Cisco SA 540 Security Appliance

Overview:

Cisco SA 540 Security Appliance is an all-in-one security solution that combines high-speed connectivity and integrated security capabilities. Featuring eight 10/100/1000 LAN ports, two 10/100/1000 WAN ports, VPN, firewall, and email and web protection, it is simple to install and manage and is supported by the Cisco Small Business Support Center. The Cisco SA 540 Security Appliance is a simple to install and use, all-in-one security solution designed specifically for businesses with less than 100 employees. Featuring eight high-speed LAN ports, it combines secure Internet, site-to-site, and remote connectivity with firewall, email and web security capabilities to protect a small business while improving employee productivity. It works seamlessly with other Cisco Small Business Pro products to deliver powerful, integrated solutions to unique small business problems and with 3-year peace of mind Cisco Small Business Pro Service helps to get the most investment value.

The Cisco SA 500 Series Security Appliances, part of the Cisco Small Business Pro Series, are comprehensive gateway security solutions that combine firewall, VPN, and optional web and email security capabilities, helping you feel confident that your business is protected and resilient. These easy-to-use security appliances let you control access to network resources, enabling you to protect business data and maximize network uptime. The Cisco SA 500 Series helps increase employee productivity by controlling web access, spam emails, phishing attacks, and other emerging threats, as well as by freeing IT resources from virus eradication and system cleanup activities. With the Cisco SA 500 Series, you can safely deploy new business applications without opening up security holes. Mobile employees and business partners can also securely connect to your network over the Internet using IP Security (IPsec) or Secure Sockets Layer (SSL) VPN services. With a Cisco SA 500 Series solution protecting your network, you can focus on growing your business without worrying about the latest security threats.

The Cisco SA 500 Series provides:

• Improved business resiliency: Prevent disruption of business-critical applications and services due to security breaches by implementing a robust business-grade firewall, along with support for IPS, email and web security.
• Enhanced authentication security for remote users: Prevent unauthorized access to your business network by using hardware- or software-generated one-time-use passwords.
• Increased employee productivity: Prevent the loss of employee productivity by protecting your network against spam, spyware, and inappropriate web browsing, using the optional Cisco ProtectLink Gateway. Reduced IT costs: Free up IT support resources and avoid the costly process of cleaning up infections due to spyware, viruses, and other malware by preventing them from occurring.
• Easy-to-deploy remote access: Allow employees and partners to quickly and easily connect to the business with SSL VPN.
• Improved business efficiency: Reduce costs associated with deployment, ongoing management, and monitoring of the security solution by using a single, easy-to-install, easy-to-use solution.
• Decreased liability: Reduce the company’s exposure to liability due to compromised data or inadequate corporate controls by implementing comprehensive access control and threat protection services in a single device.
• Peace of mind: Get maximum value from your Cisco solution with the Cisco Small Business Pro Service.

Challenge

The Internet has become a critical business tool for organizations of all sizes, offering new opportunities for business growth and allowing partners and remote workers to access the business network via VPN connections. But it is also a conduit for threats to enter a company's network, and these threats can have a significant negative impact:

• Unauthorized access can lead to loss of company data, unplanned downtime, and related liability concerns.
• Viruses can infect systems, bringing them down and resulting in outages and lost revenue.
• Spam and phishing create a nuisance and contribute to a loss of employee productivity.
• Spyware provides a direct inside view of your network and data that can lead to identity theft and business data loss.
• Browsing of non-work-related and harmful websites leads to lost productivity, exposure to viruses and spyware, and possible legal issues involving employees.

Solution:

The Cisco SA 500 Series provides small companies with comprehensive gateway security and VPN connectivity. With its combined firewall, email, and web security capabilities, the Cisco SA 500 Series stops threats before they enter the network and affect business operations. The Cisco SA 500 Series:

• Allows valid business traffic to flow while keeping out unwelcome visitors. It also supports a demilitarized zone (DMZ) to safely host file, web, and other Internet-accessible servers without exposing the business's internal LAN network to threats.
• Provides full-strength email and web protection at full speed: With robust content security capabilities delivered via the optional Trend Micro ProtectLink Gateway subscription offering, the Cisco SA 500 Series provides critical perimeter security services for comprehensive protection:
  • Full strength protection at full speed: ProtectLink Gateway services are delivered via a unique cloud-based approach. Emails destined for your small business are first inspected by Trend Micro, using enterprise-class inspection capabilities to stop a greater range of threats. For example, ProtectLink Gateway will scan your emails for more than 3 million different virus patterns and more than 400,000 spyware patterns. Additional antispam technology is provided via 10 different inspection technologies that evaluate not just the sender's network address reputation, but also the actual content of the email itself. Other small business products cannot make similar claims. In addition to the security benefits this approach provides, it avoids the compromise many other vendors make of having to slow down the bandwidth of traffic in order to inspect email and web content. With ProtectLink Gateway, more threats are stopped before they get to your business, without affecting bandwidth.
  • Antivirus: Award-winning antivirus technology shields your internal network resources from both known and unknown virus attacks, at the most effective point in your infrastructure, the Internet gateway. Filtering your email and web traffic at the perimeter eliminates the need for resource-intensive cleanup of an infection and helps ensure business continuity.
  • Antispyware: Blocking spyware at the gateway prevents it from entering your network through Internet traffic (HTTP and FTP) and email, avoiding costly spyware removal procedures and improving employee productivity.
  • Antispam: Effective blocking of spam, with very low false positives, helps restore the effectiveness of email, so that communication with customers, vendors, and partners continues uninterrupted.
  • Antiphishing: Identity theft protection guards against phishing attacks, thereby preventing employees from inadvertently disclosing company or personal details that could lead to financial loss.
  • URL filtering: Web and URL filtering can be used to control employee Internet usage by blocking access to inappropriate or non-work-related websites, improving employee productivity and limiting the risk of legal action by employees exposed to offensive web content.
• Increases the security of remote access: With support for VeriSign VIP services, the Cisco SA 500 Series provides two-factor authentication and one-time-use password access control for an increased level of remote access security without the need to purchase any additional authentication equipment.
• Offers easy deployment and management: The Cisco SA 500 Series can be managed via the embedded Security Appliance Configuration Utility, a powerful yet easy-to-use browser-based management and monitoring interface. This single solution provides comprehensive configuration and monitoring of all the services in a single application. The Security Appliance Configuration Utility can also be launched from Cisco Configuration Assistant. In addition, the Cisco SA 500 Series supports Simple Network Management Protocol (SNMP) monitoring.

Figures 1 and 2 show the interfaces for Cisco Configuration Assistant and the Security Appliance Configuration Utility.

Figure 1. Cisco Configuration Assistant Interface

Figure 2. Security Appliance Configuration Utility Interface

Features:

Cisco SA 500 Series Security Appliances feature all-in-one security, including:

• Secure remote access to business information with a built-in stateful packet inspection (SPI) firewall and VPN capabilities.
• Increased security of remote access: With support for optional VeriSign Identity Protection (VIP), the Cisco SA 500 Series provides two-factor authentication and one-time-use password access control.
• Lower costs associated with deployment and management based on a single, easy-to-install, easy-to-use solution.
• Prevent security breaches from email threats or malicious websites that could lead to disruption of business-critical applications and services.
• Increased employee productivity by helping prevent spam, spyware, and inappropriate web browsing with the optional Trend Micro ProtectLink Gateway.
• Easy deployment and management: The embedded Security Appliance Configuration Utility offers comprehensive configuration and monitoring of all the services in a single application.
• Affordable service coverage: The highest level of performance and reliability to keep your business running smoothly. Check out Small Business Pro Service.

Business Benefits:

The Cisco SA 500 Series Security Appliances provide security and connectivity that help you:

• Support evolving business needs: Safely deploy new applications by providing advanced application-layer security services for a wide range of popular applications, including web-based applications, email, voice over IP (VoIP), video, and multimedia applications.
• Enhance authentication security for remote users: Prevent unauthorized access to your business network by using hardware- or software-generated one-time-use passwords.
• Increase employee productivity: Prevent the loss of employee productivity by preventing spam, spyware, and inappropriate web browsing using the Trend Micro ProtectLink Gateway optional service.
• Improve business resiliency: Prevent disruption of business-critical applications and services due to security breaches by implementing a robust business-grade firewall along with support for email and web security.
• Reduce IT costs: Free up IT support resources and avoid the costly process of cleaning up infections due to spyware, viruses, and other malware by preventing them from occurring.
• Enable easy-to-deploy remote access: Allow employees and partners to quickly and easily connect to the business with SSL VPN.
• Achieve operational efficiency: Reduce costs associated with deployment and ongoing management and monitoring of the security solution by using a single, easy-to-install, easy-to-use solution.
• Decrease liability: Reduce the company's exposure to liability related to compromised data or inadequate corporate controls by implementing comprehensive access control and threat protection services in a single device.
• Enjoy peace of mind: Get maximum value from your Cisco solution through an affordable, subscription-based service offering. The Cisco Small Business Pro Service provides software upgrades and updates, extended access to the Cisco Small Business Support Center, and next-business-day hardware replacement.

Technical Specifications:

Models	SA 520	SA 520W	SA 540
SKU	SA520-K9	SA520W-K9	SA540-K9
Firewall:
Stateful packet inspection throughput*	200 Mbps	200 Mbps	300 Mbps
Unified threat management (UTM) throughput	200 Mbps	200 Mbps	300 Mbps
Connections	15,000	15,000	40,000
Rules	100	100	100
Schedules	Yes	Yes	Yes
VPN:
Triple Data Encryption Standard (3DES)/ Advanced Encryption Standard (AES) VPN throughput*	65 Mbps	65 Mbps	85 Mbps
IPsec VPN tunnels	50 max	50 max	100 max
SSL VPN tunnels	2 seats included; license required to upgrade to 25 seats (max)	2 seats included; license required to upgrade to 25 seats (max)	50 seats (max) included
Dead peer detection	Yes	Yes	Yes
IPsec Network Address Translation (NAT) traversal	Yes	Yes	Yes
NetBIOS broadcast over VPN	Yes	Yes	Yes
Trend Micro ProtectLink Gateway:
URL filtering	80+ categories	80+ categories	80+ categories
Web threat protection	Yes	Yes	Yes
Antispam protection	Yes	Yes	Yes
Virus patterns	More than 3 million	More than 3 million	More than 3 million
Spyware patterns	More than 420,000	More than 420,000	More than 420,000
Wireless:
802.11b/g/n	No	Yes	No
2 x 3 multiple input, multiple output (MIMO)	No	Yes	No
2.4 GHz	No	Yes	No
Wi-Fi Multimedia (WMM) quality of service (QoS)	No	Yes	No
Unscheduled automatic power save delivery (U-APSD) (WMM Power Save [WMM-PS])	No	Yes	No
MAC filtering	No	Yes	No
Wired Equivalent Privacy (WEP), Wi-Fi Protected Access Pre-Shared Key (WPA2-PSK), WPA2-ENT	No	Yes	No
Basic service set identifier (BSSID) or virtual access points	No	Yes; 4 supported	No
Ability to dynamically or manually adjust transmit power	No	Yes	No
Wi-Fi Protected Setup (WPS)	No	Yes	No
Other:
Routing	Static, Routing Information Protocol (RIP) v1, v2	Static, RIP v1, v2	Static, RIP v1, v2
VLANs	16	16	16
IPsec/Point-to-Point Tunneling Protocol (PPTP)/Layer 2 Tunneling Protocol (L2TP) pass-through	Yes	Yes	Yes
Message digest	MD5/SHA1/SHA2	MD5/SHA1/SHA2	MD5/SHA1/SHA2
Encryption	DES/3DES/AES	DES/3DES/AES	DES/3DES/AES
User database	100	100	400
Dynamic DNS (DDNS)	Yes	Yes	Yes
Load balancing	Yes	Yes	Yes
Integrated and automated failover and failback	Yes, using optional port for dual WAN	Yes, using optional port for dual WAN	Yes, using optional port for dual WAN
VeriSign VIP support	Yes	Yes	Yes
Physical interfaces	All Ethernet ports 10BASE-T, 100BASE-TX, 1000BASE-T capable 4 LAN ports 1 WAN port 1 optional port for use as LAN, WAN, or DMZ port 1 USB 2.0 port 1 power switch	All Ethernet ports 10BASE-T, 100BASE-TX, 1000BASE-T capable 4 LAN ports 1 WAN port 1 optional port for use as LAN, WAN, or DMZ port 1 USB 2.0 port 1 power switch 3 external antennas	All Ethernet ports 10BASE-T, 100BASE-TX, 1000BASE-T capable 8 LAN ports 1 WAN port 1 optional port for use as LAN, WAN, or DMZ port 1 USB 2.0 port 1 power switch
Environmental operating temperature	32º to 104ºF (0º to 40ºC)	32º to 104ºF (0º to 40ºC)	32º to 104ºF (0º to 40ºC)
Storage temperature	-4º to 158°F (-20º to 70°C)	-4º to 158°F (-20º to 70°C)	-4º to 158°F (-20º to 70°C)
Internal Power Supply:
Voltage range	90 to 264 VAC single phase	90 to 264 VAC single phase	90 to 264 VAC single phase
Input frequency	47 to 63 Hz	47 to 63 Hz	47 to 63 Hz
Output voltage regulation	11.4V ~ 12.6V	11.4V ~ 12.6V	11.4V ~ 12.6V
Output current	Max 2.5A	Max 2.5A	Max 2.5A
Physical Specifications:
Form factor	1 RU, 19-in. rack mountable	1 RU, 19-in. rack mountable	1 RU, 19-in. rack mountable
Dimensions (H x W x D)	1.73 x 12.12 x 7.08 inches (44 x 308 x 180 mm)	1.73 x 12.12 x 7.08 inches (44 x 308 x 180 mm)without antennas	1.73 x 12.12 x 7.08 inches (44 x 308 x 180 mm)
Weight (with internal power supply)	4.91 lb (2.23 kg)	5.15 lb (2.34 kg)	5.14 lb (2.34 kg)

* Performance test methodology: Maximum performance based on RFC 2544. All results are aggregate bidirectional. Actual performance may vary upon network environment and configuration.

Documentation:

Download the Cisco SA 500 Series Security Appliances Datasheet (PDF).