Cisco ASA 5500 Series, Vital in Cisco Secure Borderless Network

Cisco ASA Firewalls build on engineering behind the Cisco PIX 500 firewall, the Cisco IPS 4200 Series sensor, and the VPN 3000 model concentrator. These solutions enable the Cisco Adaptive Security Appliances (ASA) Firewall family to deliver a firewall that stops the widest range of threats. Cisco Adaptive Security Appliances Firewalls provide program security, network containment and control, and clean Virtual Private Network functionality throughout Cisco's product line. This breadth of security allows defense of any network area, including the most typical attack conduits such as remote sites, LAN-attached inside users, and off-site connected VPNs.

The CiscoASA 5500 Series includes the Cisco ASA 5505, 5510, 5520, 5540, 5550, 5580, and 5585-X Adaptive Security Appliances-purpose-built, high-performance security solutions that take advantage of Cisco's expertise in developing industry-leading, award-winning security and VPN solutions.

Through the Cisco MPF, the Cisco ASA 5500 Series brings a new level of security and policy control to applications and networks. MPF enables highly customizable, flow-specific security policies that have been tailored to application requirements. The performance and extensibility of the Cisco ASA 5500 Series is enhanced through user-installable SSMs. This adaptable architecture enables businesses to rapidly deploy security services when and where they are needed, such as tailoring inspection techniques to specific application and user needs or adding additional intrusion prevention and content security services such as those delivered by the Adaptive Inspection and Prevention (AIP) and Content Security and Control (CSC) SSMs. Furthermore, the modular hardware architecture of the Cisco ASA 5500 Series, along with the powerful MPF, provides the flexibility to meet future network and security requirements, extending the outstanding investment protection provided by the Cisco ASA 5500 Series and allowing businesses to adapt their network defenses to new threats as they arise.

All Cisco ASA 5500 Series appliances offer both IPsec and SSL/DTLS VPN solutions; Clientless and AnyConnect VPN features are licensed at various price points, on a per seat and per feature basis. By converging SSL and IPsec VPN services with comprehensive threat defense technologies, the Cisco ASA 5500 Series provides highly customizable, granular network access tailored to meet the requirements of diverse deployment environments, while providing advanced endpoint and network-level security.

Cisco ASA 5505 Adaptive SecurityAppliance

The Cisco ASA 5505 Adaptive Security Appliance is a next-generation, full-featured security appliance for small business, branch office, and enterprise teleworker environments. The Cisco ASA 5505 delivers high-performance firewall, SSL and IPsec VPN, and rich networking services in a modular, "plug-and-play" appliance. Using the integrated Cisco ASDM, the Cisco ASA 5505 can be rapidly deployed and easily managed, enabling businesses to minimize operations costs. The Cisco ASA 5505 features a flexible 8-port 10/100 Fast Ethernet switch, whose ports can be dynamically grouped to create up to three separate VLANs for home, business, and Internet traffic for improved network segmentation and security. The Cisco ASA 5505 provides two Power over Ethernet (PoE) ports, simplifying the deployment of Cisco IP phones with zero-touch secure voice over IP (VoIP) capabilities, as well as the deployment of external wireless access points for extended network mobility. A high-performance intrusion prevention and worm mitigation service is available with the addition of the AIP SSC. Multiple USB ports can be used to enable additional services and capabilities as they are needed.

As business needs grow, customers can install a Security Plus upgrade license, enabling the Cisco ASA 5505 to scale to support a higher connection capacity and up to 25 IPsec VPN users, add full DMZ support, and integrate into switched network environments through VLAN trunking support. Furthermore, this upgrade license maximizes business continuity by enabling support for redundant ISP connections and stateless Active/Standby high-availability services.

Businesses can also extend the Cisco ASA 5505's VPN service by enabling AnyConnect client and clientless VPN remote access to support various mobile workers and business partners. The Cisco Secure Remote Access Solution deployments can scale to serve up to 25 AnyConnect and/or clientless VPN concurrent users on each Cisco ASA 5505 by installing an Essential or a Premium AnyConnect VPN license.

This combination of market-leading security and VPN services, advanced networking features, flexible remote management capabilities, and future extensibility makes the Cisco ASA 5505 an excellent choice for businesses requiring a best-in-class small business, branch office, or enterprise teleworker security solution.

Cisco ASA 5510 Adaptive Security Appliance

The Cisco ASA 5510 Adaptive Security Appliance delivers advanced security and networking services for small and medium-sized businesses and enterprise remote/branch offices in an easy-to-deploy, cost-effective appliance. These services can be easily managed and monitored by the integrated Cisco ASDM application, thus reducing the overall deployment and operations costs associated with providing this high level of security. The Cisco ASA 5510 Adaptive Security Appliance provides high-performance firewall and VPN services and five integrated 10/100 Fast Ethernet interfaces. It optionally provides high-performance intrusion prevention and worm mitigation services through the AIP SSM, or comprehensive malware protection services through the CSC SSM. This unique combination of services on a single platform makes the Cisco ASA 5510 an excellent choice for businesses requiring a cost-effective, extensible, DMZ-enabled security solution.

As business needs grow, customers can install a Security Plus license, upgrading two of the Cisco ASA 5510 Adaptive Security Appliance interfaces to Gigabit Ethernet and enabling integration into switched network environments through VLAN support. This upgrade license maximizes business continuity by enabling Active/Active and Active/Standby high-availability services. Using the optional security context capabilities of the Cisco ASA 5510 Adaptive Security Appliance, businesses can deploy up to five virtual firewalls within an appliance to enable compartmentalized control of security policies on a departmental level. This virtualization strengthens security and reduces overall management and support costs while consolidating multiple security devices into a single appliance.

Businesses can extend their SSL and IPsec VPN capacity to support a larger number of mobile workers, remote sites, and business partners. Up to 250 AnyConnect and/or clientless VPN peers can be supported on each Cisco ASA 5510 by installing an Essential or a Premium AnyConnect VPN license; up to 250 IPsec VPN peers are supported on the base platform.

VPN capacity and resiliency can also be increased by taking advantage of the Cisco ASA 5510's integrated VPN clustering and load-balancing capabilities (available with a Security Plus license). The Cisco ASA 5510 supports up to 10 appliances in a cluster, offering a maximum of 2500 AnyConnect and/or clientless VPN peers or 2500 IPsec VPN peers per cluster. For business continuity and event planning, the Cisco ASA 5510 can also benefit from the Cisco VPN FLEX licenses, which enable administrators to react to or plan for short-term bursts of concurrent Premium VPN remote-access users, for up to a 2-month period.

Notes: More Details of Cisco ASA 5500 Family, Such as  Cisco ASA 5520, Cisco ASA 5540, Cisco ASA 5550, Cisco ASA 5580 Series...

Cisco Catalyst 3750 Switches-Features, Technology, Intelligent Switching, Network Management

The Cisco Catalyst 3750 Series switches are a premier line of enterprise-class, stackable, multilayer switches that provide high availability, security, and quality of service (QoS) to enhance the operation of the network. Its innovative unified stack management raises the bar in stack management, redundancy, and failover.

With a range of Fast Ethernet and Gigabit Ethernet configurations, the Cisco Catalyst 3750 Series can serve as both a powerful access layer switch for medium enterprise wiring closets and as a backbone switch for mid-sized networks. Customers can deploy network wide intelligent services, such as advanced QoS, rate-limiting, Cisco security access control lists (ACLs), multicast management, and high-performance IP routing—while maintaining the simplicity of traditional LAN switching. Embedded in the Cisco Catalyst 3750 Series is the Cisco Cluster Management Suite (CMS) Software, which allows users to simultaneously configure and troubleshoot multiple Cisco Catalyst desktop switches using a standard Web browser.

Cisco CMS Software provides new configuration wizards that greatly simplify the implementation of converged applications and network wide services.

The Cisco Catalyst switches are available with the SMI or the EMI. The Enhanced Multilayer Software Image enables a richer set of enterprise-class features, including hardware-based IP unicast and multicast routing, inter-VLAN routing, router access control lists (RACLs), and the Hot Standby Router Protocol (HSRP). Flexibility to upgrade to EMI after the initial deployment is provided through an EMI upgrade kit. Additional details about the differences between the SMI and EMI are provided later in this document.

More Q&A helps you know Cisco 3750 series well

Q. What software images do the Cisco Catalyst 3750 switches support?

A. the Cisco Catalyst switches are available with the SMI or the EMI.

The Enhanced Multilayer Software Image enables a richer set of enterprise-class features, including hardware-based IP unicast and multicast routing, inter-VLAN routing, router access control lists (RACLs), and the Hot Standby Router Protocol (HSRP). Flexibility to upgrade to EMI after the initial deployment is provided through an EMI upgrade kit. Additional details about the differences between the SMI and EMI are provided later in this document.

Q. Can I enable static IP routing using the SMI?

A. Yes, RIP and static routing are supported on the SMI. Dynamic IP routing protocols (OSPF, BGPv4, EIGRP, IGRP) are available only on the EMI.

Q. Is the EMI required to allow Layer 3 and Layer 4 lookups for QoS and security?

A. No. Both the SMI and the EMI allow for Layer 3 and Layer 4 lookups for QoS and security.

Q. Do the Cisco Catalyst 3750 switches support Inter-Switch Link (ISL) virtual LAN (VLAN) trunking?

A. Yes, the Cisco Catalyst 3750 switches support both 802.1Q trunking and ISL trunking. VLAN trunks can be created from any port using either standards-based 802.1Q tagging or the Cisco ISL VLAN architecture.

Q. Can the Cisco Catalyst 3750 Series switches stack with the Cisco Catalyst 3550 Series switches?

A. No, the Cisco Catalyst 3750 switches cannot stack with the Cisco Catalyst 3550 switches. The Cisco Catalyst 3750 switches’ new innovative Cisco StackWise technology with 32-Gbps high-speed stacking bus is not compatible with Cisco Catalyst 3550 switches’ Giga Stack stacking.

Overview on Technology 

The Cisco StackWise technology provides an innovative method for collectively using and extending the resources of a stack of units. Up to nine switches can be joined together to create a single switching unit with a virtual 32-Gbps stack interconnect. Furthermore, the entire stack can be managed as one unit with a single IP address. To the rest of the network, the stack operates as a single switch. With a unified management interface, the customer can with one command load a single image to all compatible switches on the stack. Cisco StackWise technology is optimized for Gigabit Ethernet deployment bringing customers new levels of performance through the high speed interconnect, resiliency through advanced failover mechanisms and ease of use through automated configuration and a single management interface.

Because of the Cisco StackWise technology, the Cisco Catalyst 3750 Series is highly scalable. There can be up to 252 Gigabit Ethernet ports in a stack. Switches within the stack can be added and removed without affecting user network access. New devices get the global configuration from the stack master, and replacement devices get the exact configuration of the old device. There is one configuration file with all stack member configurations. Its innovative design sets the bar of availability in stackable switches. It supports link and switch level redundancy.

The Cisco Catalyst 3750 supports cross-stack Ether Channel as well as Cross-Stack Uplink Fast (with sub second failover), and cross-stack equal cost routes across different switches in the stack. These features eliminate the need of relying on HSRP for router failures. In the case of Master switch failure, another Master switch takes over with minimal disruption within 2 to 3 seconds.

For more information about Cisco StackWise technology, go to:

http://www.cisco.com/go/catalyst3750.

SFPs are transceivers that provide Gigabit Ethernet connectivity from the Cisco Catalyst 3750 switches to distribution layer switches. They are functionally equivalent to Gigabit Interface Converters (GBICs), but are much smaller. Cisco Catalyst 3750 switches support 1000BASE-LX/LH and 1000BASE-SX SFPs. Like other Cisco switches and routers, the Cisco Catalyst 3750 switches do not interoperate with other vendors’ SFPs. The switch will shut down the port if an SFP is inserted that is not a Cisco SFP. Users can populate all the SFP ports of any Cisco Catalyst 3750 Switch with the same SFP or with a combination of different SFPs. Cisco Catalyst 3750 switches support the following Cisco SFPs: 1000BASE-SX and 1000BASE-LX/LH. The Cisco Catalyst 3750 switches can be supported by the Cisco RPS 675 and the Cisco RPS 300. Both the Cisco RPS 675 and RPS 300 provide superior internal power source redundancy for up to six Cisco networking devices. This results in improved fault tolerance and network uptime. For more information go to:

http://www.cisco.com/en/US/products/hw/accessor/ps2883/products_data_sheet09186a0080150e31.html.

The Cisco RPS 675 is the next-generation of the RPS 300. It provides more power (675W) than RPS 300 (300W). RPS 675 can provide up to 375W of –48V power, and 300W of 12V power. Unlike the Cisco RPS 300, the RPS 675 comes up in active mode. The customer does not need to push a button to activate the RPS 675 after a power failure.

The Cisco Catalyst 3750-24TS-E, 3750-48TS-E, 3750G-24T-E, 3750G-24TS-E are loaded with the Enhanced Multilayer Software Image, so all feature license fees are part of the standard list price. However, the Cisco Catalyst 3750-24TS-S, 3750-48TS-S, 3750G-24T-S, 3750G-24TS-S switches are loaded with the Standard Multilayer Software Image; these switches can be upgraded to the Enhanced Multilayer Software Image with the purchase of the Enhanced Multilayer Software Image upgrade kit (part number CD-3750-EMI=). The Standard Multilayer Software Image includes RIP and static routing. For dynamic IP routing features (BGPv4, OSFP, EIGRP, IGRP), the EMI is required.

The following features and functionality are supported with the Enhanced Multilayer Software Image:

•Dynamic IP routing protocols for load balancing and constructing scalable LANs:

–Open Shortest Path First (OSPF)

–Interior Gateway Routing Protocol (IGRP) and Enhanced IGRP (EIGRP)

–Border Gateway Protocol (BGPv4)

•Equal-cost routing for load balancing and redundancy

•Cisco standard and extended IP security Router RACLs for defining security policies on routed interfaces for control plane and data plane traffic

•Fallback bridging for forwarding of non-IP traffic between two or more VLANs

•Cisco Hot Standby Router Protocol (HSRP) to create redundant failsafe routing topologies

•Protocol-Independent Multicast (PIM) for IP multicast routing within a network that enables the network to receive the multicast feed requested and for switches not participating in the multicast to be pruned—support for PIM sparse mode (PIM-SM), PIM dense mode (PIM-DM), and PIM sparse-dense mode

•Distance Vector Multicast Routing Protocol (DVMRP) tunneling for interconnecting two multicast-enabled networks across no multicast networks

•Policy-based Routing (PBR) allows superior control by enabling flow redirection regardless of the routing protocol configured

Q and A: Intelligent Switching & Security

Q. Why do I need intelligence at the edge of my network?

A. Networks are evolving to address four new developments at the network edge:

• Increase in desktop computing power

• Introduction of bandwidth-intensive applications

• Expansion of highly sensitive data on the network

• Presence of multiple device types, such as IP phones and wireless LAN access points

These new demands are contending for resources with many existing mission-critical applications. As a result, IT professionals must view the edge of the network as critical to effectively manage the delivery of information and applications. As companies increasingly rely on networks as the strategic business infrastructure, it is more important than ever to ensure their high availability, security, scalability, and control. By adding Cisco intelligent functions to the wiring closet, customers can now deploy network wide intelligent services that address these requirements in a consistent way from the desktop to the core and through the WAN.

With Cisco Catalyst Intelligent Ethernet switches, Cisco helps companies to realize the full benefits of adding intelligent services to their networks. Deploying capabilities that make the network infrastructure highly available to accommodate time-critical needs, scalable to accommodate growth, secure enough to protect confidential information, and capable of differentiating and controlling traffic flows are key to further optimizing network operations.

Q. Can you provide more details on how Cisco intelligent switching will help my network?

A. New applications are requiring higher bandwidth and the need to differentiate and control the traffic flow.

Applications such as enterprise resource planning (ERP) (Oracle, SAP, etc.), voice (IP telephony traffic) and CAD/CAM require prioritization over less time-sensitive applications such as FTP or Simple Mail Transfer Protocol (SMTP). It would be highly undesirable to have a large file download destined to one port on a wiring closet switch and have quality implications such as increased latency in voice traffic, destined to another port on this switch. This condition is avoided by ensuring that voice traffic is properly classified and prioritized throughout the network. Cisco Intelligent Ethernet switches implement superior QoS to ensure that network traffic is classified prioritized, and congestion is avoided.

Q. How will the security needs of a network be handled?

A. With the rise in internal threats to a network, Cisco Ethernet switches enhance data security through a wide range of features including Secure Shell (SSH) and Simple Network Management Protocol version 3 (SNMPv3) protocols, ACLs, 802.1x, port security, private VLAN edge, Dynamic Host Configuration Protocol (DHCP) interface tracker, MAC address notification, and RADIUS/TACACS+. Depending on your security needs, the Cisco Catalyst 3550 Series complements devices such as firewalls, VPNs, and Intrusion Detection Systems.

Q. For security purposes, how can I protect unauthorized users from accessing my network?

A. the Cisco Catalyst 3750 supports 802.1x that works in conjunction with a RADIUS server to authenticate users as they access a network. The 802.1x standard is considered port-level security and is commonly used for wireless LANs. Additionally, portions of the network can be restricted by using ACLs. Access can be denied based on Media Access Control (MAC) addresses, IP addresses, or Transmission Control Protocol (TCP)/User Datagram Protocol (UDP) ports. ACL lookups are done in hardware—forwarding and routing performance is not compromised when implementing ACL-based security. An additional protection method is to use port security, which ensures the appropriate user is on the network by limiting access to the port based on MAC addresses.

Q. For security purposes, how can I monitor or track activities in my network?

A. Intrusion detection systems are tailored to monitor and track activities in a network. The Cisco Catalyst 3750 can complement this through features such as MAC address notification, which will send an alert to a management station so that network administrators know when and where users came on to the network and can take appropriate actions. The DHCP Interface Tracker (Option 82) feature will track where a user is physically connected on a network by providing both switch and port ID to a DHCP server.

Q. For security purposes, how do I protect administration passwords and traffic going to the switch during configuration or troubleshooting?

A. To protect administration traffic during the configuration or troubleshooting of a switch (such as passwords or device configuration settings), the best approach is to encrypt the data. Both SSH and SNMPv3 provide encryption of data during Telnet sessions and SNMP sessions.

Network Management

The Cisco Catalyst 3750 switches can be managed using the Web-based Cisco Cluster Management Suite (CMS) Software, which uses Cisco Switch Clustering technology. Cisco CMS is Web-based software that is embedded in Cisco Catalyst 3750, 3550, 2950, 3500 XL, 2900 XL, 2900 LRE XL, and 1900 switches. Through Cisco Switch Clustering technology, users access Cisco CMS with any standard Web browser to manage up to 16 of these switches at once, regardless of their geographic proximity with the option of using a single IP address if desired. With the addition of the Cisco Catalyst 3750 switches, Cisco CMS can now extend beyond routed boundaries for even more flexibility in managing a Cisco cluster.

Cisco CMS provides an integrated management interface for delivering intelligent services, enabling users to manage their entire LAN with one robust tool. By bringing the simplicity of traditional LAN switching to intelligent services such as multilayer switching, QoS, multicast, and security ACLs, Cisco CMS allows administrators to take advantage of benefits formerly reserved for only the most complex networks. The new Guide Mode in Cisco CMS leads the user step by step through the configuration of high-end features and provides enhanced online help for context-sensitive assistance. In addition, a Solution Wizard provides automated configuration of the switch for video streaming or video conferencing. Future software will provide Solution Wizards for voice over IP (VoIP), mission-critical applications, and security.

Cisco CMS supports standards-based connectivity options such as Ethernet, Fast Ethernet, Fast EtherChannel, Gigabit Ethernet, and Gigabit EtherChannel connectivity. Because Cisco Switch Clustering technology is not limited by proprietary stacking modules, stacking cables or interconnection media, Cisco CMS expands the traditional cluster domain beyond a single wiring closet and lets users mix and match interconnections to meet specific management, performance, and cost requirements.

Cisco Catalyst 3750 switches can be configured either as command or member switches in a Cisco switch cluster. Cisco CMS also allows the network administrator to designate a standby or redundant command switch, which takes the commander duties should the primary command switch fail. Other important features include the ability to configure multiple ports and switches simultaneously, as well as perform software updates across the entire cluster at once. Bandwidth graphs and link reports provide useful diagnostic information and the topology map gives network administrators a quick view of the network status.

More Details: PDF file of Cisco Catalyst 3750 Switches, such as more info of positioning, software updates, etc.

Networking Fundamentals

Computer Networking is any set of computers or devices connected to each other so as to communicate or exchange data. For a network to function, the devices must be interconnected. Network connections can be wired or wireless.

All networks are connected to enable communication with different kinds of media (wire or cables), which includes, twisted-pair copper wire cable, coaxial cable, optical fiber, power lines and various wireless technologies.

The devices can be separated by a few meters (e.g. via Bluetooth) or nearly unlimited distances (e.g. via the interconnections of the Internet).

In Wired networks, the medium is either copper, which carries electrical signals, or optical fibre, which carries light signals.

In Wireless networks, the medium of connection or mode of transmitting is radio waves, space, or microwaves. Wireless networks may include the home wireless connection between a wireless router and a computer with a wireless network card, the global wireless connection between two ground stations, or the communication between devices on earth and satellites then received via the internet.

Examples of Networks are:

Local Area Network. (LAN)

A LAN (Local Area Network) is an individual network that covers a single geographical area, providing networking services and applications to people within a common managerial structure, such as a single business, campus or region.

A LAN is usually administered by a single organization. The administrative control that governs the security and access control policies are enforced on the network level. LANs and WANs are very useful to individual organizations. They connect the users within the organization. They allow many forms of communication including exchange e-mails, corporate training, and other resource sharing. 

Wide Area Network. (WAN)

WAN that is usually a larger network that covers a large geographic area. An example of this is an organization that uses a WAN to interconnect their offices in different countries. The largest and best example of a WAN is the Internet, which is a network of networks, composed of many smaller networks. The Internet is considered the largest network in the world.

Main Features of WANs:

• WANs generally connect devices that are separated by a broader geographical area than can be served by a LAN.
• WANs use the services of carriers, such as telephone companies, cable companies, satellite systems, and network providers.
• WANs use serial connections of various types to provide access to bandwidth over large geographic areas.

Wireless LANs and WANs. (WLAN & WWAN)

WLAN & WWAN are the wireless equivalent of the LAN and WAN. But there are no wires between end devices and servers. Communication or data is transferred over sets of radio transceivers or waves. These types of networks are beneficial when it is too costly or inconvenient to run the necessary cables.. The media access protocols for LANs come from the IEEE.

Components of the Network
The path that a message takes from source to destination can be as simple as a single cable connecting one computer to another or as complex as a network that literally spans the globe. This network infrastructure is the platform that supports our human network. It provides the stable and reliable channel over which our communications can occur.

Devices and Media

Devices and media are the physical elements or hardware of the network. Hardware is often the visible components of the network platform such as a laptop, a PC, a Switch, Router or the cabling used to connect the devices. Occasionally, some components may not be so visible. In the case of wireless media, messages are transmitted through the air using invisible radio frequency or infrared waves.

More Networking info you can visit: http://blog.router-switch.com/