Cisco ISA550 Instruction Manual

Cisco Small Business

ISA500 Series Integrated Security Appliances

(ISA550, ISA550W, ISA570, ISA570W)

ADMINISTRATION

GUIDE

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks,

go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner

does not imply a partnership relationship between Cisco and any other company. (1110R)

Federal Communication Commission Interference Statement

(For ISA570 and ISA570W)

This equipment has been tested and found to comply with the limits for a Class A digital

device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide

reasonable protection against harmful interference when the equipment is operated in a

commercial environment. This equipment generates, uses, and can radiate radio frequency

energy and, if not installed and used in accordance with the instruction manual, may cause

harmful interference to radio communications. Operation of this equipment in a residential

area is likely to cause harmful interference in which case the user will be required to correct

the interference at his own expense.

(For ISA550 and ISA550W)

This equipment has been tested and found to comply with the limits for a Class B digital

device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide

reasonable protection against harmful interference in a residential installation. This

equipment generates, uses and can radiate radio frequency energy and, if not installed and

used in accordance with the instructions, may cause harmful interference to radio

communications. However, there is no guarantee that interference will not occur in a

particular installation. If this equipment does cause harmful interference to radio or television

reception, which can be determined by turning the equipment off and on, the user is

encouraged to try to correct the interference by one of the following measures:

•Reorient or relocate the receiving antenna.

•Increase the separation between the equipment and receiver.

•Connect the equipment into an outlet on a circuit different from that to which the

receiver is connected.

•Consult the dealer or an experienced radio/TV technician for help.

FCC Caution: Any changes or modifications not expressly approved by the party responsible

for compliance could void the user's authority to operate this equipment.

This device complies with Part 15 of the FCC Rules. Operation is subject to the following two

conditions: (1) This device may not cause harmful interference, and (2) this device must

accept any interference received, including interference that may cause undesired operation.

IMPORTANT NOTE:

FCC Radiation Exposure Statement: (For ISA550W and ISA570W)

This equipment complies with FCC radiation exposure limits set forth for an uncontrolled

environment. This equipment should be installed and operated with minimum distance 20cm

between the radiator & your body.

This transmitter must not be co-located or operating in conjunction with any other antenna or

transmitter.

The availability of some specific channels and/or operational frequency bands are country

dependent and are firmware programmed at the factory to match the intended destination.

The firmware setting is not accessible by the end user.

Industry Canada statement:

This device complies with RSS-210 of the Industry Canada Rules. Operation is subject to the

following two conditions: (1) This device may not cause harmful interference, and (2) this

device must accept any interference received, including interference that may cause

undesired operation.

Ce dispositif est conforme à la norme CNR-210 d'Industrie Canada applicable aux appareils

radio exempts de licence. Son fonctionnement est sujet aux deux conditions suivantes: (1) le

dispositif ne doit pas produire de brouillage préjudiciable, et (2) ce dispositif doit accepter

tout brouillage reçu, y compris un brouillage susceptible de provoquer un fonctionnement

indésirable.

IMPORTANT NOTE:

Canada Radiation Exposure Statement: (For ISA550W and ISA570W)

This equipment complies with Canada radiation exposure limits set forth for an uncontrolled

environment. This equipment should be installed and operated with minimum distance 20 cm

between the radiator and your body.

NOTE IMPORTANTE: (Pour l'utilisation de dispositifs mobiles)

Déclaration d'exposition aux radiations:

Cet équipement est conforme aux limites d'exposition aux rayonnements IC établies pour un

environnement non contrôlé. Cet équipement doit être installé et utilisé avec un minimum de

20 cm de distance entre la source de rayonnement et votre corps.

This device has been designed to operate with an antenna having a maximum gain of 1.8 dBi.

Antenna having a higher gain is strictly prohibited per regulations of Industry Canada. The

required antenna impedance is 50 ohms.

Under Industry Canada regulations, this radio transmitter may only operate using an antenna

of a type and maximum (or lesser) gain approved for the transmitter by Industry Canada. To

reduce potential radio interference to other users, the antenna type and its gain should be so

chosen that the equivalent isotropically radiated power (e.i.r.p.) is not more than that

necessary for successful communication.

(Le manuel d'utilisation de dispositifs émetteurs équipés d'antennes amovibles doit contenir

les informations suivantes dans un endroit bien en vue:)

Ce dispositif a été conçu pour fonctionner avec une antenne ayant un gain maximal de 1.8

dBi. Une antenne à gain plus élevé est strictement interdite par les règlements d'Industrie

Canada. L'impédance d'antenne requise est de 50 ohms.

Conformément à la réglementation d'Industrie Canada, le présent émetteur radio

peutfonctionner avec une antenne d'un type et d'un gain maximal (ou inférieur) approuvé

pourl'émetteur par Industrie Canada. Dans le but de réduire les risques de brouillage

radioélectriqueà l'intention des autres utilisateurs, il faut choisir le type d'antenne et son gain

de sorte que lapuissance isotrope rayonnée équivalente (p.i.r.e.) ne dépasse pas l'intensité

nécessaire àl'établissement d'une communication satisfaisante.

UL/CB

Rack Mount Instructions - The following or similar rack-mount instructions are included with

the installation instructions:

A) Elevated Operating Ambient - If installed in a closed or multi-unit rack assembly, the

operating ambient temperature of the rack environment may be greater than room ambient.

Therefore, consideration should be given to installing the equipment in an environment

compatible with the maximum ambient temperature (Tma) 40 degree C specified by the

manufacturer.

B) Reduced Air Flow - Installation of the equipment in a rack should be such that the amount

of air flow required for safe operation of the equipment is not compromised.

C) Mechanical Loading - Mounting of the equipment in the rack should be such that a

hazardous condition is not achieved due to uneven mechanical loading.

D) Circuit Overloading - Consideration should be given to the connection of the equipment to

the supply circuit and the effect that overloading of the circuits might have on overcurrent

protection and supply wiring. Appropriate consideration of equipment nameplate ratings

should be used when addressing this concern.

Cisco ISA500 Series Integrated Security Appliances Administration Guide 6

Contents

Chapter 1: Getting Started 19

Introduction 20

Product Overview 21

Front Panel 21

Back Panel 23

Getting Started with the Configuration Utility 25

Logging in to the Configuration Utility 26

Navigating Through the Configuration Utility 27

Using the Help System 28

Configuration Utility Icons 28

Factory Default Settings 30

Default Settings of Key Features 30

Restoring the Factory Default Settings 31

Performing Basic Configuration Tasks 32

Changing the Default Administrator Password 32

Upgrading your Firmware After your First Login 33

Backing Up Your Configuration 34

Chapter 2: Configuration Wizards 35

Using the Setup Wizard for the Initial Configuration 36

Starting the Setup Wizard 37

Configuring Cisco.com Account Credentials 37

Enabling Firmware Upgrade 38

Validating Security License 39

Enabling Bonjour and CDP Discovery Protocols 39

Configuring Remote Administration 40

Configuring Physical Ports 41

Configuring the Primary WAN 42

Configuring the Secondary WAN 42

Configuring WAN Redundancy 42

Configuring Default LAN Settings 43

Configuring DMZ 44

Cisco ISA500 Series Integrated Security Appliances Administration Guide 7

Contents

Configuring DMZ Services 45

Configuring Wireless Radio Settings 47

Configuring Intranet WLAN Access 48

Configure Security Services 49

Viewing Configuration Summary 50

Using the Dual WAN Wizard to Configure WAN Redundancy Settings 51

Starting the Dual WAN Wizard 51

Configuring a Configurable Port as a Secondary WAN Port 51

Configuring the Primary WAN 52

Configuring the Secondary WAN 52

Configuring WAN Redundancy 52

Configuring Network Failure Detection 53

Viewing Configuration Summary 54

Using the Remote Access VPN Wizard 54

Using the Remote Access VPN Wizard for IPsec Remote Access 54

Starting the Remote Access VPN Wizard 55

Configuring IPsec Remote Access Group Policy 55

Configuring WAN Settings 56

Configuring Operation Mode 56

Configuring Access Control Settings 57

Configuring DNS and WINS Settings 57

Configuring Backup Servers 58

Configuring Split Tunneling 58

Viewing Group Policy Summary 58

Configuring IPsec Remote Access User Groups 59

Viewing IPsec Remote Access Summary 59

Using Remote Access VPN Wizard for SSL Remote Access 60

Starting the Remote Access VPN Wizard with SSL Remote Access 60

Configuring SSL VPN Gateway 60

Configuring SSL VPN Group Policy 62

Configuring SSL VPN User Groups 65

Viewing SSL VPN Summary 66

Using the Site-to-Site VPN Wizard to Configure Site-to-Site VPN 66

Starting the Site-to-Site VPN Wizard 67

Configuring VPN Peer Settings 67

Configuring IKE Policies 68

Cisco ISA500 Series Integrated Security Appliances Administration Guide 8

Contents

Configuring Transform Policies 69

Configuring Local and Remote Networks 70

Viewing Configuration Summary 70

Using the DMZ Wizard to Configure DMZ Settings 71

Starting the DMZ Wizard 71

Configuring DDNS Profiles 71

Configuring DMZ Network 72

Configuring DMZ Services 74

Viewing Configuration Summary 76

Using the Wireless Wizard (for ISA550W and ISA570W only) 76

Starting the Wireless Wizard 76

Configuring Wireless Radio Settings 76

Configuring Wireless Connectivity Types 77

Specify Wireless Connectivity Settings for All Enabled SSIDs 77

Viewing Configuration Summary 78

Configuring the SSID for Intranet WLAN Access 78

Configuring the SSID for Guest WLAN Access 79

Configuring the SSID for Captive Portal Access 80

Chapter 3: Status 83

Device Status Dashboard 83

Network Status 87

Status Summary 87

Traffic Statistics 90

Usage Reports 91

WAN Bandwidth Reports 93

ARP Table 94

DHCP Bindings 94

STP Status 95

CDP Neighbor 97

Wireless Status (for ISA550W and ISA570W only) 98

Wireless Status 98

Cisco ISA500 Series Integrated Security Appliances Administration Guide 9

Contents

Client Status 99

NAT Status 99

VPN Status 100

IPsec VPN Status 100

SSL VPN Status 102

Active User Sessions 104

Security Services Reports 105

Web Security Report 105

Anti-Virus Report 106

Email Security Report 107

Network Reputation Report 108

IPS Report 109

Application Control Report 110

System Status 111

Processes 111

Resource Utilization 112

Chapter 4: Networking 114

Viewing Network Status 115

Configuring IPv4 or IPv6 Routing 115

Managing Ports 115

Viewing Status of Physical Interfaces 116

Configuring Physical Ports 117

Configuring Port Mirroring 118

Configuring Port-Based (802.1x) Access Control 119

Configuring the WAN 121

Configuring WAN Settings for Your Internet Connection 121

Configuring WAN Redundancy 129

Dual WAN Settings 129

Configuring Link Failover Detection 131

Load Balancing with Policy-Based Routing Configuration Example 132

Configuring Dynamic DNS 133

Measuring and Limiting Traffic with the Traffic Meter 134

Cisco ISA500 Series Integrated Security Appliances Administration Guide 10

Contents

Configuring a VLAN 136

Configuring DMZ 140

Configuring Zones 145

Security Levels for Zones 145

Predefined Zones 146

Configuring Zones 146

Configuring DHCP Reserved IPs 148

Configuring Routing 148

Viewing the Routing Table 149

Configuring Routing Mode 149

Configuring Static Routing 150

Configuring Dynamic Routing - RIP 151

Configuring Policy-Based Routing 152

Configuring Quality of Service 154

General QoS Settings 154

Configuring WAN QoS 155

Managing WAN Bandwidth for Upstream Traffic 155

Configuring WAN Queue Settings 156

Configuring Traffic Selectors 157

Configuring WAN QoS Policy Profiles 159

Configuring WAN QoS Class Rules 159

Mapping WAN QoS Policy Profiles to WAN Interfaces 160

WAN QoS Configuration Example 161

Configure WAN QoS for Voice Traffic from LAN to WAN 163

Configuring WAN QoS for Voice Traffic from WAN to LAN 164

Configuring LAN QoS 165

Configuring LAN Queue Settings 166

Configuring LAN QoS Classification Methods 166

Mapping CoS to LAN Queue 167

Mapping DSCP to LAN Queue 167

Configuring Default CoS 168

Configuring Wireless QoS 168

Default Wireless QoS Settings 168

Configuring Wireless QoS Classification Methods 169

Mapping CoS to Wireless Queue 170

Mapping DSCP to Wireless Queue 170

Other manuals for ISA550

This manual suits for next models

Table of contents

Other Cisco Network Hardware manuals

Cisco

Cisco ATM Cable Interface Processor ACIP-SM(=) Operator's manual

Cisco

Cisco Cisco ONS 15600 SDH User manual

Cisco

Cisco CSC-C2FCIT Instruction Manual

Cisco

Cisco VIC-2FXS - 3600 Voice Interface Card-Fxs... Instruction Manual

Cisco

Cisco SCE 1000 and Operator's manual

Cisco

Cisco SCE 2000 4/8xFE Operator's manual

Cisco

Cisco Content Delivery Engine 100/200/300/400 Manual

Cisco

Cisco MultiRIP Ethernet Card User manual

Cisco

Cisco 3660 Series User manual

Cisco

Cisco NCS 1002 User manual

Cisco

Cisco WAVE-574-K9 - Wide Area Virtualization Engine... Manual

Cisco

Cisco RSP7000 Instruction Manual

Cisco

Cisco ISA 3000 Quick start guide

Cisco

Cisco ASR 9000 Series User manual

Cisco

Cisco Firepower 4100 Series User manual

Cisco

Cisco UCS 6248 UP User manual

Cisco

Cisco TELEPRESENCE MCU ACCESSING CONFERENCES - User manual

Cisco

Cisco Aironet 340 Series User manual

Cisco

Cisco 6500 - Catalyst Series 10 Gigabit EN Interface Module... User manual

Cisco

Cisco CATALYST RPS 2300 Quick start guide

Cisco

Cisco Catalyst 8300 Series Manual

Cisco

Cisco Prisma EtherLinX User manual

Cisco

Cisco MXE 3000 Manual

Cisco

Cisco Nexus 3000 series User manual

Popular Network Hardware manuals by other brands

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL product manual

B&B Electronics

B&B Electronics ZXT9-IO-222R2 product manual

Yudor

Yudor YDS-16 user manual

D-Link

D-Link ShareCenter DNS-320L datasheet

Samsung

Samsung ES1642dc Hardware user manual

Honeywell Home

Honeywell Home LTEM-PV Installation and setup guide

evertz

evertz 7700 Series manual

D-Link

D-Link ShareCenter DNS-343 Quick installation guide

Asante

Asante AsanteBridge 1012 user guide

FireBrick

FireBrick FB2700 user manual

Audiovox Electronics

Audiovox Electronics ARWH2T user manual

ADC

ADC DSX-1 Operational Procedures Guide

NetComm

NetComm NF2 user guide

Alcatel-Lucent

Alcatel-Lucent 5620 user guide

Dell EMC

Dell EMC XC6420 Series Solution guide

Lanner

Lanner NCA-1020A user manual

Allied Telesis

Allied Telesis AT-TN121-A Specifications

Arista

Arista CCA-ETM-Q12 quick start guide