Cisco ISA550 Manual de instrucciones

Cisco Small Business

ISA500 Series Integrated Security Appliances

(ISA550, ISA550W, ISA570, ISA570W)

ADMINISTRATION

GUIDE

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks,

go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner

does not imply a partnership relationship between Cisco and any other company. (1110R)

Federal Communication Commission Interference Statement

(For ISA570 and ISA570W)

This equipment has been tested and found to comply with the limits for a Class A digital

device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide

reasonable protection against harmful interference when the equipment is operated in a

commercial environment. This equipment generates, uses, and can radiate radio frequency

energy and, if not installed and used in accordance with the instruction manual, may cause

harmful interference to radio communications. Operation of this equipment in a residential

area is likely to cause harmful interference in which case the user will be required to correct

the interference at his own expense.

(For ISA550 and ISA550W)

This equipment has been tested and found to comply with the limits for a Class B digital

device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide

reasonable protection against harmful interference in a residential installation. This

equipment generates, uses and can radiate radio frequency energy and, if not installed and

used in accordance with the instructions, may cause harmful interference to radio

communications. However, there is no guarantee that interference will not occur in a

particular installation. If this equipment does cause harmful interference to radio or television

reception, which can be determined by turning the equipment off and on, the user is

encouraged to try to correct the interference by one of the following measures:

•Reorient or relocate the receiving antenna.

•Increase the separation between the equipment and receiver.

•Connect the equipment into an outlet on a circuit different from that to which the

receiver is connected.

•Consult the dealer or an experienced radio/TV technician for help.

FCC Caution: Any changes or modifications not expressly approved by the party responsible

for compliance could void the user's authority to operate this equipment.

This device complies with Part 15 of the FCC Rules. Operation is subject to the following two

conditions: (1) This device may not cause harmful interference, and (2) this device must

accept any interference received, including interference that may cause undesired operation.

IMPORTANT NOTE:

FCC Radiation Exposure Statement: (For ISA550W and ISA570W)

This equipment complies with FCC radiation exposure limits set forth for an uncontrolled

environment. This equipment should be installed and operated with minimum distance 20cm

between the radiator & your body.

This transmitter must not be co-located or operating in conjunction with any other antenna or

transmitter.

The availability of some specific channels and/or operational frequency bands are country

dependent and are firmware programmed at the factory to match the intended destination.

The firmware setting is not accessible by the end user.

Industry Canada statement:

This device complies with RSS-210 of the Industry Canada Rules. Operation is subject to the

following two conditions: (1) This device may not cause harmful interference, and (2) this

device must accept any interference received, including interference that may cause

undesired operation.

Ce dispositif est conforme à la norme CNR-210 d'Industrie Canada applicable aux appareils

radio exempts de licence. Son fonctionnement est sujet aux deux conditions suivantes: (1) le

dispositif ne doit pas produire de brouillage préjudiciable, et (2) ce dispositif doit accepter

tout brouillage reçu, y compris un brouillage susceptible de provoquer un fonctionnement

indésirable.

IMPORTANT NOTE:

Canada Radiation Exposure Statement: (For ISA550W and ISA570W)

This equipment complies with Canada radiation exposure limits set forth for an uncontrolled

environment. This equipment should be installed and operated with minimum distance 20 cm

between the radiator and your body.

NOTE IMPORTANTE: (Pour l'utilisation de dispositifs mobiles)

Déclaration d'exposition aux radiations:

Cet équipement est conforme aux limites d'exposition aux rayonnements IC établies pour un

environnement non contrôlé. Cet équipement doit être installé et utilisé avec un minimum de

20 cm de distance entre la source de rayonnement et votre corps.

This device has been designed to operate with an antenna having a maximum gain of 1.8 dBi.

Antenna having a higher gain is strictly prohibited per regulations of Industry Canada. The

required antenna impedance is 50 ohms.

Under Industry Canada regulations, this radio transmitter may only operate using an antenna

of a type and maximum (or lesser) gain approved for the transmitter by Industry Canada. To

reduce potential radio interference to other users, the antenna type and its gain should be so

chosen that the equivalent isotropically radiated power (e.i.r.p.) is not more than that

necessary for successful communication.

(Le manuel d'utilisation de dispositifs émetteurs équipés d'antennes amovibles doit contenir

les informations suivantes dans un endroit bien en vue:)

Ce dispositif a été conçu pour fonctionner avec une antenne ayant un gain maximal de 1.8

dBi. Une antenne à gain plus élevé est strictement interdite par les règlements d'Industrie

Canada. L'impédance d'antenne requise est de 50 ohms.

Conformément à la réglementation d'Industrie Canada, le présent émetteur radio

peutfonctionner avec une antenne d'un type et d'un gain maximal (ou inférieur) approuvé

pourl'émetteur par Industrie Canada. Dans le but de réduire les risques de brouillage

radioélectriqueà l'intention des autres utilisateurs, il faut choisir le type d'antenne et son gain

de sorte que lapuissance isotrope rayonnée équivalente (p.i.r.e.) ne dépasse pas l'intensité

nécessaire àl'établissement d'une communication satisfaisante.

UL/CB

Rack Mount Instructions - The following or similar rack-mount instructions are included with

the installation instructions:

A) Elevated Operating Ambient - If installed in a closed or multi-unit rack assembly, the

operating ambient temperature of the rack environment may be greater than room ambient.

Therefore, consideration should be given to installing the equipment in an environment

compatible with the maximum ambient temperature (Tma) 40 degree C specified by the

manufacturer.

B) Reduced Air Flow - Installation of the equipment in a rack should be such that the amount

of air flow required for safe operation of the equipment is not compromised.

C) Mechanical Loading - Mounting of the equipment in the rack should be such that a

hazardous condition is not achieved due to uneven mechanical loading.

D) Circuit Overloading - Consideration should be given to the connection of the equipment to

the supply circuit and the effect that overloading of the circuits might have on overcurrent

protection and supply wiring. Appropriate consideration of equipment nameplate ratings

should be used when addressing this concern.

Cisco ISA500 Series Integrated Security Appliances Administration Guide 6

Contents

Chapter 1: Getting Started 19

Introduction 20

Product Overview 21

Front Panel 21

Back Panel 23

Getting Started with the Configuration Utility 25

Logging in to the Configuration Utility 26

Navigating Through the Configuration Utility 27

Using the Help System 28

Configuration Utility Icons 28

Factory Default Settings 30

Default Settings of Key Features 30

Restoring the Factory Default Settings 31

Performing Basic Configuration Tasks 32

Changing the Default Administrator Password 32

Upgrading your Firmware After your First Login 33

Backing Up Your Configuration 34

Chapter 2: Configuration Wizards 35

Using the Setup Wizard for the Initial Configuration 36

Starting the Setup Wizard 37

Configuring Cisco.com Account Credentials 37

Enabling Firmware Upgrade 38

Validating Security License 39

Enabling Bonjour and CDP Discovery Protocols 39

Configuring Remote Administration 40

Configuring Physical Ports 41

Configuring the Primary WAN 42

Configuring the Secondary WAN 42

Configuring WAN Redundancy 42

Configuring Default LAN Settings 43

Configuring DMZ 44

Cisco ISA500 Series Integrated Security Appliances Administration Guide 7

Contents

Configuring DMZ Services 45

Configuring Wireless Radio Settings 47

Configuring Intranet WLAN Access 48

Configure Security Services 49

Viewing Configuration Summary 50

Using the Dual WAN Wizard to Configure WAN Redundancy Settings 51

Starting the Dual WAN Wizard 51

Configuring a Configurable Port as a Secondary WAN Port 51

Configuring the Primary WAN 52

Configuring the Secondary WAN 52

Configuring WAN Redundancy 52

Configuring Network Failure Detection 53

Viewing Configuration Summary 54

Using the Remote Access VPN Wizard 54

Using the Remote Access VPN Wizard for IPsec Remote Access 54

Starting the Remote Access VPN Wizard 55

Configuring IPsec Remote Access Group Policy 55

Configuring WAN Settings 56

Configuring Operation Mode 56

Configuring Access Control Settings 57

Configuring DNS and WINS Settings 57

Configuring Backup Servers 58

Configuring Split Tunneling 58

Viewing Group Policy Summary 58

Configuring IPsec Remote Access User Groups 59

Viewing IPsec Remote Access Summary 59

Using Remote Access VPN Wizard for SSL Remote Access 60

Starting the Remote Access VPN Wizard with SSL Remote Access 60

Configuring SSL VPN Gateway 60

Configuring SSL VPN Group Policy 62

Configuring SSL VPN User Groups 65

Viewing SSL VPN Summary 66

Using the Site-to-Site VPN Wizard to Configure Site-to-Site VPN 66

Starting the Site-to-Site VPN Wizard 67

Configuring VPN Peer Settings 67

Configuring IKE Policies 68

Cisco ISA500 Series Integrated Security Appliances Administration Guide 8

Contents

Configuring Transform Policies 69

Configuring Local and Remote Networks 70

Viewing Configuration Summary 70

Using the DMZ Wizard to Configure DMZ Settings 71

Starting the DMZ Wizard 71

Configuring DDNS Profiles 71

Configuring DMZ Network 72

Configuring DMZ Services 74

Viewing Configuration Summary 76

Using the Wireless Wizard (for ISA550W and ISA570W only) 76

Starting the Wireless Wizard 76

Configuring Wireless Radio Settings 76

Configuring Wireless Connectivity Types 77

Specify Wireless Connectivity Settings for All Enabled SSIDs 77

Viewing Configuration Summary 78

Configuring the SSID for Intranet WLAN Access 78

Configuring the SSID for Guest WLAN Access 79

Configuring the SSID for Captive Portal Access 80

Chapter 3: Status 83

Device Status Dashboard 83

Network Status 87

Status Summary 87

Traffic Statistics 90

Usage Reports 91

WAN Bandwidth Reports 93

ARP Table 94

DHCP Bindings 94

STP Status 95

CDP Neighbor 97

Wireless Status (for ISA550W and ISA570W only) 98

Wireless Status 98

Cisco ISA500 Series Integrated Security Appliances Administration Guide 9

Contents

Client Status 99

NAT Status 99

VPN Status 100

IPsec VPN Status 100

SSL VPN Status 102

Active User Sessions 104

Security Services Reports 105

Web Security Report 105

Anti-Virus Report 106

Email Security Report 107

Network Reputation Report 108

IPS Report 109

Application Control Report 110

System Status 111

Processes 111

Resource Utilization 112

Chapter 4: Networking 114

Viewing Network Status 115

Configuring IPv4 or IPv6 Routing 115

Managing Ports 115

Viewing Status of Physical Interfaces 116

Configuring Physical Ports 117

Configuring Port Mirroring 118

Configuring Port-Based (802.1x) Access Control 119

Configuring the WAN 121

Configuring WAN Settings for Your Internet Connection 121

Configuring WAN Redundancy 129

Dual WAN Settings 129

Configuring Link Failover Detection 131

Load Balancing with Policy-Based Routing Configuration Example 132

Configuring Dynamic DNS 133

Measuring and Limiting Traffic with the Traffic Meter 134

Cisco ISA500 Series Integrated Security Appliances Administration Guide 10

Contents

Configuring a VLAN 136

Configuring DMZ 140

Configuring Zones 145

Security Levels for Zones 145

Predefined Zones 146

Configuring Zones 146

Configuring DHCP Reserved IPs 148

Configuring Routing 148

Viewing the Routing Table 149

Configuring Routing Mode 149

Configuring Static Routing 150

Configuring Dynamic Routing - RIP 151

Configuring Policy-Based Routing 152

Configuring Quality of Service 154

General QoS Settings 154

Configuring WAN QoS 155

Managing WAN Bandwidth for Upstream Traffic 155

Configuring WAN Queue Settings 156

Configuring Traffic Selectors 157

Configuring WAN QoS Policy Profiles 159

Configuring WAN QoS Class Rules 159

Mapping WAN QoS Policy Profiles to WAN Interfaces 160

WAN QoS Configuration Example 161

Configure WAN QoS for Voice Traffic from LAN to WAN 163

Configuring WAN QoS for Voice Traffic from WAN to LAN 164

Configuring LAN QoS 165

Configuring LAN Queue Settings 166

Configuring LAN QoS Classification Methods 166

Mapping CoS to LAN Queue 167

Mapping DSCP to LAN Queue 167

Configuring Default CoS 168

Configuring Wireless QoS 168

Default Wireless QoS Settings 168

Configuring Wireless QoS Classification Methods 169

Mapping CoS to Wireless Queue 170

Mapping DSCP to Wireless Queue 170

Otros manuales para ISA550

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Hardware de red de Cisco

Cisco

Cisco MERAKI MR57 Manual de usuario

Cisco

Cisco UCS-FI-6332-16UP Manual de usuario

Cisco

Cisco NM-1FE-TX - Interface Module Ethernet Manual de usuario

Cisco

Cisco SOURCEfire 3D500 Manual de usuario

Cisco

Cisco GS7000 Instrucciones de funcionamiento

Cisco

Cisco AIR-BR1410A-A-K9 - Aironet 1410 Wireless... Guía de referencia rápida

Cisco

Cisco Wide Area Application Engine 612 Manual

Cisco

Cisco NCS 1000 Manual de usuario

Cisco

Cisco Firepower 1010 Manual de usuario

Cisco

Cisco Firepower 4100 Series Manual de usuario

Cisco

Cisco 3660 Series Manual de usuario

Cisco

Cisco CATALYST RPS 2300 Guía de inicio rápido

Cisco

Cisco ATA 191 Manual de usuario

Cisco

Cisco NCS 2006 Manual

Cisco

Cisco NM-1A-T3 - 1port Ds3 Atm Network Module Manual de usuario

Cisco

Cisco 8540 - Catalyst Campus Switch Router Modular Expansion... Manual de usuario

Cisco

Cisco 8011-2X2XP4L Manual

Cisco

Cisco ASA 5506-X Manual

Cisco

Cisco NCS 6008 LCC Manual de instrucciones

Cisco

Cisco NCS 1002 Manual de usuario

Cisco

Cisco 40-Gigabit and 100-Gigabit CFP Transceiver... Guía de inicio rápido

Cisco

Cisco Rack-Mount and Cable Mgmt. 7505/7010 Manual de usuario

Cisco

Cisco ASR 901S Series Instrucciones de funcionamiento

Cisco

Cisco NCS 1002 Actualización de firmware

Manuales populares de Hardware de red de otras marcas

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manual de usuario

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manual de usuario

Yudor

Yudor YDS-16 Manual de usuario

D-Link

D-Link ShareCenter DNS-320L Manual de usuario

Samsung

Samsung ES1642dc Instrucciones de uso

Honeywell Home

Honeywell Home LTEM-PV Instrucciones de montaje

evertz

evertz 7700 Series Manual de usuario

D-Link

D-Link ShareCenter DNS-343 Manual de usuario

Asante

Asante AsanteBridge 1012 Manual de usuario

FireBrick

FireBrick FB2700 Manual de usuario

Audiovox Electronics

Audiovox Electronics ARWH2T Manual de usuario

ADC

ADC DSX-1 Manual

NetComm

NetComm NF2 Manual de usuario

Alcatel-Lucent

Alcatel-Lucent 5620 Manual de usuario

Dell EMC

Dell EMC XC6420 Series Manual de usuario

Lanner

Lanner NCA-1020A Manual de usuario

Allied Telesis

Allied Telesis AT-TN121-A Manual de usuario

Arista

Arista CCA-ETM-Q12 Manual de usuario