Cisco IronPort S670 User manual

Networking Worksheet
Cisco IronPort Web Security Appliance
Cisco IronPort C370
EmailSecurity Appliance
QUICKSTART GUIDE
Cisco IronPort S670

 Transparent with L4 Switch Transparent with WCCP Router Explicit Forward Proxy
 Simplex Tap Duplex Tap

Is there another proxy on the network? NO YES: In Transparent Mode In Forward Mode
Other Proxy in Forward Mode IP address and Port:

Default System Hostname:
DNS Servers
Use the Internet’s root DNS servers Use these DNS servers (maximum 3):
1. ........................................................................................................................
2. .......................................................................................................................
3. ........................................................................................................................
Network Time Protocol (NTP) server IP address and host name:
Time Zone Region Region: Country: GMT Offset:

 IP address: .............................................................................................................................
Network mask: .............................................................................................................................
Host name: .............................................................................................................................
NOTE: The Web Proxy can share the Management interface. If congured separately, the Data interface IP address and the Management
interface IP address cannot share the same subnet.
 IP address: .............................................................................................................................
Network mask: .............................................................................................................................
Host name: .............................................................................................................................

 Default Gateway: .............................................................................................................................
Static Route Name: .............................................................................................................................
Static Route Destination Network: .............................................................................................................................
Static Route Gateway: .............................................................................................................................
 Default Gateway: .............................................................................................................................
Static Route Name: .............................................................................................................................
Static Route Destination Network: .............................................................................................................................
Static Route Gateway: .............................................................................................................................

Device type: Layer 4 switch WCCP router
NOTE: When you connect the appliance to a WCCP router, you must congure the Web Security appliance to create WCCP services after
you run the System Setup Wizard.

Administrative Password: Auto Support
Send Email System Alerts to:

IP Spoong Action for Detected Malware: Monitor Only Block
L4 Trafc Monitor: Monitor Only Block Action for Unscannable Transactions: Monitor Only Block
IronPort URL Filtering SenderBase Network Participation
Web Reputation Filters Participation Level: Limited Standard
Malware and Spyware Scanning: Enable Webroot Enable McAfee
© 2009 Cisco Systems, Inc. All rights reserved. Cisco, the Cisc o logo, Cisco Systems, Cisco IronPort, IronPort, SenderBas e and AsyncOS are registered trademarks or trademarks of Cisco Systems, Inc. and/or its afliates in the United States
and certain other countries. All other trademarks mentioned in the document or website are the property of their respective owners. The use of the word partner does not imply a partnership between Cisco and any other company. (0903R)
P/N 421-0542
Technical Support:
1-877-641-IRON (4766)

Use this Quickstart Guide to get the Cisco IronPort S-Series
appliance installed and running on your network, and refer to
the Deployment chapter in the IronPort AsyncOS for Web
User Guide for information about how to congure appliance
settings.
Before you start, make sure you have the following equipment:
Rack cabinet enclosure •
RapidRails •TM and adaptor kits
10/100/Gigabit BaseT TCP/IP local area network (LAN) •
Check to make sure the following items are present in the Cisco
IronPort Web Security appliance system box:
 •
Dual-head power cables (1) •
Straight power cables (2) •
Ethernet •TM cable
Null Modem cable •
Documentation CD •
IronPort AsyncOS for Web User Guide •
Safety and Compliance Guide •
Terms and Conditions of Use •
Release Notes •

You can download the AsyncOS Release Notes from the IronPort
Customer Support Portal located at www.ironport.com/support
 
The S-Series appliance is typically installed as an additional layer in the
network between clients and the Internet. Depending on how you deploy
the appliance, you may or may not need a Layer 4 (L4) switch or a WCCP
router to direct client trafc to the appliance. Deployment options include:
 • – Web proxy with an L4 switch
 • – Web proxy with a WCCP router
 • – Connected to a network switch
 • – Ethernet tap (simplex or duplex)
SimplexMode: – Port T1 receives all outgoing trafc and port T2
receives all incoming trafc.
DuplexMode: – Port T1 receives all incoming and outgoing trafc.

Install the Cisco IronPort appliance into your rack cabinet. Ensure the
ambient temperature around the system is within the specied limits,
and ensure there is  around the unit.
Documentation
CD
Quickstart
Guide
Safety and
Compliance Guide

2

1

3
The Networking Worksheet that is located toward the back of
this guide is a useful prerequisite to running the System Setup Wizard.
Ironport strongly recommends using the Networking Worksheet to plan
your deployment and record the information that you need to complete
the initial conguration.
To monitor true client IP addresses, the L4 Trafc Monitor should
always be congured inside the rewall and before NAT (Network
Address Translation).
Dual-Head
Power
Cables
(1)
Ethernet
Cable
Null Modem
Cable
Straight
Power
Cables
(2)
Management PC
L4 switch/
WCCP router
Ethernet tap
Simplex/Duplex Firewall
Clients Internet

Congure your laptop’s network connection to use an IP address on the
same subnet as the S-Series appliance (192.168.42.xx).
The laptop can only connect to the S-Series appliance if the laptop
IP address and the appliance IP address are on the same subnet.
Connect your laptop to the  using the Ethernet
cable included in the system box. The S-Series appliance uses the M1
Management Port only.

Cable the S-Series appliance.Plug the Ethernet cables into the
appropriate ports on the back panel of the appliance.
The proxy ports are labeled P1 and P2. •
P1onlyenabled: – When only P1 is enabled, connect it to
the network for both incoming and outgoing trafc.
P1andP2enabled: – When both P1 and P2 are enabled, you
must connect P1 to the internal network and P2 to the Internet.
The Trafc Monitor ports are labeled T1 and T2. •
– Simplextap: Ports T1 and T2; one cable for all packets destined
for the Internet (T1), and one cable for all packets coming from the
Internet (T2).
Duplextap: – Port T1; one cable for all incoming and outgoing trafc.
L4 switch/WCCP Router/
Network switch
Ethernet tap
Simplex/Duplex
Management PC
Management Port

4

5

6

Plug the female end of the straight power cable, or the female ends of •
the dual-head power cable into the redundant power supplies on the
back panel of the appliance.
Plug the male end(s) into an electrical outlet. •
 by pressing the On/Off switch on the front
panel of the appliance. You must for the system to
initialize each time you power up the system.
Access the Cisco IronPort S-Series appliance and run the System Setup
Wizard to congure basic settings and enable a set of system defaults.
To access the S-Series appliance, open a web browser and connect •
to the Management interface:
http://192.168.42.42:8080 where 192.168.42.42 is the default IP
address, and 8080 is the default Admin port setting.
The host name parameter is assigned during system setup. Before
you can connect to the Management interface using a host name
(http://hostname:8080), you must add the appliance host name and
IP address to your DNS server database.
Login using the default user name •admin, and the default
password ironport.
Run the System Setup Wizard. •
Use the web interface to set up policies, enable features, and modify
settings as necessary to maintain your conguration.
Use the Web Security Manager
> Identities page to identify groups of users on the network. Then use
the Web Access Policies page to control user access to the Internet by
conguring which objects and applications to allow or block, which URL
categories to monitor or block, and web reputation and anti-malware
settings.
Use the Monitor > Reports page to schedule
interactive reports, and set up archive reporting to track trends and
activity over time.
Use the System Administration > Feature Keys page
to enter valid keys for features that you enabled during setup.
 If you connect the appliance to a WCCP v2
router, use the Network > Transparent Redirection page to create at least
one WCCP service.
 Send a copy of the current conguration le
to the system administrator. This le can be used to restore your initial
System Setup Wizard defaults if necessary.
For information about managing the Cisco IronPort S-Series appliance,
refer to theIronPortAsyncOSforWebUserGuide.
Dual-Head
Power Cable
Straight
Power Cable OR
CiscoIronPort C370
50
95
F
C
35
10
SERIAL
MANAGEMENT
1
2
3
4
SERIAL
MANAGEMENT
1
2
3
4
SERIAL MGMT DA T A 1 2 3
3
4
SERIAL MGMT DA T A 1 2 3
3
4
MANAGEMENT
3
4
CiscoIronPort C370
Temperature Limits
Wait 5
minutes
Power
User Guide