Cisco 5505 - ASA Firewall Edition Bundle User manual

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

Cisco ASA 5500 Series Configuration

Guide using ASDM

Software Version 6.3, for use with Cisco ASA 5500 Version 8.3

Customer Order Number: N/A, Online only

Text Part Number: OL-20339-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL

STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT

WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT

SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE

OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH

ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT

LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF

DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,

WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO

OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at

www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership

relationship between Cisco and any other company. (1005R)

Cisco ASA 5500 Series Configuration Guide using ASDM

 
iii
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
CONTENTS
About This Guide lix
Document Objectives lix
Audience lix
Related Documentation lx
Document Conventions lx
Obtaining Documentation, Obtaining Support, and Security Guidelines lx
PART
 
1Getting Started and General Information
CHAPTER
 
1Introduction to the Cisco ASA 5500 Series Adaptive Security Appliance 1-1
ASDM Client Operating System and Browser Requirements 1-1
ASA 5500 Model Support 1-2
Module Support 1-2
VPN Specifications 1-3
New Features 1-3
New Features in Version 6.3(2)/8.3(2) 1-3
New Features in Version 6.3(1)/8.3(1) 1-6
Unsupported Commands 1-13
Ignored and View-Only Commands 1-13
Effects of Unsupported Commands 1-14
Discontinuous Subnet Masks Not Supported 1-14
Interactive User Commands Not Supported by the ASDM CLI Tool 1-14
Firewall Functional Overview 1-15
Security Policy Overview 1-15
Permitting or Denying Traffic with Access Rules 1-16
Applying NAT 1-16
Protecting from IP Fragments 1-16
Using AAA for Through Traffic 1-16
Applying HTTP, HTTPS, or FTP Filtering 1-16
Applying Application Inspection 1-16
Sending Traffic to the Advanced Inspection and Prevention Security Services Module 1-16
Sending Traffic to the Content Security and Control Security Services Module 1-17
Applying QoS Policies 1-17
Applying Connection Limits and TCP Normalization 1-17

Contents

Cisco ASA 5500 Series Configuration Guide using ASDM

OL-20339-01

Enabling Threat Detection 1-17

Enabling the Botnet Traffic Filter 1-17

Configuring Cisco Unified Communications 1-18

Firewall Mode Overview 1-18

Stateful Inspection Overview 1-18

VPN Functional Overview 1-19

Security Context Overview 1-20

CHAPTER

2Getting Started 2-1

Configuring the Security Appliance for ASDM Access 2-1

Starting ASDM 2-1

Downloading the ASDM Launcher 2-2

Starting ASDM from the ASDM Launcher 2-2

Using ASDM in Demo Mode 2-3

Starting ASDM from a Web Browser 2-4

Multiple ASDM Session Support 2-5

Factory Default Configurations 2-5

Restoring the Factory Default Configuration 2-5

ASA 5505 Default Configuration 2-6

ASA 5510 and Higher Default Configuration 2-7

Getting Started With the Configuration 2-8

Using the Command Line Interface 2-8

Using the Command Line Interface Tool 2-9

Handling Command Errors 2-9

Using Interactive Commands 2-9

Avoiding Conflicts with Other Administrators 2-10

Showing Commands Ignored by ASDM on the Device 2-10

CHAPTER

3Using the ASDM User Interface 3-1

Information About the ASDM User Interface 3-1

Navigating in the ASDM User Interface 3-3

Menus 3-4

File Menu 3-4

View Menu 3-5

Tools Menu 3-6

Wizards Menu 3-8

Window Menu 3-9

Help Menu 3-9

Contents

Cisco ASA 5500 Series Configuration Guide using ASDM

OL-20339-01

Toolbar 3-10

ASDM Assistant 3-10

Status Bar 3-11

Connection to Device 3-11

Device List 3-11

Common Buttons 3-12

Keyboard Shortcuts 3-13

Enabling Extended Screen Reader Support 3-14

Organizational Folder 3-15

About the Help Window 3-15

Header Buttons 3-15

Browser Window 3-15

Home Pane (Single Mode and Context) 3-16

Device Dashboard Tab 3-16

Device Information Pane 3-17

Interface Status Pane 3-17

VPN Sessions Pane 3-17

Failover Status Pane 3-18

System Resources Status Pane 3-18

Traffic Status Pane 3-18

Latest ASDM Syslog Messages Pane 3-18

Firewall Dashboard Tab 3-19

Traffic Overview Pane 3-20

Top 10 Access Rules Pane 3-20

Top Usage Status Pane 3-20

Top Ten Protected Servers Under SYN Attack Pane 3-21

Top 200 Hosts Pane 3-21

Top Botnet Traffic Filter Hits Pane 3-21

Content Security Tab 3-21

Intrusion Prevention Tab 3-22

Home Pane (System) 3-24

CHAPTER

4Managing Feature Licenses 4-1

Supported Feature Licenses Per Model 4-1

Licenses Per Model 4-2

License Notes 4-9

VPN License and Feature Compatibility 4-11

Information About Feature Licenses 4-11

Contents

Cisco ASA 5500 Series Configuration Guide using ASDM

OL-20339-01

Preinstalled License 4-12

Permanent License 4-12

Time-Based Licenses 4-12

Time-Based License Activation Guidelines 4-12

How the Time-Based License Timer Works 4-12

How Permanent and Time-Based Licenses Combine 4-13

Stacking Time-Based Licenses 4-14

Time-Based License Expiration 4-14

Shared SSL VPN Licenses 4-14

Information About the Shared Licensing Server and Participants 4-15

Communication Issues Between Participant and Server 4-16

Information About the Shared Licensing Backup Server 4-16

Failover and Shared Licenses 4-17

Maximum Number of Participants 4-18

Failover Licenses 4-19

Failover License Requirements 4-19

How Failover Licenses Combine 4-19

Loss of Communication Between Failover Units 4-20

Upgrading Failover Pairs 4-20

Licenses FAQ 4-20

Guidelines and Limitations 4-21

Viewing Your Current License 4-23

Obtaining an Activation Key 4-23

Activating or Deactivating Keys 4-24

Configuring a Shared License 4-25

Configuring the Shared Licensing Server 4-25

Configuring the Shared Licensing Participant and the Optional Backup Server 4-26

Monitoring the Shared License 4-27

Feature History for Licensing 4-27

CHAPTER

5Configuring the Transparent or Routed Firewall 5-1

Configuring the Firewall Mode 5-1

Information About the Firewall Mode 5-1

Information About Routed Firewall Mode 5-2

Information About Transparent Firewall Mode 5-2

Licensing Requirements for the Firewall Mode 5-4

Default Settings 5-4

Guidelines and Limitations 5-5

Setting the Firewall Mode 5-7

Contents

vii

Cisco ASA 5500 Series Configuration Guide using ASDM

OL-20339-01

Configuring ARP Inspection for the Transparent Firewall 5-8

Information About ARP Inspection 5-8

Licensing Requirements for ARP Inspection 5-8

Default Settings 5-9

Guidelines and Limitations 5-9

Configuring ARP Inspection 5-9

Task Flow for Configuring ARP Inspection 5-9

Adding a Static ARP Entry 5-9

Enabling ARP Inspection 5-10

Feature History for ARP Inspection 5-11

Customizing the MAC Address Table for the Transparent Firewall 5-11

Information About the MAC Address Table 5-11

Licensing Requirements for the MAC Address Table 5-12

Default Settings 5-12

Guidelines and Limitations 5-12

Configuring the MAC Address Table 5-13

Adding a Static MAC Address 5-13

Disabling MAC Address Learning 5-13

Feature History for the MAC Address Table 5-14

Firewall Mode Examples 5-14

How Data Moves Through the Security Appliance in Routed Firewall Mode 5-14

An Inside User Visits a Web Server 5-15

An Outside User Visits a Web Server on the DMZ 5-16

An Inside User Visits a Web Server on the DMZ 5-17

An Outside User Attempts to Access an Inside Host 5-18

A DMZ User Attempts to Access an Inside Host 5-19

How Data Moves Through the Transparent Firewall 5-20

An Inside User Visits a Web Server 5-21

An Inside User Visits a Web Server Using NAT 5-22

An Outside User Visits a Web Server on the Inside Network 5-23

An Outside User Attempts to Access an Inside Host 5-24

PART

2Setting up the Adaptive Security Appliance

CHAPTER

6Configuring Multiple Context Mode 6-1

Information About Security Contexts 6-1

Common Uses for Security Contexts 6-2

Context Configuration Files 6-2

Context Configurations 6-2

Contents

viii

Cisco ASA 5500 Series Configuration Guide using ASDM

OL-20339-01

System Configuration 6-2

Admin Context Configuration 6-2

How the Security Appliance Classifies Packets 6-3

Valid Classifier Criteria 6-3

Classification Examples 6-4

Cascading Security Contexts 6-6

Management Access to Security Contexts 6-7

System Administrator Access 6-7

Context Administrator Access 6-8

Information About Resource Management 6-8

Resource Limits 6-8

Default Class 6-9

Class Members 6-10

Information About MAC Addresses 6-11

Default MAC Address 6-11

Interaction with Manual MAC Addresses 6-11

Failover MAC Addresses 6-11

MAC Address Format 6-11

Licensing Requirements for Multiple Context Mode 6-12

Guidelines and Limitations 6-12

Default Settings 6-13

Configuring Multiple Contexts 6-13

Task Flow for Configuring Multiple Context Mode 6-13

Enabling or Disabling Multiple Context Mode 6-14

Enabling Multiple Context Mode 6-14

Restoring Single Context Mode 6-14

Configuring a Class for Resource Management 6-15

Configuring a Security Context 6-17

Automatically Assigning MAC Addresses to Context Interfaces 6-19

Monitoring Security Contexts 6-20

Monitoring Context Resource Usage 6-20

Viewing Assigned MAC Addresses 6-21

Viewing MAC Addresses in the System Configuration 6-21

Viewing MAC Addresses Within a Context 6-22

Feature History for Multiple Context Mode 6-23

CHAPTER

7Using the Startup Wizard 7-1

Information About the Startup Wizard 7-1

Licensing Requirements for the Startup Wizard 7-1

Contents

Cisco ASA 5500 Series Configuration Guide using ASDM

OL-20339-01

Prerequisites for the Startup Wizard 7-2

Guidelines and Limitations 7-2

Startup Wizard Screens for ASA 5500 Series Adaptive Security Appliances 7-3

Startup Wizard Screens for the ASA 5505 Adaptive Security Appliance 7-3

Step 1 - Starting Point or Welcome 7-4

Step 2 - Basic Configuration 7-5

Step 3 - Time Zone and Clock Configuration 7-5

Step 4 - Auto Update Server 7-6

Step 5 - Management IP Address Configuration 7-6

Step 6 - Interface Selection 7-6

Step 7 - Switch Port Allocation 7-7

Step 8 - Interface IP Address Configuration 7-8

Step 9 - Internet Interface Configuration - PPPoE 7-8

Step 10 - Business Interface Configuration - PPPoE 7-9

Step 11 - Home Interface Configuration - PPPoE 7-10

Step 12 - General Interface Configuration 7-10

Step 13 - Static Routes 7-11

Adding or Editing Static Routes 7-11

Step 14 - DHCP Server 7-11

Step 15 - Address Translation (NAT/PAT) 7-12

Step 16 - Administrative Access 7-13

Adding or Editing Administrative Access Entry 7-13

Step 17 - Easy VPN Remote Configuration 7-14

Step 18 - Startup Wizard Summary 7-16

Other Interfaces Configuration 7-16

Editing Interfaces 7-16

Configuring IPv6 Neighbor Discovery 7-18

Configuring Neighbor Solicitation Messages 7-18

Configuring the Neighbor Solicitation Message Interval 7-19

Configuring the Neighbor Reachable Time 7-19

Configuring DAD Settings 7-20

Configuring IPv6 Addresses on an Interface 7-21

Configuring IPv6 Prefixes on an Interface 7-21

Configuring Router Advertisement Messages 7-22

Configuring the Router Advertisement Transmission Interval 7-23

Configuring the Router Lifetime Value 7-24

Suppressing Router Advertisement Messages 7-25

Configuring IPv6 Static Neighbors 7-25

Adding an IPv6 Static Neighbor 7-25

Contents

Cisco ASA 5500 Series Configuration Guide using ASDM

OL-20339-01

Editing Static Neighbors 7-26

Deleting Static Neighbors 7-26

Viewing and Clearing Dynamic Neighbors 7-27

Interface Configuration 7-27

Outside Interface Configuration - PPPoE 7-27

Outside Interface Configuration 7-28

Feature History for the Startup Wizard 7-29

CHAPTER

8Configuring Interfaces 8-1

Information About Interfaces 8-1

ASA 5505 Interfaces 8-2

Understanding ASA 5505 Ports and Interfaces 8-2

Maximum Active VLAN Interfaces for Your License 8-2

VLAN MAC Addresses 8-4

Power over Ethernet 8-4

Monitoring Traffic Using SPAN 8-4

ASA 5580 Interfaces 8-5

Auto-MDI/MDIX Feature 8-5

Security Levels 8-5

Dual IP Stack 8-6

Management Interface (ASA 5510 and Higher) 8-6

Licensing Requirements for Interfaces 8-6

Guidelines and Limitations 8-7

Default Settings 8-8

Starting Interface Configuration (ASA 5510 and Higher) 8-9

Task Flow for Starting Interface Configuration 8-9

Enabling the Physical Interface and Configuring Ethernet Parameters 8-10

Configuring a Redundant Interface 8-12

Changing the Active Interface 8-14

Configuring VLAN Subinterfaces and 802.1Q Trunking 8-14

Assigning Interfaces to Contexts and Automatically Assigning MAC Addresses (Multiple Context

Mode) 8-16

Starting Interface Configuration (ASA 5505) 8-16

Task Flow for Starting Interface Configuration 8-16

Configuring VLAN Interfaces 8-17

Configuring and Enabling Switch Ports as Access Ports 8-18

Configuring and Enabling Switch Ports as Trunk Ports 8-19

Completing Interface Configuration (All Models) 8-21

Other manuals for 5505 - ASA Firewall Edition Bundle

This manual suits for next models

Table of contents

Other Cisco Firewall manuals

Cisco

Cisco Firepower 2100 Series Quick reference guide

Cisco

Cisco FPR1010-ASA-K9 User manual

Cisco

Cisco Spam User manual

Cisco

Cisco PIX 520 - PIX Firewall 520 User manual

Cisco

Cisco 5505 - ASA Firewall Edition Bundle User manual

Cisco

Cisco ASA 5580 User manual

Cisco

Cisco IronPort C370 User manual

Cisco

Cisco Firepower 4100 Series Manual

Cisco

Cisco Firepower 2120 Manual

Cisco

Cisco ASA 5506-X User manual

Cisco

Cisco PIX 506E - Security Appliance User manual

Cisco

Cisco 5505 - ASA Firewall Edition Bundle User manual

Cisco

Cisco Cisco ASA 5510 User manual

Cisco

Cisco ASA 5508-X User manual

Cisco

Cisco Firepower 1100 Series Manual

Cisco

Cisco RV120W User manual

Cisco

Cisco 881W - Integrated Services Router Wireless Instruction Manual

Cisco

Cisco S190 User manual

Cisco

Cisco C170 User manual

Cisco

Cisco M690 User manual

Cisco

Cisco M190 User manual

Cisco

Cisco Meraki MX100 User manual

Cisco

Cisco Cisco ASA Series Installation instructions

Cisco

Cisco LightStream 1010 Installation instructions

Popular Firewall manuals by other brands

Fortinet

Fortinet FortiGate Voice Series install guide

ADTRAN

ADTRAN NetVanta 2300 Specifications

SecureLogix

SecureLogix ETM System installation guide

NETGEAR

NETGEAR ProSafe FVX538 Reference manual

Lanner

Lanner FW-8877 user manual

Huawei

Huawei USG6000 Series Upgrade guide

H3C

H3C SecPath F5000-AI-15 installation guide

Nexcom

Nexcom DNA 1150 user manual

Fortinet

Fortinet FortiGate-60 series install guide

Draytek

Draytek Vigor2860 Series user guide

Lanner electronics

Lanner electronics FW-7650 Series user manual

Swisscom

Swisscom Internet Backup manual

SonicWALL

SonicWALL NSa 5700 quick start guide

DPtech

DPtech FW1000 SERIES Maintenance manual

FEITIAN

FEITIAN MultiPass FIDO product manual

EBLOCKER

EBLOCKER PRO user manual

GTA

GTA GB-200 Product guide

Trend Micro

Trend Micro Deep Edge quick start guide