Cisco WS-CE500 - Catalyst Express 500-24PC Instruction Manual

Cisco Small Business
SA500 Series Security Appliances
ADMINISTRATION
GUIDE

© 2011 Cisco Systems, Inc. All rights reserved. OL-19114-05
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks,
go to this URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does
not imply a partnership relationship between Cisco and any other company. (1110R)

Cisco SA500 Series Security Appliances Administration Guide 3
Contents
Chapter 1: Getting Started 10
Feature Overview 10
Device Overview 11
Front Panel 11
Rear Panel 12
Installation 13
Installation Options 13
Hardware Installation 16
Getting Started with the Configuration Utility 17
Connecting to the Configuration Utility 18
Using the Getting Started Pages 19
Navigating Through the Configuration Utility 21
Using the Help System 22
About the Default Settings 22
Basic Tasks 23
Changing the Default User Name and Password 23
Backing Up Your Configuration 24
Upgrading the Firmware 24
Common Configuration Scenarios 25
Basic Network Configuration with Internet Access 26
Cisco Smart Business Communications System Configuration 28
Firewall for Controlling Inbound and Outbound Traffic 29
DMZ for Public Websites and Services 29
Configuring ProtectLink Web & Email Security 31
Site-to-Site Networking and Remote Access 31
Wireless Networking 35
Chapter 2: Networking 36
Configuring the WAN Connection 37
Viewing the WAN Status 39
Creating PPPoE Profiles 40
Configuring an IP Alias 41

Cisco SA500 Series Security Appliances Administration Guide 4
Contents
Configuring the LAN 43
About the Default LAN Settings 43
Configuring the LAN 44
Viewing the LAN Status 46
VLAN Configuration 46
DHCP Reserved IPs 52
DHCP Leased Clients 53
Configuring an IGMP Proxy 53
Configuring the Optional Port as a LAN Port 53
Configuring the Optional WAN 54
Configuring Auto-Rollover, Load Balancing, and Failure Detection 57
Configuring the Protocol Bindings for Load Balancing 60
Configuring a DMZ 61
Configuring the DMZ Settings 64
DMZ Reserved IPs 66
DMZ DHCP Leased Clients 67
Routing 67
Routing 67
Static Routing 68
Dynamic Routing 69
Port Management 70
Configuring the Ports 70
Configuring SPAN (Port Mirroring) 71
QoS Bandwidth Profiles 72
Creating QoS Bandwidth Profiles for WAN Interfaces 72
Traffic Selectors 73
LAN QoS 74
Enabling LAN QoS 74
Port CoS Mapping 75
Port DSCP Mapping 75
DSCP Remarking 75
Dynamic DNS 76

Cisco SA500 Series Security Appliances Administration Guide 5
Contents
Configuring IPv6 Addressing 77
IP Routing Mode 78
Configuring the IPv6 WAN Connection 78
Configuring the IPv6 LAN 80
IPv6 LAN Address Pools 82
IPv6 Multi LAN 83
IPv6 Static Routing 83
Routing (RIPng) 84
6to4 Tunneling 85
IPv6 Tunnels Status 85
ISATAP Tunnels 86
MLD Tunnels 87
Router Advertisement Daemon (RADVD) 88
Configuring Router Advertisement 88
Adding RADVD Prefixes 89
Chapter 3: Wireless Configuration for the SA520W 91
Configuring an Access Point 91
Step 1: Configuring the Wireless Profiles 92
Profile Advanced Configuration 95
Configuring the QoS Settings for a Wireless Profile 95
Controlling Wireless Access Based on MAC Addresses 96
Step 2: Configuring the Access Points 98
Configuring the Radio 99
Basic Radio Configuration 99
Advanced Radio Configuration 101
Chapter 4: Firewall Configuration 103
Configuring Firewall Rules to Control Inbound and Outbound Traffic 103
Preliminary Tasks for Firewall Rules 104
Configuring the Default Outbound Policy 107
Configuring a Firewall Rule for Outbound Traffic 107

Cisco SA500 Series Security Appliances Administration Guide 6
Contents
Configuring a Firewall Rule for Inbound Traffic 110
Prioritizing Firewall Rules 113
Firewall Rule Configuration Examples 114
Using Other Tools to Prevent Attacks, Restrict Access, and
Control Inbound Traffic 117
Configuring Attack Checks 118
Configuring MAC Filtering to Allow or Block Traffic 119
Configuring IP/MAC Binding 120
Port Triggering 121
Configuring a Port Triggering Rule to Direct Traffic to Specified Ports 122
Viewing the Port Triggering Status 122
Configuring Session Settings to Analyze Incoming Packets 123
Using Other Tools to Control Access to the Internet 124
Configuring Content Filtering to Allow or Block Web Components 124
Configuring Approved URLs to Allow Access to Websites 126
Configuring Blocked URLs to Prevent Access to Websites 127
Configuring IP/MAC Binding to Prevent Spoofing 128
SIP 129
Chapter 5: Intrusion Prevention System 130
Configuring IPS 131
Configuring the IPS Policy 132
Configuring the Protocol Inspection Settings 133
Configuring Peer-to-Peer Blocking and Instant Messaging 134
Chapter 6: Using Cisco ProtectLink Security Services 135
Chapter 7: Configuring VPN 136
About VPN 136
Configuring a Site-to-Site VPN Tunnel 137
Configuring an IPsec VPN Tunnel for Remote Access with a VPN Client 139
Configuring the User Database for the IPsec Remote Access VPN 142
Advanced Configuration of IPsec VPN 144

Cisco SA500 Series Security Appliances Administration Guide 7
Contents
Viewing the Basic Setting Defaults for IPsec VPN 144
Configuring the IKE Policies for IPsec VPN 144
Configuring the IPsec VPN Policies 148
Configuring SSL VPN for Browser-Based Remote Access 154
Access Options for SSL VPN 155
Security Tips for SSL VPN 155
Elements of the SSL VPN 156
Scenario Step 1: Customizing the Portal Layout 157
Scenario Step 2: Adding the SSL VPN Users 159
Creating the SSL VPN Policies 160
Specifying the Network Resources for SSL VPN 163
Configuring SSL VPN Port Forwarding 163
SSL VPN Tunnel Client Configuration 165
Viewing the SSL VPN Client Portal 168
VeriSign™ Identity Protection configuration 169
Configuring VeriSign Identity Protection 169
Managing User Credentials for VeriSign Service 170
Chapter 8: Administration 171
Users 171
Domains 172
Groups 173
Adding or Editing User Settings 173
Adding or Editing User Login Policies 175
Firmware and Configuration 176
Upgrading Firmware and Working with Configuration Files 176
Maintaining the USB Device 178
Using the Secondary Firmware 180
Diagnostics 180
Measuring and Limiting Traffic with the Traffic Meter 182
Configuring the Time Settings 184
Configuring the Logging Options 185

Cisco SA500 Series Security Appliances Administration Guide 8
Contents
Local Logging Config 185
IPv6 Logging 187
Remote Logging 188
Logs Facility and Severity 189
Managing Certificates for Authentication 190
Configuring RADIUS Server Records 193
License Management 194
Chapter 9: Network Management 197
RMON (Remote Management) 197
CDP 199
SNMP 199
Configuring SNMP 200
Configuring SNMP System Info 200
UPnP 201
Bonjour 202
Configuring Bonjour 202
Associating VLANs 202
Chapter 10: Status 204
Device Status 204
Device Status 205
Resource Utilization 207
Interface Statistics 207
Port Statistics 208
Wireless Statistics for the SA520W 208
VPN Status 210
IPsec VPN Status 210
SSL VPN Status 211
Quick VPN Status 212
Active Users 213
View Logs 213

Cisco SA500 Series Security Appliances Administration Guide 9
Contents
View All Logs 213
IPsec VPN Logs 215
ProtectLink Logs 215
CDP Neighbor 215
LAN Devices 216
Reports 216
Appendix A: Troubleshooting 217
Internet Connection 217
Date and Time 220
Pinging to Test LAN Connectivity 221
Restoring Factory Default Configuration Settings 223
Appendix B: Standard Services 224
Appendix C: Technical Specifications and Environmental Requirements 227
Appendix D: Factory Default Settings 229
General Settings 229
Router Settings 231
Wireless Settings 234
Storage 237
Security Settings 238
Appendix E: Where to Go From Here 240

1
Cisco SA500 Series Security Appliances Administration Guide 10
Getting Started
This chapter describes the SA500 and provides scenarios to help you to begin
configuring your security appliance to meet the needs of your business.
•Feature Overview
•Installation Options
•Hardware Installation
•Getting Started with the Configuration Utility
•About the Default Settings
•Basic Tasks
•Common Configuration Scenarios
Feature Overview
The features of the SA520, SA520W, and the SA540 are compared in the following
table.
Table 1 Comparison of SA500 Series Security Appliance Models
Feature SA520 SA520W SA540
Firewall
Performance
200 Mbps 200 Mbps 300 Mbps
UTM 200 Mbps 200 Mbps 300 Mbps
VPN
Performance
65 Mbps 65 Mbps 85 Mbps
Connections 15,000 15,000 40,000

Getting Started
Feature Overview
Cisco SA500 Series Security Appliances Administration Guide 11
1
Device Overview
Before you begin to use the security appliance, become familiar with the LEDs on
the front panel and the ports on the rear panel. Refer to the following illustrations
and descriptions.
Front Panel
•RESET Button—To reboot the security appliance, push and release the
Reset button. To restore the factory default settings, press and hold the
Reset button for 5 seconds.
•DIAG LED—(Orange) When lit, indicates the appliance is performing the
power-on diagnostics. When off, indicates the appliance has booted
properly.
•POWER LED—(Green) When lit, indicates the appliance is powered on.
•DMZ LED—(Green) When lit, indicates the Optional port is configured as a
Demilitarized Zone or Demarcation Zone, which allows public services such
as web servers, without exposing your LAN.
•SPEED LED—(Green or Orange) Indicates the traffic rate for the associated
port. Off = 10 Mbps, Green = 100 Mbps, Orange = 1000 Mbps.
LAN Ports 448
Wireless
(802.11n)
No Yes No
IPsec (# seats) Yes (50) Yes (50) Yes (100)
SSL (# seats) Includes 2 seats.
With license, up
to 25 seats.
Includes 2 seats.
With license, up
to 25 seats.
Included (50)
Feature SA520 SA520W SA540

Getting Started
Feature Overview
Cisco SA500 Series Security Appliances Administration Guide 12
1
•LINK/ACT LED—(Green) When lit, indicates that a connection is being
made through the port. When flashing, the port is active.
•WLAN LED—(Green) When lit, indicates that wireless is enabled
(SA520W).
Rear Panel
•POWER Switch—Turns the security appliance on or off.
•POWER Connector—Connects the security appliance to power using the
supplied power cable.
•LAN Ports—Connect computers and other network appliances to the
security appliance. The SA520 and SA520W have 4 LAN ports. The SA540
has 8.
•OPTIONAL Port—Can be configured to operate as a WAN, LAN, or DMZ
port. A DMZ (Demilitarized Zone or Demarcation Zone) can be configured to
allow public access to services such as web servers without exposing your
LAN.
•WAN Port—Connects the security appliance to DSL, a cable modem, or
another WAN connectivity device.
•USB Port—Connects the security appliance to a USB device. You can use a
USB device to store configuration files for backup and restore operations.
NOTE The back panel of the SA520W includes three threaded connectors for the
antennas.

Getting Started
Installation
Cisco SA500 Series Security Appliances Administration Guide 13
1
Installation
This section guides you through the installation of your security appliance. Refer to
the following topics:
•Installation Options, page 13
•Hardware Installation, page 16
Installation Options
You can place your security appliance on a desktop, mount it on a wall, or mount it
in a rack.
Placement Tips
•Ambient Temperature—To prevent the security appliance from
overheating, do not operate it in an area that exceeds an ambient
temperature of 104°F (40°C).
•Air Flow—Be sure that there is adequate air flow around the device.
•Mechanical Loading—Be sure that the security appliance is level and
stable to avoid any hazardous conditions.
To place the security appliance on a desktop, install the four rubber feet (included)
on the bottom of the security appliance. Place the device on a flat surface.

Getting Started
Installation
Cisco SA500 Series Security Appliances Administration Guide 14
1
Wall Mounting
STEP 1 Insert two 17 mm screws, with anchors, into the wall 15 cm apart (about 5.9
inches). Leave 3-4 mm (about 1/8 inch) of the head exposed.

Getting Started
Installation
Cisco SA500 Series Security Appliances Administration Guide 15
1
STEP 2 Position the unit so that the wall-mount slots are over the two screws. Slide the unit
down until the screws fit snugly into the wall-mount slots.
Rack Mounting
You can mount the security appliance in any standard size, 19-inch (about 48 cm)
wide rack. Each security appliance requires 1 rack unit (RU) of space, which is 1.75
inches (44.45 mm) high.
!
CAUTION Do not overload the power outlet or circuit when installing multiple devices in a
rack.

Getting Started
Installation
Cisco SA500 Series Security Appliances Administration Guide 16
1
STEP 1 Remove the four screws from each side of the security appliance.
STEP 2 Place one of the supplied spacers on the side of the security appliance so that the
four holes align to the screw holes. Place a rack mount bracket next to the spacer
and reinstall the screws.
NOTE If the screws are not long enough to reattach the bracket with the spacer, attach the
bracket directly to the case without the spacer.
STEP 3 Install the security appliance into a standard rack as shown.
Hardware Installation
Follow these steps to connect the equipment:
STEP 1 Connect the security appliance to power.
STEP 2 If you are installing the SA520W, screw each antenna onto a threaded connector
on the back panel. Orient each antenna to point upward.
STEP 3 For DSL, a cable modem, or other WAN connectivity devices, connect an Ethernet
network cable from the device to the WAN port on the back panel. Cisco strongly
recommends using Cat5E or better cable.
STEP 4 For network devices, connect an Ethernet network cable from the network device
to one of the dedicated LAN ports on the back panel.

Getting Started
Getting Started with the Configuration Utility
Cisco SA500 Series Security Appliances Administration Guide 17
1
STEP 5 If you are using a UC500, connect an Ethernet network cable from the WAN port of
the UC500 to an available LAN port of the security appliance.
STEP 6 Power on the security appliance.
STEP 7 Power on the connected devices. Each LED lights to show an active connection.
A sample configuration is illustrated below.
Congratulations! The installation of the security appliance is complete.
Getting Started with the Configuration Utility
The Configuration Utility web page is a web based device manager that is used to
provision the SA500 Series Security Appliances. To use this utility, you must be
able to connect to the SA500 Series Security Appliances from your administration
PC or laptop. You can access the security appliance by using any web browser
(such as Microsoft Internet Explorer or Mozilla Firefox).

Getting Started
Getting Started with the Configuration Utility
Cisco SA500 Series Security Appliances Administration Guide 18
1
Connecting to the Configuration Utility
STEP 1 Connect your computer to an available LAN port on the back panel of the security
appliance.
STEP 2 Start a web browser, and enter the following address: 192.168.75.1
This address is the factory default LAN address of the security appliance. If you
change this setting in the LAN configuration, you will need to enter the new IP
address to connect to the Configuration Utility.
STEP 3 When the Security Alert appears, accept or install the certificate:
•Internet Explorer: Click Yes to proceed, or click View Certificate for details.
On the Certificate page, click Install the Certificate. Follow the instructions
in the Wizard to complete the installation.
•Firefox: Click the link to add an exception. Click the Add Exception button.
Click Get Certificate, and then click Confirm Security Exception.
•Safari: Click Continue to proceed, or click Show Certificate. On the
Certificate page, click Install the Certificate. Follow the instructions in the
Wizard to complete the installation.
STEP 4 Enter the default user name and password:
•Username: cisco
•Password: cisco
STEP 5 Click Log In. The Getting Started (Basic) window opens. For more information, see
Using the Getting Started Pages, page 19.
NOTE You can use the Cisco Configuration Assistant (CCA) t to launch the Configuration
Utility if you are using the security appliance with a CCA-supported device, such
as the UC500. For more information about CCA, see:
www.cisco.com/go/configassist.

Getting Started
Getting Started with the Configuration Utility
Cisco SA500 Series Security Appliances Administration Guide 19
1
Using the Getting Started Pages
The Getting Started pages provide help with common configuration tasks.
•Find a task that you need to perform, and then click a link to get started.
Proceed in order through the listed links.
•For help with advanced configuration tasks, such as firewall/NAT
configuration, optional WAN configuration, DMZ configuration, and VPN
setup, click the Getting Started > Advanced link in the navigation pane,
and click the links to perform the tasks that you want to complete.
•To return to the Getting Started (Basic) page at any time, click the Getting
Started button in the menu bar.
•To prevent the Getting Started (Basic) page from appearing automatically
after you log in, check the Don’t show this on start-up box.
Getting Started (Basic) Page

Getting Started
Getting Started with the Configuration Utility
Cisco SA500 Series Security Appliances Administration Guide 20
1
Getting Started (Advanced) Page