Cisco WS-CE500 - Catalyst Express 500-24PC Mode d’emploi

Cisco Small Business

SA500 Series Security Appliances

ADMINISTRATION

GUIDE

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks,

go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does

not imply a partnership relationship between Cisco and any other company. (1110R)

Cisco SA500 Series Security Appliances Administration Guide 3

Contents

Chapter 1: Getting Started 10

Feature Overview 10

Device Overview 11

Front Panel 11

Rear Panel 12

Installation 13

Installation Options 13

Hardware Installation 16

Getting Started with the Configuration Utility 17

Connecting to the Configuration Utility 18

Using the Getting Started Pages 19

Navigating Through the Configuration Utility 21

Using the Help System 22

About the Default Settings 22

Basic Tasks 23

Changing the Default User Name and Password 23

Backing Up Your Configuration 24

Upgrading the Firmware 24

Common Configuration Scenarios 25

Basic Network Configuration with Internet Access 26

Cisco Smart Business Communications System Configuration 28

Firewall for Controlling Inbound and Outbound Traffic 29

DMZ for Public Websites and Services 29

Configuring ProtectLink Web & Email Security 31

Site-to-Site Networking and Remote Access 31

Wireless Networking 35

Chapter 2: Networking 36

Configuring the WAN Connection 37

Viewing the WAN Status 39

Creating PPPoE Profiles 40

Configuring an IP Alias 41

Cisco SA500 Series Security Appliances Administration Guide 4

Contents

Configuring the LAN 43

About the Default LAN Settings 43

Configuring the LAN 44

Viewing the LAN Status 46

VLAN Configuration 46

DHCP Reserved IPs 52

DHCP Leased Clients 53

Configuring an IGMP Proxy 53

Configuring the Optional Port as a LAN Port 53

Configuring the Optional WAN 54

Configuring Auto-Rollover, Load Balancing, and Failure Detection 57

Configuring the Protocol Bindings for Load Balancing 60

Configuring a DMZ 61

Configuring the DMZ Settings 64

DMZ Reserved IPs 66

DMZ DHCP Leased Clients 67

Routing 67

Static Routing 68

Dynamic Routing 69

Port Management 70

Configuring the Ports 70

Configuring SPAN (Port Mirroring) 71

QoS Bandwidth Profiles 72

Creating QoS Bandwidth Profiles for WAN Interfaces 72

Traffic Selectors 73

LAN QoS 74

Enabling LAN QoS 74

Port CoS Mapping 75

Port DSCP Mapping 75

DSCP Remarking 75

Dynamic DNS 76

Cisco SA500 Series Security Appliances Administration Guide 5

Contents

Configuring IPv6 Addressing 77

IP Routing Mode 78

Configuring the IPv6 WAN Connection 78

Configuring the IPv6 LAN 80

IPv6 LAN Address Pools 82

IPv6 Multi LAN 83

IPv6 Static Routing 83

Routing (RIPng) 84

6to4 Tunneling 85

IPv6 Tunnels Status 85

ISATAP Tunnels 86

MLD Tunnels 87

Router Advertisement Daemon (RADVD) 88

Configuring Router Advertisement 88

Adding RADVD Prefixes 89

Chapter 3: Wireless Configuration for the SA520W 91

Configuring an Access Point 91

Step 1: Configuring the Wireless Profiles 92

Profile Advanced Configuration 95

Configuring the QoS Settings for a Wireless Profile 95

Controlling Wireless Access Based on MAC Addresses 96

Step 2: Configuring the Access Points 98

Configuring the Radio 99

Basic Radio Configuration 99

Advanced Radio Configuration 101

Chapter 4: Firewall Configuration 103

Configuring Firewall Rules to Control Inbound and Outbound Traffic 103

Preliminary Tasks for Firewall Rules 104

Configuring the Default Outbound Policy 107

Configuring a Firewall Rule for Outbound Traffic 107

Cisco SA500 Series Security Appliances Administration Guide 6

Contents

Configuring a Firewall Rule for Inbound Traffic 110

Prioritizing Firewall Rules 113

Firewall Rule Configuration Examples 114

Using Other Tools to Prevent Attacks, Restrict Access, and

Control Inbound Traffic 117

Configuring Attack Checks 118

Configuring MAC Filtering to Allow or Block Traffic 119

Configuring IP/MAC Binding 120

Port Triggering 121

Configuring a Port Triggering Rule to Direct Traffic to Specified Ports 122

Viewing the Port Triggering Status 122

Configuring Session Settings to Analyze Incoming Packets 123

Using Other Tools to Control Access to the Internet 124

Configuring Content Filtering to Allow or Block Web Components 124

Configuring Approved URLs to Allow Access to Websites 126

Configuring Blocked URLs to Prevent Access to Websites 127

Configuring IP/MAC Binding to Prevent Spoofing 128

SIP 129

Chapter 5: Intrusion Prevention System 130

Configuring IPS 131

Configuring the IPS Policy 132

Configuring the Protocol Inspection Settings 133

Configuring Peer-to-Peer Blocking and Instant Messaging 134

Chapter 6: Using Cisco ProtectLink Security Services 135

Chapter 7: Configuring VPN 136

About VPN 136

Configuring a Site-to-Site VPN Tunnel 137

Configuring an IPsec VPN Tunnel for Remote Access with a VPN Client 139

Configuring the User Database for the IPsec Remote Access VPN 142

Advanced Configuration of IPsec VPN 144

Cisco SA500 Series Security Appliances Administration Guide 7

Contents

Viewing the Basic Setting Defaults for IPsec VPN 144

Configuring the IKE Policies for IPsec VPN 144

Configuring the IPsec VPN Policies 148

Configuring SSL VPN for Browser-Based Remote Access 154

Access Options for SSL VPN 155

Security Tips for SSL VPN 155

Elements of the SSL VPN 156

Scenario Step 1: Customizing the Portal Layout 157

Scenario Step 2: Adding the SSL VPN Users 159

Creating the SSL VPN Policies 160

Specifying the Network Resources for SSL VPN 163

Configuring SSL VPN Port Forwarding 163

SSL VPN Tunnel Client Configuration 165

Viewing the SSL VPN Client Portal 168

VeriSign™ Identity Protection configuration 169

Configuring VeriSign Identity Protection 169

Managing User Credentials for VeriSign Service 170

Chapter 8: Administration 171

Users 171

Domains 172

Groups 173

Adding or Editing User Settings 173

Adding or Editing User Login Policies 175

Firmware and Configuration 176

Upgrading Firmware and Working with Configuration Files 176

Maintaining the USB Device 178

Using the Secondary Firmware 180

Diagnostics 180

Measuring and Limiting Traffic with the Traffic Meter 182

Configuring the Time Settings 184

Configuring the Logging Options 185

Cisco SA500 Series Security Appliances Administration Guide 8

Contents

Local Logging Config 185

IPv6 Logging 187

Remote Logging 188

Logs Facility and Severity 189

Managing Certificates for Authentication 190

Configuring RADIUS Server Records 193

License Management 194

Chapter 9: Network Management 197

RMON (Remote Management) 197

CDP 199

SNMP 199

Configuring SNMP 200

Configuring SNMP System Info 200

UPnP 201

Bonjour 202

Configuring Bonjour 202

Associating VLANs 202

Chapter 10: Status 204

Device Status 204

Device Status 205

Resource Utilization 207

Interface Statistics 207

Port Statistics 208

Wireless Statistics for the SA520W 208

VPN Status 210

IPsec VPN Status 210

SSL VPN Status 211

Quick VPN Status 212

Active Users 213

View Logs 213

Cisco SA500 Series Security Appliances Administration Guide 9

Contents

View All Logs 213

IPsec VPN Logs 215

ProtectLink Logs 215

CDP Neighbor 215

LAN Devices 216

Reports 216

Appendix A: Troubleshooting 217

Internet Connection 217

Date and Time 220

Pinging to Test LAN Connectivity 221

Restoring Factory Default Configuration Settings 223

Appendix B: Standard Services 224

Appendix C: Technical Specifications and Environmental Requirements 227

Appendix D: Factory Default Settings 229

General Settings 229

Router Settings 231

Wireless Settings 234

Storage 237

Security Settings 238

Appendix E: Where to Go From Here 240

Cisco SA500 Series Security Appliances Administration Guide 10

Getting Started

This chapter describes the SA500 and provides scenarios to help you to begin

configuring your security appliance to meet the needs of your business.

•Feature Overview

•Installation Options

•Hardware Installation

•Getting Started with the Configuration Utility

•About the Default Settings

•Basic Tasks

•Common Configuration Scenarios

Feature Overview

The features of the SA520, SA520W, and the SA540 are compared in the following

table.

Table 1 Comparison of SA500 Series Security Appliance Models

Feature SA520 SA520W SA540

Firewall

Performance

200 Mbps 200 Mbps 300 Mbps

UTM 200 Mbps 200 Mbps 300 Mbps

VPN

Performance

65 Mbps 65 Mbps 85 Mbps

Connections 15,000 15,000 40,000

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels Cisco Matériel réseau

Cisco

Cisco ONS 15454 Manuel

Cisco

Cisco VSVM Mode d’emploi

Cisco

Cisco Catalyst 8300 Series Manuel

Cisco

Cisco Cisco ONS 15600 SDH Manuel utilisateur

Cisco

Cisco o UCS X440p Instructions d'installation et d'entretien

Cisco

Cisco IPS-4240-K9 - Intrusion Protection Sys 4240 Manuel utilisateur

Cisco

Cisco GS7000 Mode d'emploi

Cisco

Cisco SCE8000 GBE Manuel utilisateur

Cisco

Cisco Versatile Interface Processor (VIP6-80)... Manuel de l'opérateur

Cisco

Cisco 3660 Series Manuel utilisateur

Cisco

Cisco ASR 5000 Manuel utilisateur

Cisco

Cisco CWDM-OADM 1 Series Guide de démarrage rapide

Cisco

Cisco Edge Concentrator MGX 8220 Manuel de référence

Cisco

Cisco Physical Access 1125 Appliance Manuel utilisateur

Cisco

Cisco ASR 5000 Mode d’emploi

Cisco

Cisco MDS 9500 Series Manuel

Cisco

Cisco ONS 15540 ESP Manuel

Cisco

Cisco GS7000 Mode d'emploi

Cisco

Cisco Firepower 9300 Guide de maintenance et de service

Cisco

Cisco NCS 2000 series Manuel utilisateur

Cisco

Cisco MERAKI CW9166D1 Manuel utilisateur

Cisco

Cisco CVPN3002-K9 - Fast Ethernet VPN Gateway Manuel utilisateur

Cisco

Cisco UCS X10c Instructions d'installation et d'entretien

Cisco

Cisco Meraki Catalyst 9300/X/L-M Series Manuel utilisateur

Manuels Matériel réseau populaires d'autres marques

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manuel utilisateur

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manuel utilisateur

Yudor

Yudor YDS-16 Manuel utilisateur

D-Link

D-Link ShareCenter DNS-320L Manuel utilisateur

Samsung

Samsung ES1642dc Instructions d'utilisation

Honeywell Home

Honeywell Home LTEM-PV Instructions de montage

evertz

evertz 7700 Series Manuel utilisateur

D-Link

D-Link ShareCenter DNS-343 Manuel utilisateur

Asante

Asante AsanteBridge 1012 Manuel utilisateur

FireBrick

FireBrick FB2700 Manuel utilisateur

Audiovox Electronics

Audiovox Electronics ARWH2T Manuel utilisateur

ADC

ADC DSX-1 Manuel

NetComm

NetComm NF2 Manuel utilisateur

Alcatel-Lucent

Alcatel-Lucent 5620 Manuel utilisateur

Dell EMC

Dell EMC XC6420 Series Manuel utilisateur

Lanner

Lanner NCA-1020A Manuel utilisateur

Allied Telesis

Allied Telesis AT-TN121-A Manuel utilisateur

Arista

Arista CCA-ETM-Q12 Manuel utilisateur