Cisco 515E - PIX Restricted Bundle Manual de usuario

Corporate Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 526-4100

Cisco PIX 515E Security Appliance

Getting Started Guide

Customer Order Number: DOC-7817654=

Text Part Number: 78-17645-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT

NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT

ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR

THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE

INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU

ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A

COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE

PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED

OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL

DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR

INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH

DAMAGES.

Cisco PIX 515E Security Appliance Getting Started Guide

CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work,

Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP,

CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital,

the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink,

Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo,

Networking Academy, Network Registrar, Pa cke t , PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet,

The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the

United States and certain other countries.

All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a

partnership relationship between Cisco and any other company. (0601R)

iii

PIX 515E Security Appliance Getting Started Guide

78-17645-01

CONTENTS

CHAPTER

1Installing and Setting Up the PIX 515E Security Appliance 1-1

Verifying the Package Contents 1-2

Installing the PIX 515E Security Appliance 1-3

Front and Back Panel Components 1-4

Setting Up the Security Appliance 1-5

About the Factory-Default Configuration 1-6

About the Adaptive Security Device Manager 1-6

Using the Startup Wizard 1-7

Before Launching the Startup Wizard 1-7

Running the Startup Wizard 1-8

What to Do Next 1-9

CHAPTER

2Scenario: DMZ Configuration 2-1

Example DMZ Network Topology 2-1

Configuring the Security Appliance for a DMZ Deployment 2-4

Configuration Requirements 2-5

Starting ASDM 2-6

Creating IP Pools for Network Address Translation 2-7

Configuring NAT for Inside Clients to Communicate with the DMZ Web

Server 2-12

Configuring NAT for Inside Clients to Communicate with Devices on the

Internet 2-15

Configuring an External Identity for the DMZ Web Server 2-16

Providing Public HTTP Access to the DMZ Web Server 2-18

What to Do Next 2-24

Contents

PIX 515E Security Appliance Getting Started Guide

78-17645-01

CHAPTER

3Scenario: IPsec Remote-Access VPN Configuration 3-1

Example IPsec Remote-Access VPN Network Topology 3-1

Implementing the IPsec Remote-Access VPN Scenario 3-2

Information to Have Available 3-3

Starting ASDM 3-3

Configuring the PIX 515E for an IPsec Remote-Access VPN 3-5

Selecting VPN Client Types 3-6

Specifying the VPN Tunnel Group Name and Authentication Method 3-7

Specifying a User Authentication Method 3-8

(Optional) Configuring User Accounts 3-10

Configuring Address Pools 3-11

Configuring Client Attributes 3-12

Configuring the IKE Policy 3-13

Configuring IPsec Encryption and Authentication Parameters 3-15

Specifying Address Translation Exception and Split Tunneling 3-16

Verifying the Remote-Access VPN Configuration 3-17

What to Do Next 3-18

CHAPTER

4Scenario: Site-to-Site VPN Configuration 4-1

Example Site-to-Site VPN Network Topology 4-1

Implementing the Site-to-Site Scenario 4-2

Information to Have Available 4-2

Configuring the Site-to-Site VPN 4-3

Starting ASDM 4-3

Configuring the Security Appliance at the Local Site 4-4

Providing Information About the Remote VPN Peer 4-6

Configuring the IKE Policy 4-7

Configuring IPsec Encryption and Authentication Parameters 4-9

Specifying Hosts and Networks 4-10

PIX 515E Security Appliance Getting Started Guide

78-17645-01

Contents

Viewing VPN Attributes and Completing the Wizard 4-11

Configuring the Other Side of the VPN Connection 4-13

What to Do Next 4-13

APPENDIX

AObtaining a DES License or a 3DES-AES License A-1

Contents

PIX 515E Security Appliance Getting Started Guide

78-17645-01

CHAPTER

1-1

PIX 515E Security Appliance Getting Started Guide

78-17645-01

Installing and Setting Up the PIX 515E

Security Appliance

This chapter describes how to install and perform the initial configuration of the

security appliance. This chapter includes the following sections:

•Verifying the Package Contents, page 1-2

•Installing the PIX 515E Security Appliance, page 1-3

•Front and Back Panel Components, page 1-4

•Setting Up the Security Appliance, page 1-5

•What to Do Next, page 1-9

Chapter 1 Installing and Setting Up the PIX 515E Security Appliance

Verifying the Package Contents

1-2

PIX 515E Security Appliance Getting Started Guide

78-17645-01

Verifying the Package Contents

Verify the contents of the packing box, shown in Figure 1-1, to ensure that you

have received all items necessary to install your PIX 515E security appliance.

Figure 1-1 Contents of PIX 515E Package

End User License and

Software Warranty

PIX 515E

Getting Started

Guide

Safety and

Compliance

Guide

PIX 515E

PC terminal adapter

(74-0495-01)

Documentation

Blue console cable

(72-1259-01)

Yellow Ethernet cable

(72-1482-01)

Cisco PIX

Security Appliance

Product CD

DO NOT INSTALL INTERFACE

CARDS WITH POWER APPLIED

Link FDX FDX

100 Mbps Link

100 Mbps

FAILOVER

PIX-515E

CONSOLE

10/100 ETHERNET 1 10/100 ETHERNET 0

Failover serial cable

(74-1213-01)

Mounting brackets

(700-01170-02 AO SSI-3)

7 flathead screws

(69-0123-01)

4 cap screws

(69-0124-01)

4 spacers

(69-0125-01)

Rubber feet

97955

Power cable

1-3

PIX 515E Security Appliance Getting Started Guide

78-17645-01

Chapter 1 Installing and Setting Up the PIX 515E Security Appliance

Installing the PIX 515E Security Appliance

This section describes how to install your PIX 515E security appliance into your

own network, which might resemble the example network in Figure 1-2.

Figure 1-2 Sample Network Layout

To install the PIX 515E security appliance, complete these steps:

Step 1 Mount the chassis in a rack by performing the following steps:

a. Attach the brackets to the chassis with the supplied screws. The brackets

attach to the holes near the front of the chassis.

b. Attach the chassis to the equipment rack.

Step 2 Use one of the provided yellow Ethernet cables to connect the outside 10/100

Ethernet interface, Ethernet 0, to a DSL modem, cable modem, router, or switch.

Step 3 Use the other provided yellow Ethernet cable to connect the inside 10/100

Ethernet interface, Ethernet 1, to a switch or hub.

Step 4 Connect one end of the power cable to the rear of the PIX 515E security appliance

and the other end to a power outlet.

Internet

97998

DMZ server

Laptop

computer

Printer

Personal

computer

Switch

Switch Inside

Outside

Router

PIX 515E

Power

cable

DMZ

Chapter 1 Installing and Setting Up the PIX 515E Security Appliance

Front and Back Panel Components

1-4

PIX 515E Security Appliance Getting Started Guide

78-17645-01

Step 5 Power up the PIX 515E security appliance. The power switch is located at the rear

of the chassis.

Front and Back Panel Components

Figure 1-3 illustrates the LEDs on the front panel of the PIX515E Security

Appliance.

Figure 1-3 PIX515E Security Appliance Front Panel LEDs

Figure 1-4 illustrates the back panel components.

LED Color State Description

POWER Green On On when the unit has power.

ACT Green On If part of a failover pair, the light is on when the unit is the active

unit.

Off If part of a failover pair, the light is off when the unit is in standby

mode.

NETWORK Green Flashing Flashing when at least one network interface is passing traffic.

POWER ACT NETWORK

97779

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Cortafuegos de Cisco

Cisco

Cisco 3110 Manual

Cisco

Cisco Firepower 4100 Series Manual de usuario

Cisco

Cisco ASA 5555-X Manual de usuario

Cisco

Cisco 2100 Series Manual de usuario

Cisco

Cisco FPR1010-ASA-K9 Manual de usuario

Cisco

Cisco 881W - Integrated Services Router Wireless Manual de instrucciones

Cisco

Cisco Small Business RV215W Manual de usuario

Cisco

Cisco ISA 3000 Manual de usuario

Cisco

Cisco MX400 Manual de usuario

Cisco

Cisco Cisco ASA Series Instrucciones de instalación

Cisco

Cisco 5510 - ASA SSL / IPsec VPN Edition Manual de usuario

Cisco

Cisco PIX-525-UR-BUN - PIX 525 Unrestricted Bundle Manual de usuario

Cisco

Cisco Firepower 7010, Firepower 7020, Firepower 7030, Firepower 7050, Firepower 7110, Firepower 7120, Firepower 7115, Firepower... Manual de usuario

Cisco

Cisco 380 Series Manual

Cisco

Cisco Firepower 2120 Manual

Cisco

Cisco PIX 506E - Security Appliance Manual de usuario

Cisco

Cisco Meraki MX64 Manual de usuario

Cisco

Cisco ISA3000-4C-K9 Manual

Cisco

Cisco IPS-4255-K9 - Intrusion Protection Sys 4255 Manual de usuario

Cisco

Cisco M195 Manual

Cisco

Cisco PIX 506E - Security Appliance Manual de usuario

Cisco

Cisco IronPort M1070 Manual de usuario

Cisco

Cisco Cisco ASA Series Instrucciones de instalación

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Manual de usuario

Manuales populares de Cortafuegos de otras marcas

Fortinet

Fortinet FortiGate Voice Series Manual de usuario

ADTRAN

ADTRAN NetVanta 2300 Manual de usuario

SecureLogix

SecureLogix ETM System Manual de usuario

NETGEAR

NETGEAR ProSafe FVX538 Manual de usuario

Lanner

Lanner FW-8877 Manual de usuario

Huawei

Huawei USG6000 Series Manual de instalación y operación

H3C

H3C SecPath F5000-AI-15 Manual de usuario

Nexcom

Nexcom DNA 1150 Manual de usuario

Fortinet

Fortinet FortiGate-60 series Manual de usuario

Draytek

Draytek Vigor2860 Series Manual de usuario

Lanner electronics

Lanner electronics FW-7650 Series Manual de usuario

Swisscom

Swisscom Internet Backup Manual de usuario

SonicWALL

SonicWALL NSa 5700 Manual de usuario

DPtech

DPtech FW1000 SERIES Manual de usuario

FEITIAN

FEITIAN MultiPass FIDO Manual de usuario

EBLOCKER

EBLOCKER PRO Manual de usuario

GTA

GTA GB-200 Manual de usuario

Trend Micro

Trend Micro Deep Edge Manual de usuario