Sophos CR1500ia Startup Guide

PDF

Document

Unified Threat Management

CR1500ia POWER

RESET

A B C D

ESC

ENTER

CONSOLE

I J

K L

E F G H M N O P

U V W X

Q R S T

QUICK START GUIDE

CR1500ia Appliance

Document Version: PL QSG1500ia/96000/10.02.0.0.473/08082012

DEFAULTS

Default IP addresses

Ethernet Port IP Address

Z one

172.16.16.16/255.255.255.0 LAN

IP via DHCP WAN

Default Username & Password

Web Admin Console

Username admin

* Password admin

CLI Console (SSH/Serial Connection)

* Password admin

* Username and Password are case sensitive

UNDERSTANDING THE APPLIANCE

FRONT PANEL

LCD Display

(For future use)

Console Port

Console cable connects here

Cyberoam

Package Contents

Checking the package contents - Check that the package contents are complete.

One Cyberoam Appliance

One Serial Cable

One Power Cable

One Cyberoam Quick Start Guide

One Straight-through Ethernet Cable

Rack Mountain Kit

Serial Cable

AC Power Adapter with Cable

Quick Start Guide

Blue Straight-through

Ethernet Cable

If any items from the package are missing. please contact Cyberoam Support at [email protected]

Management Ports GBE Ports

HDD

BACK PANEL

System Fans

GBE Ports USB ports

(For future use)

GBE Ports

SFP ports

Fiber optic cables connect here

Power Switch

Power

Supply Fans

Power connectors

Power cables connect to power outlets

Console Port Use to connect to the Management computer

Configurable GBE Ports A,B,C,D,E,F,G,H,K,L,M,N,O,P,Q,R,S,T,U,V,W,X,Y,Z - Use these ports to connect the

Appliance to the Ethernet network

Mini GBIC SFP ports - To use these ports, you will require additional Fiber patch cords. Optionally you can convert these ports to function as Giga Ethernet ports by connecting a Fiber Optic Transceiver.

If you want to bypass Cyberoam in-case of power or Appliance failure when deployed as Bridge, use the pair of below mentioned ports: U-V, W-X

As Cyberoam does not pre-configure any ports for LAN, WAN, DMZ networks, it is not necessary to use any particular port for them. Usage of ports depends on how the physical connection is required or planned.

PLANNING THE CONFIGURATION

Before configuring, you need to plan the deployment mode of Cyberoam. Cyberoam can be placed in

Bridge or Gateway/Route mode according to your requirement.

To control the Internet access through Cyberoam the entire Internet bound traffic from the LAN network should pass through Cyberoam.

Gateway Mode

Configure as Gateway if you want to use Cyberoam as

A firewall or replace an existing Firewall

A gateway for routing traffic

Link load balancer and implement gateway failover functionality

Apart from configuring Gateway IP address (IP address through which all the traffic will be routed), you must also configure LAN and WAN IP addresses.

Internet LAN Network

10.10.10.1

10.10.10.2

10.10.10.3

61.10.15.18

Cyberoam in

Gateway mode Gateway mode policies controlling traffic between

LAN & DMZ networks.

WAN

61.10.15.17

Gateway mode policies controlling traffic between

LAN and WAN networks.

192.168.1.254

DMZ Network

Mail Server Web Server

192.168.1.9

192.168.1.5

Bridge Mode

Configure as Bridge if

You have a private network behind an existing firewall or behind a router and you do not want to replace the firewall.

You are already masquerading outgoing traffic.

Internet

Cyberoam in Bridge mode

LAN

LAN Network

10.10.10.254

10.10.10.5

10.10.10.1

Management IP

Bridge mode policies controlling traffic between

LAN and WAN networks

You will be able to manage and monitor the entire Internet traffic passing through Cyberoam, control web access and apply bandwidth and application restrictions, apply antivirus and antispam policy and IPS policy in either of the modes.

GETTING CONFIGURATION INFORMATION

Use the table given below to gather ISP (Internet Service Provider) information

If Internet connection is via

You are probably using

Get information Cyberoam configuration from

Network Configuration wizard

Select “Obtain an IP from

DHCP”

Cable modem,

DSL with a

Router

DHCP

Home

DSL/ADSL

T1/E1,

Static broadband,

Cable or DSL with a static IP

PPPoE

Static

-----------

Username

Password

IP address

Subnet mask

Gateway IP address

Primary DNS

Secondary DNS

How to get the information:

From the PC connected to the Internet: open a command prompt window, type the command ipconfig.

Select “Obtain an IP from

PPPoE”

Select “Use Static IP”

Use the tables given below to gather the information you need before proceeding to deploy the Appliance.

Gateway Mode

For all the required Ports

Ports IP address Subnet Mask Zone Type

A __.__.__.__

__.__.__.__

LAN/WAN/DMZ

__.__.__.__

LAN/WAN/DMZ

__.__.__.__

LAN/WAN/DMZ

Ports IP address Subnet Mask Zone Type

N __.__.__.__

__.__.__.__

LAN/WAN/DMZ

__.__.__.__

LAN/WAN/DMZ

__.__.__.__

LAN/WAN/DMZ

The LAN IP address and Subnet Mask must be valid for the respective networks.

Bridge Mode

Bridge IP address ___.___.___.___

IP address Subnet Mask ___.___.___.___

GENERAL SETTINGS

IP address of the Default Gateway

A default gateway is required for

Cyberoam to route connections to the Internet. ___.___.___.___

DNS IP Address

System Time Zone

System Date and Time

___.___.___.___

______________

Email ID of the administrator where Cyberoam will send System Alerts ______________

CONNECTING CYBEROAM

Ethernet connection

Connect one end of the straight-through cable into Port A on the Back panel of the Appliance and the other end into the Ethernet Adapter port of Management computer. Change the IP address of the management computer to 172.16.16.2 and the subnet mask to 255.255.255.0.

Connect one end of an Ethernet cable into Port B on the Back panel of the Appliance and the other end to your Internet connection e.g. DSL modem or cable modem. It is possible that cable might already be connected between your computer and your modem. If so, disconnect it from your computer and connect into Port B.

Internet

Switch

(Optional)

Management

Computer

Connect the AC Power connector into the Back panel of the Appliance and the other end into a standard AC receptacle and turn the power switch ON.

Start your management computer. Following Appliance LEDs light up:

Power - Green indicating that Appliance is ON

HDD - Red indicating that hard disk is Active

Port A, Port B (Front panel) - Green indicating an active connection

From the management computer:

Browse to https://172.16.16.16

Log on to the Cyberoam Web Admin Console using default username ‘admin’ and password ‘admin’.

Click Wizard icon to launch the Network Configuration wizard.

Prerequisite

Ethernet connection between management computer and Cyberoam.

2. Internet Explorer 7+ or Mozilla Firefox 1.5+ is required to access Cyberoam Web Admin Console.

Appliance LED Behavior

LED

Power

State

Green

HDD

GBE Ports

(Front panel)

Off

Flashing Red

Off

Flashing Amber (Left)

Amber (Left)

Green (Right)

Off

Description

Cyberoam appliance is ON

Cyberoam appliance is OFF

Activity going on

No activity

Network Activity at the Port

Correct cable is used and power is on port

Port is connected at the 1000Mbps

No link

Network Configuration Wizard guides you step-by-step through the configuration of the network parameters like IP address, subnet mask, and default gateway for Cyberoam. Use the configuration settings you have noted in section 4.

Click ' Start ' to start the configuration.

The Identity Based

UTM Appliance

Secure your enterprise with Cyberoam integrated

Internet security

Screen 1 - Network Configuration Wizard

CONFIGURE MODE

Gateway mode Bridge mode

To configure Cyberoam in Gateway mode, select the option Gateway Mode and click button.

To configure Cyberoam in Bridge mode, select the option Bridge Mode and click button.

Follow the on-screen steps to:

1. Configure Interface: Configure IP Address,

Subnet Mask and Zone for each port.

By default, Cyberoam binds ports A, B and C to

LAN, WAN and DMZ zones respectively. To enable interface for PPPoE, provide PPPoE details: Username and Password (only for

WAN zone)

1. Configure Bridge IP address and subnet mask.

2. Provide Gateway and DNS IP address.

Click Next to repeat the steps given above for each port.

2. Configure DNS server address: Click “Obtain an IP from DHCP” to override appliance

DNS and use DNS received from the external DHCP server

Refer to the screen titled Screen 2 - Zone and Network Configuration.

PortA

Obtain an IP from DHCP

Obtain an IP from PPPoE

Use Static IP

IP Address

Subnet Mask

10.10.10.1

255.255.255.0

Zone LAN

CR1500ia

Gateway Details

ISP Name

IP Address

PPPoE Details

User Name

Password

DNS Configuration

Obtain DNS from DHCP

Primary DNS

Secondary DNS

192.168.1.254

203.88.135.194

Screen 2 - Zone and Network Configuration

CONFIGURE INTERNET ACCESS

By default, Cyberoam applies 'General Internet Policy' as Internet access policy for LAN to WAN traffic.

Do not change the default setting .

Cyberoam provides 3 types of policies:

'Monitor Only' policy allows all LAN to WAN traffic

'General Internet' policy enables IPS and Virus scanning and allows LAN to WAN traffic except Unhealthy

Web and Internet traffic as defined by Cyberoam. This will include sites related to Adult contents, Drugs, Crime and Suicide, Gambling, Militancy and Extremist, Violence, Weapons, Phishing and Fraud and URL Translation sites.

'Strict Internet' policy enables IPS and Virus scanning and allows only authenticated LAN to WAN traffic.

Click button to configure the mail settings

Please select policy for LAN WAN traffic

Monitor Only

Allows access without authentication

Does not block any traffic

General Internet Policy

Blocks unhealthy web and

Internet traffic

Scan HTTP Traffic for

Viruses

Strict Internet Policy

Does not allow access without authentication

Screen 3 - Access Configuration

Until Intrusion Prevention System module is subscribed, IPS scanning will not be effective.

2 Until Gateway Anti Virus module is subscribed, virus scanning will not be effective.

CONFIGURE MAIL SETTINGS

1. Specify Administrator Email ID

2. Specify Mail server IP address

3. Specify email address that should be used to send the System Alerts

4. Click “Authentication Required” to enable SMTP authentication, if required and specify username and password.

Click button for Date and Time zone configuration

Configure Email and Mail Server settings for System Notifications

Send Notifications to Email Address [email protected]

Mail Server IP Address - Port

From Email Address

203.88.35.194

25 [email protected]

Authentication Required

Username

Password cyberoam

*****

Screen 4 - Mail Settings

CONFIGURE DATE AND TIME ZONE

Set time zone and current date

Enable clock synchronization with NTP server to tune Cyberoam's clock using global time servers.

Screen 5 - Date and Time Configuration

Click button to view the configured details. Copy the configured details for future use.

Click 'Finish' . It will take a few minutes to save the configuration details.

Configuring Gateway Mode

Wait for Sometime

Screen 6 - Network Configuration Wizard

On successful configuration the following page is displayed. https://172.16.16.16

- Click to access Web Admin Console

Screen 7 - Network Configuration Wizard

After a few seconds, click the URL to access the Web Admin Console.

Click Close button to close the

Network Configuration Wizard window.

Note:

If you change the LAN IP address (Gateway mode) or Bridge IP address (Bridge mode), you must use this address to reconnect to the Web Admin Console. You might also have to change the IP address of the management computer to be on the same subnet as the new IP address.

Refer to the ‘Guides’ section on http://docs.cyberoam.com for information on how to Control Traffic, and how to configure Anti-Virus Protection, Content Filtering, Spam Filtering, Intrusion Prevention System

(IPS), and Virtual Private Networking (VPN).

Congratulations!!!

This finishes the basic configuration of Cyberoam.

Your network is now protected from Internet-based threats and access to Adult contents, Drugs, Crime and

Suicide, Gambling, Militancy and Extremist, Violence, Weapons, Phishing and Fraud and URLTranslation sites are blocked.

WHAT NEXT?

1. Create Customer Account and register Appliance

Browse to http://customer.cyberoam.com and click Register and follow the on-screen steps.

It creates your customer account as well as register your appliance.

To subscribe for free 15-days trial subscription of Web and Application Filtering, IPS, Anti Virus and

Anti Spam, browse to http://customer.cyberoam.com and login with the credentials provided at the time of account creation.

2. Access Cyberoam Web Admin Console

Browse to https://<IP address of cyberoam> and log on using the default username (admin) and password (admin).

Note: Internet Explorer 7+ or Mozilla Firefox 1.5+ is required to access the Cyberoam Web Admin

Console.

Go to menu System Maintenance Licensing page and synchronize the registration details.

Registration and subscription details are displayed only after synchronization.

Configure the correct firewall rule for your Domain Name Server (DNS). You may not be able to access Internet if not configured properly.

Go to Firewall Rule Rule and edit default firewall rules to enable virus scanning.

For the below given steps, refer to Getting Started Guide (From Documentation CD supplied along with Appliance)

- Verify Configuration

- Configure Mail & Web server access.

Set authentication parameters

Go to Identity Authentication Authentication Server to define the authentication parameters.

Access Help

For accessing online help, click the Help button or F1 key on any of the screens to access the corresponding topic's help. Use the Contents and Index options to navigate through the entire online help.

Additional Resources

Visit following links for more information to configure Cyberoam

Technical Documentation http://docs.cyberoam.com

Cyberoam Knowledge Base http://kb.cyberoam.com

Cyberoam Security Center - http://csc.cyberoam.com

Cyberoam Upgrades http://download.cyberoam.com

Important Notes:

Important Notice

Cyberoam Technologies Pvt. Ltd. has supplied this Information believing it to be accurate and reliable at the time of printing, but is presented without warranty of any kind, expressed or implied. Users must take full responsibility for their application of any products. Cyberoam

Technologies Pvt. Ltd. assumes no responsibility for any errors that may appear in this document. Cyberoam Technologies Pvt. Ltd. reserves the right, without notice to make changes in product design or specifications. Information is subject to change without notice.

USER’S LICENSE

Use of this product is subject to acceptance of the terms and conditions of Cyberoam End User License Agreement (EULA) and Warranty

Policy for Cyberoam UTM Appliances. You will find the copy of the EULA at http://www.cyberoam.com/documents/EULA.html and the

Warranty Policy for Cyberoam UTM Appliances at http://kb.cyberoam.com

RESTRICTED RIGHTS

Technologies Pvt. Ltd.

Corporate Headquarters

Cyberoam Technologies Pvt. Ltd.

901, Silicon Tower, Off. C.G. Road,

Ahmedabad – 380006, INDIA.

Phone: +91-79-66065606

Fax: +91-79-26407640

Toll Free Numbers

USA : +1-800-686-2360

India : 1-800-301-00013

APAC/MEA : +1-877-777-0368

Europe : +44-808-120-3958

Unified Threat Management

Visit: www.cyberoam.com

Contact : sales@cy beroam.com

Hello! I am an AI chatbot specifically trained to assist you with the Sophos CR1500ia Quick guide. I have thoroughly reviewed the document and can help you locate the exact information you need or explain the content in clear and simple terms. Whether you’re looking for guidance on specific features, troubleshooting steps, or general usage, feel free to ask your questions. The more details you provide about your concerns or needs, the more accurately and effectively I can assist you!