Cisco S195 User manual

Cisco Systems, Inc.
www.cisco.com
Cisco Web Security Appliance S195, S395, S695,
and S695F Getting Started Guide
Contents
Welcome
Published: June 7, 2019
Welcome
Document Network Settings
Plan the Installation
Temporarily Change Your IP Address for Remote Access
Connect to the Appliance
Log In to the Appliance
Run the System Setup Wizard
Check for Available Upgrades
Configure Network Settings
Configuration Summary
Additional Configurations
Related Documentation
Cisco Notification Service
Cisco Web Security Appliance S195, S395, S695, and S695F (WSA) helps organizations secure and
control web traffic. This guide describes how to setup your appliances and use the System Setup
Wizard to configure basic settings for the appliance. You can also refer to the “Deployment” chapter
in the AsyncOS for Cisco Web Security Appliances User Guide for information about how to configure
appliance settings.

2
Cisco Web Security Appliance S195, S395, S695, and S695F Getting Started Guide
Document Network Settings
Document Network Settings
Before you begin, write down the following information about your network and administrator settings.
Deployment Options
Web Proxy:
– Transparent with L4
– Switch Transparent with
WCCP Router
– Explicit Forward Proxy
L4 Traffic Monitor:
•Simplex tap/Span port
•Duplex tap/Span port
Network Context
Is there another proxy on the
network:
Other Proxy IP Address:
Other Proxy Port:
Network Settings
Default System Hostname:
DNS Servers: Use the Internet root DNS servers.
Use the DNS servers (maximum 3):
1.
2.
3.
Network Time Protocol (NTP)
Server:
Time Zone Region:
Time Zone Country:
Time Zone GMT Offset:

3
Cisco Web Security Appliance S195, S395, S695, and S695F Getting Started Guide
Document Network Settings
Interface Settings
Management Port
IP Address:
Network Mask:
Hostname:
Data Port (Optional, see Note)
IP Address:
Network Mask:
Hostname:
Note The Web Proxy can share the management interface. If configured separately, the Data
interface IP address and the management interface IP address cannot share the same subnet.
Routes
Internal Routes for Management
Default Gateway:
Static Route Name:
Static Route Destination Network:
Static Route Gateway:
Internal Routes for Data
Default Gateway:
Static Route Name:
Static Route Destination Network:
Static Route Gateway:

4
Cisco Web Security Appliance S195, S395, S695, and S695F Getting Started Guide
Document Network Settings
Transparent Routing Device
Device Type: •Layer 4 Switch or No Device
•WCCP Router
– Enable standard service ID
(web-cache).
– Router Addresses:
_________________
– Enable router security.
Password:
_________________
Note When you connect the appliance to a WCCP router, you might need to configure the Web
Security appliance to create WCCP services after you run the System Setup Wizard.
Administrative Settings
Administrator Password:
Email System Alerts To:
SMTP Relay Host: (Optional)
AutoSupport: Enable
SenderBase Network
Participation:
Enable
•Limited
•Standard
Security Services
L4 Traffic Monitor: •Monitor only
•Block
Acceptable Use Controls: Enable
•Cisco IronPort Web Usage Controls
Web Reputation Filters: Enable
Malware and Spyware Scanning: •Enable Webroot
•Enable McAfee
•Enable Sophos
Action for Detected Malware: •Monitor only
•Block
IronPort Data Security Filtering: Enable
Locking Faceplate
4-digit code (for the S695-LKFP
appliance)

5
Cisco Web Security Appliance S195, S395, S695, and S695F Getting Started Guide
Plan the Installation
Plan the Installation
Decide how you are going to configure the Cisco Web Security Appliance within your network.
The Cisco Web Security Appliance is typically installed as an additional layer in the network between
clients and the Internet. Depending on how you deploy the appliance, you may or may not need a Layer
4 (L4) switch or a WCCP router to direct client traffic to the appliance.
Deployment options include:
•Transparent Proxy – Web proxy with an L4 switch
•Transparent Proxy – Web proxy with a WCCP router
•Explicit Forward Proxy – Connection to a network switch
•L4 Traffic Monitor – Ethernet tap (simplex or duplex)
– Simplex Mode: Port T1 receives all outgoing traffic, and port T2 receives all incoming traffic.
– Duplex Mode: Port T1 receives all incoming and outgoing traffic.
Note See “Connect to the Appliance” section on page 7 for more information about individual ports on the
appliance.
Note To monitor true client IP addresses, the L4 traffic monitor should always be configured inside the
firewall and before NAT (Network Address Translation).
If your installation includes multiple Cisco Web Security Appliances (S-Series) or Cisco Email Security
Appliances (C-Series), you may want to also use a Cisco Content Security Management Appliance
(M-Series) to manage them, as show in the following network diagram:

6
Cisco Web Security Appliance S195, S395, S695, and S695F Getting Started Guide
Temporarily Change Your IP Address for Remote Access
Temporarily Change Your IP Address for Remote Access
To remotely configure the appliance using the network connection, you must temporarily change the
IP address of your computer.
Note Make a note of your current IP configuration settings as you will need to revert to these settings after
you finish the configuration.
Alternatively, you can use the serial console to configure the appliance, without changing the IP address.
If you use the serial console, see Connect to the Appliance, page 7.
Temporarily Change Your IP Address on Windows
Note The exact steps depend on the version of your operating system.
Procedure
Step 1 Connect your laptop to the primary Management Port (labeled M1) using the cross over or Ethernet cable
included in the system box. The Cisco Web Security Appliance uses the M1 Management port only. See
“Plan the Installation” section on page 5.
Step 2 Go to the Start menu and choose Control Panel.
Step 3 Double-click Network and Sharing Center.

7
Cisco Web Security Appliance S195, S395, S695, and S695F Getting Started Guide
Connect to the Appliance
Step 4 Click Local Area Connection and then click Properties.
Step 5 Choose Internet Protocol (TCP/IP) and then click Properties.
Step 6 Choose Use the Following IP Address.
Step 7 Enter the following changes:
– IP Address: 192.168.42.43
– Subnet Mask: 255.255.255.0
– Default Gateway: 192.168.42.1
Step 8 Click OK and Close to exit the dialog box.
Temporarily Change Your IP Address on Mac
Note The exact steps depend on the version of your operating system.
Procedure
Step 1 Launch the Apple menu and choose System Preferences.
Step 2 Click Network.
Step 3 Click lock icon to allow changes.
Step 4 Select the Ethernet network configuration with the green icon. This is your active connection. Then click
Advanced.
Step 5 Click the TCP/IP tab and from Ethernet settings, choose Manually from the drop-down list.
Step 6 Enter the following changes:
– IP Address: 192.168.42.43
– Subnet Mask: 255.255.255.0
– Router: 192.168.42.1
Step 7 Click OK.
Connect to the Appliance
After rack-mounting the appliance, follow these steps to connect cables, turn on power, and verify
connectivity.
•Cisco S195 Appliance, page 8
•Cisco S395 Appliance, page 9
•Cisco S695 Appliance, page 10
•Cisco S695F Appliance, page 12

8
Cisco Web Security Appliance S195, S395, S695, and S695F Getting Started Guide
Connect to the Appliance
Note The connection diagram in each topic shows the default configuration using a management computer
connected to your private network. Your deployment may vary depending on your basic logical network
connectivity, ports, addressing, and configuration requirements.
Cisco S195 Appliance
Step 1 Plug one end of the straight power cable into the power supply on the back panel of the appliance.
Note It is optional to order a separate power cable and connect to the second power supply at the back
panel of the appliance for redundancy.
Step 2 Plug the other end into an electrical outlet.
Step 3 Plug the Ethernet cables into the appropriate ports on the back panel of the appliance.
•The proxy ports are labeled P1 and P2.
– P1 only enabled: When only P1 is enabled, connect it to the network for both incoming and
outgoing traffic.
– P1 and P2 enabled: When both P1 and P2 are enabled, you must connect P1 to the internal
network and P2 to the internet.
•The traffic monitor ports are labeled T1 and T2.
– Simplex tap: Ports T1 and T2; one cable for all packets destined for the internet (T1) and one
cable for all packets coming from the internet (T2).
– Duplex tap: Port T1; one cable for all incoming and outgoing traffic.
Step 4 Connect your laptop to the Management port (M1) using the Ethernet cable included in the system box.
Step 5 Power up the appliance by pressing the On/Off switch on the front panel of the appliance. You must
wait 10 minutes for the system to initialize each time you power up the system. After the appliance
powers up, a solid green light on the front panel indicates that the appliance is operational.
1 Management port (M1) - (192.168.42.42) 2 Management computer (192.68.42.43)
3 Traffic monitor port 1 (T1) 4 WAN modem
5 Internet

9
Cisco Web Security Appliance S195, S395, S695, and S695F Getting Started Guide
Connect to the Appliance
Caution If you turn the power off before the initialization is complete, the appliance will not reach an operational
state and must be returned to Cisco.
Note If turned on quickly after connecting power to the appliance, the appliance powers up, the fans spin and
the LEDs turn on. Within 30-60 seconds, the fans stop and all LEDs turn off. The appliance powers on
31 seconds later. This behavior is by design to allow the system firmware and controller to synchronize.
Step 6 See the AsyncOS for Cisco Web Security Appliances User Guide for further configuration.
Cisco S395 Appliance
Step 1 Plug one end of each straight power cable into the redundant power supplies on the back panel of the
appliance.
Step 2 Plug the other end into an electrical outlet.
Step 3 Plug the Ethernet cables into the appropriate ports on the back panel of the appliance.
•The proxy ports are labeled P1 and P2.
– P1 only enabled: When only P1 is enabled, connect it to the network for both incoming and
outgoing traffic.
– P1 and P2 enabled: When both P1 and P2 are enabled, you must connect P1 to the internal
network and P2 to the internet.
•The traffic monitor ports are labeled T1 and T2.
– Simplex tap: Ports T1 and T2; one cable for all packets destined for the internet (T1) and one
cable for all packets coming from the internet (T2).
– Duplex tap: Port T1; one cable for all incoming and outgoing traffic.
Step 4 Connect your laptop to the Management port using the Ethernet cable included in the system box. The
S-Series appliance uses the M1 Management port only.

10
Cisco Web Security Appliance S195, S395, S695, and S695F Getting Started Guide
Connect to the Appliance
Step 5 Power up the appliance by pressing the On/Off switch on the front panel of the appliance. You must
wait 10 minutes for the system to initialize each time you power up the system. After the appliance
powers up, a solid green light on the front panel indicates that the appliance is operational.
Caution If you turn the power off before the initialization is complete, the appliance will not reach an operational
state and must be returned to Cisco.
Note If turned on quickly after connecting power to the appliance, the appliance powers up, the fans spin and
the LEDs turn on. Within 30-60 seconds, the fans stop and all LEDs turn off. The appliance powers on
31 seconds later. This behavior is by design to allow the system firmware and controller to synchronize.
Step 6 See the AsyncOS for Cisco Web Security Appliances User Guide for further configuration.
Cisco S695 Appliance
Step 1 Plug one end of each straight power cable into the redundant power supplies on the back panel of the
appliance.
Step 2 Plug the other end into an electrical outlet.
Step 3 Plug the Ethernet cables into the appropriate ports on the back panel of the appliance.
•The proxy ports are labeled P1 and P2.
– P1 only enabled: When only P1 is enabled, connect it to the network for both incoming and
outgoing traffic.
– P1 and P2 enabled: When both P1 and P2 are enabled, you must connect P1 to the internal
network and P2 to the internet.
•The traffic monitor ports are labeled T1 and T2.
– Simplex tap: Ports T1 and T2; one cable for all packets destined for the internet (T1) and one
cable for all packets coming from the internet (T2).
– Duplex tap: Port T1; one cable for all incoming and outgoing traffic.
Step 4 Connect your laptop to the Management port using the Ethernet cable included in the system box.
1 Management Port (M1) - (192.168.42.42) 2 Management Computer (192.168.42.43)
3 Traffic Monitor Port 1 (T1) 4 WAN Modem
5 Internet