Cisco PIX-515E Manual de usuario
Quick Start Guide
Cisco PIX 515E Firewall
1Check Items Included
2Install the PIX 515E
3Configure the PIX 515E
4Example Configurations
5Optional Maintenance and Upgrade Procedures
2
About the Cisco PIX 515E Firewall
The Cisco PIX 515E delivers enterprise-class security
for small-to-medium business and enterprise networks,
in a modular, purpose-built appliance. Its versatile
one-rack unit (1RU) design supports up to 6 10/100
Fast Ethernet interfaces, making it an excellent choice
for businesses requiring a cost-effective, resilient security solution with demilitarized zone (DMZ)
support. It delivers up to 188 Mbps of firewall throughput with the ability to handle over
130,000 simultaneous sessions. Some PIX 515E models include award-winning high-availability
services as well as integrated hardware VPN acceleration, delivering up to 130 Mbps of 3DES and
256-bit AES VPN throughput.
99550
POWER
ACT NETWORK
PIX Firewall
SERIES
H
ar
d
ware
F
eatures
•433-MHz Intel Celeron processor
•32-MB RAM with the restricted (R) license;
64-MB RAM with the unrestricted (UR) and
failover (FO) licenses
•16-MB Flash memory
•128-KB level 2 cache memory at 433 MHz
•32-bit, 33-MHz system bus
•Up to 6 10/100 Fast Ethernet interfaces
•Serial console port for administrative access
•Front panel LEDs for power, failover, and
network status
•Up to 188-Mbps firewall throughput
•Supports 56-bit DES, 168-bit 3DES, and
128- or 256-bit AES data encryption to
ensure data privacy
•Up to 60/130-Mbps VPN throughput
(VAC/VAC+)
S
o
f
tware
F
eatures
•Includes Cisco PIX Device Manager (PDM)
for intuitive, web-based administration of
PIX Firewalls
•Supports three licensing models with
additional host capacity and failover
capability
•Internal DHCP server supports up to
256 address leases per interface
•Supports up to 2000 remote access and
site-to-site VPN peers
•Supports up to 130,000 simultaneous
connections
•Supports up to eight 802.1Q VLAN-based
logical interfaces
•Intrusion protection from many different
types of popular network-based attacks
ranging from malformed packet attacks to
DoS attacks
•Delivers highly resilient network security
services via award-winning stateful failover
on certain PIX 515E models
3
1 Check Items Included
End User License and
Software Warranty
PIX 515E
Getting Started
Guide
Safety and
Compliance
Guide
PIX 515E
PC terminal adapter
(74-0495-01)
Documentation
Blue console cable
(72-1259-01)
Yellow Ethernet cable
(72-1482-01)
Cisco PIX
Security Appliance
Product CD
DO NOT INSTALL INTERFACE
CARDS WITH POWER APPLIED
LinkFDXFDX
100MbpsLink
100Mbps
FAILOVER
PIX-515E
CONSOLE
10/100 ETHERNET 1 10/100 ETHERNET 0
Failover serial cable
(74-1213-01)
Mounting brackets
(700-01170-02 AO SSI-3)
7 flathead screws
(69-0123-01)
4 cap screws
(69-0124-01)
4 spacers
(69-0125-01)
Rubber feet
97955
Power cable
4
2 Install the PIX 515E
Follow these steps to install the PIX 515E:
Step 1 Install the rubber feet onto the five, round, recessed areas on the bottom of the chassis.
Note The chassis is also rack-mountable. For rack-mounting and failover instructions, refer to
the Cisco PIX Firewall Hardware Installation Guide.
Step 2 Use the yellow Ethernet cable (72-1482-01) provided to connect the outside 10/100 Ethernet
interface, Ethernet 0, to a DSL modem, cable modem, or switch.
Step 3 Use the other yellow Ethernet cable (72-1482-01) provided to connect the inside 10/100
Ethernet interface, Ethernet 1, to a switch or hub.
Step 4 Connect the power cable to the rear of the PIX 515E and a power outlet.
Step 5 Power up the PIX 515E. The power switch is located at the rear of the chassis.
Note For additional hardware installation procedures, refer to the Cisco PIX Firewall Hardware
Installation Guide.
Internet
97998
DMZ server
Laptop
computer
Printer
Personal
computer
Switch
Switch Inside
Outside
Router
PIX 515E
Power
cable
DMZ
5
3 Configure the PIX 515E
The PIX 515E comes with a factory-default configuration that meets the needs of most small and
medium business networking environments. A default DHCP server address pool is included for hosts on
the inside interface. The factory-default configuration on the PIX 515E protects your inside network
from unsolicited traffic.
By default, the PIX 515E denies all inbound traffic through the outside interface. Based on your
network security policy, you should also consider configuring the PIX 515E to deny all ICMP traffic
to the outside interface, or any other interface you deem necessary, by entering the icmp command.
For more information about the icmp command, refer to the Cisco PIX Firewall Command Reference.
The PIX 515E contains an integrated web-based configuration
tool called the Cisco PIX Device Manager (PDM), that is
designed to help you set up the PIX Firewall. PDM is
preinstalled on the PIX 515E. To access PDM, make sure that
JavaScript and Java are enabled in your web browser. Refer to
the Cisco PIX Device Manager Installation Guide for more
information on the operating system and web browser
environments supported by PDM.
PDM includes a Startup Wizard for simplified initial
configuration of your PIX Firewall. With just a few steps, the
PDM Startup Wizard enables you to efficiently create a basic configuration that allows packets to flow
through the PIX Firewall from the inside network to the outside network securely. Follow these steps to
use the Startup Wizard:
Step 1 If you have not already done so, connect the inside Ethernet 1 interface of the PIX 515E to a
switch or hub using the Ethernet cable. To this same switch, connect a PC for configuring the
PIX 515E.
Step 2 Configure your PC to use DHCP (to receive an IP address automatically from the PIX 515E)
or assign a static IP address to your PC by selecting an address out of the 192.168.1.0
network. (Valid addresses are 192.168.1.2 through 192.168.1.254 with a mask of 255.255.255.0
and default route of 192.168.1.1.)
Note The inside interface of the PIX 515E is assigned 192.168.1.1 by default, so this
address is unavailable.
Step 3 Check the LINK LED on the PIX 515E Ethernet 1 interface. When connectivity occurs, the
LINK LED on the Ethernet 1 interface of the PIX Firewall and the corresponding LINK LED on
the switch or hub lights up solid green.
6
Step 4 To access the Startup Wizard, use the PC connected to the switch or hub and enter the URL
https://192.168.1.1/startup.html into your Internet browser.
Note Remember to add the “s” in “https” or the connection fails. HTTPS (HTTP over SSL)
provides a secure connection between your browser and the PIX 515E.
Step 5 Leave both the username and password boxes empty. Press Enter.
Step 6 Select Yes to accept the certificates and follow the instructions in the Startup Wizard to set up
your PIX 515E. For online Help, click the Help button at the bottom of the Startup Wizard
window.
4 Example Configurations
The following section provides configuration examples for two common PIX 515E configuration
scenarios: hosting a web server on a DMZ network and establishing a site-to-site VPN connection with
other business partners or remote offices. Use these examples to set up your network. Substitute
network addresses and apply additional policies as needed.
DMZ Configuration
A demilitarized zone (DMZ) is a neutral zone between private (inside) and public (outside) networks.
A DMZ allows you to have a presence on the public Internet, while protecting private network
resources that are accessed by users on the public Internet; for example, mail servers or web servers.
The illustration below shows a sample network topology that is common to most DMZ
implementations using the PIX 515E, in which the web server is on the DMZ interface. HTTP clients
from the inside and the outside networks are able to access the web server securely.
In the illustration below, an HTTP client (10.10.10.10) on the inside network initiates HTTP
communications with the DMZ web server (30.30.30.30). HTTP access to the DMZ web server is
provided for all clients on the Internet; all other communications are denied. The network is
configured such that the range of available IP addresses on the DMZ interface are between
30.30.30.50–30.30.30.60. There are two publicly routable IP addresses available, one for the
PIX 515E outside interface (209.165.156.10) and one for the translated DMZ server
(209.165.156.11). Because the DMZ server is located on a private DMZ network, it is necessary to
translate its private IP address to a public (routable) IP address. This public address allows external
clients HTTP access to the DMZ server as though it was located on the Internet. Use PDM to quickly
configure your PIX 515E for secure communications between HTTP clients and web servers.
7
Step 1 Manage IP Pools for Network Translations
For an inside HTTP client (10.10.10.10) to access the web server on the DMZ network (30.30.30.30),
it is necessary to define an IP pool (30.30.30.50–30.30.30.60) for the DMZ interface. Similarly, an IP
pool for the outside interface (209.165.156.10) is required for the inside HTTP client to communicate
with any device on the public network. Use PDM to manage IP pools efficiently and easily to facilitate
secure communications between protected network clients and devices on the Internet.
a. Launch PDM.
b. Click the Configuration button at the top of the PDM window.
97999
PIX 515E
Internet
HTTP client
10.10.10.10
Web server
30.30.30.30
DMZ
30.30.30.0
Inside
10.10.10.0
HTTP client
HTTP client
Outside
209.165.156.10
8
c. Select the Translation Rules tab.
d. Click the Manage Pools button and a new window appears, allowing you to add or edit global
address pools.
Note For most configurations, global pools are added to the less secure, or public, interfaces.
In the Manage Global Address Pools window:
a. Select the dmz interface.
b. Click the Add button.
In the Add Global Pool Item window:
a. Select dmz from the Interface drop-down menu.
9
b. Click the Range radio button to enter the IP address range.
c. Because the range of IP addresses for the DMZ interface is 30.30.30.50– 30.30.30.60, enter
these values in the two fields.
d. Enter a unique Pool ID (in this case, enter 200).
e. Click the OK button to go back to the Manage Global Address Pools window.
Note You can also select PAT or PAT using the IP address of the interface if there are limited IP
addresses available for the DMZ interface.
Because there are only two public IP addresses available, with one reserved for the DMZ server, all
traffic initiated by the inside HTTP client exits the PIX 515E using the outside interface IP address.
This allows traffic from the inside client to be routed to and from the Internet.
In the Manage Global Address Pools window:
a. Select the outside interface.
b. Click the Add button.
10
When the new window comes up:
a. Select outside from the Interface drop-down menu.
b. Click the Port Address Translation (PAT) using the IP address of the interface radio button.
c. Assign the same Pool ID for this pool as in Step d above (200).
d. Click the OK button.
Once the pools are configured, confirm their values before applying the rules to the PIX 515E.
Confirm the configurations:
a. Click the OK button.
b. Click the Apply button in the main window.
Este manual sirve para los siguientes modelos
1
Tabla de contenidos
Otros manuales de Cortafuegos de Cisco
Cisco
Cisco PIX 506 - Firewall Manual de usuario
Cisco
Cisco Small Business Pro SA 520W Manual de instrucciones
Cisco
Cisco MX400 Manual de usuario
Cisco
Cisco Spam Manual de usuario
Cisco
Cisco 5505 - ASA Firewall Edition Bundle Manual de usuario
Cisco
Cisco Firepower 1100 Manual de usuario
Cisco
Cisco M190 Manual de usuario
Cisco
Cisco ASA 5512-X Manual de usuario
Cisco
Cisco PIX 501 Manual
Cisco
Cisco Firepower 2100 Series Guía de referencia rápida
Cisco
Cisco PIX 501 Manual de usuario
Cisco
Cisco ASA 5506-X Manual de usuario
Cisco
Cisco Firepower 3500 Documento técnico
Cisco
Cisco Small Business RV220W Manual de instrucciones
Cisco
Cisco PIX-525-UR-BUN - PIX 525 Unrestricted Bundle Manual de usuario
Cisco
Cisco ASA 5506-X Instrucciones de instalación
Cisco
Cisco C690 Manual de usuario
Cisco
Cisco CSA 90 Series Manual del producto
Cisco
Cisco Small Business RV215W Manual de usuario
Cisco
Cisco Cisco ASA Series Instrucciones de instalación
Manuales populares de Cortafuegos de otras marcas
H3C
H3C SecPath F5000-AI-15 Manual de usuario
Nexcom
Nexcom DNA 1150 Manual de usuario
Fortinet
Fortinet FortiGate-60 series Manual de usuario
Draytek
Draytek Vigor2860 Series Manual de usuario
Lanner electronics
Lanner electronics FW-7650 Series Manual de usuario
Swisscom
Swisscom Internet Backup Manual de usuario
