CSM Single tier installation

[Xavier Lloyd]

Hi all,

I found this excerpt from the installation guide for CSM, can someone explain this for me please? (Related to installing Performance Monitor and CSM on the same server)

If you enable Event Management on your Security Manager server, you cannot use that server for any of the following services:

•Syslog on CiscoWorks Common Services

•Syslog on CiscoWorks Resource Manager Essentials (RME)

•Syslog on Performance Monitor

Does it mean that CiscoWorks Common Services/RME/PM cannot send out syslogs or cannot receive syslogs? Why not?

Also it says that it's only suggested for a small deployment? How many devices is considered small? I'm going to do a deployment with 6 ASAs and 6 built in IPS's. Don't think the security infrastructure will grow very much in the future. Is this too big for a single-tier with CSM and Performance Manager?

Thanks!

Regards,

Xavier

[Christopher.Hayre · Accepted solution]

Xavier,

CSM Event Viewer collects and stores syslogs over udp/514 (syslog).  Thus, you would not be able to run any other process on the server configured to listen (and receive) syslogs over udp/514.

For deployment specs, please refer to the CSM Deployment Planning Guide.  It's minimum requirements section should help answer your questions.  Note that it is rated for up to 25 devices.

http://www.cisco.com/en/US/docs/security/security_management/cisco_security_manager/security_manager/4.2/deployment/guide/cmsdg42.html#wp47684

Hope this helps.

Thanks!

Chris