Cisco Content Security Management Appliance M390

Overview:

Centralize management and reporting functions across multiple Cisco® Email Security Appliances (ESAs) and Cisco Web Security Appliances (WSAs) with the Cisco Content Security Management Appliance (SMA). The integration of Cisco SMA with Cisco ESAs and WSAs simplifies the planning and administration of email and web security, improves compliance monitoring, makes possible a consistent enforcement of acceptable-use policies, and enhances threat protection.

Organizations must often coordinate the management and administration of multiple appliances across geographically dispersed teams with a limited staff and budget. Built on a robust platform optimized for reporting and tracking, the Cisco SMA delivers high performance and scalability plus industry-leading protection and control for long-term investment value.

Simplified Administration and Planning

Using the Cisco SMA’s easy-to-use intuitive interface, network managers can publish policy settings and configuration changes from a single console to multiple Cisco ESAs and WSAs. Alternatively, organizations can dedicate specific appliances to individual applications for high-volume deployments.

In addition, network managers can be notified when security appliances exceed their recommended capacity. The Cisco SMA reports the number of transactions per second and the system’s latency, response time, and proxy buffer memory. This information enables network managers to determine when they need to reconfigure the system or install additional appliances.

Improved Compliance Monitoring and Enforcement

Centralized reporting and tracking help determine which users are in violation of acceptable use policies, identify policy infractions across any department or site, and monitor the use of Web 2.0 applications such as Facebook and YouTube as well as visits to URLs in specific categories such as ”gambling” or ”sports”.

By centralizing the management of multiple appliances, administrators can enforce consistent acceptable use policies across the organization.

Enhanced Threat Protection

The Cisco SMA delivers a comprehensive view of an organization’s security operations, providing better threat intelligence, defense, and remediation. Important features include the centralized management of email spam quarantine, comprehensive threat monitoring across multiple web security gateways, web reputation scoring, and botnet detection. The Cisco SMA’s reporting capabilities can also be used to help administrators identify and address activities involving data loss prevention (DLP).

High Performance and Scalability

The Cisco SMA has two proprietary databases optimized for reporting and tracking, rather than a single generic database. Appropriate computations are applied to each query for the rapid generation of real-time reports.

Built on the high-performance Cisco AsyncOS® operating system, the Cisco SMA provides industryleading scalability to meet the demands of small, medium-sized, and large enterprises as well as service providers.

Flexible Deployment with the Cisco Content Security Management Virtual Appliance

The Cisco Content Security Management Virtual Appliance (SMAV) significantly lowers the cost of managing email and web security, especially in highly distributed networks. Your network manager can create instances where and when they are needed, using your existing network infrastructure. The Cisco SMAV is a software version of the Cisco SMA and runs on top of a VMware ESXi hypervisor and Cisco Unified Computing System™ (Cisco UCS®) servers. You will receive an unlimited number of Cisco SMAV instances with the purchase of a SMA software license for any of the Cisco Email or Web Security software bundles.

Features and Benefits:

Feature	Benefits
Centralized management and reporting	The Cisco SMA simplifies administration by publishing configurations from a single management console to multiple Cisco WSAs. Updates and settings are managed centrally on that console rather than on the individual appliances. Organizations can dedicate specific appliances to individual applications for high-volume deployments. Fully integrated reporting allows traffic data from multiple Cisco ESAs and WSAs to be consolidated.
Message tracking	Data is aggregated from multiple Cisco ESAs, including data categorized by sender, recipient, message subject, and other parameters. Scanning results, such as spam and virus verdicts, are also displayed, as are policy violations.
Web tracking	A record of individual web transactions is maintained, with information such as IP address, username, domain name, time accessed, and other details. Visibility is provided into employee use of Web 2.0 applications such as Facebook, YouTube, and instant messaging.
Web reporting	Web tracking information is aggregated in real time and displayed in a high-level, easy-to-use graphical format. Reporting features help administrators determine the websites, URL categories, and applications that employees can access on company devices.
Spam quarantining	Spam and marketing messages are stored centrally with the easy-to-use self-service Cisco Spam Quarantine solution. Large enterprises with multiple Cisco ESAs can offload their spam traffic to one location for easier tracking and provide a single point for employee access.
Threat monitoring	Data about web-based threats is provided in real time, including, for example, which users are encountering the most blocks or warnings, and which websites and URL categories pose the biggest risks. Malware and other threats that Cisco WSAs have detected and blocked are also reported.
Reputation scoring	This feature provides detailed information about the reputation scores of the websites that users access. These scores are based on data provided by Cisco WSAs, which analyze web server behavior and assign a score to each URL that reflects the likelihood that it contains malware.
Botnet detection	Ports and systems with potential malware connections are displayed. Data from the Layer 4 traffic monitoring feature on Cisco WSAs can help organizations detect and remediate botnet-infected hosts.

Specifications:

	SMA M190	SMA M195	SMA M390	SMA M395	SMA M690	SMA M695
Performance
	Small to midsize businesses or branch offices	Small to midsize businesses or branch offices	Medium-sized enterprise	Medium-sized enterprise	Large enterprise	Large enterprise
Number of Users*	Up to 2000	Up to 2000	2000 to 10,000	2000 to 10,000	10,000 or more	10,000 or more
Disk Space	1.2 TB (2 x 600-GB SAS)	1.2 TB (2 x 600-GB SAS)	3.6 TB (6 x 600-GB SAS)	4.8 TB (8 x 600-GB SAS)	6.0 TB (10 x 600-GB SAS)	9.6 TB (16 x 600-GB SAS)
Raid Mirroring	Yes (RAID 1)	Yes (RAID 1)	Yes (RAID 10)	Yes (RAID 10)	Yes (RAID 10)	Yes (RAID 10)
Memory	8 GB DDR4	16 GB DDR4	16 GB DDR4	16 GB DDR4	32 GB DDR4	32 GB DDR4
CPUs	1 x 1.9 GHz, 6 core	1 x 2.1 GHz, 8 core	2 x 2.4 GHz, 6 core	1 x 2.1 GHz, 12 core	2 x 2.4 GHz, 6 core	2 x 2.1 GHz, 8 core
Hardware
Rack units (RU)	1 Rack Unit (1RU)	1 Rack Unit (1RU)	1 Rack Unit (1RU)	1 Rack Unit (1RU)	2 Rack Units (2RU)	2 Rack Units (2RU)
Dimensions (H x W x D)	1.7 x 19 x 31 in. (4.3 x 48.3 x 78.7 cm)	1.7 x 16.89 x 29.8 in. (4.32 x 43.0 x 75.6 cm)	1.7 x 19 x 31 in. (4.3 x 48.3 x 78.7 cm)	1.7 x 16.89 x 29.8 in. (4.32 x 43.0 x 75.6 cm)	3.4 in. x 19 in. x 29 in (8.6 x 48.3 x 73.7 cm)	3.4 x 16.9 x 29.5 in. (8.64 x 42.92 x 74.93 cm)
Redundant power supply	Yes, Accessory option	Yes, Accessory option	Yes	Yes	Yes	Yes
Remote power cycling	Yes	Yes	Yes	Yes	Yes	Yes
DC power option	No	No	No	No	Yes (930W)	No
Hot-swappable hard disk	Yes	Yes	Yes	Yes	Yes	Yes
Power Consumption	2626 BTU/hr	2626 BTU/hr	2626 BTU/hr	2626 BTU/hr	2216.5 BTU/hr	3582 BTU/hr
Power Supply	770W	770W	770W	770W	650W	1050W
Fiber option	No	No	No	No	Yes, separate SKUs 2 port 1G Base-SX Fiber: SMA-M690-1G 2 port 10G Base-SR Fiber: SMA-M690-10G	Yes, separate SKU 2-port 1GBASE-SX Fiber or 10GBASE-SR Fiber selectable upon ordering (modules included): SMA-C695F
Ethernet interfaces	2-port 1GBASE-T copper network interface (NIC), RJ-45	2-port 1GBASE-T copper network interface (NIC), RJ-45	6 port 1G Base-T copper network interface (NICs), RJ - 45	6 port 1G Base-T copper network interface (NICs), RJ - 45	6-port 1GBASE-T copper network interface (NIC), RJ-45	6-port 1GBASE-T copper network interface (NIC), RJ-45
HD Size	1.2 TB (2 x 600-GB SAS)	1.2 TB (2 x 600 12G SAS 10K RPM SFF HDD)	Six 600 GB Hard Disk drives	Eight 600 GB Hard Disk drives	Sixteen 600 GB hard disk drives (2.5” 12G SAS 10K RPM) are installed into front-panel drive bays that provide hot-swappable access for SAS drives	Ten 600 GB hard disk drives (2.5” 10K SAS 4Kn) are installed into front-panel drive bays that provide hot-swappable access for SAS drives
CPU	1 x 1.9GHz, 6C	1 x 2.1GHz, 8C	Two E5–2620 v3 processor	One 2.1GHz 12c 2400MHz processor	Two E5–2620 v3 processors	Two 2.1GHz 8c 2400MHz processor
RAM	8 GB, DDR4	16 GB, DDR4	Two 8GB DDR4-2133 DIMM1	One 16GB DDR4-2666 DIMM1	Four 8GB DDR4-2133 DIMM1	Two 16GB DDR4-2666 DIMM1
Speed (Mbps)	10/100/1000, autonegotiate	10/100/1000, autonegotiate	10/100/1000, autonegotiate	10/100/1000, autonegotiate	10/100/1000, autonegotiate	10/100/1000, autonegotiate

*Please confirm sizing guidance with a Cisco content security specialist to help ensure that your solution will meet your current and projected needs.

Table: Cisco SMAV

SMA Users	Model	Disk	Memory	CPUs
Evaluations only	Cisco SMAV M000v	250 GB (10K RPM SAS)	4 GB	1 (2.7 GHz)
Small Enterprise (up to 1K)	Cisco SMAV M100v	250 GB (10K RPM SAS)	6 GB	2 (2.7 GHz)
Medium Enterprise (up to 5K)	Cisco SMAV M300v	1024 GB (10K RPM SAS)	8 GB	4 (2.7 GHz)
Large enterprise or service provider	Cisco SMAV M600v	2032 GB (10K RPM SAS)	8 GB	8 (2.7 GHz)
Servers
Cisco UCS	VMware ESXi 5.0, 5.1, and 5.5 Hypervisor

Documentation:

Download the Cisco Content Security Management Appliance Data Sheet (PDF).