Cisco 515E - PIX Restricted Bundle Manuel utilisateur

Corporate Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 526-4100

Cisco PIX 515E Security Appliance

Getting Started Guide

Customer Order Number: DOC-7817654=

Text Part Number: 78-17645-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT

NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT

ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR

THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE

INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU

ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A

COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE

PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED

OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL

DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR

INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH

DAMAGES.

Cisco PIX 515E Security Appliance Getting Started Guide

CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We Work,

Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP,

CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital,

the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink,

Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers logo,

Networking Academy, Network Registrar, Pa cke t , PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet,

The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the

United States and certain other countries.

All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply a

partnership relationship between Cisco and any other company. (0601R)

iii

PIX 515E Security Appliance Getting Started Guide

78-17645-01

CONTENTS

CHAPTER

1Installing and Setting Up the PIX 515E Security Appliance 1-1

Verifying the Package Contents 1-2

Installing the PIX 515E Security Appliance 1-3

Front and Back Panel Components 1-4

Setting Up the Security Appliance 1-5

About the Factory-Default Configuration 1-6

About the Adaptive Security Device Manager 1-6

Using the Startup Wizard 1-7

Before Launching the Startup Wizard 1-7

Running the Startup Wizard 1-8

What to Do Next 1-9

CHAPTER

2Scenario: DMZ Configuration 2-1

Example DMZ Network Topology 2-1

Configuring the Security Appliance for a DMZ Deployment 2-4

Configuration Requirements 2-5

Starting ASDM 2-6

Creating IP Pools for Network Address Translation 2-7

Configuring NAT for Inside Clients to Communicate with the DMZ Web

Server 2-12

Configuring NAT for Inside Clients to Communicate with Devices on the

Internet 2-15

Configuring an External Identity for the DMZ Web Server 2-16

Providing Public HTTP Access to the DMZ Web Server 2-18

What to Do Next 2-24

Contents

PIX 515E Security Appliance Getting Started Guide

78-17645-01

CHAPTER

3Scenario: IPsec Remote-Access VPN Configuration 3-1

Example IPsec Remote-Access VPN Network Topology 3-1

Implementing the IPsec Remote-Access VPN Scenario 3-2

Information to Have Available 3-3

Starting ASDM 3-3

Configuring the PIX 515E for an IPsec Remote-Access VPN 3-5

Selecting VPN Client Types 3-6

Specifying the VPN Tunnel Group Name and Authentication Method 3-7

Specifying a User Authentication Method 3-8

(Optional) Configuring User Accounts 3-10

Configuring Address Pools 3-11

Configuring Client Attributes 3-12

Configuring the IKE Policy 3-13

Configuring IPsec Encryption and Authentication Parameters 3-15

Specifying Address Translation Exception and Split Tunneling 3-16

Verifying the Remote-Access VPN Configuration 3-17

What to Do Next 3-18

CHAPTER

4Scenario: Site-to-Site VPN Configuration 4-1

Example Site-to-Site VPN Network Topology 4-1

Implementing the Site-to-Site Scenario 4-2

Information to Have Available 4-2

Configuring the Site-to-Site VPN 4-3

Starting ASDM 4-3

Configuring the Security Appliance at the Local Site 4-4

Providing Information About the Remote VPN Peer 4-6

Configuring the IKE Policy 4-7

Configuring IPsec Encryption and Authentication Parameters 4-9

Specifying Hosts and Networks 4-10

PIX 515E Security Appliance Getting Started Guide

78-17645-01

Contents

Viewing VPN Attributes and Completing the Wizard 4-11

Configuring the Other Side of the VPN Connection 4-13

What to Do Next 4-13

APPENDIX

AObtaining a DES License or a 3DES-AES License A-1

Contents

PIX 515E Security Appliance Getting Started Guide

78-17645-01

CHAPTER

1-1

PIX 515E Security Appliance Getting Started Guide

78-17645-01

Installing and Setting Up the PIX 515E

Security Appliance

This chapter describes how to install and perform the initial configuration of the

security appliance. This chapter includes the following sections:

•Verifying the Package Contents, page 1-2

•Installing the PIX 515E Security Appliance, page 1-3

•Front and Back Panel Components, page 1-4

•Setting Up the Security Appliance, page 1-5

•What to Do Next, page 1-9

Chapter 1 Installing and Setting Up the PIX 515E Security Appliance

Verifying the Package Contents

1-2

PIX 515E Security Appliance Getting Started Guide

78-17645-01

Verifying the Package Contents

Verify the contents of the packing box, shown in Figure 1-1, to ensure that you

have received all items necessary to install your PIX 515E security appliance.

Figure 1-1 Contents of PIX 515E Package

End User License and

Software Warranty

PIX 515E

Getting Started

Guide

Safety and

Compliance

Guide

PIX 515E

PC terminal adapter

(74-0495-01)

Documentation

Blue console cable

(72-1259-01)

Yellow Ethernet cable

(72-1482-01)

Cisco PIX

Security Appliance

Product CD

DO NOT INSTALL INTERFACE

CARDS WITH POWER APPLIED

Link FDX FDX

100 Mbps Link

100 Mbps

FAILOVER

PIX-515E

CONSOLE

10/100 ETHERNET 1 10/100 ETHERNET 0

Failover serial cable

(74-1213-01)

Mounting brackets

(700-01170-02 AO SSI-3)

7 flathead screws

(69-0123-01)

4 cap screws

(69-0124-01)

4 spacers

(69-0125-01)

Rubber feet

97955

Power cable

1-3

PIX 515E Security Appliance Getting Started Guide

78-17645-01

Chapter 1 Installing and Setting Up the PIX 515E Security Appliance

Installing the PIX 515E Security Appliance

This section describes how to install your PIX 515E security appliance into your

own network, which might resemble the example network in Figure 1-2.

Figure 1-2 Sample Network Layout

To install the PIX 515E security appliance, complete these steps:

Step 1 Mount the chassis in a rack by performing the following steps:

a. Attach the brackets to the chassis with the supplied screws. The brackets

attach to the holes near the front of the chassis.

b. Attach the chassis to the equipment rack.

Step 2 Use one of the provided yellow Ethernet cables to connect the outside 10/100

Ethernet interface, Ethernet 0, to a DSL modem, cable modem, router, or switch.

Step 3 Use the other provided yellow Ethernet cable to connect the inside 10/100

Ethernet interface, Ethernet 1, to a switch or hub.

Step 4 Connect one end of the power cable to the rear of the PIX 515E security appliance

and the other end to a power outlet.

Internet

97998

DMZ server

Laptop

computer

Printer

Personal

computer

Switch

Switch Inside

Outside

Router

PIX 515E

Power

cable

DMZ

Chapter 1 Installing and Setting Up the PIX 515E Security Appliance

Front and Back Panel Components

1-4

PIX 515E Security Appliance Getting Started Guide

78-17645-01

Step 5 Power up the PIX 515E security appliance. The power switch is located at the rear

of the chassis.

Front and Back Panel Components

Figure 1-3 illustrates the LEDs on the front panel of the PIX515E Security

Appliance.

Figure 1-3 PIX515E Security Appliance Front Panel LEDs

Figure 1-4 illustrates the back panel components.

LED Color State Description

POWER Green On On when the unit has power.

ACT Green On If part of a failover pair, the light is on when the unit is the active

unit.

Off If part of a failover pair, the light is off when the unit is in standby

mode.

NETWORK Green Flashing Flashing when at least one network interface is passing traffic.

POWER ACT NETWORK

97779

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Cisco Pare-feu

Cisco

Cisco RV110W Mode d’emploi

Cisco

Cisco ASA 5512-X Manuel

Cisco

Cisco Small Business RV215W Mode d’emploi

Cisco

Cisco RV120W Mode d’emploi

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Manuel utilisateur

Cisco

Cisco 5510 - ASA SSL / IPsec VPN Edition Manuel utilisateur

Cisco

Cisco 5510 - ASA SSL / IPsec VPN Edition Manuel utilisateur

Cisco

Cisco RV110W Manuel utilisateur

Cisco

Cisco Small Business RV215W Manuel utilisateur

Cisco

Cisco M170 Manuel utilisateur

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Manuel utilisateur

Cisco

Cisco MX400 Manuel utilisateur

Cisco

Cisco Firepower 4100 Series Manuel d'installation

Cisco

Cisco IronPort C370 Manuel utilisateur

Cisco

Cisco Firepower 1100 Series Manuel

Cisco

Cisco 3100 Series Manuel

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Manuel

Cisco

Cisco M195 Manuel

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Manuel utilisateur

Cisco

Cisco Firepower 2100 Series Guide de référence rapide

Cisco

Cisco 380 Series Manuel

Cisco

Cisco Firepower 2120 Manuel

Cisco

Cisco Cisco ASA 5500 Series Manuel utilisateur

Cisco

Cisco ISA3000-4C-K9 Manuel

Manuels Pare-feu populaires d'autres marques

Fortinet

Fortinet FortiGate Voice Series Manuel utilisateur

ADTRAN

ADTRAN NetVanta 2300 Manuel utilisateur

SecureLogix

SecureLogix ETM System Manuel utilisateur

NETGEAR

NETGEAR ProSafe FVX538 Manuel utilisateur

Lanner

Lanner FW-8877 Manuel utilisateur

Huawei

Huawei USG6000 Series Manuel d'installation et d'exploitation

H3C

H3C SecPath F5000-AI-15 Manuel utilisateur

Nexcom

Nexcom DNA 1150 Manuel utilisateur

Fortinet

Fortinet FortiGate-60 series Manuel utilisateur

Draytek

Draytek Vigor2860 Series Manuel utilisateur

Lanner electronics

Lanner electronics FW-7650 Series Manuel utilisateur

Swisscom

Swisscom Internet Backup Manuel utilisateur

SonicWALL

SonicWALL NSa 5700 Manuel utilisateur

DPtech

DPtech FW1000 SERIES Manuel utilisateur

FEITIAN

FEITIAN MultiPass FIDO Manuel utilisateur

EBLOCKER

EBLOCKER PRO Manuel utilisateur

GTA

GTA GB-200 Manuel utilisateur

Trend Micro

Trend Micro Deep Edge Manuel utilisateur