SA 500 Series Security Appliances Administration Guide

241 Pages·2010·2.79 MB·English

ADMINISTRATION
GUIDE
Cisco Small Business Pro
SA 500 Series Security Appliances
CCDE, CCENT, CCSI, CiscoEos, CiscoExplorer, CiscoHealthPresence, CiscoIronPort, the Ciscologo, CiscoNurse Connect, CiscoPulse, CiscoSensorBase,
CiscoStackPower, CiscoStadiumVision, CiscoTelePresence, CiscoTrustSec, CiscoUnified Computing System, CiscoWebEx, DCE, Flip Channels, Flip for
Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing
the Way We Work, Live, Play, and Learn, CiscoCapital, CiscoCapital (Design), Cisco:Financed (Stylized), CiscoStore, Flip Gift Card, and One Million Acts of
Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP,
CCSP, CCVP, Cisco, the CiscoCertified Internetwork Expert logo, CiscoIOS, CiscoLumin, CiscoNexus, CiscoPress, CiscoSystems, CiscoSystems Capital, the
CiscoSystems logo, CiscoUnity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker,
iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking
Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert,
StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a
partnership relationship between Cisco and any other company. (1002R)
© 2010 Cisco Systems, Inc. All rights reserved. OL-19114-03
Contents
Chapter 1: Getting Started 10
Feature Overview 10
Device Overview 11
Front Panel 11
Rear Panel 12
Installation 13
Installation Options 13
Hardware Installation 16
Getting Started with the Configuration Utility 17
Connecting to the Configuration Utility 17
Using the Getting Started Pages 20
Navigating Through the Configuration Utility 22
Using the Help System 23
About the Default Settings 24
Basic Tasks 25
Changing the Default User Name and Password 25
Backing Up Your Configuration 26
Upgrading the Firmware 26
Common Configuration Scenarios 27
Basic Network Configuration with Internet Access 28
Cisco Smart Business Communications System Configuration 30
Firewall for Controlling Inbound and Outbound Traffic 31
DMZ for Public Web Sites and Services 32
Configuring ProtectLink Web & Email Security 33
Site-to-Site Networking and Remote Access 33
Wireless Networking 37
Chapter 2: Status 38
Device Status 38
Device Status 38
Port Statistics 41
Wireless Statistics for the SA 520W 41
Cisco SA 500 Series Security Appliances Administration Guide 3
Contents
VPN Status 43
IPSec VPN Connection Status 43
SSL VPN Status 44
View Logs Status 46
View All Logs 46
IPSec VPN Logs 47
Policy Enforcement Logs 48
Active Users 48
CDP Neighbor 49
LAN Devices 49
Chapter 3: Networking 50
Configuring the WAN Connection 51
Viewing the WAN Status 54
Creating PPPoE Profiles 55
Configuring the LAN 56
About the Default LAN Settings 56
Configuring the LAN 57
Viewing the LAN Status 59
DHCP Reserved IPs 60
DHCP Leased Clients 61
Configuring the Optional Port as a LAN Port 61
Configuring the Optional WAN 61
Configuring Auto-Rollover, Load Balancing, and Failure Detection 65
Configuring the Protocol Bindings for Load Balancing 68
Configuring a DMZ 69
Configuring the DMZ Settings 72
DMZ Reserved IPs 74
DMZ DHCP Leased Clients 75
VLAN Configuration 75
Default VLAN Settings 76
Enabling or Disabling VLAN Support 77
Cisco SA 500 Series Security Appliances Administration Guide 4
Contents
Creating VLAN IDs 77
Assigning VLANs to LAN Ports 78
Multiple VLAN Subnets 79
Routing 81
Routing 81
Static Routing 82
Dynamic Routing 83
Port Management 85
Configuring the Ports 85
Configuring SPAN (Port Mirroring) 85
Bandwidth Profiles 86
Creating Bandwidth Profiles 87
Traffic Selectors 88
Dynamic DNS 89
Configuring IPv6 Addressing 90
IP Routing Mode 91
Configuring the IPv6 WAN Connection 92
Configuring the IPv6 LAN 93
IPv6 LAN Address Pools 95
IPv6 Multi LAN 96
IPv6 Static Routing 97
Routing (RIPng) 98
6to4 Tunneling 98
IPv6 Tunnels Status 99
ISATAP Tunnels 99
MLD Tunnels 100
Router Advertisement Daemon (RADVD) 101
Configuring Router Advertisement 101
Adding RADVD Prefixes 102
802.1p 104
Enabling 802.1p 104
802.1p Mapping 104
Cisco SA 500 Series Security Appliances Administration Guide 5
Contents
DSCP Remarking 105
Chapter 4: Wireless Configuration for the SA 520W 106
Configuring an Access Point 106
Step 1: Configuring the Wireless Profiles 106
Profile Advanced Configuration 109
Configuring the QoS Settings for a Wireless Profile 110
Controlling Wireless Access Based on MAC Addresses 111
Step 2: Configuring the Access Points 113
Configuring the Radio 114
Basic Radio Configuration 114
Advanced Radio Configuration 116
Chapter 5: Firewall Configuration 118
Configuring Firewall Rules to Control Inbound and Outbound Traffic 118
Preliminary Tasks for Firewall Rules 119
Configuring the Default Outbound Policy 122
Configuring a Firewall Rule for Outbound Traffic 122
Configuring a Firewall Rule for Inbound Traffic 125
Prioritizing Firewall Rules 128
Firewall Rule Configuration Examples 129
Using Other Tools to Prevent Attacks, Restrict Access, and
Control Inbound Traffic 132
Configuring Attack Checks 133
Configuring MAC Filtering to Allow or Block Traffic 134
Port Triggering 135
Configuring a Port Triggering Rule to Direct Traffic to Specified Ports 136
Viewing the Port Triggering Status 137
Configuring Session Settings to Analyze Incoming Packets 137
Using Other Tools to Control Access to the Internet 138
Configuring Content Filtering to Allow or Block Web Components 139
Configuring Approved URLs to Allow Access to Websites 140
Configuring Blocked URLs to Prevent Access to Websites 141
Cisco SA 500 Series Security Appliances Administration Guide 6
Contents
Configuring IP/MAC Binding to Prevent Spoofing 142
SIP 143
Chapter 6: Intrusion Prevention System 144
Configuring IPS 144
Configuring the IPS Policy 146
Configuring the Protocol Inspection Settings 146
Configuring Peer-to-Peer Blocking and Instant Messaging 147
Chapter 7: Using Cisco ProtectLink Security Services 148
Chapter 8: Configuring VPN 149
About VPN 149
Configuring a Site-to-Site VPN Tunnel 150
Configuring an IPSec VPN Tunnel for Remote Access with a VPN Client 153
Configuring the User Database for the IPSec Remote Access VPN 155
Advanced Configuration of IPSec VPN 157
Viewing the Basic Setting Defaults for IPSec VPN 157
Configuring the IKE Policies for IPSec VPN 157
Configuring the IPSec VPN Policies 161
Configuring SSL VPN for Browser-Based Remote Access 167
Access Options for SSL VPN 168
Security Tips for SSL VPN 168
Elements of the SSL VPN 169
Scenario Step 1: Customizing the Portal Layout 170
Scenario Step 2: Adding the SSL VPN Users 172
Creating the SSL VPN Policies 173
Specifying the Network Resources for SSL VPN 176
Configuring SSL VPN Port Forwarding 176
SSL VPN Tunnel Client Configuration 178
Viewing the SSL VPN Client Portal 181
VeriSign™ Identity Protection configuration 182
Configuring VeriSign Identity Protection 182
Cisco SA 500 Series Security Appliances Administration Guide 7
Contents
Managing User Credentials for VeriSign Service 183
Chapter 9: Administration 184
Users 184
Domains 185
Groups 186
Adding or Editing User Settings 186
Adding or Editing User Login Policies 188
Maintenance 189
Managing Licenses 189
Upgrading Firmware and Working with Configuration Files 192
Maintaining the USB Device 194
Using the Secondary Firmware 196
Diagnostics 196
Measuring and Limiting Traffic with the Traffic Meter 197
Configuring the Time Settings 199
Configuring the Logging Options 201
Local Logging Config 201
IPv6 Logging 202
Remote Logging 203
Logs Facility 204
Managing Certificates for Authentication 206
Configuring RADIUS Server Records 208
Chapter 10: Network Management 210
RMON (Remote Management) 210
CDP 211
SNMP 212
Configuring SNMP 212
Configuring SNMP System Info 213
UPnP 214
Bonjour 215
Cisco SA 500 Series Security Appliances Administration Guide 8
Contents
Configuring Bonjour 215
Associating VLANs 215
Appendix A: Troubleshooting 217
Internet Connection 217
Date and Time 220
Pinging to Test LAN Connectivity 221
Restoring Factory-Default Configuration Settings 223
Appendix B: Standard Services 224
Appendix C: Technical Specifications and Environmental Requirements 227
Appendix D: Factory Default Settings 229
General Settings 229
Router Settings 231
Wireless Settings 234
Storage 236
Security Settings 238
Appendix E: Where to Go From Here 240
Cisco SA 500 Series Security Appliances Administration Guide 9
1
Getting Started
This chapter describes the SA 500 and provides scenarios to help you to begin
configuring your security appliance to meet the needs of your business.
• Feature Overview
• Installation Options
• Hardware Installation
• Getting Started with the Configuration Utility
• About the Default Settings
• Basic Tasks
• Common Configuration Scenarios
Feature Overview
The features of the SA 520, SA 520W, and the SA 540 are compared in the
following table.
Table1 Comparison of SA 500 Series Security Appliance Models
Feature SA 520 SA 520W SA 540
Firewall 200 Mbps 200 Mbps 300 Mbps
Performance
UTM 200 Mbps 200 Mbps 300 Mbps
VPN 65 Mbps 65 Mbps 85 Mbps
Performance
Connections 15,000 15,000 40,000
Cisco SA 500 Series Security Appliances Administration Guide 10