated, they affect what is displayed in the Audit
Log Viewer and how big audit logs can grow.
2. Click Housekeeping on the left.
3. Select the default housekeeping settings. An asterisk denotes fields that are mandatory.
Run every n hours.* Default is 12. The value represents (in hours) how numeric using up and down

often to run a full audit. arrows
Number of days of audit records to keep.* The value represents the number of numeric using up and down
Default is 120. days that audit records are kept. arrows
Number of days of job execution records to The value represents the number of numeric using up and down
keep.* Default is 120. days that job executions records are arrows
kept.
Number of days of closed alert records to The value represents the number of numeric using up and down
keep.* Default is 120. days that alerts are kept after being arrows
closed.
Configure Diagnostics Logging
Use this page to set the logging levels. The Master Log includes all of the General and Device Plugin data. To reduce the
size of the Master Log or to produce a targeted log, configure the levels accordingly. The level you choose determines the
amount of information provided in each log. For example, debug logs can later be used to send diagnostic information to
Support. The logging levels are described in the following table.
Log Description
Level
DEBUG Logs detailed informational events and is most useful when you are attempting to diagnose prob-
lems.
INFO Logs high-level informational messages only.
WARN Logs potentially harmful events.
ERROR Logs all errors that do not cause the system to restart.
507
Log Description
Level
OFF Disables logging. The Master Log cannot be disabled.
ALL Logs everything. Applicable only to the Master Log.
When you enable a log, data is written to a specific log file. For example, if the Master log is set to INFO or above, mes-
sages are written to log.log. If the Master Log is set to DEBUG, all messages are written to debug.log and also to
log.log (messages for INFO and above). All other logs send data to a log of the same name, for example, secur-
ity.log and network.log.
Configure Diagnostic Logging
1. Select Administration > Settings > Diagnostics.
The system displays the Diagnostics window. An asterisk denotes fields that are mandatory.
2. Specify the Master Logging Level, General, and Device Plugin settings.
508
509
Required Ports, Protocols, and Services
Management Center uses the following ports while operating. Ensure that you allow these ports when setting up Man-
agement Center.
Inbound Connections to Management Center
Service Port Protocol Configurable? Source Description
SSL 8080 TCP No User's client Management Center web
8082 console
SSH 22 TCP No User's client Management Center CLI
SSL 8082 TCP No User's client Management Center API
Outbound Connections from Management Center
LDAP 10389 TCP Yes LDAP server Authentication
LDAPS 389
636
Active Dir- 10389 TCP Yes Active Directory Authentication
ectory 389 server
636
RADIUS 1812 UDP/TCP Yes RADIUS server Authentication
RADIUS 1813 UDP/TCP Yes RADIUS server Accounting
SMTP 25 TCP Yes SMTP server SMTP alerts
SNMP Trap 162 UDP Yes Trap receiver SNMP traps
HTTP Proxy 8080 TCP Yes HTTP Proxy Updates
NTP 123 UDP/TCP No NTP server list Time sync to customer-
configured NTP time
server
HTTPS 443 TCP No Symantec bto.bluecoat.com
License activation,
Web Application Pro-
tection (WAP) sub-
scription, the latest
release information and
documentation
DNS 53 UDP/TCP No DNS server FQDN lookups
MA 443 TCP No Malware Analysis Health monitoring and
backup
510

PacketShaper 80/443 TCP No PacketShaper Health Monitoring (unen-
crypted/encrypted)
Reporter 8080/8082 TCP No Reporter Reporter API (unen-
crypted/encrypted)
ProxySG 22 TCP No ProxySG appli- ProxySG appliance mon-
ance itoring and management
Management 22 TCP No Management Management Center
Center Center communication with fail-
over partner
VPM 8082 TCP No ProxySG appli- Visual Policy Manager
ance
CAS 8080/8082 TCP No Content Analysis Health Monitoring (unen-
crypted/encrypted)
ance formance Statistics.
Starting with Management
Center 1.7, Port 9009 is dis-
abled unless HTTP is
enabled via the security
http enalbe command.
ance formance Statistics over
HTTPS
SSL Visibility 443 TCP No SSL Visibility Health monitoring and
configuration synch
Required URLs
Ensure connectivity from Management Center to the following URLs.

validation.es.bluecoat.com/phs.cgi HTTPS 443 Validates the license every 5 minutes. After suc-
TCP cessful validation, validation occurs every hour.
bto-services.es.bluecoat.com HTTPS 443 Validates the license.
TCP
device-services.es.bluecoat.com HTTPS 443 License related.
TCP
services.es.bluecoat.com HTTPS 443 License related.
TCP 443
511

abrca.bluecoat.com HTTPS 443 Symantec CA.
TCP
appliance.bluecoat.com HTTPS 443 Trust package downloads.
TCP
subscription.es.bluecoat.com HTTPS 443 Subscription services.
TCP
upload.bluecoat.com HTTPS 443 Upload diagnostic reports to Symantec support.
TCP
sgapi.es.bluecoat.com HTTPS 443 Universal VPM policy.
TCP
Determine Which Version You are Using
To aid in troubleshooting, you might need to determine the version and build of Management Center that is currently running.
Refer to the Management Center Release Notes to identify issues or limitations that your build might include.
1. In the web console banner, click > About. The web console displays the Management Center - About dialog.

The dialog displays information about the Management Center version. See the table following this procedure.
2. Click Close to close the dialog.
512
Build Information Fields
Field Description
Version The Management Center version.
Build The number of the installed build.
Serial Number The serial number of the appliance.
Automate Password Reset Process
As an administrator on Management Center, you need to configure settings so that users can request a password reset if
they forget their password.
1. Select Administration > Settings > General.
2. Set the Is Reset Password enabled? field to true.
3. For Reset Password Email Subject, modify the email subject line, if desired.
4. For Reset Password Email Message, modify the body of the email that is automatically sent to users when they
click the Reset Password link. For example, you can add a person's name to the signature instead of the generic
Management Center.
The message contains two substitution variables: {fullname} and {password}. Management Center
automatically replaces {fullname} with the user's first and last name and replaces {password} with a
temporary password.
5. Click Save to store the settings on the server.
6. Make sure an email server is configured. See "Configure Mail Settings" on page 483.
When the email is sent with the temporary password, the user's account is marked so the administrators know that
the password is only temporary. The temporary password will expire.
513
Prevent Licensing Issues on a Virtual Appliance
To prevent licensing issues, ensure that the VA is allowed network access to the license validation server at https://val-
idation.es.bluecoat.com. See "Verify Web Console Access" on page 37.
If communication with the server fails, the license may be suspended. Unless you have purchased a VA offline license, con-
stant Internet connection is required for Management Center to communicate regularly with the license validation server to
confirm that the serial number is valid.
Duplicate Serial Numbers
If the license validation server detects duplicate serial numbers, your license is invalidated and the license health status
goes to a critical state. Verify your license in BCLP and contact Symantec Support if you continue to have problems.
Expiring Licenses
Management Center health goes into a Warning state when the license is 15 days from expiring. For example, if the license
will expire on January 30th, the Messages option in the web console banner displays Warning-level alerts, such as the fol-
lowing, starting on January 15th.
The web console banner displays an alert for each licensed component.
Once the license expires, Management Center goes into an Error state and remains in that state for another 15 days or until
the license is updated (whichever occurs first). For example, starting on January 30th, the Messages option in the web con-
sole banner displays Warning-level alerts for each licensed component until the license is renewed.
If you do not renew the license within 15 days after the expiration date, you will be unable to load the web console. You must
renew the license through the CLI using # license get-from-bluecoat or # license get-from-url.
Stop or Restart Services
To troubleshoot some issues, you might need to stop or restart Management Center services. You will need to restart the
services after you install or update a Management Center license.
Stop Management Center Services
You can start or stop the Management Center, report generator, or statistics monitoring services.
2. Enter privileged mode by typing enable at the command prompt.
514
4. At the # prompt, type the following command and press Enter:
#service stop-service [ management-center | report-generator | statistics-monitoring ]
The CLI displays the command prompt.
Restart Services
2. Enter privileged mode by typing enable at the command prompt.
4. At the # prompt, type restart services and press Enter.

The CLI displays the command prompt.
You cannot access the web console while the services are restarting; however, you can try accessing the web con-
sole a few minutes after issuing the command.
Test Network Connectivity
Verify that your network is set up correctly by using the ping command or the tracepath command in the CLI. Be sure
to specify a hostname or IP address that you know is reachable and working.
2. Enter Privileged mode. "Privileged Mode Commands" on page 531.
3. Ping an IP address:
# ping <hostname or IP address>
4. Trace the path between the host and a destination IP address:
# tracepath <destination>
If you receive an error message, check your network configuration.
515
Upload System Diagnostics
To help Symantec Technical Support troubleshoot a Management Center issue, you can send diagnostics information to an
external server using a supported protocol (FTP, HTTP, HTTPS, or SCP).
1. Log in to the CLI. See "Access the Management Center CLI" on page 523.
2. (If required) Enter the privileged mode password and press Enter.
3. Enter the appropriate command to upload the diagnostics:
Using FTP
# service upload-diagnostics ftp://<username:password>@host/path
where <username:password> is the username and password to authenticate to the server and
host/path is the path to where you want to save the file.
Using HTTP
# service upload-diagnostics http://host/path
where host/path is the path to where you want to save the file.
Using HTTPS
# service upload-diagnostics https://host/path
where host/path is the path to where you want to save the file.
Using SCP
# service upload-diagnostics scp://<username:password>@host/path
where <username:password> is the username and password to authenticate to the server and
host/path is the path to where you want to save the file.
View Hardware Diagnostics and Memory Resources
Use the Hardware Diagnostics screen to check on how much memory and storage space is being used by Management
Center system components and processes. In addition, you can monitor various hardware sensors to spot potential prob-
lems with CPUs, fans, power supplies, and so forth (not applicable to virtual appliances).
n System Metrics — Details about memory usage of the CPUs and Management Center processes
n Storage Usage — Additional memory settings
n Data Storage — Amount of data used by each feature
n Database Storage — Amount of storage used for each database (Management Center, Device Statistics, Reporter)
n Temperature Sensors — The results of temperature monitoring for the chassis, CPU, and other components that
produce heat in the appliance
516
n RPM Sensors — Reports the speed at which the fans on the appliance spin
n Voltage Sensors— Reports the voltage, status and state of components for which the appliance has a voltage
sensor such as CPU cores, power supply, and others
n Other Sensors — Reports status of optional hardware components, such as extra power supplies
Byte counts for memory usage are approximations, not precise values.
To view hardware diagnostics for your appliance:
1. Select Administration > Hardware Diagnostics.
2. Click Refresh to view the most current appliance status totals and usage.
517
Problems and Errors
The following are error messages that you might encounter in Management Center.
Read Messages and Alerts
In the web console banner, the Messages icon displays alerts to communicate that a change was made, such as a con-
firmation of device activation. Alerts indicate the severity level of the change; for example, Messages displays a green Mes-
sage-level alert when you add a device and a red Error-level message when device activation fails.
If you have unread alerts, the Messages icon in the banner displays the number of unread alerts and the status of the
alert with the highest severity level.
To read messages, in the web console banner, click Messages.
To filter alerts, click Errors, Warnings, or Messages at the bottom of the dialog. To understand more about colors and
status, see "About Color-Coded Status Indicators" on page 30.
To manage alerts, click on the Alerts icon to get to the Alerts page. See Manage Alerts for more information.
When you navigate to another screen, Message-level alerts are removed from the Messages dialog, but Errors
and Warnings remain on the dialog until you read them.
"Could not enable statistics collection due to unexpected server failure" when activating
a device
Problem: When you activate a device, you receive the alert "Statistics collection failed. Could not enable statistics col-
lection on <device> due to unexpected server failure". When you added the device, you had selected Collect statistics for
this device.
Resolution 1 : Statistics collection requires SGOS 6.3.x. If the ProxySG appliance is not running SGOS 6.3.x or later, dis-
able statistics collection by editing the device details and clearing Collect statistics for this device. You can enable stat-
istics collection for the device again later if you upgrade SGOS to a supported version.
Resolution 2 : Connection settings are incorrect. Verify device connection parameters and edit the device details.
519
"Import batch contains duplicate device name violation" when importing multiple
devices
Problem: When you import devices, you receive the error "Import batch contains duplicate device name violation."
Resolution: Each device in the import file must have a unique name. Management Center detects duplicate device names
even if you select only one or none of the devices for importing, and regardless of their placement in the hierarchy.
Rename duplicate devices in the import file and import them again. Alternatively, remove devices that you do not want to
add from the file and import devices again.
"Local Changes Detected" error when installing policy
Problem: When you click Install Policy, the Policy Editor displays a Local Changes Detected message:
This message means that the policy on a device has changed outside of Management Center. It could have been changed
on the ProxySG appliance itself, or through an overlay installation if you also use Symantec Director to manage devices.
Resolution: To resolve this conflict, click Compare to see the differences between the policy on the device and the policy
you want to install. See "Compare the Device Policy Version with Current Policy Version" on page 272 for information.
Then, click Install Policy to overwrite the version on the device, or click Cancel to keep the version on the device.
User has "access denied" error when running a job
Problem: A user runs a job manually (through the Run Now option) or using the Immediate schedule option, but the job
completes with an "access denied" error.
Resolution: Check the user's permissions; if they do not have sufficient permissions for the operation, they cannot run a
manual or immediate job for the operation. For more information, see "Reference: Understanding Job Permissions" on
page 324.
"Multi-tenant policy support is not enabled for this device" when installing policy
Problem: Attempts to install policy to a ProxySG appliance fail and you receive the message "Error: Multi-tenant policy is
520
not enabled for this device".
Resolution 1: Multi-tenant policy was introduced in SGOS 6.6.x; if the device is running an earlier version of SGOS, you
cannot install multi-tenant policy to it. If the device is running SGOS 6.6.x, proceed to the next resolution.
Resolution 2: The device does not have the Multi-Tenant Policy license or the license is invalid. If this is the case, contact
your Symantec sales point of contact or Symantec customer care for assistance.
To determine if the appliance has the license:
1. Log in to the ProxySG Management Console.
2. Select Maintenance > Licensing.
3. In the list of Licensed Components, look for Multi-Tenant Policy. If the license is installed and valid, proceed to the
next resolution.
Resolution 3: Multi-tenant policy is not enabled on the device. To enable it, enter the following commands:
#(config) general
#(config general) multi-tenant enable
ok
521
Management Center REST API
Management Center 1.6.1.1 and later include a new REST API. You can use this API if you want to access Management
Center without using the UI or want to trigger Management Center operation without using the UI. This REST API has the
ability to:
n Access and raise alerts.
n View registered devices, device health, and other monitoring variables.
n View jobs and job execution status.
n Start and cancel jobs.
n Show basic device information like version, disk usage, name of device.
No special policy or licensing is required to use this feature. API activities are recorded in the audit log.
Limitations
The REST API has the following requirements:
n JSON is the only supported payload.
n HTTPS is required to access the API.
n BASIC authentication is the only supported authentication method for providing user credentials for the API.
n You cannot add devices. A bulk device import already exists.
Documentation
Access the REST API documentation at the following URL:
https://MC_IP:8082/help/api
For example:
https://198.51.100.18:8082/help/api
Troubleshooting
Confirm that the user has the proper permissions:
n REST API permissions (included in default administrator role).
n Appropriate permissions for the data or operation. For example, the user must have the Device permission if they
want to use the Device API to list devices.
522
CLI Command Reference
Management Center includes a command-line interface (CLI) that allows you to perform basic administrative tasks. A PDF
of the Management Center CLI command documentation is available on BlueTouch Online:
n "Access the Management Center CLI" on the next page—Describes how to access the CLI via an SSH connection.
n "CLI URL Syntax" on page 524—Describes the valid syntax for commands that require a URL path
n CLI Command Reference: List—Navigate links to view command descriptions and syntax.
Access the Management Center CLI
Log on to the CLI through an SSH connection or through the Management Center VMware console.
For hardware appliances, access the CLI through the serial console.
Log on using SSH
1. Install an SSH client. This procedure uses PuTTY as an example; your steps might be slightly different.
2. Open PuTTY and specify the following information:
n Host Name (or IP address)—The IP address that you specified for
n Port—22
3. (Optional) Specify a name for the connection and click Save to save the settings.
4. Click Open. The SSH window opens, with a login prompt.
5. At the login as: prompt, type admin and press Enter.
6. At the admin@IP_address's password: prompt, type your password and press Enter. The console displays
the CLI banner.
Log on through the VMware console
Use the VMware console or SSH if you are logging into a Virtual Appliance.
1. In the VMware client, browse to the VM in the inventory.
2. Select the VM, right-click, and select Open Console.
The console displays the CLI console and prompts you to press Enter three times.
3. Press Enter three times. The console displays the CLI banner.
524
CLI URL Syntax
All CLI commands that accept a URL as a download source or upload destination are formatted as:
protocol://host/path
For example, the SCP protocol must use the format:
scp://host/path
If path is a directory, it must end with a forward slash (/).
The following protocols are supported, although some commands do not support all of the protocols:
n ftp://hostname[:port]/path
n ftps://hostname[:port]/path
n http://hostname[:port]/path
n https://hostname[:port]/path
n scp://hostname[:port]/path
Notes
l URLs cannot contain spaces. If the hostname or path contains a space, you must use the URL-encoded
characters instead: %20.
For example, enter the following URL
http://yourserver.com/d/backup 2.tgz.gpg
as
http://yourserver.com/d/backup%202.tgz.gpg.
l The @ symbol is available for use in server credentials for the following commands:
o backup import
o installed-systems add
o license get-from-url
o service upload-diagnostics
o security ssl import server-certificate
525
Standard Mode Commands
Standard mode is the default mode when you log onto the CLI. In standard mode, you can view configuration settings, but
not change them.
> enable 525
> exit 525
> help 526
> ping 526
> show 527
> tracepath 529
> enable
Use this command to enter privileged mode. Privileged mode commands enable you to view and change your configuration
settings.
By default, you are not required to enter a password for privileged mode. You can configure a password for privileged mode
using the #security enable-password CLI command.
See "Privileged Mode Commands" on page 531 for information on commands available in privileged mode.
Syntax
> enable
Example
Management Center> enable
Management Center#
> exit
Exit the CLI and return to the banner, where you can choose to enter the CLI or Management Center setup.
Syntax
> exit
Example
Management Center> exit
Copyright (c) 2015, Symantec Corporation.
Welcome to the Symantec Management Center CLI

Version: 1.3.0.2 Release id: 655010
--------------------MENU--------------------
1) Command Line Interface
2) Setup
--------------------------------------------
Enter option:
> help
Display a list of all commands and a brief description of each. Alternatively, use ? to display the list.
This command is also available in privileged mode.
Syntax
> help
or
> ?
Example
Management Center> help
enable Turn on privileged commands
exit Exit command line interface
help (or ?) Display this help
ping Ping utility
show Show system information
tracepath Trace path utility
> ping
Verify whether a particular destination exists and is responding to requests by sending ICMP echo packets.
Syntax
> ping <hostname or IP address>
527
Example
Management Center> ping 192.0.2.0
PING 192.0.20.0 (192.0.20.0) 56(84) bytes of data

64 bytes from 192.0.20.0: icmp_seq=1 ttl=125 time=6.43 ms
--- 192.0.20.0 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3007ms
rtt min/avg/max/mdev = 2.319/3.454/6.437/1.729 ms
> show
Display system information.
Syntax
> show [subcommands]
Subcommands
> show clock
Displays the current system time information (time, date, and timezone) set for Management Center along with UTC time
for reference. Works the same as > show timezone.
Example
Management Center> show clock

UTC time : 2017-02-02 03:50:51+00:00 UTC
Local time : 2017-02-02 03:50:51+00:00 UTC
Timezone : UTC
> show http-proxy
Displays HTTP proxy status (enabled or not) and configuration (host, port, user name, password).
> show installed-systems
Lists the images that are currently installed on the system and each image's software version number, release build num-
ber, and when the image was last booted.
> show interface
Displays interface and network settings, including IP address, subnet mask, gateway, and DNS servers.
528
> show license
Lists the component names of all licenses installed on the system and, for each license, displays the status (Valid, Invalid,
Expired, Unknown), date the license was activated, expiration date, and type (such as Subscription or Demo).
> show setupinfo
Display system configuration, such as IP address and DNS servers. This reflects the settings specified during initial con-
figuration of Management Center.
Example
Management Center> show setupinfo
Network settings:
IP address: 10.169.21.51
Subnet mask: 255.255.254.0
IP gateway: 10.169.21.1
DNS server: 10.167.4.55
DNS server: 10.167.4.50
NIC media setting: auto
HTTP Proxy settings:

Enabled: false
HTTP Proxy host:
HTTP Proxy port:
Username:
Password:
> show snmp
Displays the community string and whether remote read access is enabled or disabled.
> show status
Displays the following system statistics (example only):
l Configuration
l General status
l RAID status (displays for HW appliances only)
l Service status
529
Example:
Management Center> show status

Configuration:
Memory installed: 7858 megabytes
Memory free: 4388 megabytes
CPUs installed: 2
MAC: 00:50:56:b5:73:80
General status:
System started: 2015-08-18 15:27:48UTC
CPU utilization: 0
Service status:
BCCM : start/running
Statistics Monitoring : start/running
> show timezone
Displays the current system timezone information (time, date, and timezone) set for Management Center, along with
UTC time for reference. Works the same as > show clock.
Example
Management Center> show timezone

UTC time : 2017-02-02 03:50:51+00:00 UTC
Local time : 2017-02-02 03:50:51+00:00 UTC
Timezone : UTC
> show version
Display information such as system version, build version, and serial number.
Example
Management Center> show version

Version: Blue Coat Management Center 1.9.1.1
Release id: 199309 x86_64 (Debug)
Serial number: [#########]
NIC 0 MAC: 00:00:00:AA:BB:CC
> tracepath
Identifies the route packets take to reach a destination. The command executes until the entire route to the host is traced;
alternatively, you can press you press Control+C to return to the command prompt while the trace is in progress.
Syntax
> tracepath <hostname or IP address>
530
Example
Management Center> tracepath google.com
1: 192.0.2.0 (192.0.2.0) 0.131ms pmtu 1500
1: server1-company.com (192.0.2.1) 0.725ms
2: 172.16.167.17 (172.16.167.17) 0.581ms
3: 216.16.227.26 (216.16.227.26) 2.310ms
4: network.net (216.16.232.121) 2.817ms
5: 216.16.255.193 (216.16.255.193) 2.269ms
6: 24.153.3.141 (24.153.3.141) 3.517ms
7: 64.71.241.97 (64.71.241.97) 6.934ms
8: 69.63.248.89 (69.63.248.89) 19.716ms
9: no reply
531
Privileged Mode Commands
Privileged mode provides a set of commands that enable you to view, manage, and change configuration settings.
Enter privileged mode from standard mode by using the enable command. The prompt changes from a > to a #, indicating
that you are in privileged mode.
# appliance-name 532
# backup 533
# clock 534
# diagnostic-systems 535
# disable 536
# exit 536
# failover 537
# help 538
# http-proxy 538
# installed-systems 539
# license 541
# pcap 542
# ping 543
# restart 544
# restore-defaults 544
# rsyslog-output 545
# security 546
# service 551
# show 553
# shutdown 556
# snmp 556
# static-route 557
# statistics-monitoring 557
# subscriptions 558
# tracepath 559
# verify-hardware 560
# timezone 560
# appliance-name
Change the Management Center appliance name. Changing the appliance name updates all areas where the appliance
name is referenced, including the CLI, the hostname attached to syslog entries, and the SNMP sysname.
Syntax
# appliance-name [subcommands]
Subcommands
# appliance-name set <appliance_name>
Reconfigures the name of the appliance with one that you specify.
<appliance_name> is the name of the appliance. The <appliance_name> must be between 1-64 characters in length
and consist of the following character types: alphanumeric, hyphen, underscore, and periods.
# appliance-name view
Displays the current appliance name.
Notes
l Unless it is further changed by the user, the appliance name does not change after it has been manually configured
except when Management Center is downgraded to a version that does not support a configurable appliance name.
l After upgrading from a build that does not allow appliance name configuration to one that does, the SNMP sysname
defaults to ‘BCMC’ which differs from the default appliance name. The SNMP sysname will retain this value until an
appliance name is configured, after which the SNMP sysname will correspond with the configured appliance name.
l After downgrading to a build that does not allow appliance name configuration, the SNMP sysname defaults to
‘BCMC’ and the appliance name returns to the default value for that build.
l The default appliance name for Management Center builds that do not support a configurable appliance name is
based on the build version and changes when the user upgrades or downgrades the appliance.
l The appliance name is not included with the backup data. You must manually configure the appliance name after
restoring the appliance configuration.
l After upgrading the appliance from a version that does not support appliance name configuration to one that does, the
default appliance name will be the same as the default appliance name of the first image that was ever run.
Exceptions to this are listed below and whichever occurred most recently will be the one in effect:
l A factory reset was previously executed while running image X: the default appliance name after the upgrade
will be the appliance name from image X.
l The appliance was previously downgraded from an image Y that supported appliance name configuration to
533
image Z that does not. In this instance the default appliance name after the current upgrade will be the same
as the default appliance name of image Z.
Example of changing the appliance name to MC_One:
Management Center# appliance-name set MC_One
Changing the appliance name will restart the services.
Are you sure you want to change the appliance name? [y/n]
Updating sysname string to MC_One
Reloading snmpd:
# backup
Back up the Management Center configuration, and view, export, and restore existing backups.
Syntax
# backup [subcommands]
Subcommands
# backup create [full|partial]
# backup create full
Create a full system backup.
# backup create partial
Create a backup that does not include statistics monitoring trend data.
Back up the current Management Center configuration.
# backup delete <index_number>
Delete the specified configuration backup.
Use the backup view command to determine the index number to use.
# backup export <index_number> <URL>
Export the specified backup to a destination server. You must enter a passphrase to secure the backup.
Use the backup view command to determine the index number to use. <URL> is the URL of the destination server and
path. Supported protocols are FTP, FTPS, HTTP, HTTPS, and SCP. See "CLI URL Syntax" on page 524 for information
on how to format the URL.
# backup import <URL>
Import a backup from the specified server. To import the backup, you must enter the passphrase that was specified during
the backup export.
534
<URL> is the URL of the external server and path. Supported protocols are FTP, FTPS, HTTP, HTTPS, and SCP. See
"CLI URL Syntax" on page 524 for information on how to format the URL.
# backup restore <index_number>
Restore a Management Center backup, specified by the index number.
Use the backup view command to determine the index number to use.
# backup restore latest
Restore the most recent configuration backup.
# backup restore-data <index_number>|latest
Restore the configuration and data from a backup. Can be used to transfer configuration and data from one Management
Center to another. The serial number, license, CLI password, and network configuration is not restored since this is not
applicable when transferring the configuration and data to another unit.
# backup view
View existing configuration backups.
Transfer Configuration and Data to Another Appliance
To transfer configuration and data from one Management Center appliance to another:
1. On the first Management Center: use the backup create command to back up the configuration.

2. Use the backup export command to upload the backup to a Web, FTP, or SCP server.
3. Log in to the second Management Center appliance, and use the backup import command to download the
backup from the server specified in step 2.
4. Restore the backup using the backup restore-data command.
Example
Management Center# backup view
Available Backups:
Timestamp Version
1 | 2015-May-26 03:33:00 UTC 1.4.1.1 (555777)
2 | 2015-Apr-16 09:02:00 UTC 1.3.3.1 (554444)
# clock
View the system time settings in the Management Center configuration, and set the specific date and time it displays. The
system time displays on various things that may include a timestamp to show the history of action, including:
l Management Center web console
l Policy object revision history
l Audit logging
l System logging
l Statistics monitoring
The system does not include clock settings in a backup of Management Center.
535
While Management Center uses the system (local) time, the timestamp may be displayed in the UTC timezone for
some things. See # timezone for more information.
Syntax
# clock [subcommands]
Subcommands
# clock set[year|month|day|hour|minute|second] <number>
Set the local time on the Management Center system.
The CLI prevents any invalid entries. For example, if you are trying to enter in February 29th during a leap year (such as
2020), it works, but if it is entered for a year that is not a leap year (such as 2017), the system returns an error.
# clock view
Displays the current system time information (time, date, and timezone) set for Management Center, along with UTC time
for reference. Works the same as # show clock, but is not available in disable mode.
Examples
Management Center# clock view

UTC time : 2017-02-22 03:50:51+00:00 UTC
Local time : 2017-02-22 03:50:51+00:00 UTC
Timezone : UTC
Management Center# clock set day 23
Management Center# clock view

UTC time : 2017-02-23 03:51:31+00:00 UTC
Local time : 2017-02-23 03:51:31+00:00 UTC
Timezone : UTC
Management Center# clock set day 29

29 is not valid for month(02) and year(2017). Acceptable value is between 1 and 28.
Failed to set system clock.
# diagnostic-systems
Upgrade and manage diagnostic systems. To switch between diagnostic and system images, press the SPACEBAR dur-
ing the boot countdown.
Upgrading and managing diagnostic systems is for Management Center hardware releases only.
Syntax
# diagnostic-systems [subcommands]
536
Subcommands
# diagnostic-systems add <URL>
Downloads and installs the specified diagnostic image. The user is shown progress (bytes downloaded) which they can
safely stop watching by entering Ctrl+C. They may resume watching the download progress by running diagnostic-
systems view-downloads.
# diagnostic-systems view
Displays the list of diagnostic images installed on the appliance.
# diagnostic-systems view-downloads
Displays running progress of the diagnostic image currently being downloaded. If no image is being downloaded, it displays
the status of the last download request. The user can stop watching the progress by entering Ctrl+C.
# diagnostic-systems delete <index>
Deletes the specified diagnostic image from the appliance. Locked systems cannot be deleted.
# diagnostic-systems lock <index>
Locks the specified diagnostic image, preventing it from being deleted.
# diagnostic-systems unlock <index>
Unlocks the specified diagnostic image, allowing it to be deleted.
# disable
Return to standard mode in the CLI.
Syntax
# disable
Example
Management Center# disable
# exit
Exit the CLI and return to the banner, where you can choose to enter the CLI or Management Center setup.
To return to standard mode from privileged mode, use the disable command. See "# disable" above for information.
Syntax
# exit
Example
Management Center# exit
537
Copyright (c) 2015, Symantec Corporation
Welcome to the Symantec Management Center CLI
Version: 1.4.1.1 Release id: 555000
--------------------MENU--------------------
1) Command Line Interface
2) Setup
--------------------------------------------
Enter option:
# failover
Configures Management Center failover. Management Center supports failover using two physical appliances. One appli-
ance is delegated as the primary and the other as the secondary. After failover is configured, the secondary replicates data
from the primary appliance. During continuous replication, users can perform all normal operations on the primary failover
partner. Users cannot access the secondary failover partner—its sole purpose is to replicate actions occurring on the
primary node so that it can take over if something happens to primary node. See "Configure Management Center Failover"
on page 492 for more information.
Syntax
# failover [subcommands]
Subcommands
# failover view
Display current failover settings.
Configures the appliance to be the primary partner in the failover group.
# failover make-secondary
Configures the appliance to be the standby partner in the failover group.
# failover disable
Disables all failover settings.
Example
# failover view
Failover:
538
Primary: 198.51.100.20
Secondary*: 198.51.100.24
# help
Display a list of all commands and a brief description of each. Alternatively, use ? to display the list.
This command is also available in standard mode.
Syntax
#help
or
# ?
Example
Management Center# help
backup Create, view and restore backups
disable Turn off privileged commands
exit Exit command line interface
help (or ?) Display this help
installed-systems Upgrade and manage installed systems
license Install and update the Management Center license
ping Ping utility
restart Restart the system or services
security Manage certificates, passwords and access to privileged commands
service Diagnostic and service support
show Show system information
tracepath Trace path utility
# http-proxy
Configure Explicit HTTP Proxy settings.
Syntax
# http-proxy [subcommands]
539
Subcommands
> show http-proxy
Display network settings and HTTP Proxy settings, such as IP address, DNS servers, HTTP Proxy host IP address and
HTTP Proxy port number.
# http-proxy enable
Enables use of the proxy.
# http-proxy disable
Disables use of the proxy.
# http-proxy configure
Configures proxy settings, such as Proxy host, port, username and password.
Example
Management Center> http-proxy configure
Network settings:
IP address: 10.169.0.219
Subnet mask: 255.255.0.0
IP gateway: 10.168.0.1
DNS server: 1.1.1.1
Enabled: true
HTTP Proxy host: 10.168.0.207
HTTP Proxy port: 8080
Username: user1
Password: *****
# installed-systems
Upgrade and manage installed systems.
Before upgrading the Management Center image, set the default system image to the currently running image.
Syntax
# installed-systems [subcommands]
540
Subcommands
# installed-systems add <URL>
Download and install a system image.
<URL> is the location on a server where image resides, in the following format:
http://host/path
Specify the default system image. The default system image will be run after the next reboot.
<index_number> is the number of the image. Use installed-systems view command to determine the image to
use.
# installed-systems delete <index_number>
Delete the specified system image.
<index_number> is the number of the image. Use installed-systems view command to determine the image to
use.
Display the installed system images, with version, build number, and last boot time. The command also indicates the run-
ning image and default image, which will be run upon the next reboot.
# installed-systems view-downloads
View the progress of downloads in progress or the status of the last download. If no systems have been downloaded, the
CLI responds No systems are being downloaded.
#installed-systems cancel-downloads
Cancel the progress of all downloads in progress. The CLI displays a list of active download(s), along with the message
Are you sure you want to cancel image download? [Y/N]. If the download cancellation is confirmed, the
CLI responds System image download canceled.If there are no downloads in progress, the CLI responds No
image downloads in progress.
After the cancellation, use # installed-systems view-downloads to verify the information confirmation to continue

with the cancellation or abort. If active downloads are canceled, If no systems have been downloaded, the CLI responds.
Example of canceled image download:
Management Center#installed-systems cancel-downloads
Are you sure you want to cancel image download? [Y/N] y
System image download cancelled.
Management Center#installed-systems view-downloads

Download URL: <URL>
Download Status: Download cancelled
Download bytes: 0
#installed-systems lock <index_number>
541
Lock the specified system image so that it cannot be deleted.
# installed-systems unlock <index_number>
Unlock the specified system image so that it can be deleted.
Example
Management Center# installed-systems view

Installed System Images:
Version Release Last boot time Attributes
*1 | 1.4.4.1 555770 2015-05-14 19:42:51 UTC Locked
+2 | 1.4.0.1 555000 2015-03-09 11:22:11 UTC Unlocked
(*) running system image

(+) default system image (will be run on next reboot)
# license
Install a Management Center license or view the status of the last license download.
The CLI prompts you to enter your BTO credentials when you install the license for the first time.
Syntax
#license [subcommands]
Subcommands
#license get-from-bluecoat
Install a new license or update the existing license from BTO. The CLI only prompts you for your BTO username and pass-
word if you are installing a new license on a VA appliance.
This command displays the download progress until download is complete.
#license get-from-url <URL>
Update the existing license from a license file on a local server. The command prompts for an optional passphrase, which
is used to decode birth certificates embedded in license files.
This command displays the download progress until download is complete. See "CLI URL Syntax" on page 524 for inform-
ation on how to format the URL.
#license view
View general information such as appliance serial number, information on licensed components, and status of the last
attempted license download, including any download in progress.
If you are running a Management Center VA and have not purchased the Offline VA support option, issuing the license
view command requires connectivity to the Symantec license validation server. If you issue the command without Offline
VA support and Management Center is unable to contact the license validation server, the CLI displays the error:
542
Cannot communicate with license validation server
For more information, refer to the KB article You receive a "Cannot communicate with license validation server" error in Man-
agement Center.
If you are running a version of Management Center that contains features available only through license components,
contact your sales engineer to ensure that you have the correct license.
Example
Management Center# license view
General Information
Manufacturer: Bluecoat Systems Inc.
Serial Number: ##########
Appliance Number: MC-S400-20
License Component Information

Status Component Name Activation Expiration License Type
Valid Management Center 2015-05-01 2016-04-30 Subscription
Valid Performance Monitoring 2015-05-01 2016-04-30 Subscription
Valid Device Configuration 2015-05-01 2016-04-30 Subscription
Valid Device Inventory 2015-05-01 2016-04-30 Subscription
Valid Policy Management 2015-05-01 2016-04-30 Subscription

Download Information
Download Date: 2015-05-01 23:34:00
Download Status: Download complete
Install Status: Valid
# pcap
The PCAP utility enables you to capture packets of Ethernet frames entering or leaving Management Center. Packet cap-
turing allows filtering on various attributes of the frame to limit the amount of data collected. The collected data can then be
transferred to the desktop for analysis via service diagnostic upload.
To view the captured packets, you must have a tool that can read Packet Sniffer Pro 1.1 files such as Wireshark or Ether-
eal.
Packet captures are limited to 100 MB. The files rotate once the 100 MB limit is reached.
Syntax
# pcap [subcommands]
543
Subcommands
# pcap filter
Specifies filters to use for PCAP. If you set a filter and subsequently change it while the PCAP is running, the change will
not be applied until you restart the packet capture.
Subcommands:
# pcap filter clear
Clears all pcap filters.
# pcap filter set-host ipv4_address | hostname
Captures data only between Management Center and the specified host.
# pcap filter set-port port
Captures data only on the specified port.
# pcap filter view
Displays the filters currently enabled.
# pcap info
Reports current state of the packet capture.
# pcap start
Starts the capture.
# pcap stop
Stops the capture.
Example
Management Center# pcap info

Packet capture information:
Current state: Running
Filtering: port 80
Packets captured: 15020
# ping
Verify whether a particular destination exists and is responding to requests by sending ICMP echo packets.
Syntax
# ping <hostname or IP address>
544
Example
Management Center# ping 192.0.2.0
PING 192.0.20.0 (192.0.20.0) 56(84) bytes of data

--- 192.0.20.0 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3007ms
rtt min/avg/max/mdev = 2.319/3.454/6.437/1.729 ms
# restart
Restart the Management Center VA or services.
Syntax
# restart [subcommands]
Subcommands
# restart reboot
Reboot the virtual appliance. When the appliance shuts down, the network connection closes and you must start a new CLI
session.
# restart services
Restart Management Center services.
Example
Management Center#restart reboot
Management Center#
Broadcast message from admin@bccm_main-6-x86_64.localdomain
(/dev/pts/0) at 23:27 ...
The system is going down for reboot NOW!
# restore-defaults
Restore factory defaults on the appliance/device running Management Center. This command is only available using the
serial console.
Syntax
# restore-defaults [subcommands]
545
Subcommands
# restore-defaults factory-defaults
Reboots the appliance/device after restoring factory defaults is complete.
# restore-defaults factory-defaults-halt
Halts the appliance/device after restoring factory defaults is complete.
# restore-defaults factory-defaults-shutdown
Powers off the appliance/device after restoring factory defaults is complete.
# restore-defaults reset-admin
Resets the UI admin password to admin/admin.
# restore-defaults configuration
Resets the UI configuration back to defaults. Retains all other data.
Example
Management Center #restore-defaults reset-admin
This operation will restore admin password on UI to default. Management Center service
will be unavailable during this operation.
Are you sure you want to restore UI admin password? [y/N]
# rsyslog-output
Configure the remote servers where remote syslog output can be sent.
Syntax
# rsyslog-output [subcommands]
Subcommands
# rsyslog-output add
Add new syslog server configuration.
# rsyslog-output configure
Configure existing syslog server.
# rsyslog-output delete
Delete syslog server configuration.
# rsyslog-output disable
Disable use of remote syslog output.
# rsyslog-output enable
546
Enable use of remote syslog output.
# rsyslog-output view
View configured syslog servers.
Examples
Management Center# rsyslog-output add
Enter syslog server host []: my-remote-host
Enter syslog server port [514]:
Enter syslog server protocol (TCP|UDP) [TCP]:
Management Center# rsyslog-output disable
Management Center# rsyslog-output view
Warning - Remote syslog server output is disabled.
Host Port Protocol

1 | my-remote-host 514 UDP
Management Center# rsyslog-output delete 1
Remove syslog server configuration (Host "my-remote-host", Port 514, Protocol

UDP)? [y/N] y
# security
Specify security options for Management Center including basic certificate management using ssl.
Syntax
# security [subcommands]
# security ssl [subcommands]
Subcommands
# security allowed-hosts
Subcommands:
# security allowed-hosts add
# security allowed-hosts delete
# security allowed-hosts view
Limits access to a specific host such that it can be accessed only by the specified hostname, and not its
IP address. For example, consider a Management Center instance with the following properties:
547
l Hostname: mc.example.com
l IP address: 192.0.2.10
The administrator then enters the following command:
# security allowed-hosts add mc.example.com
After the preceding command is run, users will only be able to access the Management Center by typing
mc.example.com in the browser address bar. If users type 192.0.2.10 in the address bar, they will receive
a 403 Forbidden error.
You can also specify an IP address instead of a hostname. If you specify an IP address, users can only
access the device using the IP address and will receive an error if the hostname is used.
The security allowed-hosts command has no effect on Management Center failover pairs.
# security enable-password
Turns on the password for privileged commands. If you turn on the password, you must enter an enable pass-
word to enter privileged mode.
<password> is the enable password you specify.
# security generate-ssl-certificate
Generate a new SSL certificate for Management Center. When an SSL certificate expires, you can use this
command to generate a new one.
If you change the SSL certificate, statistics monitoring will fail unless you install the certificate on
your monitored appliances. See Statistics Monitoring Over HTTPS for more information.
# security http
Subcommands:
# security http enable
# security http disable
# security http view
Enables or disables HTTP access to port 8080. The command also controls access to statistics monitoring
port 9009. By default, HTTP is disabled. You can enable HTTP in the following cases:
l You want to install system images without a secure connection on managed devices.
l You want to monitor appliances over HTTP port 9009.
# security icmp
Subcommands:
# security icmp enable
# security icmp disable
Enables or disables ICMP echo. By default, ICMP is disabled. Management Center will respond to pings
after ICMP is enabled.
548
# security password
Change the password used to access the CLI. To change the password, you must enter the current pass-
word, and then specify and confirm the new password.
# security reset-password
Resets the password used to access the CLI for the admin account. This command is only available through
the serial console. To restore the default password for the admin UI account, see "# restore-defaults" on
page 544.
# security unset-enable-password
Turns off the password for privileged commands. If you turn off the password, you can enter privileged mode
without having to enter an enable password.
# security ssl
Subcommands:
# security ssl client-authentication disable
Disable X.509 client authentication.
# security ssl client-authentication password-requirement
Subcommands:
# security ssl client-authentication password-requirement enable
# security ssl client-authentication password-requirement disable
Enables or disables the requirement for users to enter their password during SSL mutual authentication. The
behavior is as follows:
l enable: All users are forced to enter their password when accessing Management Center.
l disable: When the password requirement is disabled, a user does not have to enter a password to
access Management Center if the system determines the certificate is valid, and finds the user in the
local user database or the LDAP system, if configured.
The default is enable.
This method only supports the local or LDAP authentication schemes. You can use active directory but only if
you set it up using the LDAP settings (Administration > Settings > LDAP). This is because a service
account is needed to look up users because the system no longer has the user password.
To validate certificates, you must create a regular expression to evaluate the information in the certificate's
SubjAltName field.The subjectAltName data is compared to a regex set by the security ssl cli-
ent-authentication set-regex command, which is used to extract the portion of the value to use as
the user's identity. That value is then used to find the user in the local or LDAP authentication service. Refer
to the following for more information:
l "# security ssl client-authentication set-regex" on the facing page
l "Use Certificate Subject Alternative Name Data for Certificate Validation" on page 340
l "Authenticate Users with SSL Mutual Authentication" on page 336
# security ssl client-authentication set-mandatory
549
Users must use X.509 client authentication. If X.509 client authentication fails, no connection
is established.
When configured, all traffic requires a certificate. For example, to access file service requests
and API's, client authentication is mandatory.
# security ssl client-authentication set-optional
If X.509 client authentication fails, users can log in using the standard Management Center
login page. Issuing this command requires Management Center to restart.
Sets the regex command used to extract the certificate's name or data set in the certificates
Subject Alternative Name (subjAltName); the default is CN=(.*?), .
Subcommand:
default
Resets the principal regex to the default.
Subject alternative name example:

"'1\\.3\\.6\.1\\.4\\.1\\.311\\.20\\.2\\.3,\\s\\[0\\](.*?)@\'"
Refer to "Use Certificate Subject Alternative Name Data for Certificate Validation" on
# security ssl client-authentication view
View current X.509 client authentication settings.
# security ssl import external-certificate <name> <URL>
Downloads the certificate from the specified URL and installs it to the truststore with the spe-
cified name. Certificates are not case sensitive. See "CLI URL Syntax" on page 524 for inform-
ation on how to format the security ssl import external-certificate <name>
<URL>URL.
# security ssl import server-certificate <URL>
Downloads the certificate from the specified URL and installs it to the keystore, replacing the
appliances SSL certificate if it exists. This command does not restart the MC services; users
must do so manually by running restart services. See "CLI URL Syntax" on page 524
for information on how to format the URL.
If you change the SSL certificate, statistics monitoring will fail unless you install the cer-
tificate on your monitored appliances. See Statistics Monitoring Over HTTPS for more
information.
# security ssl list external-certificates all
Displays the names of all certificates in the truststore. Certificate names are not case
550
sensitive.
# security ssl list external-certificates system
Displays the names of all system certificates in the truststore. Certificate names are not case
sensitive.
# security ssl list external-certificates user
Displays the names of all user added certificates in the truststore. Certificate names are not
case sensitive.
# security ssl list server-certificates
Displays the names of all server certificates in the keystore. Currently, there will only ever be
one, and it will be named defaultcertkey.
# security ssl delete external-certificate <name>
Delete the specified certificate from the truststore. System certificates cannot be deleted.
# security ssl delete server certificate
Deletes the appliances certificate being used for SSL. This command does not restart the MC
services; users must do so manually by running restart services.
# security ssl view external-certificate <name>
Displays details of the certificate in the truststore with the given name. Details include owner,
issuer, expiration date and fingerprints. Certificate names are not case sensitive.
# security ssl view server-certificate
Displays details of the certificate in the keystore with the given name. Details include owner,
issuer, expiration date and fingerprints. Certificate names are not case sensitive.
# security ssl hsts enable
Enables the HTTPS Strict Transport Security (HSTS) protocol.
# security ssl hsts disable
Disables the HTTPS Strict Transport Security (HSTS) protocol.
# security ssl-protocols
Beginning in Management Center 1.5.3.2, TLSv1.1 is disabled by default. This command enables you to manage TLSv1.1
operation.
Subcommands:
# security ssl-protocols disable TLSv1.1
Disables TLS v1.1 t protocol.
# security ssl-protocols enable TLSv1.1
Enables TLS v1.1 t protocol.
551
# security ssl-protocols view
Displays the enabled SSL protocols.
Example
Management Center # security unset-enable-password
Management Center # security ssl import external-certificate < name> <URL>
1. Import an external certificate from a server using the public key. This allows Management Center to connect to an
external server without using a username or password for authentication.
2. Name the certificate.
3. Go to the URL of the server, and copy and paste the URL into the subcommand.
4. Click Return. While the certificate downloads, the CLI displays the details of the connection to the server and
inspects the certificate for details such as:
l Owner
l Issuer
l Serial Number
l Valid from date
l Valid until date
l Certificate fingerprints
l Extensions
When the download is complete, the CLI queries:
Are you sure you want to import this as a trusted certificate? [y/N]
# service
The service command allows you to view disk usage and troubleshoot the following:
l Disk space or possible file corruption issues
l Enable verbose logging
l Upload diagnostic data to Symantec using an open support case
l Possible VPM cache corruption issues
View Disk Usage
View your current disk usage before performing disk maintenance.
Syntax
#service disk-usage
552
Perform Disk Maintenance
Clean your disk by using the #service db-maintenance command and subcommand. This is used for manual data-
base cleanup and re-indexing. While running this maintenance command, both Management Center and statistics mon-
itoring are unavailable.
Syntax
#service db-maintenance
Automated disk space cleanup occurs when Management Center reaches 85% of disk utilization. This automated
cleanup removes backed up dump files and all but the latest Management Center backup. This automated cleanup is
not as thorough as performing disk maintenance manually. Management Center and statistics monitoring remain
available and running.
Enable Verbose Logging
To enable verbose debug logging, execute the command #service enable-verbose-logging. W hen you have com-
pleted capturing what you want, stop the logging by executing the command #service disable-verbose-logging.
You can then export the debug log from the web console or include the log in a support case upload.
Syntax
#service enable-verbose-logging
#service disable-verbose-logging
You should enable verbose logging to include more debug-level details in system logs, which can be used to
troubleshoot issues you may have encountered. Because the system log is included in the diagnostics upload to
Symantec Support, enabling verbose logging includes debug-level logs in the diagnostics archive.
Start or Stop Service
Start or stop Management Center services.
#service stop-service [ management-center | report-generator | statistics-monitoring ]
Stops the specified service.
#service start-service [ management-center | report-generator | statistics-monitoring ]
Starts the specified service.
Use the show status command to view the current status of the services.
Management Center# show status

Configuration:
CPUs installed: 2
MAC: 00:50:56:b5:8a:e1
Birth Certificate: Installed
553
General status:
System started: 2017-02-24 06:50:58MST
CPU utilization: 0
Service status:
Report Generator : stop/waiting
Failover:
Status: Disabled
Upload Diagnostics Data
Upload diagnostics data to a destination server or directly to Symantec if you have an open support case.
Syntax
#service upload-diagnostics[subcommands]
Subcommands
# service upload-diagnostics [subcommands]
SCP:scp://<host>/<path>
FTP: ftp://<host>/<path>
FTPS: ftps://<host>/<path>
HTTP: http://<host>/<path>
HTTPS: https://<host>/<path>
# service upload-diagnostics <case_number>
Upload the diagnostics to Symantec Support with your existing case number.
<case_number> is the number for your open Symantec Support case.
Purge VPM Cache
If you receive a message when starting the Visual Policy Manager Editor from the web console that a jar mismatch exists,
you will need to purge the VPM cache. This happens rarely, such as if there is a network failure while jars are being trans-
ferred between devices.
Purge all Visual Policy Manager .jar files by using #purge-vpm cache command.
Syntax
#purge-vpm cache
# show
Display system information.
554
Syntax
# show [subcommands]
Subcommands
# show clock
Displays the current system time information (time, date, and timezone) set for Management Center along with UTC time
for reference. Works the same as # show timezone. It is also similar to # timezone view and # clock view, with
the exception that # show clock works in disable mode and these other two cannot.
Example
Management Center# show clock

UTC time : 2017-02-02 03:50:51+00:00 UTC
Local time : 2017-02-02 03:50:51+00:00 UTC
Timezone : UTC
# show http-proxy
Displays HTTP proxy status (enabled or not) and configuration (host, port, user name, password).
# show installed-systems
Lists the images that are currently installed on the system and each image's software version number, release build num-
ber, and when the image was last booted.
# show interface
Displays interface and network settings, including IP address, subnet mask, gateway, and DNS servers.
# show license
Lists the component names of all licenses installed on the system and, for each license, displays the status (Valid, Invalid,
Expired, Unknown), date the license was activated, expiration date, and type (such as Subscription or Demo).
# show setupinfo
Display system configuration, such as IP address and DNS servers. This reflects the settings specified during initial con-
figuration of Management Center.
Example
Management Center# show setupinfo
Network settings:
IP address: 10.169.21.51
Subnet mask: 255.255.254.0
555
IP gateway: 10.169.21.1
DNS server: 10.167.4.55
DNS server: 10.167.4.50

Enabled: false
HTTP Proxy host:
HTTP Proxy port:
Username:
Password:

# show snmp
Displays the community string and whether remote read access is enabled or disabled.
# show status
Displays the following system statistics (example only):
l Configuration
l General status
l RAID status (displays for HW appliances only)
l Service status
Example
Management Center# show status

Configuration:
CPUs installed: 2
MAC: 00:50:56:b5:73:80
General status:
System started: 2015-08-18 15:27:48UTC
CPU utilization: 0
Service status:
# show timezone
UTC time for reference. Works the same as # show clock. It is also similar to # timezone view and # clock view,
with the exception that # show timezone works in disable mode and these other two cannot.
Example
Management Center# show timezone

UTC time : 2017-02-02 03:50:51+00:00 UTC
556
Local time : 2017-02-02 03:50:51+00:00 UTC

Timezone : UTC
# show version
Display information such as system version, build version, and serial number.
Example
Management Center# show version

Version: Blue Coat Management Center 1.9.1.1
Release id: 199309 x86_64 (Debug)
Serial number: [#########]
NIC 0 MAC: 00:00:00:AA:BB:CC
# shutdown
Shut the hardware or virtual appliance down.
Syntax
# shutdown
Example
Management Center#shutdown
Are you sure you want to shutdown the system? [y/N]
# snmp
Enables you to disallow remote read access or only allow read-only remote access. You can set the community string and
view the SNMP settings for SNMP traps.
You can view SNMP settings in the standard "> show" on page 527 command.
Syntax
# snmp [subcommands]
Subcommands
# disable-remote-read-access
Disallows remote read access
# enable-remote-read-access
Allows read-only remote access.
# set-community
Set the community string (you cannot use the default).
557
# view
View SNMP settings.
Example
Management Center# snmp view
Community String: 2cc72a6160
Remote Read Access: Disabled
# static-route
Configures the static network route settings for available network interfaces. The static routes are made up of destination
IP addresses, subnet masks, and gateway IP addresses.
Syntax
# static-route [subcommands]
Subcommands
# static-route add <nic_interface>
Adds a static network route entry to the specified NIC interface.
# static-route delete <nic_interface> <staticroute_entry>
Deletes the specified static network route entry.
# static-route update <nic_interface> <staticroute_entry>
Reconfigures the specified static network route entry.
# static-route view <nic_interface>
Displays the static network route entries for the available NICs. Specifying the <nic_interface> will display all the static
route indexes created for a given NIC.
Example of adding a static network route entry to nic0_0:
Management Center# static-route add nic0_0
Enter the IP address for destination network []: 172.16.50.1
Enter the subnet mask for destination network []: 255.255.255.0
Enter the IP address for gateway []: 172.16.50.254
# statistics-monitoring
Shut the hardware or virtual appliance down.
558
Syntax
# statistics-monitoring [subcommands]
Subcommands
# statistics-monitoring set-per-hour-lifetime
Set per hour trend data lifetime. Must be entered in number of days.
# statistics-monitoring set-per-minute-lifetime
Set per hour trend data lifetime. Must be entered in number of days.
# statistics-monitoring view
View current statistics monitoring lifetime settings, record statistics, and disk usage data.
Example
# statistics-monitoring view
Total devices: 2
Reporting devices: 1
Data characteristics:
Lifetime Records Disk Usage
minute 7 days 131240 113 MB
hour 366 days 50927 26 MB
# subscriptions
Download and view the current status of Symantec subscriptions.
In Management Center 1.6.1.1, the subscriptions command controls only the Web Application Protection
(WAP) subscription. To use Web Application Firewall (WAF) features, you must ensure that Management Center
can connect to https://subscription.es.bluecoat.com to download the WAP subscription bundle. If the WAP sub-
scription cannot be downloaded, the Blacklist and Analytics Filter rules table in the Security Profile will not be avail-
able. However, all other WAF features should still be available and functioning. The WAP subscription cannot
currently be loaded when Management Center is in offline mode.
Syntax
#subscriptions [subcommands]
Subcommands
#subscriptions application-protection
# subscriptions application-protection download
Downloads the application-protection subscription update.
# subscriptions application-protection download-force
Downloads the application-protection subscription update, even if an instance of the identical update already exists.
559
# subscriptions application-protection view
View the application-protection status.
Example
Management Center# subscriptions application-protection view
Management Center# subscriptions application-protection view
License Type: Subscription

Licensed Until: 2017-01-05
Subscription Validity: Valid
Data Validity: Valid
Last Download Information:
Time: 2016-03-08T14:54:30.944+0000
URL: https://subscription.es.bluecoat.com/application-protection/database
Status: Success
The download URL is not configurable.
# tracepath
Identifies the route packets take to reach a destination.
The command executes until the entire route to the host is traced; alternatively, you can press you press Control+C to
return to the command prompt while the trace is in progress.
Syntax
# tracepath <hostname or IP address>
Example
Management Center# tracepath google.com
1: 10.169.21.52 (10.169.21.52) 0.131ms pmtu 1500
2: 172.16.167.17 (172.16.167.17) 0.581ms
3: 216.16.227.26 (216.16.227.26) 2.310ms
4: network.net (216.16.232.121) 2.817ms
5: 216.16.255.193 (216.16.255.193) 2.269ms
6: 24.153.3.141 (24.153.3.141) 3.517ms
7: 64.71.241.97 (64.71.241.97) 6.934ms
560
8: 69.63.248.89 (69.63.248.89) 19.716ms
9: no reply
# verify-hardware
Displays all hardware system information for the appliance running Management Center. This command helps when dia-
gnosing any problems encountered during installation or initial configuration.
Syntax
# verify-hardware [subcommands]
To diagnose problems with the hardware, see "# diagnostic-systems" on page 535
Example
Management Center #verify-hardware
Serial number: 4313320063
System model: Symantec 1000
RAM:
16384 MB
CPU0_DIMM_A1 8192 MB DDR3
CPU0_DIMM_A2 8192 MB DDR3
Number of physical CPUs: 1
Number of cores: 4
CPU Type: Intel(R) Xeon(R) CPU E5-2418L 0 @ 2.00GHz
Storage:
sda 7 GB ATP IG SlimSATA
sdb 7 GB ATP IG SlimSATA
sdc 1000 GB ST91000640SS
sdd 1000 GB ST91000640SS
sde 1000 GB ST91000640SS
sdf 502 MB ATP IG eUSB
Network: nic0_0 Intel Corporation I350 Gigabit Network Connection (00:d0:83:09:6b:c4)
# timezone
View the clock timezone settings in the Management Center configuration, and set the specific timezone it displays. This
affects any logging process that uses system time. Changing the Management Center system timezone using this
561
command should not affect the dates or times shown in the web console.
The system does not include timezone settings in a backup of Management Center. A system reset to default settings
restores the timezone to the default timezone (UTC).
Syntax
# timezone [subcommands]
Subcommands
# timezone list [<area>|<area/location>]
Search for available timezones in specific areas.
An incomplete entry searches for items beginning with the last letter entered. The command executes with or without an
argument ([<area>|<area/location>]). W ithout an argument, the timezone areas show. With an argument, one of
four things happen:
l If you specify an area, it shows all timezones in that area.
l If the search string matches only one timezone, it shows the local time for that match.
l If the search string matches multiple timezones, it shows the timezones that match.
l If the search string does not match any of the known valid timezones, the user receives a message that no
matches are found.
Examples
Management Center# timezone list

Africa
America
Antarctica
Arctic
Asia
Atlantic
Australia
Europe
Indian
Pacific
UTC
Management Center# timezone list america/d

America/Danmarkshavn
America/Dawson
America/Dawson_Creek
America/Denver
America/Detroit
America/Dominica

# timezone set [<area>/<location>]
Sets the local timezone for the system.
562
The CLI automatically completes an entry if only one timezone matches from the list of valid timezones shown from the #
timezone list command. The system only allows a timezone to be set if it is in the available list. Any other values are
rejected.
Using this subcommand restarts any Management Center services, such as the UI, statistics monitoring, and system log-
ging. If you attempt to set the timezone to the one already being used, the system informs you that it is already set and the
command does not make changes or restart any services.
Examples
Management Center# timezone set america/denver

Management Center# timezone view
UTC time : 2017-02-22 20:19:54+00:00 UTC
Local time : 2017-02-22 13:19:54-07:00 MST
Timezone : America/Denver
Management Center# timezone set denver

'denver' is not a valid time zone.
(Use "timezone list" for supported time zones)
Failed to set system time zone.
Management Center# timezone set america/den

Time zone is already set to 'America/Denver'
Management Center# timezone set america/da

'america/da' is not a valid time zone.
Possible matching time zones are:
America/Danmarkshavn
America/Dawson
America/Dawson_Creek
(Use "timezone list" for supported time zones)
Failed to set system time zone.
# timezone view
UTC time for reference. Works the same as # show timezone, but is not available in disable mode.
Example
Management Center# timezone view

UTC time : 2017-02-23 03:51:31+00:00 UTC
Local time : 2017-02-23 03:51:31+00:00 UTC
Timezone : UTC
563

BC MGMT Center Guide

Uploaded by

Copyright:

Available Formats

BC MGMT Center Guide

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

BC MGMT Center Guide

Uploaded by

Copyright:

Available Formats

Symantec Management

Center Configuration &

Management Center v1.9.1.1

Status Color How it applies to devices How it applies to alerts

Error A component on the device is failing, or is far out- An error occurred, preventing an

Service Port Protocol Configurable? Destination Description

URL Protocol Port Description

If the web console does not load, run the # license view CLI command to determine if the license was installed

Add and Monitor Devices 41

Create and Manage Jobs 42

Upload Files to Management Center 43

Add Users and Grant Permissions 47

Monitor Device Health 49

Integrate Reporter into Management Center 55

View Consolidated Reports 55

Migrate Device Metadata from Director as Management Center Scripts 56

View Audit Log 63

Regularly Back Up a Group of Devices 64

Order é Name Type Widget Description

1, 2, 3, etc. The name Reporter - displays only Reporter widgets on the dash- Each dash- The description

Linux Example: tar -cvzf myjsondata.tgz data.json

Linux Example: echo 'password' | /usr/bin/gpg --batch --yes --no-tty --compress-

(config)# mc-migration generate

# ssh keygen-lf <(ssh-keyscan device_ip 2>/dev/null)

# (config ssh-console) view host-public-key sshv2

# ssh-keygen -l -e sha256 -f /tmp/hostkey

name deploymentStatus host port userName password enablePassw collectPdmSt

Enter Specify the deployment Enter Enter Enter the Enter the Enter the Specify

#security http enable

Metric Description Status Current Value Warning Threshold Critical Threshold

Name Info State UP/DOWN

Name Info State UP/DOWN

Name Description Date/Time ê Device OS Ver- Exported Restored Pinned

Condition Available Qualifiers Example

Condition Available Qualifiers Example

1. The #(config general) multi-tenant criterion command specifies a substitution expression that is

7. Use the icons to add more rules.

2. Click the W AF security profile hyperlink or highlight the row and click Edit.

;;re-enter configure mode

4. Select the text and click the Convert Selection to New Section icon . The Policy Editor displays the new

Order of policy sec- How policy is evaluated Resulting behavior

Order of policy sec- How policy is evaluated Resulting behavior

1. The #(config general) multi-tenant criterion command specifies a substitution expression that is

Type Location Notes

5. From Select Policies to Install, select the Object Selector . To choose the policies to install, click the check

What do you want to accomplish? What you can do Refer to this topic

Subcondition Associated Trigger Example

Subcondition Associated Trigger Example

Permission action Allows access to these areas/functions Requires these permissions to be useful

Permission Allows access to Requires these per- Grant these permissions for more func-

Permission Allows access to Requires these per- Grant these permissions for more func-

Permission action Allows access to these areas/- Requires these per- Grant these per-

Permission action Allows access to these areas/- Requires these per- Grant these per-

Permission action Allows access to these areas/functions Requires these permissions

Permission action Allows access to Requires these per- Grant these permissions for ancil-

Permission action Allows access to Requires these per- Grant these permissions for ancil-

Permission action Allows access to these Requires these permissions to Grant these permissions

Permission action Allows access to these Requires these permissions to Grant these permissions

Permission Allows access to these areas/- Requires these Grant these permissions for