Cisco ISA550 Instruction Manual

Cisco Small Business
ISA500 Series Integrated Security Appliances
(ISA550, ISA550W, ISA570, ISA570W)
ADMINISTRATION
GUIDE

© 2012 Cisco Systems, Inc. All rights reserved. 78-20776-01
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks,
go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner
does not imply a partnership relationship between Cisco and any other company. (1110R)

Federal Communication Commission Interference Statement
(For ISA570 and ISA570W)
This equipment has been tested and found to comply with the limits for a Class A digital
device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide
reasonable protection against harmful interference when the equipment is operated in a
commercial environment. This equipment generates, uses, and can radiate radio frequency
energy and, if not installed and used in accordance with the instruction manual, may cause
harmful interference to radio communications. Operation of this equipment in a residential
area is likely to cause harmful interference in which case the user will be required to correct
the interference at his own expense.
(For ISA550 and ISA550W)
This equipment has been tested and found to comply with the limits for a Class B digital
device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide
reasonable protection against harmful interference in a residential installation. This
equipment generates, uses and can radiate radio frequency energy and, if not installed and
used in accordance with the instructions, may cause harmful interference to radio
communications. However, there is no guarantee that interference will not occur in a
particular installation. If this equipment does cause harmful interference to radio or television
reception, which can be determined by turning the equipment off and on, the user is
encouraged to try to correct the interference by one of the following measures:
•Reorient or relocate the receiving antenna.
•Increase the separation between the equipment and receiver.
•Connect the equipment into an outlet on a circuit different from that to which the
receiver is connected.
•Consult the dealer or an experienced radio/TV technician for help.
FCC Caution: Any changes or modifications not expressly approved by the party responsible
for compliance could void the user's authority to operate this equipment.
This device complies with Part 15 of the FCC Rules. Operation is subject to the following two
conditions: (1) This device may not cause harmful interference, and (2) this device must
accept any interference received, including interference that may cause undesired operation.
IMPORTANT NOTE:
FCC Radiation Exposure Statement: (For ISA550W and ISA570W)
This equipment complies with FCC radiation exposure limits set forth for an uncontrolled
environment. This equipment should be installed and operated with minimum distance 20cm
between the radiator & your body.
This transmitter must not be co-located or operating in conjunction with any other antenna or
transmitter.

The availability of some specific channels and/or operational frequency bands are country
dependent and are firmware programmed at the factory to match the intended destination.
The firmware setting is not accessible by the end user.
Industry Canada statement:
This device complies with RSS-210 of the Industry Canada Rules. Operation is subject to the
following two conditions: (1) This device may not cause harmful interference, and (2) this
device must accept any interference received, including interference that may cause
undesired operation.
Ce dispositif est conforme à la norme CNR-210 d'Industrie Canada applicable aux appareils
radio exempts de licence. Son fonctionnement est sujet aux deux conditions suivantes: (1) le
dispositif ne doit pas produire de brouillage préjudiciable, et (2) ce dispositif doit accepter
tout brouillage reçu, y compris un brouillage susceptible de provoquer un fonctionnement
indésirable.
IMPORTANT NOTE:
Canada Radiation Exposure Statement: (For ISA550W and ISA570W)
This equipment complies with Canada radiation exposure limits set forth for an uncontrolled
environment. This equipment should be installed and operated with minimum distance 20 cm
between the radiator and your body.
NOTE IMPORTANTE: (Pour l'utilisation de dispositifs mobiles)
Déclaration d'exposition aux radiations:
Cet équipement est conforme aux limites d'exposition aux rayonnements IC établies pour un
environnement non contrôlé. Cet équipement doit être installé et utilisé avec un minimum de
20 cm de distance entre la source de rayonnement et votre corps.
This device has been designed to operate with an antenna having a maximum gain of 1.8 dBi.
Antenna having a higher gain is strictly prohibited per regulations of Industry Canada. The
required antenna impedance is 50 ohms.
Under Industry Canada regulations, this radio transmitter may only operate using an antenna
of a type and maximum (or lesser) gain approved for the transmitter by Industry Canada. To
reduce potential radio interference to other users, the antenna type and its gain should be so
chosen that the equivalent isotropically radiated power (e.i.r.p.) is not more than that
necessary for successful communication.
(Le manuel d'utilisation de dispositifs émetteurs équipés d'antennes amovibles doit contenir
les informations suivantes dans un endroit bien en vue:)
Ce dispositif a été conçu pour fonctionner avec une antenne ayant un gain maximal de 1.8
dBi. Une antenne à gain plus élevé est strictement interdite par les règlements d'Industrie
Canada. L'impédance d'antenne requise est de 50 ohms.

Conformément à la réglementation d'Industrie Canada, le présent émetteur radio
peutfonctionner avec une antenne d'un type et d'un gain maximal (ou inférieur) approuvé
pourl'émetteur par Industrie Canada. Dans le but de réduire les risques de brouillage
radioélectriqueà l'intention des autres utilisateurs, il faut choisir le type d'antenne et son gain
de sorte que lapuissance isotrope rayonnée équivalente (p.i.r.e.) ne dépasse pas l'intensité
nécessaire àl'établissement d'une communication satisfaisante.
UL/CB
Rack Mount Instructions - The following or similar rack-mount instructions are included with
the installation instructions:
A) Elevated Operating Ambient - If installed in a closed or multi-unit rack assembly, the
operating ambient temperature of the rack environment may be greater than room ambient.
Therefore, consideration should be given to installing the equipment in an environment
compatible with the maximum ambient temperature (Tma) 40 degree C specified by the
manufacturer.
B) Reduced Air Flow - Installation of the equipment in a rack should be such that the amount
of air flow required for safe operation of the equipment is not compromised.
C) Mechanical Loading - Mounting of the equipment in the rack should be such that a
hazardous condition is not achieved due to uneven mechanical loading.
D) Circuit Overloading - Consideration should be given to the connection of the equipment to
the supply circuit and the effect that overloading of the circuits might have on overcurrent
protection and supply wiring. Appropriate consideration of equipment nameplate ratings
should be used when addressing this concern.

Cisco ISA500 Series Integrated Security Appliances Administration Guide 6
Contents
Chapter 1: Getting Started 19
Introduction 20
Product Overview 21
Front Panel 21
Back Panel 23
Getting Started with the Configuration Utility 25
Logging in to the Configuration Utility 26
Navigating Through the Configuration Utility 27
Using the Help System 28
Configuration Utility Icons 28
Factory Default Settings 30
Default Settings of Key Features 30
Restoring the Factory Default Settings 31
Performing Basic Configuration Tasks 32
Changing the Default Administrator Password 32
Upgrading your Firmware After your First Login 33
Backing Up Your Configuration 34
Chapter 2: Configuration Wizards 35
Using the Setup Wizard for the Initial Configuration 36
Starting the Setup Wizard 37
Configuring Cisco.com Account Credentials 37
Enabling Firmware Upgrade 38
Validating Security License 39
Enabling Bonjour and CDP Discovery Protocols 39
Configuring Remote Administration 40
Configuring Physical Ports 41
Configuring the Primary WAN 42
Configuring the Secondary WAN 42
Configuring WAN Redundancy 42
Configuring Default LAN Settings 43
Configuring DMZ 44

Cisco ISA500 Series Integrated Security Appliances Administration Guide 7
Contents
Configuring DMZ Services 45
Configuring Wireless Radio Settings 47
Configuring Intranet WLAN Access 48
Configure Security Services 49
Viewing Configuration Summary 50
Using the Dual WAN Wizard to Configure WAN Redundancy Settings 51
Starting the Dual WAN Wizard 51
Configuring a Configurable Port as a Secondary WAN Port 51
Configuring the Primary WAN 52
Configuring the Secondary WAN 52
Configuring WAN Redundancy 52
Configuring Network Failure Detection 53
Viewing Configuration Summary 54
Using the Remote Access VPN Wizard 54
Using the Remote Access VPN Wizard for IPsec Remote Access 54
Starting the Remote Access VPN Wizard 55
Configuring IPsec Remote Access Group Policy 55
Configuring WAN Settings 56
Configuring Operation Mode 56
Configuring Access Control Settings 57
Configuring DNS and WINS Settings 57
Configuring Backup Servers 58
Configuring Split Tunneling 58
Viewing Group Policy Summary 58
Configuring IPsec Remote Access User Groups 59
Viewing IPsec Remote Access Summary 59
Using Remote Access VPN Wizard for SSL Remote Access 60
Starting the Remote Access VPN Wizard with SSL Remote Access 60
Configuring SSL VPN Gateway 60
Configuring SSL VPN Group Policy 62
Configuring SSL VPN User Groups 65
Viewing SSL VPN Summary 66
Using the Site-to-Site VPN Wizard to Configure Site-to-Site VPN 66
Starting the Site-to-Site VPN Wizard 67
Configuring VPN Peer Settings 67
Configuring IKE Policies 68

Cisco ISA500 Series Integrated Security Appliances Administration Guide 8
Contents
Configuring Transform Policies 69
Configuring Local and Remote Networks 70
Viewing Configuration Summary 70
Using the DMZ Wizard to Configure DMZ Settings 71
Starting the DMZ Wizard 71
Configuring DDNS Profiles 71
Configuring DMZ Network 72
Configuring DMZ Services 74
Viewing Configuration Summary 76
Using the Wireless Wizard (for ISA550W and ISA570W only) 76
Starting the Wireless Wizard 76
Configuring Wireless Radio Settings 76
Configuring Wireless Connectivity Types 77
Specify Wireless Connectivity Settings for All Enabled SSIDs 77
Viewing Configuration Summary 78
Configuring the SSID for Intranet WLAN Access 78
Configuring the SSID for Guest WLAN Access 79
Configuring the SSID for Captive Portal Access 80
Chapter 3: Status 83
Device Status Dashboard 83
Network Status 87
Status Summary 87
Traffic Statistics 90
Usage Reports 91
WAN Bandwidth Reports 93
ARP Table 94
DHCP Bindings 94
STP Status 95
CDP Neighbor 97
Wireless Status (for ISA550W and ISA570W only) 98
Wireless Status 98

Cisco ISA500 Series Integrated Security Appliances Administration Guide 9
Contents
Client Status 99
NAT Status 99
VPN Status 100
IPsec VPN Status 100
SSL VPN Status 102
Active User Sessions 104
Security Services Reports 105
Web Security Report 105
Anti-Virus Report 106
Email Security Report 107
Network Reputation Report 108
IPS Report 109
Application Control Report 110
System Status 111
Processes 111
Resource Utilization 112
Chapter 4: Networking 114
Viewing Network Status 115
Configuring IPv4 or IPv6 Routing 115
Managing Ports 115
Viewing Status of Physical Interfaces 116
Configuring Physical Ports 117
Configuring Port Mirroring 118
Configuring Port-Based (802.1x) Access Control 119
Configuring the WAN 121
Configuring WAN Settings for Your Internet Connection 121
Configuring WAN Redundancy 129
Dual WAN Settings 129
Configuring Link Failover Detection 131
Load Balancing with Policy-Based Routing Configuration Example 132
Configuring Dynamic DNS 133
Measuring and Limiting Traffic with the Traffic Meter 134

Cisco ISA500 Series Integrated Security Appliances Administration Guide 10
Contents
Configuring a VLAN 136
Configuring DMZ 140
Configuring Zones 145
Security Levels for Zones 145
Predefined Zones 146
Configuring Zones 146
Configuring DHCP Reserved IPs 148
Configuring Routing 148
Viewing the Routing Table 149
Configuring Routing Mode 149
Configuring Static Routing 150
Configuring Dynamic Routing - RIP 151
Configuring Policy-Based Routing 152
Configuring Quality of Service 154
General QoS Settings 154
Configuring WAN QoS 155
Managing WAN Bandwidth for Upstream Traffic 155
Configuring WAN Queue Settings 156
Configuring Traffic Selectors 157
Configuring WAN QoS Policy Profiles 159
Configuring WAN QoS Class Rules 159
Mapping WAN QoS Policy Profiles to WAN Interfaces 160
WAN QoS Configuration Example 161
Configure WAN QoS for Voice Traffic from LAN to WAN 163
Configuring WAN QoS for Voice Traffic from WAN to LAN 164
Configuring LAN QoS 165
Configuring LAN Queue Settings 166
Configuring LAN QoS Classification Methods 166
Mapping CoS to LAN Queue 167
Mapping DSCP to LAN Queue 167
Configuring Default CoS 168
Configuring Wireless QoS 168
Default Wireless QoS Settings 168
Configuring Wireless QoS Classification Methods 169
Mapping CoS to Wireless Queue 170
Mapping DSCP to Wireless Queue 170