Home > Articles > Cisco Network Technology > General Networking > Understanding Cisco Security Agent Components and Installation

Understanding Cisco Security Agent Components and Installation

  • Sample Chapter is provided courtesy of Cisco Press.
  • Date: Jul 29, 2005.

Chapter Description

In this chapter, you will continue to gain an understanding of the CSA architecture through an exploration of the agent software components, protocol communication, and installation.

From the Book

Cisco Security Agent

Cisco Security Agent


Agent Kits

Agents are initially installed on endpoints via an executable install file. You can download and install this file directly from the CSA MC itself from an SSL-protected web page. Other methods of installation include locally executing the EXE file manually or via many other scripted and automated installation procedures such as an enterprise software installation system.

Creating an Agent Kit

Before you can install an agent kit on a workstation, you must accomplish a few tasks. First you must create the appropriate initial modules, policies, and rules that the agent will use. Then you must define the group and attach policies to it. Then you must create the agent kit and define a few installation kit parameters. This section describes these tasks and explains the options along the way.

Step 1

Choose System > Agent Kits from the navigation bar. This brings you to a view of all the currently available kits. (There are pre-installed agent kits available.) See Figure 6-1.

Step 2

Click New.


Figure 1

Figure 6-1 Available Agent Installation Kits

Step 3

When prompted with the What Is Your Target Architecture? pop-up window, choose the appropriate platform. In this example, choose Windows.

Step 4

Create a name and description that is appropriate to this agent kit, as shown in Figure 6-2.

  Figure 2

Figure 6-2 Agent Kit Creation

Step 5

Choose the appropriate groups that will be associated with this installation kit. You may choose more that one group if necessary.

Step 6

Choose whether this should be a quiet install. Both the quiet and nonquiet installs need to be executed on the local machine either manually or via a scripted or automated method; however, when you choose Quiet Install, the user is not prompted during the installation for options such as installing the network shim or rebooting after installation.

Step 7

(Optional) If you choose Quiet Install, you can then select to install the network shim or reboot automatically after the installation completes.

Step 8

(Optional) Choose whether you want to install the Cisco Trust Agent (CTA), which is part of the Cisco Self-Defending Network Initiative. CTA can query the CSA for information about the local workstation, such as installed hotfixes and service patches as well as some state information about the CSA itself. If you do opt to load CTA, you can include information regarding its initialization as well as CTA certificate information that is used to secure the CTA Extensible Authentication Protocol (EAP) session to the Cisco Secure Access Control Server (ACS). Finally, under CTA, you can opt to state whether the CTA should be uninstalled if the CSA is ever uninstalled.

Step 9

After you have configured the kit to your liking, click Make Kit.

Upon completion of your agent kit creation, a confirmation screen displays summarizing the selections you made during the creation process. (See Figure 6-3.) You are also reminded that the kit is not ready for deployment until after the next rule generation has been performed. You can perform a generation at this time if you are ready to proceed.

Figure 3

Figure 6-3 Agent Kit Confirmation Screen

To Shim or Not to Shim?

With regard to the CSA operation and ability to protect a host, the network shim provides the following capabilities:

  • Port scan detection
  • SYN flood protection
  • Malformed packet protection

Now, you may say, "I want all of that. Why would I not load the network shim with every agent kit?" Good question! The reason is that other network shims might already be loaded on the workstation. These other network shims typically take the form of VPN or personal firewall software. Quite often, these shims can conflict and cause problems with endpoint operation. The solution is to either not load the CSA network shim or remove the other software that is in conflict.

Disabling the network shim does not stop network access control rules from running; it only stops the network hardening features from being active, such as SYN flood protection and port scan detection. As a best practice, it is advisable to continue to use the network shim on Internet-facing servers or systems that might be targeted by such attacks as listed previously. Servers do not tend to use the type of software that conflicts with the network shim provided by the CSA, and you would therefore have few conflicts to resolve in this case. Desktop and laptop systems regularly use applications that could conflict, and you should cautiously test the shim on these systems to prevent unnecessary outages. Because desktop systems are not often targeted for denial-of-service (DoS) attacks, these preventive and alerting mechanisms in the shim can often be better served by well-placed network IDS sensors.

Installing Agent Kits

Agent kits, once created, still need to be installed on the remote systems you are attempting to protect. The installation package created varies according to the intended operating system architecture onto which it will be loaded. The installation procedures vary between the Windows, Linux, and Solaris implementations of the product. The next few sections cover the installation processes and procedures necessary to successfully load the agent on these systems.

Installing a Windows Agent Kit

After you have created the Windows agent kits, they are ready for installation. First look at how the remote endpoints can install the software directly from an SSL-protected web page on the CSA MC. Perform the following tasks on the endpoint:

Step 1

Open a web browser and go to the following URL:




The web page that displays, as seen in Figure 6-4, provides a listing of all agent kits on this CSA MC server.

  Figure 4

Figure 6-4 Available Agent Kits Page


To view this URL and register with this particular CSA MC server, you must be allowed to do so as defined in the Registration Control settings on the CSA MC, as shown in Figure 6-5. To access this page, choose Systems > Registration Control.

Step 2

From the Cisco Security Agent Kits page, choose the kit you want to install by clicking the link. You must have local administrator rights to install the kit.

Step 3

You are prompted to save the installation file. Click Save and find a location that is appropriate for the file.

Step 4

Close your browser and double-click the executable file you downloaded. The EXE is a self-extracting file.


If the agent is performing a quiet install, no interaction occurs with the user, and all installation occurs without any input required from the user. If the agent is performing a nonquiet install, proceed with the following steps to complete the installation.


Before the installation can continue, the agent installation kit verifies the user has local administrator rights; otherwise, a pop-up notification displays.

Step 5

After clicking Next to proceed with the installation, read the license agreement, as shown in Figure 6-6. You are required to accept the license agreement to continue.

  Figure 5

Figure 6-5 Registration Control Page

  Figure 6

Figure 6-6 Installation License Agreement

Step 6

Choose the installation path, as shown in Figure 6-7. The default installation directory is Program Files\Cisco Systems. The folder selected here becomes the location in which a CSAgent folder is created. All agent executables and other supporting files are placed in a directory hierarchy within the newly created CSAgent folder in the directory you select.

  Figure 7

Figure 6-7 Installation Directory Path

Step 7

After you select the path, choose whether to install the network shim, as shown in Figure 6-8.

Upon completing Step 7, a summary screen displays before final installation continues, as shown in Figure 6-9. After you verify that the summary information regarding the installation to be performed is correct, the actual agent installation begins, as shown in Figure 6-10.

After completing the installation, the system presents you with a reboot request. A reboot is not required for most agent functionality to become active; however, for a more detailed look at the functions available after a successful reboot, see the "Immediately Rebooting the System After Installation" section later in this chapter. Figure 6-11 shows a sample reboot request.

Figure 8

Figure 6-8 Choose Whether to Shim

Figure 9

Figure 6-9 Pre-Installation Summary Screen

Figure 10

Figure 6-10 Installation Begins

Figure 11

Figure 6-11 Reboot Request

As an alternative to sending the user to the URL that includes every possible agent kit, you can go back to the Cisco Security Agent Kits page and choose the specific kit you want the user to install. When this page opens, you will see a specific link that you can send to the user via e-mail or another method. This link is to the direct download for that kit and enables the user to install that specific agent kit when clicked. You are also given the Copy to Clipboard option, which places the specific link in your Windows clipboard so that you can craft an e-mail and then just paste the link into the message from your clipboard.

Installing a Solaris Agent Kit

The installation of a Solaris agent kit is a command-line process that requires the installer to be a super user on the system. To install a Solaris agent kit, retrieve the agent installation kit as per the Windows agent kit retrieval process described earlier or manually copy the kit from the CSA MC. Continue the installation process by unpacking the archive and installing the package to the default directory, which is /opt/CSCOcsa, using the following two commands on the Solaris system:

  • tar xf CSA-Server_4.5.0.15-setup.tar
  • pkgadd -a CSCOcsa/reloc/cfg/admin –d

To complete the Solaris installation process, verify the package to install is the intended package as per the system response that displays as a result of your command entry above and acknowledge that you want to continue the installation. Press q when the installation completes. Finally, reboot the system by typing shutdown -y i6 g0.

Installing a Linux Agent Kit

The installation of a Linux agent kit is a command-line process. To begin the process, you must first obtain the Linux agent kit file from the CSA MC. After retrieving the installation kit, you unpack the compressed agent kit using the following command entered at a com-mand prompt:

tar xvf CSAagent-4.5-51.i386.tar

You should now change directories to the CSCOcsa directory that was created during the unpacking process. This directory is the location from which you install the Red Hat Packet Manager (RPM). When in the correct directory, type the following to install the Linux RPM: ./install_rpm.

As an alternative to using the command-line installation procedure, you can use the graphical interface of Red Hat to download, extract, and install the CSA. (See Figure 6-12.)

Figure 12

Figure 6-12 Linux Agent Installation

Immediately Rebooting the System After Installation

Most CSA protective mechanisms take effect immediately after installation, even before a reboot. CSA is not fully functional, however, until a reboot has occurred. Here is a list of functionality that does not take effect until after a reboot:

  • Network shield rules—Network shield rules are not applied until after a reboot. Network shield rules provide protective mechanisms that relate to the network shim.
  • Buffer-overflow protection—Buffer-overflow protection is only enforced for processes that start after the installation is complete. The agent does not monitor any processes that were already running; however, it does monitor any new processes that are spawned by the already running process. For Linux/Solaris agents, buffer overflow protection is only in effect for new processes.
  • Data access control rules—These rules are not applied to Uniform Resource Identifiers (URIs) until the web server is restarted. This pertains to Windows, Solaris, and Linux agents.
  • COM component access control rules—COM rules, which are discussed in Chapter 4, "Understanding CSA Policies, Modules, and Rules," are not functional until the system restarts.
  • Network access control rules (Solaris/Linux restriction only)—On Solaris and Linux, these rules only apply to new socket connections.
  • File access control rules (Solaris/Linux restriction only)—Only newly opened files have these rules enforced.

Scripted Installation

As an alternative to the manual installation processes described previously for each operating system, you can install the CSA agent automatically via a script when the user logs in to the network. The CSA agent self-extracting EXE is located in %Program Files%\CSCOpx\CSAMC45\bin\webserver\htdocs\deploy_kits on the CSA MC server. You can move this file to an appropriate location and use it in scripts or other automated installation mechanisms. For a script to install the executable successfully, be sure to create the kit as a quiet install and with the appropriate options, such as network shim and automatic reboot.

Installing Software Updates

As with any software product, various software updates will become available for the CSA product over time. You should install these updates to add new functionality or provide fixes to CSA components. When you receive a new update to the CSA product, read the release and installation notes provided with the software update. When you are familiar with the reason for the update and the procedures necessary to complete the update, proceed with updating the CSA MC application. This update will also update the agent software that is available to the agents in the form of future agent kits or updates to currently deployed agent installations. To see a listing of the available software updates on the CSA MC, as shown in Figure 6-13, choose Systems > Software Updates from the navigation bar.

You can obtain the information regarding each update by following the link in the Name column. Figure 6-14 shows an example of the information that displays.

Currently, two different types of scheduled updates are available to CSA: automatic and manual. With automatic updates, an agent polls as expected, and as part of the transaction it receives and installs the updated software silently. Figure 6-15 shows a typical screen that displays in a CSA MC regarding scheduled software updates that have been configured for deployment.

Figure 13

Figure 6-13 Available Software Updates Page

Figure 14

Figure 6-14 Specific Available Update Information

Figure 15

Figure 6-15 Scheduled Updates Screen

With a manual update, the installation is not silent. The user is prompted to either install the update immediately or postpone the update for up to 10 days.

To configure a new update with parameters specific to your environment, follow these steps and refer to Figure 6-16:

Step 1

Choose Systems > Software Updates > Schedule Software Updates > New.

Step 2

Provide a name and description for the update.

Step 3

Choose the architecture the update will be targeting.

Step 4

Choose the group or groups that will be required to install the update.

Step 5

Choose a timeframe in which the updates will be available. By default, this is set to the entire day. If you edit this timeframe, the update will only be available during that window and no users can update outside of that timeframe even if they select Postpone at an earlier time and are now attempting to install via the button on the local GUI.

Step 6

The last configurable option is choosing whether to make the update automatic. If you make the update automatic, users do not have the option to postpone the installation.

Figure 16

Figure 6-16 Update Configuration Screen

Uninstalling an Agent Kit

If you want to script an uninstallation of a security agent, you can use a pre-installed Cisco-provided BAT file to aid in the process. On Windows systems, the script is csa_uninstall.bat and is located in the system32 directory. If you want to script the uninstall as a quiet uninstall, you should add a parameter to the BAT file. For an automated scripted quiet uninstallation, execute csa_uninstall.bat 3 in the agent's local system32 directory. You might need to disable any rules that relate to service control prior to attempting to uninstall the agent. A query rule could easily foil your attempt to script an uninstallation of the agent.

The process to uninstall an agent running on Solaris is also very simple. From the Solaris server, enter pkgrm CSCOcsa. This process can be stopped by agent control rules that might be active. Disable any of these preventive rules before attempting uninstallation.

Uninstalling the agent in Linux is also a command-line feature. Before you can proceed, you must make sure you have the correct version number and then type the following from a command line:

rpm -qf /opt/CSCOcsa/bin/csamanagerd CSAagent-4.5-56

When that completes, type the following:

rpm -ev CSAagent-4.5-56.i386

As always, if any rules would prevent agent installation, you must disable those first before proceeding.

Cisco Press Promotional Mailings & Special Offers

I would like to receive exclusive offers and hear about products from Cisco Press and its family of brands. I can unsubscribe at any time.


Pearson Education, Inc., 221 River Street, Hoboken, New Jersey 07030, (Pearson) presents this site to provide information about Cisco Press products and services that can be purchased through this site.

This privacy notice provides an overview of our commitment to privacy and describes how we collect, protect, use and share personal information collected through this site. Please note that other Pearson websites and online products and services have their own separate privacy policies.

Collection and Use of Information

To conduct business and deliver products and services, Pearson collects and uses personal information in several ways in connection with this site, including:

Questions and Inquiries

For inquiries and questions, we collect the inquiry or question, together with name, contact details (email address, phone number and mailing address) and any other additional information voluntarily submitted to us through a Contact Us form or an email. We use this information to address the inquiry and respond to the question.

Online Store

For orders and purchases placed through our online store on this site, we collect order details, name, institution name and address (if applicable), email address, phone number, shipping and billing addresses, credit/debit card information, shipping options and any instructions. We use this information to complete transactions, fulfill orders, communicate with individuals placing orders or visiting the online store, and for related purposes.


Pearson may offer opportunities to provide feedback or participate in surveys, including surveys evaluating Pearson products, services or sites. Participation is voluntary. Pearson collects information requested in the survey questions and uses the information to evaluate, support, maintain and improve products, services or sites; develop new products and services; conduct educational research; and for other purposes specified in the survey.

Contests and Drawings

Occasionally, we may sponsor a contest or drawing. Participation is optional. Pearson collects name, contact information and other information specified on the entry form for the contest or drawing to conduct the contest or drawing. Pearson may collect additional personal information from the winners of a contest or drawing in order to award the prize and for tax reporting purposes, as required by law.


If you have elected to receive email newsletters or promotional mailings and special offers but want to unsubscribe, simply email information@ciscopress.com.

Service Announcements

On rare occasions it is necessary to send out a strictly service related announcement. For instance, if our service is temporarily suspended for maintenance we might send users an email. Generally, users may not opt-out of these communications, though they can deactivate their account information. However, these communications are not promotional in nature.

Customer Service

We communicate with users on a regular basis to provide requested services and in regard to issues relating to their account we reply via email or phone in accordance with the users' wishes when a user submits their information through our Contact Us form.

Other Collection and Use of Information

Application and System Logs

Pearson automatically collects log data to help ensure the delivery, availability and security of this site. Log data may include technical information about how a user or visitor connected to this site, such as browser type, type of computer/device, operating system, internet service provider and IP address. We use this information for support purposes and to monitor the health of the site, identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents and appropriately scale computing resources.

Web Analytics

Pearson may use third party web trend analytical services, including Google Analytics, to collect visitor information, such as IP addresses, browser types, referring pages, pages visited and time spent on a particular site. While these analytical services collect and report information on an anonymous basis, they may use cookies to gather web trend information. The information gathered may enable Pearson (but not the third party web trend services) to link information with application and system log data. Pearson uses this information for system administration and to identify problems, improve service, detect unauthorized access and fraudulent activity, prevent and respond to security incidents, appropriately scale computing resources and otherwise support and deliver this site and its services.

Cookies and Related Technologies

This site uses cookies and similar technologies to personalize content, measure traffic patterns, control security, track use and access of information on this site, and provide interest-based messages and advertising. Users can manage and block the use of cookies through their browser. Disabling or blocking certain cookies may limit the functionality of this site.

Do Not Track

This site currently does not respond to Do Not Track signals.


Pearson uses appropriate physical, administrative and technical security measures to protect personal information from unauthorized access, use and disclosure.


This site is not directed to children under the age of 13.


Pearson may send or direct marketing communications to users, provided that

  • Pearson will not use personal information collected or processed as a K-12 school service provider for the purpose of directed or targeted advertising.
  • Such marketing is consistent with applicable law and Pearson's legal obligations.
  • Pearson will not knowingly direct or send marketing communications to an individual who has expressed a preference not to receive marketing.
  • Where required by applicable law, express or implied consent to marketing exists and has not been withdrawn.

Pearson may provide personal information to a third party service provider on a restricted basis to provide marketing solely on behalf of Pearson or an affiliate or customer for whom Pearson is a service provider. Marketing preferences may be changed at any time.

Correcting/Updating Personal Information

If a user's personally identifiable information changes (such as your postal address or email address), we provide a way to correct or update that user's personal data provided to us. This can be done on the Account page. If a user no longer desires our service and desires to delete his or her account, please contact us at customer-service@informit.com and we will process the deletion of a user's account.


Users can always make an informed choice as to whether they should proceed with certain services offered by Cisco Press. If you choose to remove yourself from our mailing list(s) simply visit the following page and uncheck any communication you no longer want to receive: www.ciscopress.com/u.aspx.

Sale of Personal Information

Pearson does not rent or sell personal information in exchange for any payment of money.

While Pearson does not sell personal information, as defined in Nevada law, Nevada residents may email a request for no sale of their personal information to NevadaDesignatedRequest@pearson.com.

Supplemental Privacy Statement for California Residents

California residents should read our Supplemental privacy statement for California residents in conjunction with this Privacy Notice. The Supplemental privacy statement for California residents explains Pearson's commitment to comply with California law and applies to personal information of California residents collected in connection with this site and the Services.

Sharing and Disclosure

Pearson may disclose personal information, as follows:

  • As required by law.
  • With the consent of the individual (or their parent, if the individual is a minor)
  • In response to a subpoena, court order or legal process, to the extent permitted or required by law
  • To protect the security and safety of individuals, data, assets and systems, consistent with applicable law
  • In connection the sale, joint venture or other transfer of some or all of its company or assets, subject to the provisions of this Privacy Notice
  • To investigate or address actual or suspected fraud or other illegal activities
  • To exercise its legal rights, including enforcement of the Terms of Use for this site or another contract
  • To affiliated Pearson companies and other companies and organizations who perform work for Pearson and are obligated to protect the privacy of personal information consistent with this Privacy Notice
  • To a school, organization, company or government agency, where Pearson collects or processes the personal information in a school setting or on behalf of such organization, company or government agency.


This web site contains links to other sites. Please be aware that we are not responsible for the privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of each and every web site that collects Personal Information. This privacy statement applies solely to information collected by this web site.

Requests and Contact

Please contact us about this Privacy Notice or if you have any requests or questions relating to the privacy of your personal information.

Changes to this Privacy Notice

We may revise this Privacy Notice through an updated posting. We will identify the effective date of the revision in the posting. Often, updates are made to provide greater clarity or to comply with changes in regulatory requirements. If the updates involve material changes to the collection, protection, use or disclosure of Personal Information, Pearson will provide notice of the change through a conspicuous notice on this site or other appropriate way. Continued use of the site after the effective date of a posted revision evidences acceptance. Please contact us if you have questions or concerns about the Privacy Notice or any objection to any revisions.

Last Update: November 17, 2020