Cisco WS-CE500 - Catalyst Express 500-24PC Manual de instrucciones

Cisco Small Business

SA500 Series Security Appliances

ADMINISTRATION

GUIDE

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks,

go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does

not imply a partnership relationship between Cisco and any other company. (1110R)

Cisco SA500 Series Security Appliances Administration Guide 3

Contents

Chapter 1: Getting Started 10

Feature Overview 10

Device Overview 11

Front Panel 11

Rear Panel 12

Installation 13

Installation Options 13

Hardware Installation 16

Getting Started with the Configuration Utility 17

Connecting to the Configuration Utility 18

Using the Getting Started Pages 19

Navigating Through the Configuration Utility 21

Using the Help System 22

About the Default Settings 22

Basic Tasks 23

Changing the Default User Name and Password 23

Backing Up Your Configuration 24

Upgrading the Firmware 24

Common Configuration Scenarios 25

Basic Network Configuration with Internet Access 26

Cisco Smart Business Communications System Configuration 28

Firewall for Controlling Inbound and Outbound Traffic 29

DMZ for Public Websites and Services 29

Configuring ProtectLink Web & Email Security 31

Site-to-Site Networking and Remote Access 31

Wireless Networking 35

Chapter 2: Networking 36

Configuring the WAN Connection 37

Viewing the WAN Status 39

Creating PPPoE Profiles 40

Configuring an IP Alias 41

Cisco SA500 Series Security Appliances Administration Guide 4

Contents

Configuring the LAN 43

About the Default LAN Settings 43

Configuring the LAN 44

Viewing the LAN Status 46

VLAN Configuration 46

DHCP Reserved IPs 52

DHCP Leased Clients 53

Configuring an IGMP Proxy 53

Configuring the Optional Port as a LAN Port 53

Configuring the Optional WAN 54

Configuring Auto-Rollover, Load Balancing, and Failure Detection 57

Configuring the Protocol Bindings for Load Balancing 60

Configuring a DMZ 61

Configuring the DMZ Settings 64

DMZ Reserved IPs 66

DMZ DHCP Leased Clients 67

Routing 67

Static Routing 68

Dynamic Routing 69

Port Management 70

Configuring the Ports 70

Configuring SPAN (Port Mirroring) 71

QoS Bandwidth Profiles 72

Creating QoS Bandwidth Profiles for WAN Interfaces 72

Traffic Selectors 73

LAN QoS 74

Enabling LAN QoS 74

Port CoS Mapping 75

Port DSCP Mapping 75

DSCP Remarking 75

Dynamic DNS 76

Cisco SA500 Series Security Appliances Administration Guide 5

Contents

Configuring IPv6 Addressing 77

IP Routing Mode 78

Configuring the IPv6 WAN Connection 78

Configuring the IPv6 LAN 80

IPv6 LAN Address Pools 82

IPv6 Multi LAN 83

IPv6 Static Routing 83

Routing (RIPng) 84

6to4 Tunneling 85

IPv6 Tunnels Status 85

ISATAP Tunnels 86

MLD Tunnels 87

Router Advertisement Daemon (RADVD) 88

Configuring Router Advertisement 88

Adding RADVD Prefixes 89

Chapter 3: Wireless Configuration for the SA520W 91

Configuring an Access Point 91

Step 1: Configuring the Wireless Profiles 92

Profile Advanced Configuration 95

Configuring the QoS Settings for a Wireless Profile 95

Controlling Wireless Access Based on MAC Addresses 96

Step 2: Configuring the Access Points 98

Configuring the Radio 99

Basic Radio Configuration 99

Advanced Radio Configuration 101

Chapter 4: Firewall Configuration 103

Configuring Firewall Rules to Control Inbound and Outbound Traffic 103

Preliminary Tasks for Firewall Rules 104

Configuring the Default Outbound Policy 107

Configuring a Firewall Rule for Outbound Traffic 107

Cisco SA500 Series Security Appliances Administration Guide 6

Contents

Configuring a Firewall Rule for Inbound Traffic 110

Prioritizing Firewall Rules 113

Firewall Rule Configuration Examples 114

Using Other Tools to Prevent Attacks, Restrict Access, and

Control Inbound Traffic 117

Configuring Attack Checks 118

Configuring MAC Filtering to Allow or Block Traffic 119

Configuring IP/MAC Binding 120

Port Triggering 121

Configuring a Port Triggering Rule to Direct Traffic to Specified Ports 122

Viewing the Port Triggering Status 122

Configuring Session Settings to Analyze Incoming Packets 123

Using Other Tools to Control Access to the Internet 124

Configuring Content Filtering to Allow or Block Web Components 124

Configuring Approved URLs to Allow Access to Websites 126

Configuring Blocked URLs to Prevent Access to Websites 127

Configuring IP/MAC Binding to Prevent Spoofing 128

SIP 129

Chapter 5: Intrusion Prevention System 130

Configuring IPS 131

Configuring the IPS Policy 132

Configuring the Protocol Inspection Settings 133

Configuring Peer-to-Peer Blocking and Instant Messaging 134

Chapter 6: Using Cisco ProtectLink Security Services 135

Chapter 7: Configuring VPN 136

About VPN 136

Configuring a Site-to-Site VPN Tunnel 137

Configuring an IPsec VPN Tunnel for Remote Access with a VPN Client 139

Configuring the User Database for the IPsec Remote Access VPN 142

Advanced Configuration of IPsec VPN 144

Cisco SA500 Series Security Appliances Administration Guide 7

Contents

Viewing the Basic Setting Defaults for IPsec VPN 144

Configuring the IKE Policies for IPsec VPN 144

Configuring the IPsec VPN Policies 148

Configuring SSL VPN for Browser-Based Remote Access 154

Access Options for SSL VPN 155

Security Tips for SSL VPN 155

Elements of the SSL VPN 156

Scenario Step 1: Customizing the Portal Layout 157

Scenario Step 2: Adding the SSL VPN Users 159

Creating the SSL VPN Policies 160

Specifying the Network Resources for SSL VPN 163

Configuring SSL VPN Port Forwarding 163

SSL VPN Tunnel Client Configuration 165

Viewing the SSL VPN Client Portal 168

VeriSign™ Identity Protection configuration 169

Configuring VeriSign Identity Protection 169

Managing User Credentials for VeriSign Service 170

Chapter 8: Administration 171

Users 171

Domains 172

Groups 173

Adding or Editing User Settings 173

Adding or Editing User Login Policies 175

Firmware and Configuration 176

Upgrading Firmware and Working with Configuration Files 176

Maintaining the USB Device 178

Using the Secondary Firmware 180

Diagnostics 180

Measuring and Limiting Traffic with the Traffic Meter 182

Configuring the Time Settings 184

Configuring the Logging Options 185

Cisco SA500 Series Security Appliances Administration Guide 8

Contents

Local Logging Config 185

IPv6 Logging 187

Remote Logging 188

Logs Facility and Severity 189

Managing Certificates for Authentication 190

Configuring RADIUS Server Records 193

License Management 194

Chapter 9: Network Management 197

RMON (Remote Management) 197

CDP 199

SNMP 199

Configuring SNMP 200

Configuring SNMP System Info 200

UPnP 201

Bonjour 202

Configuring Bonjour 202

Associating VLANs 202

Chapter 10: Status 204

Device Status 204

Device Status 205

Resource Utilization 207

Interface Statistics 207

Port Statistics 208

Wireless Statistics for the SA520W 208

VPN Status 210

IPsec VPN Status 210

SSL VPN Status 211

Quick VPN Status 212

Active Users 213

View Logs 213

Cisco SA500 Series Security Appliances Administration Guide 9

Contents

View All Logs 213

IPsec VPN Logs 215

ProtectLink Logs 215

CDP Neighbor 215

LAN Devices 216

Reports 216

Appendix A: Troubleshooting 217

Internet Connection 217

Date and Time 220

Pinging to Test LAN Connectivity 221

Restoring Factory Default Configuration Settings 223

Appendix B: Standard Services 224

Appendix C: Technical Specifications and Environmental Requirements 227

Appendix D: Factory Default Settings 229

General Settings 229

Router Settings 231

Wireless Settings 234

Storage 237

Security Settings 238

Appendix E: Where to Go From Here 240

Cisco SA500 Series Security Appliances Administration Guide 10

Getting Started

This chapter describes the SA500 and provides scenarios to help you to begin

configuring your security appliance to meet the needs of your business.

•Feature Overview

•Installation Options

•Hardware Installation

•Getting Started with the Configuration Utility

•About the Default Settings

•Basic Tasks

•Common Configuration Scenarios

Feature Overview

The features of the SA520, SA520W, and the SA540 are compared in the following

table.

Table 1 Comparison of SA500 Series Security Appliance Models

Feature SA520 SA520W SA540

Firewall

Performance

200 Mbps 200 Mbps 300 Mbps

UTM 200 Mbps 200 Mbps 300 Mbps

VPN

Performance

65 Mbps 65 Mbps 85 Mbps

Connections 15,000 15,000 40,000

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Hardware de red de Cisco

Cisco

Cisco IDS 4210 - Intrusion Detection Sys 4210... Manual de usuario

Cisco

Cisco ONS 15327 Manual

Cisco

Cisco Versatile Interface Processor (VIP6-80)... Manual del operador

Cisco

Cisco S170 Web Manual de usuario

Cisco

Cisco MERAKI CW9166D1 Manual de usuario

Cisco

Cisco Nexus 3000 series Manual de usuario

Cisco

Cisco 2431 - IAD Router Manual de usuario

Cisco

Cisco CVPN3002-K9 - Fast Ethernet VPN Gateway Manual de usuario

Cisco

Cisco TELEPRESENCE MCU ACCESSING CONFERENCES - Manual de usuario

Cisco

Cisco ONS 15454 SDH Manual

Cisco

Cisco Catalyst X6148 Manual de usuario

Cisco

Cisco ASR 5000 Manual de instrucciones

Cisco

Cisco IDS-4230-FE - Intrusion Detection Sys Fast Ethernet... Manual del operador

Cisco

Cisco IAD2430 Series Manual

Cisco

Cisco CE-507 - Content Engine 507 Manual de usuario

Cisco

Cisco Aironet 1040 Series Manual de usuario

Cisco

Cisco Cisco 5400 ENCS Manual

Cisco

Cisco NM-1A-T3 - 1port Ds3 Atm Network Module Manual de usuario

Cisco

Cisco 15530-LCMB-0200 - ESCON Multiplexing Line Card... Manual

Cisco

Cisco C7200-I - Input/Output Controller - Control... Manual de usuario

Cisco

Cisco 5400 Series Manual de instrucciones

Cisco

Cisco Firepower 9300 Manual

Cisco

Cisco Aironet 1000 Series Manual

Cisco

Cisco 220 Series Smart Plus Manual de usuario

Manuales populares de Hardware de red de otras marcas

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manual de usuario

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manual de usuario

Yudor

Yudor YDS-16 Manual de usuario

D-Link

D-Link ShareCenter DNS-320L Manual de usuario

Samsung

Samsung ES1642dc Instrucciones de uso

Honeywell Home

Honeywell Home LTEM-PV Instrucciones de montaje

evertz

evertz 7700 Series Manual de usuario

D-Link

D-Link ShareCenter DNS-343 Manual de usuario

Asante

Asante AsanteBridge 1012 Manual de usuario

FireBrick

FireBrick FB2700 Manual de usuario

Audiovox Electronics

Audiovox Electronics ARWH2T Manual de usuario

ADC

ADC DSX-1 Manual

NetComm

NetComm NF2 Manual de usuario

Alcatel-Lucent

Alcatel-Lucent 5620 Manual de usuario

Dell EMC

Dell EMC XC6420 Series Manual de usuario

Lanner

Lanner NCA-1020A Manual de usuario

Allied Telesis

Allied Telesis AT-TN121-A Manual de usuario

Arista

Arista CCA-ETM-Q12 Manual de usuario