Managing Policies; Settings; Restrictions - F-SECURE POLICY MANAGER 9.0 Administrator's Manual

Managing policies

This section describes how to configure and distribute policies.

Settings

To configure settings, browse the policy tree and change the values of the policy variables.
There are two types of policy variables:
• leaf nodes under a subtree,
• table cells.
All policy variables have an associated type. You can set their values in the main application area. A policy
variable can be one of the following types:
• Integer: normal integer number.
• Display String: 7-bit ASCII text string.
• IP Address: four-octet IP address.
• Counter: incrementing integer.
• Gauge: non-wrapping integer.
• TimeTicks: elapsed time units (measured in 1/100s of a second).
• Octet String: binary data (this type is also used in UNICODE text strings).
• OID: object identifier.
• Opaque: binary data that can represent additional data types.
A policy variable may have a pre-defined default value. The default values behave as if they were inherited
from above the root domain. That is, they appear to be inherited values even if the top (root) domain is
selected. Default values can be overridden just like any other value.
Values on the selected policy domain level are color-coded as follows:
• Black – changed values on the selected policy domain or host level.
• Gray – inherited values.
• Red – invalid values.
• Dimmed red – inherited invalid values.

Restrictions

Using value restrictions, an administrator can restrict the values of any policy variable to a list of acceptable
values from which the user can choose.
There are two types of restriction: access restrictions and value restrictions. Access restrictions are
and Hidden. Final always forces the policy: the policy variable overrides any local host value, and the end
user cannot change the value as long as the
end user. Unlike the
Additionally, the administrator can restrict integer-type variables (Integer, Counter, and Gauge) to a range
of acceptable values. An additional restriction, the
restriction, the end user cannot add or delete rows from fixed-size tables. Because the
be used for empty tables, the
from changing a table's values).
If a variable in the product Management Information Base (MIB) already contains a range or choice definition,
the administrator can further restrict the range or choices, but not extend them. If the product MIB does not
define value restrictions, the administrator can specify any range or choice restriction.
Final
Final restriction, the Hidden
FIXED_SIZE restriction should be used for this purpose (preventing end users
F-Secure Policy Manager | Using Policy Manager Console | 49
restriction is set. Hidden
restriction may be ignored by the managed application.
FIXED_SIZE restriction, can be applied to tables. With this
Final
merely hides the value from the
Final restriction cannot