Cisco ISA550 Instruction Manual

Cisco Small Business
ISA500 Series Integrated Security Appliances
(ISA550, ISA550W, ISA570, ISA570W)
ADMINISTRATION
GUIDE

© 2012 Cisco Systems, Inc. All rights reserved. 78-20776-01
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks,
go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner
does not imply a partnership relationship between Cisco and any other company. (1110R)

Federal Communication Commission Interference Statement
(For ISA570 and ISA570W)
This equipment has been tested and found to comply with the limits for a Class A digital
device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide
reasonable protection against harmful interference when the equipment is operated in a
commercial environment. This equipment generates, uses, and can radiate radio frequency
energy and, if not installed and used in accordance with the instruction manual, may cause
harmful interference to radio communications. Operation of this equipment in a residential
area is likely to cause harmful interference in which case the user will be required to correct
the interference at his own expense.
(For ISA550 and ISA550W)
This equipment has been tested and found to comply with the limits for a Class B digital
device, pursuant to Part 15 of the FCC Rules. These limits are designed to provide
reasonable protection against harmful interference in a residential installation. This
equipment generates, uses and can radiate radio frequency energy and, if not installed and
used in accordance with the instructions, may cause harmful interference to radio
communications. However, there is no guarantee that interference will not occur in a
particular installation. If this equipment does cause harmful interference to radio or television
reception, which can be determined by turning the equipment off and on, the user is
encouraged to try to correct the interference by one of the following measures:
•Reorient or relocate the receiving antenna.
•Increase the separation between the equipment and receiver.
•Connect the equipment into an outlet on a circuit different from that to which the
receiver is connected.
•Consult the dealer or an experienced radio/TV technician for help.
FCC Caution: Any changes or modifications not expressly approved by the party responsible
for compliance could void the user's authority to operate this equipment.
This device complies with Part 15 of the FCC Rules. Operation is subject to the following two
conditions: (1) This device may not cause harmful interference, and (2) this device must
accept any interference received, including interference that may cause undesired operation.
IMPORTANT NOTE:
FCC Radiation Exposure Statement: (For ISA550W and ISA570W)
This equipment complies with FCC radiation exposure limits set forth for an uncontrolled
environment. This equipment should be installed and operated with minimum distance 20cm
between the radiator & your body.
This transmitter must not be co-located or operating in conjunction with any other antenna or
transmitter.

The availability of some specific channels and/or operational frequency bands are country
dependent and are firmware programmed at the factory to match the intended destination.
The firmware setting is not accessible by the end user.
Industry Canada statement:
This device complies with RSS-210 of the Industry Canada Rules. Operation is subject to the
following two conditions: (1) This device may not cause harmful interference, and (2) this
device must accept any interference received, including interference that may cause
undesired operation.
Ce dispositif est conforme à la norme CNR-210 d'Industrie Canada applicable aux appareils
radio exempts de licence. Son fonctionnement est sujet aux deux conditions suivantes: (1) le
dispositif ne doit pas produire de brouillage préjudiciable, et (2) ce dispositif doit accepter
tout brouillage reçu, y compris un brouillage susceptible de provoquer un fonctionnement
indésirable.
IMPORTANT NOTE:
Canada Radiation Exposure Statement: (For ISA550W and ISA570W)
This equipment complies with Canada radiation exposure limits set forth for an uncontrolled
environment. This equipment should be installed and operated with minimum distance 20 cm
between the radiator and your body.
NOTE IMPORTANTE: (Pour l'utilisation de dispositifs mobiles)
Déclaration d'exposition aux radiations:
Cet équipement est conforme aux limites d'exposition aux rayonnements IC établies pour un
environnement non contrôlé. Cet équipement doit être installé et utilisé avec un minimum de
20 cm de distance entre la source de rayonnement et votre corps.
This device has been designed to operate with an antenna having a maximum gain of 1.8 dBi.
Antenna having a higher gain is strictly prohibited per regulations of Industry Canada. The
required antenna impedance is 50 ohms.
Under Industry Canada regulations, this radio transmitter may only operate using an antenna
of a type and maximum (or lesser) gain approved for the transmitter by Industry Canada. To
reduce potential radio interference to other users, the antenna type and its gain should be so
chosen that the equivalent isotropically radiated power (e.i.r.p.) is not more than that
necessary for successful communication.
(Le manuel d'utilisation de dispositifs émetteurs équipés d'antennes amovibles doit contenir
les informations suivantes dans un endroit bien en vue:)
Ce dispositif a été conçu pour fonctionner avec une antenne ayant un gain maximal de 1.8
dBi. Une antenne à gain plus élevé est strictement interdite par les règlements d'Industrie
Canada. L'impédance d'antenne requise est de 50 ohms.

Conformément à la réglementation d'Industrie Canada, le présent émetteur radio
peutfonctionner avec une antenne d'un type et d'un gain maximal (ou inférieur) approuvé
pourl'émetteur par Industrie Canada. Dans le but de réduire les risques de brouillage
radioélectriqueà l'intention des autres utilisateurs, il faut choisir le type d'antenne et son gain
de sorte que lapuissance isotrope rayonnée équivalente (p.i.r.e.) ne dépasse pas l'intensité
nécessaire àl'établissement d'une communication satisfaisante.
UL/CB
Rack Mount Instructions - The following or similar rack-mount instructions are included with
the installation instructions:
A) Elevated Operating Ambient - If installed in a closed or multi-unit rack assembly, the
operating ambient temperature of the rack environment may be greater than room ambient.
Therefore, consideration should be given to installing the equipment in an environment
compatible with the maximum ambient temperature (Tma) 40 degree C specified by the
manufacturer.
B) Reduced Air Flow - Installation of the equipment in a rack should be such that the amount
of air flow required for safe operation of the equipment is not compromised.
C) Mechanical Loading - Mounting of the equipment in the rack should be such that a
hazardous condition is not achieved due to uneven mechanical loading.
D) Circuit Overloading - Consideration should be given to the connection of the equipment to
the supply circuit and the effect that overloading of the circuits might have on overcurrent
protection and supply wiring. Appropriate consideration of equipment nameplate ratings
should be used when addressing this concern.

Cisco ISA500 Series Integrated Security Appliances Administration Guide 6
Contents
Chapter 1: Getting Started 19
Introduction 20
Product Overview 21
Front Panel 21
Back Panel 23
Getting Started with the Configuration Utility 25
Logging in to the Configuration Utility 26
Navigating Through the Configuration Utility 27
Using the Help System 28
Configuration Utility Icons 28
Factory Default Settings 30
Default Settings of Key Features 30
Restoring the Factory Default Settings 31
Performing Basic Configuration Tasks 32
Changing the Default Administrator Password 32
Upgrading your Firmware After your First Login 33
Backing Up Your Configuration 34
Chapter 2: Configuration Wizards 35
Using the Setup Wizard for the Initial Configuration 36
Starting the Setup Wizard 37
Configuring Cisco.com Account Credentials 37
Enabling Firmware Upgrade 38
Validating Security License 39
Enabling Bonjour and CDP Discovery Protocols 39
Configuring Remote Administration 40
Configuring Physical Ports 41
Configuring the Primary WAN 42
Configuring the Secondary WAN 42
Configuring WAN Redundancy 42
Configuring Default LAN Settings 43
Configuring DMZ 44

Cisco ISA500 Series Integrated Security Appliances Administration Guide 7
Contents
Configuring DMZ Services 45
Configuring Wireless Radio Settings 47
Configuring Intranet WLAN Access 48
Configure Security Services 49
Viewing Configuration Summary 50
Using the Dual WAN Wizard to Configure WAN Redundancy Settings 51
Starting the Dual WAN Wizard 51
Configuring a Configurable Port as a Secondary WAN Port 51
Configuring the Primary WAN 52
Configuring the Secondary WAN 52
Configuring WAN Redundancy 52
Configuring Network Failure Detection 53
Viewing Configuration Summary 54
Using the Remote Access VPN Wizard 54
Using the Remote Access VPN Wizard for IPsec Remote Access 54
Starting the Remote Access VPN Wizard 55
Configuring IPsec Remote Access Group Policy 55
Configuring WAN Settings 56
Configuring Operation Mode 56
Configuring Access Control Settings 57
Configuring DNS and WINS Settings 57
Configuring Backup Servers 58
Configuring Split Tunneling 58
Viewing Group Policy Summary 58
Configuring IPsec Remote Access User Groups 59
Viewing IPsec Remote Access Summary 59
Using Remote Access VPN Wizard for SSL Remote Access 60
Starting the Remote Access VPN Wizard with SSL Remote Access 60
Configuring SSL VPN Gateway 60
Configuring SSL VPN Group Policy 62
Configuring SSL VPN User Groups 65
Viewing SSL VPN Summary 66
Using the Site-to-Site VPN Wizard to Configure Site-to-Site VPN 66
Starting the Site-to-Site VPN Wizard 67
Configuring VPN Peer Settings 67
Configuring IKE Policies 68

Cisco ISA500 Series Integrated Security Appliances Administration Guide 8
Contents
Configuring Transform Policies 69
Configuring Local and Remote Networks 70
Viewing Configuration Summary 70
Using the DMZ Wizard to Configure DMZ Settings 71
Starting the DMZ Wizard 71
Configuring DDNS Profiles 71
Configuring DMZ Network 72
Configuring DMZ Services 74
Viewing Configuration Summary 76
Using the Wireless Wizard (for ISA550W and ISA570W only) 76
Starting the Wireless Wizard 76
Configuring Wireless Radio Settings 76
Configuring Wireless Connectivity Types 77
Specify Wireless Connectivity Settings for All Enabled SSIDs 77
Viewing Configuration Summary 78
Configuring the SSID for Intranet WLAN Access 78
Configuring the SSID for Guest WLAN Access 79
Configuring the SSID for Captive Portal Access 80
Chapter 3: Status 83
Device Status Dashboard 83
Network Status 87
Status Summary 87
Traffic Statistics 90
Usage Reports 91
WAN Bandwidth Reports 93
ARP Table 94
DHCP Bindings 94
STP Status 95
CDP Neighbor 97
Wireless Status (for ISA550W and ISA570W only) 98
Wireless Status 98

Cisco ISA500 Series Integrated Security Appliances Administration Guide 9
Contents
Client Status 99
NAT Status 99
VPN Status 100
IPsec VPN Status 100
SSL VPN Status 102
Active User Sessions 104
Security Services Reports 105
Web Security Report 105
Anti-Virus Report 106
Email Security Report 107
Network Reputation Report 108
IPS Report 109
Application Control Report 110
System Status 111
Processes 111
Resource Utilization 112
Chapter 4: Networking 114
Viewing Network Status 115
Configuring IPv4 or IPv6 Routing 115
Managing Ports 115
Viewing Status of Physical Interfaces 116
Configuring Physical Ports 117
Configuring Port Mirroring 118
Configuring Port-Based (802.1x) Access Control 119
Configuring the WAN 121
Configuring WAN Settings for Your Internet Connection 121
Configuring WAN Redundancy 129
Dual WAN Settings 129
Configuring Link Failover Detection 131
Load Balancing with Policy-Based Routing Configuration Example 132
Configuring Dynamic DNS 133
Measuring and Limiting Traffic with the Traffic Meter 134

Cisco ISA500 Series Integrated Security Appliances Administration Guide 10
Contents
Configuring a VLAN 136
Configuring DMZ 140
Configuring Zones 145
Security Levels for Zones 145
Predefined Zones 146
Configuring Zones 146
Configuring DHCP Reserved IPs 148
Configuring Routing 148
Viewing the Routing Table 149
Configuring Routing Mode 149
Configuring Static Routing 150
Configuring Dynamic Routing - RIP 151
Configuring Policy-Based Routing 152
Configuring Quality of Service 154
General QoS Settings 154
Configuring WAN QoS 155
Managing WAN Bandwidth for Upstream Traffic 155
Configuring WAN Queue Settings 156
Configuring Traffic Selectors 157
Configuring WAN QoS Policy Profiles 159
Configuring WAN QoS Class Rules 159
Mapping WAN QoS Policy Profiles to WAN Interfaces 160
WAN QoS Configuration Example 161
Configure WAN QoS for Voice Traffic from LAN to WAN 163
Configuring WAN QoS for Voice Traffic from WAN to LAN 164
Configuring LAN QoS 165
Configuring LAN Queue Settings 166
Configuring LAN QoS Classification Methods 166
Mapping CoS to LAN Queue 167
Mapping DSCP to LAN Queue 167
Configuring Default CoS 168
Configuring Wireless QoS 168
Default Wireless QoS Settings 168
Configuring Wireless QoS Classification Methods 169
Mapping CoS to Wireless Queue 170
Mapping DSCP to Wireless Queue 170

Cisco ISA500 Series Integrated Security Appliances Administration Guide 11
Contents
Configuring IGMP 170
Configuring VRRP 172
Address Management 173
Configuring Addresses 173
Configuring Address Groups 174
Service Management 175
Configuring Services 175
Configuring Service Groups 177
Configuring Captive Portal 177
Chapter 5: Wireless (for ISA550W and ISA570W only) 181
Viewing Wireless Status 182
Viewing Wireless Statistics 182
Viewing Wireless Client Status 183
Configuring the Basic Settings 183
Configuring SSID Profiles 185
Configuring Wireless Security 186
Controlling Wireless Access Based on MAC Addresses 192
Mapping the SSID to VLAN 193
Configuring SSID Schedule 193
Configuring Wi-Fi Protected Setup 194
Configuring Captive Portal 196
Configuring Wireless Rogue AP Detection 199
Advanced Radio Settings 201
Chapter 6: Firewall 203
Configuring Firewall Rules to Control Inbound and Outbound Traffic 204
About Security Zones 204
Default Firewall Settings 206
Priorities of Firewall Rules 207
Preliminary Tasks for Configuring Firewall Rules 207
General Firewall Settings 208

Cisco ISA500 Series Integrated Security Appliances Administration Guide 12
Contents
Configuring a Firewall Rule 209
Configuring a Firewall Rule to Allow Multicast Traffic 211
Configuring Firewall Logging Settings 212
Configuring NAT Rules to Securely Access a Remote Network 213
Viewing NAT Translation Status 214
Priorities of NAT Rules 215
Configuring Dynamic PAT Rules 216
Configuring Static NAT Rules 217
Configuring Port Forwarding Rules 218
Configuring Port Triggering Rules 220
Configuring Advanced NAT Rules 221
Configuring IP Alias for Advanced NAT rules 222
Configuring an Advanced NAT Rule to Support NAT Hairpinning 224
Firewall and NAT Rule Configuration Examples 226
Allowing Inbound Traffic Using the WAN IP Address 226
Allowing Inbound Traffic Using a Public IP Address 228
Allowing Inbound Traffic from Specified Range of Outside Hosts 231
Blocking Outbound Traffic by Schedule and IP Address Range 232
Blocking Outbound Traffic to an Offsite Mail Server 232
Configuring Content Filtering to Control Internet Access 233
Configuring Content Filtering Policy Profiles 233
Configuring Website Access Control List 234
Mapping Content Filtering Policy Profiles to Zones 235
Configuring Advanced Content Filtering Settings 236
Configuring MAC Address Filtering to Permit or Block Traffic 237
Configuring IP-MAC Binding to Prevent Spoofing 238
Configuring Attack Protection 239
Configuring Session Limits 240
Configuring Application Level Gateway 241
Chapter 7: Security Services 243
About Security Services 244

Cisco ISA500 Series Integrated Security Appliances Administration Guide 13
Contents
Activating Security Services 245
Priority of Security Services 245
Security Services Dashboard 246
Viewing Security Services Reports 247
Viewing Web Security Report 248
Viewing Anti-Virus Report 249
Viewing Email Security Report 250
Viewing Network Reputation Report 251
Viewing IPS Report 252
Viewing Application Control Report 253
Configuring Anti-Virus 254
General Anti-Virus Settings 255
Configuring Advanced Anti-Virus Settings 258
Configuring HTTP Notification 259
Configuring Email Notification 259
Updating Anti-Virus Signatures 260
Configuring Application Control 261
Configuring Application Control Policies 262
General Application Control Policy Settings 262
Adding an Application Control Policy 263
Permitting or Blocking Traffic for all Applications in a Category 264
Permitting or Blocking Traffic for an Application 265
General Application Control Settings 266
Enabling Application Control Service 267
Mapping Application Control Policies to Zones 267
Configuring Application Control Policy Mapping Rules 268
Updating Application Signature Database 269
Advanced Application Control Settings 270
Configuring Spam Filter 271
Configuring Intrusion Prevention 273
Configuring Signature Actions 275
Updating IPS Signature Database 276
Configuring Web Reputation Filtering 277
Configuring Web URL Filtering 279

Cisco ISA500 Series Integrated Security Appliances Administration Guide 14
Contents
Configuring Web URL Filtering Policy Profiles 280
Configuring Website Access Control List 280
Mapping Web URL Filtering Policy Profiles to Zones 282
Configuring Advanced Web URL Filtering Settings 282
Network Reputation 283
Chapter 8: VPN 284
About VPNs 285
Viewing VPN Status 286
Viewing IPsec VPN Status 286
Viewing SSL VPN Status 288
Configuring a Site-to-Site VPN 290
Configuration Tasks to Establish a Site-to-Site VPN Tunnel 291
General Site-to-Site VPN Settings 292
Configuring IPsec VPN Policies 293
Configuring IKE Policies 299
Configuring Transform Sets 301
Remote Teleworker Configuration Examples 302
Configuring IPsec Remote Access 305
Cisco VPN Client Compatibility 306
Enabling IPsec Remote Access 307
Configuring IPsec Remote Access Group Policies 307
Allowing IPsec Remote VPN Clients to Access the Internet 310
Configuring Teleworker VPN Client 313
Required IPsec VPN Servers 314
Benefits of the Teleworker VPN Client Feature 315
Modes of Operation 315
Client Mode 316
Network Extension Mode 317
General Teleworker VPN Client Settings 318
Configuring Teleworker VPN Client Group Policies 319
Configuring SSL VPN 322
Elements of the SSL VPN 323

Cisco ISA500 Series Integrated Security Appliances Administration Guide 15
Contents
Configuration Tasks to Establish a SSL VPN Tunnel 324
Installing Cisco AnyConnect Secure Mobility Client 325
Importing Certificates for User Authentication 326
Configuring SSL VPN Users 326
Configuring SSL VPN Gateway 326
Configuring SSL VPN Group Policies 329
Accessing SSL VPN Portal 332
Allowing SSL VPN Clients to Access the Internet 332
Configuring L2TP Server 334
Configuring VPN Passthrough 336
Chapter 9: User Management 338
Viewing Active User Sessions 338
Configuring Users and User Groups 339
Default User and User Group 339
Available Services for User Groups 339
Preempt Administrators 340
Configuring Local Users 340
Configuring Local User Groups 341
Configuring User Authentication Settings 343
Using Local Database for User Authentication 344
Using RADIUS Server for User Authentication 344
Using Local Database and RADIUS Server for User Authentication 347
Using LDAP for User Authentication 348
Using Local Database and LDAP for Authentication 350
Configuring RADIUS Servers 351
Chapter 10: Device Management 353
Viewing System Status 354
Viewing Process Status 354
Viewing Resource Utilization 354
Administration 355

Cisco ISA500 Series Integrated Security Appliances Administration Guide 16
Contents
Configuring Administrator Settings 356
Configuring Remote Administration 357
Configuring Email Alert Settings 358
Configuring SNMP 365
Backing Up and Restoring a Configuration 366
Managing Certificates for Authentication 368
Viewing Certificate Status and Details 369
Exporting Certificates to Your Local PC 370
Exporting Certificates to a USB Device 371
Importing Certificates from Your Local PC 371
Importing Certificates from a USB Device 372
Generating New Certificate Signing Requests 372
Importing Signed Certificate for CSR from Your Local PC 373
Configuring Cisco Services and Support Settings 374
Configuring Cisco.com Account 374
Configuring Cisco OnPlus 375
Configuring Remote Support Settings 376
Sending Contents for System Diagnosis 376
Configuring System Time 377
Configuring Device Properties 378
Diagnostic Utilities 378
Ping 379
Traceroute 379
DNS Lookup 380
Packet Capture 380
Device Discovery Protocols 380
UPnP Discovery 381
Bonjour Discovery 382
CDP Discovery 382
LLDP Discovery 383
Firmware Management 384
Viewing Firmware Information 385

Cisco ISA500 Series Integrated Security Appliances Administration Guide 17
Contents
Using the Secondary Firmware 385
Upgrading your Firmware from Cisco.com 386
Upgrading Firmware from a PC or a USB Device 387
Firmware Auto Fall Back Mechanism 388
Using Rescue Mode to Recover the System 388
Managing Security License 389
Checking Security License Status 390
Installing or Renewing Security License 391
Log Management 392
Viewing Logs 392
Configuring Log Settings 394
Configuring Log Facilities 397
Rebooting and Resetting the Device 398
Restoring the Factory Default Settings 398
Rebooting the Security Appliance 399
Configuring Schedules 399
Appendix A: Troubleshooting 401
Internet Connection 401
Date and Time 404
Pinging to Test LAN Connectivity 405
Testing the LAN Path from Your PC to Your Security Appliance 405
Testing the LAN Path from Your PC to a Remote Device 406
Appendix B: Technical Specifications and Environmental Requirements 407
Appendix C: Factory Default Settings 409
Device Management 409
User Management 411
Networking 412
Wireless 416
VPN 417
Security Services 419

Cisco ISA500 Series Integrated Security Appliances Administration Guide 18
Contents
Firewall 419
Reports 421
Default Service Objects 422
Default Address Objects 426
Appendix D: Where to Go From Here 427

1
Cisco ISA500 Series Integrated Security Appliances Administration Guide 19
Getting Started
This chapter provides an overview of the Cisco ISA500 Series Integrated Security
Appliance and describes basic configuration tasks to help you configure your
security appliance. It includes the following sections:
•Introduction, page 20
•Product Overview, page 21
•Getting Started with the Configuration Utility, page 25
•Factory Default Settings, page 30
•Performing Basic Configuration Tasks, page 32
NOTE For information about how to physically install your security appliance, see the
Cisco ISA500 Series Integrated Security Appliances Quick Start Guide at:
www.cisco.com/go/isa500resources.

Getting Started
Introduction
Cisco ISA500 Series Integrated Security Appliances Administration Guide 20
1
Introduction
Thank you for choosing the Cisco ISA500 Series Integrated Security Appliance, a
member of the Small Business Family. The ISA500 Series is a set of Unified Threat
Management (UTM) security appliances that provide business-class security
gateway solutions with dual WAN, DMZ, zone-based firewall, site-to-site and
remote access VPN (including IPsec Remote Access, Teleworker VPN Client, and
SSL VPN) support, and Internet threat protection, such as Intrusion Prevention
(IPS), Anti-Virus, Application Control, Web URL Filtering, Web Reputation Filtering,
Spam Filter, and Network Reputation. The ISA550W and ISA570W include
802.11b/g/n access point capabilities.
The following table lists the available model numbers.
NOTE Any configurable port can be configured to be a WAN, DMZ, or LAN port. Only one
configurable port can be configured as a WAN port at a time. Up to 4 configurable
ports can be configured as DMZ ports.
Model Description Configuration
ISA550 Cisco ISA550 Integrated
Security Appliance
1 WAN port, 2 LAN ports,
4 configurable ports, and 1 USB 2.0
port
ISA550W Cisco ISA550 Integrated
Security Appliance with
Wi-Fi
1 WAN port, 2 LAN ports,
4 configurable ports, 1 USB 2.0 port,
and 802.11b/g/n
ISA570 Cisco ISA570 Integrated
Security Appliance
1 WAN port, 4 LAN ports,
5 configurable ports, and 1 USB 2.0
port
ISA570W Cisco ISA570 Integrated
Security Appliance with
Wi-Fi
1 WAN port, 4 LAN ports,
5 configurable ports, 1 USB 2.0 port,
and 802.11b/g/n