Cisco M170 User manual

303495
1
0
1
0
Cisco M170
Email
Security
Appliance
QUICK START GUIDE
Cisco M170 Content Security
Management Appliance
1Welcome
2Before You Begin
3Document Network Settings
4Plan the Installation
5Install the Appliance in a Rack
6Plug In the Appliance
7Temporarily Change Your IP Address
8Connect to the Appliance
9Power Up the Appliance
10 Log In to the Appliance
11 Run the System Setup Wizard
12 Configure Network Settings
13 Configuration Summary
14 You’re Done!
15 Frequently Asked Questions
16 Where to Go From Here
M170_QSG.fm Page 1 Wednesday, March 13, 2013 10:01 PM

2
Revised: March 13, 2013
Part Number: 78-19644-04
1 Welcome
Thank you for choosing the Cisco M170 Content Security
Management Appliance (Cisco M170).
The Content Security Management appliance centralizes and
consolidates important policy and runtime data, providing
administrators and end-users with a single interface for
managing their email and web security systems. It ensures top
performance from Cisco C-Series and S-Series appliances, and
protects corporate network integrity by increasing deployment
flexibility.
The Content Security Management appliance provides the
central platform for managing all reporting and auditing
information for Cisco Email and Web Security appliances.
Optional management features allow you to coordinate all your
security operations from a single Content Security Management
appliance or to spread the load across multiple appliances.
This guide describes how to physically install the Cisco M170
appliance and use the System Setup Wizard to configure basic
settings.
M170_QSG.fm Page 2 Wednesday, March 13, 2013 10:01 PM

3
2 Before You Begin
Before you begin the installation, make sure that you have the
items you need.
The following items are included with the Cisco M170 Content
Security Management Appliance:
• Quick Start Guide (this guide)
• Rails and adaptor kit
• Power cable(s)
• Ethernet cable for connecting the appliance to your
network
• Regulatory Safety and Compliance Information
You will need to provide the following items yourself:
• Rack cabinet enclosure (if rack-mounting the appliance)
• Phillips-head screwdriver for assembling rails
• 10/100 Gigabit Base-T TCP/IP LAN
• Desktop or laptop computer
• Web browser (or SSH and terminal software)
• Network and administrator information for the “Document
Network Settings” section on page 4
M170_QSG.fm Page 3 Wednesday, March 13, 2013 10:01 PM

4
3 Document Network Settings
Before you begin, write down the following information about
your network and administrator settings.You will need this
information when running the System Setup Wizard.
System Settings
Default System Hostname:
Deliver Scheduled Reports To:
Time Zone Information:
NTP Server:
Admin Password:
AutoSupport: Enable/Disable
Network Integration
Default Gateway (Router) IP Address:
DNS (Internet or Specify Own):
Interfaces
Data Port 1
IP Address:
Network Mask:
Fully Qualified Hostname:
Data Port 2
IP Address:
Network Mask:
M170_QSG.fm Page 4 Wednesday, March 13, 2013 10:01 PM

5
4 Plan the Installation
The Cisco M170 Content Security Management Appliance is
designed to serve as an external or “off box” location to
monitor corporate policy settings and audit information. It
combines hardware, an operating system (AsyncOS), and
supporting services to centralize and consolidate important
policy and runtime data.
The Cisco M170 appliance is designed to sit within your inner
DMZ and receive quarantined spam from Cisco C-Series and
S-Series appliances in your outer DMZ. Internal users access the
Content Security Management appliance to view and manage
messages in their quarantines.
Plan for your network configuration to look something like this:
Internet
Firewall
Internal Users
Cisco IronPort C-Series
Outer DMZ
Inner DMZ
Cisco IronPort S-Series
Cisco IronPort M-Series
303492
1
0
1
0
CiscoIronPort C170
Email
Management
Appliance
1
0
1
0
CiscoIronPort C170
Email
Management
Appliance
1
0
1
0
CiscoIronPort S170
Email
Management
Appliance
1
0
1
0
CiscoIronPort M170
Email
Management
Appliance
1
0
1
0
CiscoIronPort M170
Email
Management
Appliance
M170_QSG.fm Page 5 Wednesday, March 13, 2013 10:01 PM

6
5 Install the Appliance in a Rack
Install the Cisco M170 Content Security Management
Appliance using either the slide rails or fixed rack mount
brackets. For information about these installation options, see
the Cisco 170 Series Hardware Installation Guide.
Appliance Placement
• Ambient Temperature—To prevent the appliance from
overheating, do not operate it in an area that exceeds an
ambient temperature of 104°F (40°C).
• Air Flow—Be sure that there is adequate air flow around
the appliance.
• Mechanical Loading—Be sure that the appliance is level
and stable to avoid any hazardous conditions.
1
0
1
0
CiscoC170
Web
Security
Appliance
50
104
F
C
40
10
303363
Temperature Limits
M170_QSG.fm Page 6 Wednesday, March 13, 2013 10:01 PM

7
6 Plug In the Appliance
Plug the female end of the power cable into the power supply on
the back panel of the appliance. Plug the male end(s) into an
electrical outlet.
7JZ78-004E
P1 P2CONSOLE
303393
Plug the M170 power cable
into an electrical outlet.
M170_QSG.fm Page 7 Wednesday, March 13, 2013 10:01 PM

8
7 Temporarily Change Your IP
Address
To connect to the Cisco M170, you must temporarily change the
IP address of your computer.
Note Make a note of your current IP configuration settings
as you will need to revert to these settings after you
finish the configuration.
For Windows
Step 1 Go to the Start menu and choose Control Panel.
Step 2 Double-click Network and Sharing Center.
Step 3 Click Local Area Connection and then click Properties.
Step 4 Select Internet Protocol (TCP/IP) and then click
Properties.
Step 5 Select Use the Following IP Address.
Step 6 Enter the following changes:
• IP Address: 192.168.42.43
• Subnet Mask: 255.255.255.0
• Default Gateway: 192.168.42.1
Step 7 Click OK and Close to exit the dialog box.
For Mac
Step 1 Launch the Apple menu and choose System Preferences.
Step 2 Click Network.
Step 3 Select the network configuration with the green icon.
This is your active connection. Then click Advanced.
Step 4 Click the TCP/IP tab and from Ethernet settings,
choose Manually from the drop-down list.
Step 5 Enter the following changes:
M170_QSG.fm Page 8 Wednesday, March 13, 2013 10:01 PM

9
• IP Address: 192.168.42.43
• Subnet Mask: 255.255.255.0
• Router: 192.168.42.1
Step 6 Click OK.
8 Connect to the Appliance
The Cisco M170 appliance has two gigabit network ports:
P1 and P2.
For the purposes of setup, connect to P1 as your management
interface and configure incoming web traffic or email on the P2
interface. These settings can be changed after the initial
installation.
7JZ78-004E
P1 P2CONSOLE
P1 P2
P1:
Management: 192.168.42.42
Connect the P1 port
to your computer using
an Ethernet cable.
P2:
Incoming web traffic or email
Connect the P2 port
to your network using
an Ethernet cable.
303494
M170_QSG.fm Page 9 Wednesday, March 13, 2013 10:01 PM

10
9 Power Up the Appliance
Power up the appliance by pressing the On/Off switch on the
front panel of the Cisco M170. You must wait five minutes for
the system to initialize each time you power up the system.
After the machine powers up, a solid green light indicates that
the appliance is operational.
10 Log In to the Appliance
You can log into the Cisco M170 using one of two interfaces:
the web-based interface or the command line interface.
Web-Based Interface
Step 1 For web browser access via the Ethernet port (see the
“Connect to the Appliance” section on page 9), go to the
Cisco M170 appliance management interface by
entering the following URL in a web browser:
http://192.168.42.42
1
0
1
0
Cisco C170
Email
Security
Appliance
303362
Wait five minutes.
M170_QSG.fm Page 10 Wednesday, March 13, 2013 10:01 PM

11
Step 2 Enter the following login information:
• Username: admin
• Password: ironport
Note The hostname parameter is assigned during system
setup. Before you can connect to the management
interface using a hostname (http://hostname:8080), you
must add the appliance hostname and IP address to
your DNS server database.
Step 3 Click Login.
Command-Line Interface
Step 1 For command-line interface access via the serial port
(see the “Connect to the Appliance” section on page 9),
access the command-line interface terminal emulator
using 9600 bits, 8 bits, no parity, 1 stop bit (9600, 8,
N, 1) and flow control set to Hardware.
Step 2 Initiate a session to the IP address 192.168.42.42.
Step 3 Log in as admin with the password ironport.
Step 4 At the prompt, run the systemsetup command.
303360
M170_QSG.fm Page 11 Wednesday, March 13, 2013 10:01 PM

12
11 Run the System Setup Wizard
The System Setup Wizard starts automatically when you access
the appliance using the web-based interface (or when you run
the systemsetup command from the command-line interface)
and displays the end user license agreement (also known as the
EULA).
Step 1 Start the System Setup Wizard.
Step 2 Accept the end user license agreement.
Step 3 Enter registration information.
Step 4 Enter information from the “Document Network
Settings” section on page 4.
Step 5 Set web security settings.
Step 6 Review the configuration summary page.
Step 7 Log back in to the appliance with the username admin
and the new password that you set in the System Setup
Wizard.
The Cisco M170 Content Security Management
Appliance uses a self-signed certificate that may trigger
a warning from your web browser. You can simply
accept the certificate and ignore this warning.
Step 8 Write down your new administrator password and
keep it in a safe place.
M170_QSG.fm Page 12 Wednesday, March 13, 2013 10:01 PM

13
12 Configure Network Settings
Depending on your network configuration, your firewall may
need to be configured to allow access using the following ports.
SMTP and DNS services must have access to the Internet.
• DNS: port 53
• SMTP: port 6025 and 25
For other system functions, the following services may be
required:
• FTP: port 21, data port TCP 1024 and higher
• HTTP: port 80 or 82
• HTTPS: port 83 or 443
• LDAP: port 389 or 3268
• LDAP over SSL: port 636
• LDAP with SSL for global catalog queries: port 3269
• NTP: port 123
• Quarantine Authentication: 110 (POP) and/or 143 (IMAP)
• SSH: port 22
• Telnet: port 23
Note If you do not open port 443, you cannot download
feature keys.
For more information, see the appendix, “Firewall
Information” in the Cisco AsyncOS for Content Security
Management User Guide for more information.
Warning You must shut down your appliance from the
System Administration > Shutdown/Reboot page to
prevent corruption of your queue and configuration
files.
M170_QSG.fm Page 13 Wednesday, March 13, 2013 10:01 PM

14
13 Configuration Summary
Review the following details of your configuration.
Item Description
Management You can manage your Content Security
Management appliance from the
management port (P1) by entering
http://192.168.42.42, or the hostname
assigned to your appliance when you
have completed the System Setup
Wizard.
If you reset your configuration to
factory default settings (for example, by
re-running the System Setup Wizard),
you can only access the management
interface from the P1 port
(http://192.168.42.42), so ensure you
have a connection to the P1 port.
Also, verify that you open firewall ports
80 or 82 for HTTP, and 83 and 443 for
HTTPS on your management interface.
Computer Address Remember to change your computer IP
address back to the original settings that
you noted in the “Document Network
Settings” section on page 4.
You can review a summary of your
system settings from the Management
Appliance > Centralized Services >
Security Appliances page.
M170_QSG.fm Page 14 Wednesday, March 13, 2013 10:01 PM

15
14 You’re Done!
Congratulations, you are now ready to start using your
Cisco M170 Content Security Management Appliance. You may
wish to consider taking some of the following steps to get more
out of the appliance:
Adding Security Appliances
You can add the Cisco Email Security appliances and Cisco Web
Security appliances that you want to manage. To add Cisco
Security appliances to the Cisco M170, choose Management
Appliance > Centralized Services > Security Appliances.
Enabling Centralized Email and Web Reporting
The Cisco M170 Content Security Management Appliance
supports both email reporting and web reporting as well as web
tracking, which allows a centralized view of email and web
traffic across multiple Email and Web Security appliances.
To enable centralized email reporting, choose Management
Appliance > Centralized Services > Email > Centralized
Reporting.
To enable centralized web reporting, choose Management
Appliance > Centralized Services > Web > Centralized
Reporting.
Once you have enabled centralized reporting, you can view
statistics and information for web and email reporting from the
Management Appliance > Centralized Services > Email >
Centralized Reporting or Management Appliance > Centralized
Services > Web > Centralized Reporting Overview page.
Message Tracking
You can view details about message delivery and blocking by
running queries using the Message Tracking service (in the
GUI).
To access message tracking for the Email Security Appliance,
choose Monitor > Message Tracking.
M170_QSG.fm Page 15 Wednesday, March 13, 2013 10:01 PM

16
Scheduled Email and Web Reporting
The Cisco M170 Content Security Management Appliance
allows you to generate scheduled reports from the data coming
from your Email or Web Security appliance. Reports can be
scheduled to run on a daily, weekly, or monthly basis, and can
be configured to include data for the previous day, previous
seven days, or previous month.
More Information
There are other features that you may want to configure for
your Cisco M170 appliance. For more information about other
available features, see the Content Security Management
appliance documentation.
M170_QSG.fm Page 16 Wednesday, March 13, 2013 10:01 PM

17
15 Frequently Asked Questions
Q. How do I delete older Configuration Masters on my
Cisco M170 Content Security Management Appliance?
A. Go to the Web > Utilities > Security Services Display page,
and click Edit Settings. At the top of each Configuration
Master you can uncheck the corresponding Configuration
Master checkbox. Click Submit and that Configuration
Master no longer shows up as a Configuration tab on the
GUI.
Q. How do I add an appliance to my Cisco M170 Content
Security Management Appliance?
A. After you have enabled monitoring services on the
Cisco M170 appliance, you can add connection
information for the appliances that it manages. You can
connect any Cisco Email Security appliance using AsyncOS
6.0 or later, and any Cisco Web Security appliance running
AsyncOS 5.7, 6.3, or 7.1 or later.
a. On the Cisco M170 Content Security Management
Appliance, choose Management Appliance >
Centralized Services > Security Appliances.
b. Click Add Email Appliance to display the Add Email
Security Appliance page or click Add Web Appliance to
display the Add Web Security Appliance page.
c. In the Appliance Name and IP Address text fields, type
the appliance name and the IP address for the
Management interface of the Cisco appliance.
d. Select the services that you want to use when managing
the Cisco appliance.
e. Click Establish Connection.
f. Click Test Connection to verify that the monitoring
services on the remote appliance have been correctly
configured and are compatible.
g. If you are adding a Web Security appliance, choose the
Configuration Master to which you want to assign the
appliance.
h. Click Submit to submit your changes on the page, then
click Commit Changes to commit your changes.
M170_QSG.fm Page 17 Wednesday, March 13, 2013 10:01 PM

18
Q. Do I need to forward access logs from the Web Security
appliance to the Content Security Management appliance?
A. No. This is handled internally by the Web Security
appliance once Centralized Reporting is enabled. To enable
Centralized Reporting, go to Management Appliance >
Centralized Services > Web > Centralized Reporting.
Q. How long is data available in the Web Reporting tool?
A. Data retention is dependent upon overall usage, that is, the
number of records present. However, at a minimum, each
appliance is sized to accommodate at least 45 days of
reporting.
Q. How do I hide user names on my Web reports?
a. On the Cisco M170 Content Security Management
Appliance, choose Management Appliance >
Centralized Services > Web > Centralized Reporting.
b. Click Edit Settings.
c. Check the Anonymize User Names in Reports check
box.
d. Click Submit.
Q. How often is reporting data updated?
A. The Cisco M170 Content Security Management Appliance
pulls data for all reports from all managed appliances
approximately every 15 minutes and aggregates the data
from these appliances. Depending on your appliance, it may
take awhile for a particular message to be included in the
reporting data on the Content Security Management
appliance. Check the System Status page for information on
your data.
M170_QSG.fm Page 18 Wednesday, March 13, 2013 10:01 PM

19
16 Where to Go From Here
Support
Cisco IronPort Support http://www.cisco.com/en/US/products/
ps11169/serv_group_home.html
U.S. Toll-Free Number 1-800-553-2447
1-408-526-7209
International Contacts http://www.cisco.com/en/US/support/
tsd_cisco_worldwide_contacts.html
Online Technical
Support and
Documentation
(login may be required)
www.cisco.com/support
Cisco Email Security
Support Community
Cisco Web Security
Support Community
(Includes Content
Security Management
Appliance Support)
https://supportforums.cisco.com/com
munity/netpro/security/email
https://supportforums.cisco.com/com
munity/netpro/security/web
Product Documentation
Cisco M170 Content
Security Management
Appliance Quick Start
Guide
(this document)
http://www.cisco.com/en/US/docs/secu
rity/security_management/sma/hw/qui
ck_start/M170_QSG.pdf
Cisco 170 Series
Hardware Installation
Guide
Includes information
about LEDs, technical
specifications, and
rack-mounting
options.
http://www.cisco.com/en/US/docs/secu
rity/esa/hw/170Series_HW_Install.pdf
M170_QSG.fm Page 19 Wednesday, March 13, 2013 10:01 PM

20
Obtaining Documentation and
Submitting a Service Request
For information on obtaining documentation, submitting a
service request, and gathering additional information, see
What’s New in Cisco Product Documentation at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.
html.
Subscribe to What’s New in Cisco Product Documentation, which
lists all new and revised Cisco technical documentation, as an RSS
feed and deliver content directly to your desktop using a reader
application. The RSS feeds are a free service.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other
countries. To view a list of Cisco trademarks, go to this URL: www.cisco.com/go/trademarks. Third-party trademarks
mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
Cisco Content Security
Management
Appliance
Documentation
Includes
documentation about
configuring the
appliance features, CLI
commands, and release
notes.
http://www.cisco.com/en/US/products/
ps10155/tsd_products_support_series
_home.html
Safety and Compliance
Guide
http://www.cisco.com/en/US/docs/secu
rity/esa/hw/SafetyAndCompliance
Guide.pdf
MIBs
AsyncOS MIBs for
Cisco Content Security
Management
Appliance
(Related Tools section)
http://www.cisco.com/en/US/products/
ps10155/tsd_products_support_series
_home.html
M170_QSG.fm Page 20 Wednesday, March 13, 2013 10:01 PM