Cisco SA520-K9 Administration Guide - Page 29

Scenario 6: Firewall for Controlling Inbound and Outbound, Traffic

Get Cisco SA520-K9 - SA 500 Series Security Appliances PDF manuals and user guides
UPC - 882658266744
View all Cisco SA520-K9 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 29 highlights

Getting Started Common Configuration Scenarios 1 Scenario 6: Firewall for Controlling Inbound and Outbound Traffic By default, all outbound traffic is allowed and all inbound traffic is denied. If you want to deny some outbound traffic or allow some inbound traffic, you will need to configure a firewall rule. To prevent unwanted traffic from the Internet, and to ensure that your employees are using the Internet for approved business purposes, you can configure various levels of firewall rules. You can configure rules that apply to a specified IP address, a range of IP addresses, or to everyone globally. Consider the following examples of firewall rules: • Block outbound traffic to certain websites • Restrict Internet access for certain users • Allow inbound traffic to your DMZ • Configure advanced NAT routing For these scenarios and all situations in which you need an exception from the default firewall policy, you need to configure firewall rules. NOTE The default WAN and LAN settings might be sufficient for your deployment, but consider the steps outlined in Scenario 1: Basic Network Configuration with Internet Access, page 26. Configuration tasks for this scenario: To start configuring your firewall rules, use the Firewall and NAT Rules links on the Getting Started (Advanced) page. For more information, see Configuring Firewall Rules to Control Inbound and Outbound Traffic, page 103. Scenario 7: DMZ for Public Websites and Services If your business hosts public services such as websites, you need a way to allow access to those services without exposing your LAN. You can address this concern by configuring the Optional port of the security appliance for use as a DMZ (Demarcation Zone or Demilitarized Zone). This zone acts as a separate network between your private LAN and the Internet. After you configure your DMZ, you can configure the firewall rules that enable traffic to connect only to the services that you specify. Cisco SA500 Series Security Appliances Administration Guide 29

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
Getting Started
Common Configuration Scenarios
Cisco SA500 Series Security Appliances Administration Guide
29
1
Scenario 6: Firewall for Controlling Inbound and Outbound
Traffic
By default, all outbound traffic is allowed and all inbound traffic is denied. If you
want to deny some outbound traffic or allow some inbound traffic, you will need to
configure a firewall rule. To prevent unwanted traffic from the Internet, and to
ensure that your employees are using the Internet for approved business
purposes, you can configure various levels of firewall rules. You can configure
rules that apply to a specified IP address, a range of IP addresses, or to everyone
globally.
Consider the following examples of firewall rules:
•
Block outbound traffic to certain websites
•
Restrict Internet access for certain users
•
Allow inbound traffic to your DMZ
•
Configure advanced NAT routing
For these scenarios and all situations in which you need an exception from the
default firewall policy, you need to configure firewall rules.
NOTE
The default WAN and LAN settings might be sufficient for your deployment, but
consider the steps outlined in
Scenario 1: Basic Network Configuration with
Internet Access, page 26
.
Configuration tasks for this scenario:
To start configuring your firewall rules, use the
Firewall and NAT Rules
links on the
Getting Started (Advanced) page. For more information, see
Configuring Firewall
Rules to Control Inbound and Outbound Traffic, page 103
.
Scenario 7: DMZ for Public Websites and Services
If your business hosts public services such as websites, you need a way to allow
access to those services without exposing your LAN. You can address this
concern by configuring the Optional port of the security appliance for use as a
DMZ (Demarcation Zone or Demilitarized Zone). This zone acts as a separate
network between your private LAN and the Internet. After you configure your
DMZ, you can configure the firewall rules that enable traffic to connect only to the
services that you specify.