Cisco ROUTER-SDM-CD User manual

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco Router and Security Device
Manager User’s Guide
2.5
Customer Order Number:
Text Part Number: OL-4015-12

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT
NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT
ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR
THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION
PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO
LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as
part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE
PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED
OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL
DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR
INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and
figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and
coincidental.
Cisco Router and Security Device Manager 2.5 User’s Guide
© 2007 Cisco Systems, Inc. All rights reserved.

iii
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
CONTENTS
Home Page 1
Creating a New Connection 1
Creating a New Connection 1
New Connection Reference 2
Create Connection 2
Additional Procedures 3
How Do I Configure a Static Route? 4
How Do I View Activity on My LAN Interface? 4
How Do I Enable or Disable an Interface? 5
How Do I View the IOS Commands I Am Sending to the Router? 5
How Do I Launch the Wireless Application from Cisco SDM? 6
How Do I Configure an Unsupported WAN Interface? 6
How Do I Enable or Disable an Interface? 7
How Do I View Activity on My WAN Interface? 7
How Do I Configure NAT on a WAN Interface? 8
How Do I Configure NAT on an Unsupported Interface? 9
How Do I Configure a Dynamic Routing Protocol? 9
How Do I Configure Dial-on-Demand Routing for My ISDN or Asynchronous
Interface? 10
How Do I Edit a Radio Interface Configuration? 11
LAN Wizard 1
Ethernet Configuration 2
LAN Wizard: Select an Interface 2
LAN Wizard: IP Address and Subnet Mask 3

Contents
iv
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
LAN Wizard: Enable DHCP Server 3
LAN Wizard: DHCP Address Pool 4
DHCP Options 4
LAN Wizard: VLAN Mode 5
LAN Wizard: Switch Port 6
IRB Bridge 7
BVI Configuration 8
DHCP Pool for BVI 8
IRB for Ethernet 9
Layer 3 Ethernet Configuration 9
802.1Q Configuration 10
Trunking or Routing Configuration 10
Configure Switch Device Module 10
Configure Gigabit Ethernet Interface 11
Summary 11
802.1x Authentication 1
LAN Wizard: 802.1x Authentication (Switch Ports) 1
Advanced Options 2
LAN Wizard: RADIUS Servers for 802.1x Authentication 4
Edit 802.1x Authentication (Switch Ports) 6
LAN Wizard: 802.1x Authentication (VLAN or Ethernet) 7
802.1x Exception List 8
802.1x Authentication on Layer 3 Interfaces 9
Edit 802.1x Authentication 10
How Do I ... 11
How Do I Configure 802.1x Authentication on More Than One Ethernet
Port? 11

v
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Contents
Configuring WAN Connections 1
Configuring an Ethernet WAN Connection 1
Ethernet WAN Connection Reference 2
WAN Wizard Interface Welcome Window 2
Select Interface 3
IP Address: Ethernet without PPPoE 3
Encapsulation: PPPoE 4
Summary 5
Advanced Options 5
Configuring a Serial Connection 6
Serial Connection Reference 7
IP Address: Serial with Point-to-Point Protocol 7
IP Address: Serial with HDLC or Frame Relay 8
Authentication 9
Configure LMI and DLCI 10
Configure Clock Settings 11
Configuring a DSL Connection 13
DSL Connection Reference 14
IP Address: ATM or Ethernet with PPPoE/PPPoA 14
IP Address: ATM with RFC 1483 Routing 15
Encapsulation Autodetect 16
PVC 18
Configuring an ISDN Connection 20
ISDN Connection Reference 20
ISDN Wizard Welcome Window 21
IP Address: ISDN BRI or Analog Modem 21
Switch Type and SPIDs 22
Dial String 23
Configuring an Aux Backup Connection 24
Aux Backup Connection Reference 24

Contents
vi
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Aux Backup Welcome Window 25
Backup Configuration 25
Backup Configuration: Primary Interface and Next Hop IP Addresses 26
Backup Configuration: Hostname or IP Address to Be Tracked 27
Configuring an Analog Modem Connection 27
Analog Modem Connection Reference 28
Analog Modem Welcome 28
Configuring a Cable Modem Connection 29
Cable Modem Connection Reference 29
Cable Modem Connection Wizard Welcome 30
Select Interface 30
Summary 30
Edit Interface/Connection 1
Connection: Ethernet for IRB 5
Connection: Ethernet for Routing 6
Existing Dynamic DNS Methods 7
Add Dynamic DNS Method 7
Wireless 9
Association 9
NAT 11
Edit Switch Port 12
Application Service 13
General 14
Select Ethernet Configuration Type 16
Connection: VLAN 17
Subinterfaces List 17
Add or Edit BVI Interface 18
Add or Edit Loopback Interface 18

vii
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Contents
Connection: Virtual Template Interface 19
Connection: Ethernet LAN 19
Connection: Ethernet WAN 20
Connection: Ethernet Properties 22
Connection: Ethernet with No Encapsulation 24
Connection: ADSL 25
Connection: ADSL over ISDN 28
Connection: G.SHDSL 30
Connection: Cable Modem 34
Configure DSL Controller 35
Add a G.SHDSL Connection 37
Connection: Serial Interface, Frame Relay Encapsulation 40
Connection: Serial Interface, PPP Encapsulation 43
Connection: Serial Interface, HDLC Encapsulation 45
Add or Edit GRE Tunnel 46
Connection: ISDN BRI 48
Connection: Analog Modem 51
Connection: (AUX Backup) 53
Authentication 55
SPID Details 56
Dialer Options 57
Backup Configuration 59
Delete Connection 60
Connectivity Testing and Troubleshooting 62
Wide Area Application Services 1
Configuring a WAAS Connection 2
WAAS Reference 3

Contents
viii
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
NM WAAS 4
Integrated Service Engine 6
WCCP 7
Central Manager Registration 8
Create Firewall 1
Basic Firewall Configuration Wizard 4
Basic Firewall Interface Configuration 4
Configuring Firewall for Remote Access 5
Advanced Firewall Configuration Wizard 5
Advanced Firewall Interface Configuration 5
Advanced Firewall DMZ Service Configuration 6
DMZ Service Configuration 7
Application Security Configuration 8
Domain Name Server Configuration 9
URL Filter Server Configuration 9
Select Interface Zone 9
ZPF Inside Zones 10
Voice Configuration 10
Summary 11
SDM Warning: SDM Access 13
How Do I... 15
How Do I View Activity on My Firewall? 15
How Do I Configure a Firewall on an Unsupported Interface? 17
How Do I Configure a Firewall After I Have Configured a VPN? 17
How Do I Permit Specific Traffic Through a DMZ Interface? 18
How Do I Modify an Existing Firewall to Permit Traffic from a New Network
or Host? 19
How Do I Configure NAT on an Unsupported Interface? 19
How Do I Configure NAT Passthrough for a Firewall? 20

ix
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Contents
How Do I Permit Traffic Through a Firewall to My Easy VPN Concentrator? 20
How Do I Associate a Rule with an Interface? 22
How Do I Disassociate an Access Rule from an Interface 22
How Do I Delete a Rule That Is Associated with an Interface? 23
How Do I Create an Access Rule for a Java List? 23
How Do I Permit Specific Traffic onto My Network if I Don’t Have a DMZ
Network? 24
Firewall Policy 1
Edit Firewall Policy/ACL 1
Choose a Traffic Flow 3
Examine the Traffic Diagram and Choose a Traffic Direction 4
Make Changes to Access Rules 6
Make Changes to Inspection Rules 10
Add App-Name Application Entry 12
Add rpc Application Entry 12
Add Fragment application entry 13
Add or Edit http Application Entry 14
Java Applet Blocking 15
Cisco SDM Warning: Inspection Rule 16
Cisco SDM Warning: Firewall 17
Edit Firewall Policy 17
Add a New Rule 21
Add Traffic 22
Application Inspection 23
URL Filter 24
Quality of Service 24
Inspect Parameter 24
Select Traffic 24
Delete Rule 25

Contents
x
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12
Application Security 1
Application Security Windows 1
No Application Security Policy 3
E-mail 4
Instant Messaging 5
Peer-to-Peer Applications 6
URL Filtering 7
HTTP 8
Header Options 9
Content Options 10
Applications/Protocols 12
Timeouts and Thresholds for Inspect Parameter Maps and CBAC 13
Associate Policy with an Interface 16
Edit Inspection Rule 16
Permit, Block, and Alarm Controls 17
Site-to-Site VPN 1
VPN Design Guide 1
Create Site to Site VPN 1
Site-to-Site VPN Wizard 4
View Defaults 5
VPN Connection Information 6
IKE Proposals 8
Transform Set 11
Traffic to Protect 13
Summary of the Configuration 14
Spoke Configuration 15
Secure GRE Tunnel (GRE-over-IPSec) 16
GRE Tunnel Information 16