Cisco WS-CE500 - Catalyst Express 500-24PC Instruction Manual

Cisco Small Business

SA500 Series Security Appliances

ADMINISTRATION

GUIDE

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks,

go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does

not imply a partnership relationship between Cisco and any other company. (1110R)

Cisco SA500 Series Security Appliances Administration Guide 3

Contents

Chapter 1: Getting Started 10

Feature Overview 10

Device Overview 11

Front Panel 11

Rear Panel 12

Installation 13

Installation Options 13

Hardware Installation 16

Getting Started with the Configuration Utility 17

Connecting to the Configuration Utility 18

Using the Getting Started Pages 19

Navigating Through the Configuration Utility 21

Using the Help System 22

About the Default Settings 22

Basic Tasks 23

Changing the Default User Name and Password 23

Backing Up Your Configuration 24

Upgrading the Firmware 24

Common Configuration Scenarios 25

Basic Network Configuration with Internet Access 26

Cisco Smart Business Communications System Configuration 28

Firewall for Controlling Inbound and Outbound Traffic 29

DMZ for Public Websites and Services 29

Configuring ProtectLink Web & Email Security 31

Site-to-Site Networking and Remote Access 31

Wireless Networking 35

Chapter 2: Networking 36

Configuring the WAN Connection 37

Viewing the WAN Status 39

Creating PPPoE Profiles 40

Configuring an IP Alias 41

Cisco SA500 Series Security Appliances Administration Guide 4

Contents

Configuring the LAN 43

About the Default LAN Settings 43

Configuring the LAN 44

Viewing the LAN Status 46

VLAN Configuration 46

DHCP Reserved IPs 52

DHCP Leased Clients 53

Configuring an IGMP Proxy 53

Configuring the Optional Port as a LAN Port 53

Configuring the Optional WAN 54

Configuring Auto-Rollover, Load Balancing, and Failure Detection 57

Configuring the Protocol Bindings for Load Balancing 60

Configuring a DMZ 61

Configuring the DMZ Settings 64

DMZ Reserved IPs 66

DMZ DHCP Leased Clients 67

Routing 67

Static Routing 68

Dynamic Routing 69

Port Management 70

Configuring the Ports 70

Configuring SPAN (Port Mirroring) 71

QoS Bandwidth Profiles 72

Creating QoS Bandwidth Profiles for WAN Interfaces 72

Traffic Selectors 73

LAN QoS 74

Enabling LAN QoS 74

Port CoS Mapping 75

Port DSCP Mapping 75

DSCP Remarking 75

Dynamic DNS 76

Cisco SA500 Series Security Appliances Administration Guide 5

Contents

Configuring IPv6 Addressing 77

IP Routing Mode 78

Configuring the IPv6 WAN Connection 78

Configuring the IPv6 LAN 80

IPv6 LAN Address Pools 82

IPv6 Multi LAN 83

IPv6 Static Routing 83

Routing (RIPng) 84

6to4 Tunneling 85

IPv6 Tunnels Status 85

ISATAP Tunnels 86

MLD Tunnels 87

Router Advertisement Daemon (RADVD) 88

Configuring Router Advertisement 88

Adding RADVD Prefixes 89

Chapter 3: Wireless Configuration for the SA520W 91

Configuring an Access Point 91

Step 1: Configuring the Wireless Profiles 92

Profile Advanced Configuration 95

Configuring the QoS Settings for a Wireless Profile 95

Controlling Wireless Access Based on MAC Addresses 96

Step 2: Configuring the Access Points 98

Configuring the Radio 99

Basic Radio Configuration 99

Advanced Radio Configuration 101

Chapter 4: Firewall Configuration 103

Configuring Firewall Rules to Control Inbound and Outbound Traffic 103

Preliminary Tasks for Firewall Rules 104

Configuring the Default Outbound Policy 107

Configuring a Firewall Rule for Outbound Traffic 107

Cisco SA500 Series Security Appliances Administration Guide 6

Contents

Configuring a Firewall Rule for Inbound Traffic 110

Prioritizing Firewall Rules 113

Firewall Rule Configuration Examples 114

Using Other Tools to Prevent Attacks, Restrict Access, and

Control Inbound Traffic 117

Configuring Attack Checks 118

Configuring MAC Filtering to Allow or Block Traffic 119

Configuring IP/MAC Binding 120

Port Triggering 121

Configuring a Port Triggering Rule to Direct Traffic to Specified Ports 122

Viewing the Port Triggering Status 122

Configuring Session Settings to Analyze Incoming Packets 123

Using Other Tools to Control Access to the Internet 124

Configuring Content Filtering to Allow or Block Web Components 124

Configuring Approved URLs to Allow Access to Websites 126

Configuring Blocked URLs to Prevent Access to Websites 127

Configuring IP/MAC Binding to Prevent Spoofing 128

SIP 129

Chapter 5: Intrusion Prevention System 130

Configuring IPS 131

Configuring the IPS Policy 132

Configuring the Protocol Inspection Settings 133

Configuring Peer-to-Peer Blocking and Instant Messaging 134

Chapter 6: Using Cisco ProtectLink Security Services 135

Chapter 7: Configuring VPN 136

About VPN 136

Configuring a Site-to-Site VPN Tunnel 137

Configuring an IPsec VPN Tunnel for Remote Access with a VPN Client 139

Configuring the User Database for the IPsec Remote Access VPN 142

Advanced Configuration of IPsec VPN 144

Cisco SA500 Series Security Appliances Administration Guide 7

Contents

Viewing the Basic Setting Defaults for IPsec VPN 144

Configuring the IKE Policies for IPsec VPN 144

Configuring the IPsec VPN Policies 148

Configuring SSL VPN for Browser-Based Remote Access 154

Access Options for SSL VPN 155

Security Tips for SSL VPN 155

Elements of the SSL VPN 156

Scenario Step 1: Customizing the Portal Layout 157

Scenario Step 2: Adding the SSL VPN Users 159

Creating the SSL VPN Policies 160

Specifying the Network Resources for SSL VPN 163

Configuring SSL VPN Port Forwarding 163

SSL VPN Tunnel Client Configuration 165

Viewing the SSL VPN Client Portal 168

VeriSign™ Identity Protection configuration 169

Configuring VeriSign Identity Protection 169

Managing User Credentials for VeriSign Service 170

Chapter 8: Administration 171

Users 171

Domains 172

Groups 173

Adding or Editing User Settings 173

Adding or Editing User Login Policies 175

Firmware and Configuration 176

Upgrading Firmware and Working with Configuration Files 176

Maintaining the USB Device 178

Using the Secondary Firmware 180

Diagnostics 180

Measuring and Limiting Traffic with the Traffic Meter 182

Configuring the Time Settings 184

Configuring the Logging Options 185

Cisco SA500 Series Security Appliances Administration Guide 8

Contents

Local Logging Config 185

IPv6 Logging 187

Remote Logging 188

Logs Facility and Severity 189

Managing Certificates for Authentication 190

Configuring RADIUS Server Records 193

License Management 194

Chapter 9: Network Management 197

RMON (Remote Management) 197

CDP 199

SNMP 199

Configuring SNMP 200

Configuring SNMP System Info 200

UPnP 201

Bonjour 202

Configuring Bonjour 202

Associating VLANs 202

Chapter 10: Status 204

Device Status 204

Device Status 205

Resource Utilization 207

Interface Statistics 207

Port Statistics 208

Wireless Statistics for the SA520W 208

VPN Status 210

IPsec VPN Status 210

SSL VPN Status 211

Quick VPN Status 212

Active Users 213

View Logs 213

Cisco SA500 Series Security Appliances Administration Guide 9

Contents

View All Logs 213

IPsec VPN Logs 215

ProtectLink Logs 215

CDP Neighbor 215

LAN Devices 216

Reports 216

Appendix A: Troubleshooting 217

Internet Connection 217

Date and Time 220

Pinging to Test LAN Connectivity 221

Restoring Factory Default Configuration Settings 223

Appendix B: Standard Services 224

Appendix C: Technical Specifications and Environmental Requirements 227

Appendix D: Factory Default Settings 229

General Settings 229

Router Settings 231

Wireless Settings 234

Storage 237

Security Settings 238

Appendix E: Where to Go From Here 240

Cisco SA500 Series Security Appliances Administration Guide 10

Getting Started

This chapter describes the SA500 and provides scenarios to help you to begin

configuring your security appliance to meet the needs of your business.

•Feature Overview

•Installation Options

•Hardware Installation

•Getting Started with the Configuration Utility

•About the Default Settings

•Basic Tasks

•Common Configuration Scenarios

Feature Overview

The features of the SA520, SA520W, and the SA540 are compared in the following

table.

Table 1 Comparison of SA500 Series Security Appliance Models

Feature SA520 SA520W SA540

Firewall

Performance

200 Mbps 200 Mbps 300 Mbps

UTM 200 Mbps 200 Mbps 300 Mbps

VPN

Performance

65 Mbps 65 Mbps 85 Mbps

Connections 15,000 15,000 40,000

This manual suits for next models

Table of contents

Other Cisco Network Hardware manuals

Cisco

Cisco ME 1200 Series Manual

Cisco

Cisco 5400 Instruction Manual

Cisco

Cisco 8540 - Catalyst Campus Switch Router Modular Expansion... User manual

Cisco

Cisco DOC 785983 User manual

Cisco

Cisco WBPN User manual

Cisco

Cisco CiscoWorks Wireless LAN Solution Engine Operator's manual

Cisco

Cisco PC4000 User manual

Cisco

Cisco LightStream 1010 Manual

Cisco

Cisco AIR-WLC2106-K9 - Wireless LAN Controller... User manual

Cisco

Cisco Wide Area Virtualization Engine 274 Manual

Cisco

Cisco Aironet 340 Series User manual

Cisco

Cisco ISA500 Series Instruction Manual

Cisco

Cisco Firepower 1010 User manual

Cisco

Cisco MDS 9500 Series Manual

Cisco

Cisco Firepower 1010 Series Manual

Cisco

Cisco C7200-I - Input/Output Controller - Control... User manual

Cisco

Cisco IP/VC 3500 Original instructions

Cisco

Cisco VIP-4R/4T Operating and maintenance instructions

Cisco

Cisco ONS 15454 Manual

Cisco

Cisco NCS 4206 Instruction Manual

Cisco

Cisco UCS-FI-6332-16UP User manual

Cisco

Cisco ONS 15600 User manual

Cisco

Cisco VPN 3002 Hardware Client Manager User manual

Cisco

Cisco Aironet 1040 Series User manual

Popular Network Hardware manuals by other brands

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL product manual

B&B Electronics

B&B Electronics ZXT9-IO-222R2 product manual

Yudor

Yudor YDS-16 user manual

D-Link

D-Link ShareCenter DNS-320L datasheet

Samsung

Samsung ES1642dc Hardware user manual

Honeywell Home

Honeywell Home LTEM-PV Installation and setup guide

evertz

evertz 7700 Series manual

D-Link

D-Link ShareCenter DNS-343 Quick installation guide

Asante

Asante AsanteBridge 1012 user guide

FireBrick

FireBrick FB2700 user manual

Audiovox Electronics

Audiovox Electronics ARWH2T user manual

ADC

ADC DSX-1 Operational Procedures Guide

NetComm

NetComm NF2 user guide

Alcatel-Lucent

Alcatel-Lucent 5620 user guide

Dell EMC

Dell EMC XC6420 Series Solution guide

Lanner

Lanner NCA-1020A user manual

Allied Telesis

Allied Telesis AT-TN121-A Specifications

Arista

Arista CCA-ETM-Q12 quick start guide