Home » Cisco Manuals » Networking » Cisco SA520-K9 » Manual Viewer

Cisco SA520-K9 Administration Guide - Page 51

Secondary DNS Server Optional

UPC - 882658266744

Add to My Manuals
Save this manual to your list of manuals

Page 51 highlights

Networking Configuring the LAN 2 • None: Choose this option if you do not want to enable a DHCP server for this VLAN. • DHCP Server: Choose this option to allow the security appliance to act as a DHCP server for this VLAN. If you choose this option, complete the other fields in this section of the page. • DHCP Relay: Choose this option to allow the security appliance to use a DHCP Relay for this VLAN. If you choose this mode, also enter the IP address of the Relay Gateway. STEP 4 If you chose DHCP Server for the DHCP Mode, enter the following information: • Domain Name: (optional) Enter a domain name for this VLAN. • Starting IP Address: Enter the first IP address in the DHCP range. Any new DHCP client joining the VLAN is assigned an IP address between this address and the Ending IP Address. • Ending IP Address: Enter the last IP address in the DHCP range. Any new DHCP client joining the LAN is assigned an IP address between the Starting IP Address and this IP address. NOTE The Starting and Ending DHCP addresses should be in the same IP address range as the LAN TCP/IP address (as configured on the LAN > IPv4 LAN Configuration page, LAN TCP/IP Setup section). • Primary DNS Server and Secondary DNS Server (Optional): Enter the IP address of the primary DNS server for the VLAN. Optionally, enter the IP address of a secondary DNS server. • Primary Tftp Server and Secondary Tftp Server (Optional): Enter the IP address of the primary and secondary Tftp servers for the VLAN • WINS Server (Optional): Enter the IP address for the WINS server or, if present in your network, the Windows NetBios server. • Lease Time: Enter the maximum connection time in hours that a dynamic IP address is "leased" to a network user. When the time elapses, the user is automatically assigned a new dynamic IP address. The default is 24 hours. STEP 5 In the LAN Proxies section, check the Enable DNS Proxy box to allow the VLAN to act as a proxy for all DNS requests and to communicate with the DNS servers of the ISP. When this feature is disabled, all DHCP clients on the VLAN receive the DNS IP addresses of the ISP. Cisco SA500 Series Security Appliances Administration Guide 51

Section	Page
Getting Started	10
Feature Overview	10
Device Overview	11
Front Panel	11
Rear Panel	12
Installation	13
Installation Options	13
Hardware Installation	16
Getting Started with the Configuration Utility	17
Connecting to the Configuration Utility	18
Using the Getting Started Pages	19
Navigating Through the Configuration Utility	21
Using the Help System	22
About the Default Settings	22
Basic Tasks	23
Changing the Default User Name and Password	23
Backing Up Your Configuration	24
Upgrading the Firmware	24
Common Configuration Scenarios	25
Networking	36
Configuring the WAN Connection	37
Viewing the WAN Status	39
Creating PPPoE Profiles	40
Configuring an IP Alias	41
Configuring the LAN	43
About the Default LAN Settings	43
Configuring the LAN	44
Viewing the LAN Status	46
VLAN Configuration	46
DHCP Reserved IPs	52
DHCP Leased Clients	53
Configuring an IGMP Proxy	53
Configuring the Optional Port as a LAN Port	53
Configuring the Optional WAN	54
Configuring Auto-Rollover, Load Balancing, and Failure Detection	57
Configuring the Protocol Bindings for Load Balancing	60
Configuring a DMZ	61
Configuring the DMZ Settings	64
DMZ Reserved IPs	66
DMZ DHCP Leased Clients	67
Routing	67
Routing	67
Static Routing	68
Dynamic Routing	69
Port Management	70
Configuring the Ports	70
Configuring SPAN (Port Mirroring)	71
QoS Bandwidth Profiles	72
Creating QoS Bandwidth Profiles for WAN Interfaces	72
Traffic Selectors	73
LAN QoS	74
Enabling LAN QoS	74
Port CoS Mapping	75
Port DSCP Mapping	75
DSCP Remarking	75
Dynamic DNS	76
Configuring IPv6 Addressing	77
IP Routing Mode	78
Configuring the IPv6 WAN Connection	78
Configuring the IPv6 LAN	80
IPv6 LAN Address Pools	82
IPv6 Multi LAN	83
IPv6 Static Routing	83
Routing (RIPng)	84
6to4 Tunneling	85
IPv6 Tunnels Status	85
ISATAP Tunnels	86
MLD Tunnels	87
Router Advertisement Daemon (RADVD)	88
Configuring Router Advertisement	88
Adding RADVD Prefixes	89
Wireless Configuration for the SA520W	91
Configuring an Access Point	91
Step 1: Configuring the Wireless Profiles	92
Profile Advanced Configuration	95
Configuring the QoS Settings for a Wireless Profile	95
Controlling Wireless Access Based on MAC Addresses	96
Step 2: Configuring the Access Points	98
Configuring the Radio	99
Basic Radio Configuration	99
Advanced Radio Configuration	101
Firewall Configuration	103
Configuring Firewall Rules to Control Inbound and Outbound Traffic	103
Preliminary Tasks for Firewall Rules	104
Configuring the Default Outbound Policy	107
Configuring a Firewall Rule for Outbound Traffic	107
Configuring a Firewall Rule for Inbound Traffic	110
Prioritizing Firewall Rules	113
Firewall Rule Configuration Examples	114
Using Other Tools to Prevent Attacks, Restrict Access, and Control Inbound Traffic	117
Configuring Attack Checks	118
Configuring MAC Filtering to Allow or Block Traffic	119
Configuring IP/MAC Binding	120
Port Triggering	121
Configuring a Port Triggering Rule to Direct Traffic to Specified Ports	122
Viewing the Port Triggering Status	122
Configuring Session Settings to Analyze Incoming Packets	123
Using Other Tools to Control Access to the Internet	124
Configuring Content Filtering to Allow or Block Web Components	124
Configuring Approved URLs to Allow Access to Websites	126
Configuring Blocked URLs to Prevent Access to Websites	127
Configuring IP/MAC Binding to Prevent Spoofing	128
SIP	129
Intrusion Prevention System	130
Configuring IPS	131
Configuring the IPS Policy	132
Configuring the Protocol Inspection Settings	133
Configuring Peer-to-Peer Blocking and Instant Messaging	134
Using Cisco ProtectLink Security Services	135
Configuring VPN	136
About VPN	136
Configuring a Site-to-Site VPN Tunnel	137
Configuring an IPsec VPN Tunnel for Remote Access with a VPN Client	139
Configuring the User Database for the IPsec Remote Access VPN	142
Advanced Configuration of IPsec VPN	144
Viewing the Basic Setting Defaults for IPsec VPN	144
Configuring the IKE Policies for IPsec VPN	144
Configuring the IPsec VPN Policies	148
Configuring SSL VPN for Browser-Based Remote Access	154
Access Options for SSL VPN	155
Security Tips for SSL VPN	155
Elements of the SSL VPN	156
Scenario Step 1: Customizing the Portal Layout	157
Scenario Step 2: Adding the SSL VPN Users	159
Creating the SSL VPN Policies	160
Specifying the Network Resources for SSL VPN	163
Configuring SSL VPN Port Forwarding	163
SSL VPN Tunnel Client Configuration	165
Viewing the SSL VPN Client Portal	168
VeriSign™ Identity Protection configuration	169
Configuring VeriSign Identity Protection	169
Managing User Credentials for VeriSign Service	170
Administration	171
Users	171
Domains	172
Groups	173
Adding or Editing User Settings	173
Adding or Editing User Login Policies	175
Firmware and Configuration	176
Upgrading Firmware and Working with Configuration Files	176
Maintaining the USB Device	178
Using the Secondary Firmware	180
Diagnostics	180
Measuring and Limiting Traffic with the Traffic Meter	182
Configuring the Time Settings	184
Configuring the Logging Options	185
Local Logging Config	185
IPv6 Logging	187
Remote Logging	188
Logs Facility and Severity	189
Managing Certificates for Authentication	190
Configuring RADIUS Server Records	193
License Management	194
Network Management	197
RMON (Remote Management)	197
CDP	199
SNMP	199
Configuring SNMP	200
Configuring SNMP System Info	200
UPnP	201
Bonjour	202
Configuring Bonjour	202
Associating VLANs	202
Status	204
Device Status	204
Device Status	205
Resource Utilization	207
Interface Statistics	207
Port Statistics	208
Wireless Statistics for the SA520W	208
VPN Status	210
IPsec VPN Status	210
SSL VPN Status	211
Quick VPN Status	212
Active Users	213
View Logs	213
View All Logs	213
IPsec VPN Logs	215
ProtectLink Logs	215
CDP Neighbor	215
LAN Devices	216
Reports	216
Troubleshooting	217
Internet Connection	217
Date and Time	220
Pinging to Test LAN Connectivity	221
Restoring Factory Default Configuration Settings	223
Standard Services	224
Technical Specifications and Environmental Requirements	227
Factory Default Settings	229
General Settings	229
Router Settings	231
Wireless Settings	234
Storage	237
Security Settings	238

Match case Limit results 1 per page

Networking

Configuring the LAN

Cisco SA500 Series Security Appliances Administration Guide

•

None:

Choose this option if you do not want to enable a DHCP server for this

VLAN.

•

DHCP Server:

Choose this option to allow the security appliance to act as a

DHCP server for this VLAN. If you choose this option, complete the other

fields in this section of the page.

•

DHCP Relay:

Choose this option to allow the security appliance to use a

DHCP Relay for this VLAN. If you choose this mode, also enter the IP address

of the

Relay Gateway

STEP

If you chose DHCP Server for the DHCP Mode, enter the following information:

•

Domain Name:

(optional)

Enter a domain name for this VLAN.

•

Starting IP Address:

Enter the first IP address in the DHCP range. Any new

DHCP client joining the VLAN is assigned an IP address between this

address and the Ending IP Address.

•

Ending IP Address:

Enter the last IP address in the DHCP range. Any new

DHCP client joining the LAN is assigned an IP address between the Starting

IP Address and this IP address.

NOTE

The Starting and Ending DHCP addresses should be in the same IP

address range as the LAN TCP/IP address (as configured on the LAN > IPv4

LAN Configuration page, LAN TCP/IP Setup section).

•

Primary DNS Server

and

Secondary DNS Server (Optional)

: Enter the IP

address of the primary DNS server for the VLAN. Optionally, enter the IP

address of a secondary DNS server.

•

Primary Tftp Server

and

Secondary Tftp Server (Optional)

: Enter the IP

address of the primary and secondary Tftp servers for the VLAN

•

WINS Server (Optional):

Enter the IP address for the WINS server or, if

present in your network, the Windows NetBios server.

•

Lease Time:

Enter the maximum connection time in hours that a dynamic IP

address is “leased” to a network user. When the time elapses, the user is

automatically assigned a new dynamic IP address. The default is 24 hours.

STEP

In the

LAN Proxies

section, check the

Enable DNS Proxy

box to allow the VLAN to

act as a proxy for all DNS requests and to communicate with the DNS servers of

the ISP. When this feature is disabled, all DHCP clients on the VLAN receive the

DNS IP addresses of the ISP.