Cisco 5505 - ASA Firewall Edition Bundle User manual

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco ASA 5505
Getting Started Guide
Software Version 8.0
Customer Order Number: DOC-78-18003=
Text Part Number: 78-18003-02

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT
NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT
ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR
THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE
INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU
ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A
COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as
part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE
PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED
OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL
DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR
INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
CCVP, the Cisco Logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn
is a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Ci sco ,
the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity,
Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient,
IOS, iPhone, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, iQuick Study, LightStream, Linksys, MeetingPlace, MGX, Networking
Academy, Network Registrar, Packet, PIX, ProConnect, RateMUX, ScriptShare, SlideCast, SMARTnet, StackWise, The Fastest Way to Increase
Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other
countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply
a partnership relationship between Cisco and any other company. (0704R)
Cisco ASA 5505 Getting Started Guide
© 2007 Cisco Systems, Inc. All rights reserved.

iii
ASA 5505 Getting Started Guide
78-18003-02
CONTENTS
CHAPTER 1Before You Begin 1-1
CHAPTER 2Deployment Planning 2-1
Scenarios for Deployment Planning and Configuration 2-2
Scenario 1: Private Network with External Connectivity 2-4
Scenario 2: Basic Installation with DMZ 2-5
Scenario 3: IPsec Remote-Access VPN 2-6
Scenario 4: SSL VPN 2-7
Scenario 5: Site-to-Site VPN 2-7
Scenario 6: Easy VPN Hardware Client 2-8
Where to Find Configuration Procedures 2-10
What to Do Next 2-10
CHAPTER 3Planning a VLAN Configuration 3-1
Understanding VLANs on the ASA 5505 3-1
About Physical Ports on the ASA 5505 3-2
About VLANs 3-2
Maximum Number and Types of VLANs 3-3
Deployment Scenarios Using VLANs 3-4
Basic Deployment Using Two VLANs 3-5
DMZ Deployment 3-7
Teleworker Deployment Using Three VLANs 3-8
What to Do Next 3-9

Contents
iv
ASA 5505 Getting Started Guide
78-18003-02
CHAPTER 4Installing the ASA 5505 4-1
Verifying the Package Contents 4-1
PoE Ports and Devices 4-3
Installing the Chassis 4-3
Connecting to Network Interfaces 4-4
Powering on the ASA 5505 4-5
Setting Up a PC for System Administration 4-6
Optional Procedures 4-7
Connecting to the Console 4-7
Installing a Cable Lock 4-8
Ports and LEDs 4-9
Front Panel Components 4-9
Rear Panel Components 4-12
What to Do Next 4-13
CHAPTER 5Configuring the Adaptive Security Appliance 5-1
About the Factory Default Configuration 5-1
Using the CLI for Configuration 5-2
Using the Adaptive Security Device Manager for Configuration 5-3
Preparing to Use ASDM 5-4
Gathering Configuration Information for Initial Setup 5-5
Installing the ASDM Launcher 5-5
Starting ASDM with a Web Browser 5-8
Running the ASDM Startup Wizard 5-9
What to Do Next 5-10
CHAPTER 6Scenario: DMZ Configuration 6-1
Basic Network Layout for a DMZ Configuration 6-1

v
ASA 5505 Getting Started Guide
78-18003-02
Contents
Example DMZ Network Topology 6-2
An Inside User Visits a Web Server on the Internet 6-4
An Internet User Visits the DMZ Web Server 6-6
An Inside User Visits the DMZ Web Server 6-8
Configuring the Security Appliance for a DMZ Deployment 6-10
Configuration Requirements 6-11
Information to Have Available 6-11
Starting ASDM 6-12
Enabling Inside Clients to Communicate with Devices on the Internet 6-14
Enabling Inside Clients to Communicate with the DMZ Web Server 6-15
Translating Internal Client IP Addresses Between the Inside and DMZ
Interfaces 6-16
Translating the Public Address of the Web Server to its Real
Address 6-19
Configuring Static PAT for Public Access to the DMZ Web Server (Port
Forwarding) 6-21
Providing Public HTTP Access to the DMZ Web Server 6-25
What to Do Next 6-28
CHAPTER 7Scenario: IPsec Remote-Access VPN Configuration 7-1
Example IPsec Remote-Access VPN Network Topology 7-1
Implementing the IPsec Remote-Access VPN Scenario 7-2
Information to Have Available 7-3
Starting ASDM 7-3
Configuring the ASA 5505 for an IPsec Remote-Access VPN 7-5
Selecting VPN Client Types 7-7
Specifying the VPN Tunnel Group Name and Authentication Method 7-8
Specifying a User Authentication Method 7-9
(Optional) Configuring User Accounts 7-11
Configuring Address Pools 7-12

Contents
vi
ASA 5505 Getting Started Guide
78-18003-02
Configuring Client Attributes 7-13
Configuring the IKE Policy 7-14
Configuring IPsec Encryption and Authentication Parameters 7-16
Specifying Address Translation Exception and Split Tunneling 7-17
Verifying the Remote-Access VPN Configuration 7-18
What to Do Next 7-19
CHAPTER 8Scenario: Configuring Connections for a Cisco AnyConnect VPN Client 8-1
About SSL VPN Client Connections 8-1
Obtaining the Cisco AnyConnect VPN Client Software 8-2
Example Topology Using AnyConnect SSL VPN Clients 8-3
Implementing the Cisco SSL VPN Scenario 8-3
Information to Have Available 8-4
Starting ASDM 8-5
Configuring the ASA 5505 for the Cisco AnyConnect VPN Client 8-7
Specifying the SSL VPN Interface 8-8
Specifying a User Authentication Method 8-9
Specifying a Group Policy 8-11
Configuring the Cisco AnyConnect VPN Client 8-12
Verifying the Remote-Access VPN Configuration 8-14
What to Do Next 8-15
CHAPTER 9Scenario: SSL VPN Clientless Connections 9-1
About Clientless SSL VPN 9-1
Security Considerations for Clientless SSL VPN Connections 9-2
Example Network with Browser-Based SSL VPN Access 9-3
Implementing the Clientless SSL VPN Scenario 9-4
Information to Have Available 9-5
Starting ASDM 9-5

vii
ASA 5505 Getting Started Guide
78-18003-02
Contents
Configuring the ASA 5505 for Browser-Based SSL VPN Connections 9-7
Specifying the SSL VPN Interface 9-8
Specifying a User Authentication Method 9-10
Specifying a Group Policy 9-11
Creating a Bookmark List for Remote Users 9-12
Verifying the Configuration 9-16
What to Do Next 9-18
CHAPTER 10 Scenario: Site-to-Site VPN Configuration 10-1
Example Site-to-Site VPN Network Topology 10-1
Implementing the Site-to-Site Scenario 10-2
Information to Have Available 10-3
Configuring the Site-to-Site VPN 10-3
Starting ASDM 10-3
Configuring the Security Appliance at the Local Site 10-5
Providing Information About the Remote VPN Peer 10-7
Configuring the IKE Policy 10-8
Configuring IPsec Encryption and Authentication Parameters 10-10
Specifying Hosts and Networks 10-11
Viewing VPN Attributes and Completing the Wizard 10-12
Configuring the Other Side of the VPN Connection 10-14
What to Do Next 10-14
CHAPTER 11 Scenario: Easy VPN Hardware Client Configuration 11-1
Using an ASA 5505 as an Easy VPN Hardware Client 11-1
Client Mode and Network Extension Mode 11-2
Configuring the Easy VPN Hardware Client 11-5
Starting ASDM With the ASDM Launcher 11-6
Configuring the Hardware Client 11-9

Contents
viii
ASA 5505 Getting Started Guide
78-18003-02
Configuring Advanced Easy VPN Attributes 11-11
What to Do Next 11-12
APPENDIX AObtaining a 3DES/AES License A-1

1-1
ASA 5505 Getting Started Guide
78-18003-02
CHAPTER
1
Before You Begin
Use the following table to find the installation and configuration steps that are
required for your implementation of the Cisco ASA 5505 Adaptive Security
Appliance.
To Do This... See...
Learn about typical deployments of the
ASA 5505
Chapter 2, “Deployment Planning”
Learn about VLANs and port allocation on
the ASA 5505
Chapter 3, “Planning a VLAN Configuration”
Install the chassis Chapter 4, “Installing the ASA 5505”
Perform initial setup of the adaptive
security appliance
Chapter 5, “Configuring the Adaptive Security
Appliance”
Configure the adaptive security appliance
for your implementation
Chapter 6, “Scenario: DMZ Configuration”
Chapter 7, “Scenario: IPsec Remote-Access VPN
Configuration”
Chapter 8, “Scenario: Configuring Connections for a
Cisco AnyConnect VPN Client”
Chapter 9, “Scenario: SSL VPN Clientless
Connections”
Chapter 10, “Scenario: Site-to-Site VPN
Configuration”
Chapter 11, “Scenario: Easy VPN Hardware Client
Configuration”

Chapter 1 Before You Begin
1-2
ASA 5505 Getting Started Guide
78-18003-02
Refine the configuration
Configure optional and advanced features
Cisco Security Appliance Command Line
Configuration Guide
Cisco Security Appliance Command Reference
Cisco Security Appliance Logging Configuration and
System Log Messages
To Do This... (continued) See...

2-1
ASA 5505 Getting Started Guide
78-18003-02
CHAPTER
2
Deployment Planning
This document is based on several example scenarios that represent typical
customer deployments of the ASA 5505. The deployment scenarios in this
chapter correspond to subsequent configuration chapters.
This chapter includes the following sections:
•Scenarios for Deployment Planning and Configuration, page 2-2
•Scenario 1: Private Network with External Connectivity, page 2-4
•Scenario 2: Basic Installation with DMZ, page 2-5
•Scenario 3: IPsec Remote-Access VPN, page 2-6
•Scenario 4: SSL VPN, page 2-7
•Scenario 5: Site-to-Site VPN, page 2-7
•Scenario 6: Easy VPN Hardware Client, page 2-8
•Where to Find Configuration Procedures, page 2-10
•What to Do Next, page 2-10

Chapter 2 Deployment Planning
Scenarios for Deployment Planning and Configuration
2-2
ASA 5505 Getting Started Guide
78-18003-02
Scenarios for Deployment Planning and
Configuration
An extended adaptive security appliance deployment can include two or more of
the different deployment scenarios described in this chapter. You can use the
scenarios in this chapter to help you determine how you want to deploy the
adaptive security appliance on your network, and then determine which
configuration chapters apply to you.
Figure 2-1 illustrates an extended network that includes most of the deployment
and configuration scenarios included in this document.

2-3
ASA 5505 Getting Started Guide
78-18003-02
Chapter 2 Deployment Planning
Scenarios for Deployment Planning and Configuration
Figure 2-1 Extended Network Deployment
190924
Web Server
Remote Site
Adaptive Security
Appliance
Mobile Client
Using VPN
software client
Scenario 3: IPSec VPN
Connection
Scenario 6: Site-to-site VPN
Connection
Email Server
Adaptive Security
Appliance
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
543210
Scenario 2: Basic Installation
with DMZ
Scenario 1: Basic Installation
Internet
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
543210
Mobile Client
Using Cisco SSL
VPN Client software
Scenario 4: Cisco SSL
VPN Client
Mobile Client
Clientless SSL VPN
Scenario 5: Cisco SSL
VPN Client

Chapter 2 Deployment Planning
Scenario 1: Private Network with External Connectivity
2-4
ASA 5505 Getting Started Guide
78-18003-02
Scenario 1: Private Network with External
Connectivity
A basic deployment that is typical for a small private network is shown in
Figure 2-2.
Figure 2-2 Private (Inside) Network with External Connectivity
In this example, the adaptive security appliance enables all devices on the private
network to communicate with each other and enables users on the private network
to communicate with devices on the Internet.
Note This deployment is similar to the security deployments using the PIX 501. If you
already have a security deployment with PIX 501 security appliances in which
devices behind the firewall can communicate internally and externally, you can
keep the same deployment and replace the PIX 501 devices with ASA 5505
devices.
190925
Personal
computer
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
543210
ISP Router
Laptop
computer
Printer
Internet
Private Network
Adaptive Security
Appliance
IP Phone
Outside Network

2-5
ASA 5505 Getting Started Guide
78-18003-02
Chapter 2 Deployment Planning
Scenario 2: Basic Installation with DMZ
For information about how to configure your adaptive security appliance for this
deployment, see Chapter 5, “Configuring the Adaptive Security Appliance.”
Scenario 2: Basic Installation with DMZ
In this scenario, the adaptive security appliance is used to protect network
resources located in a demilitarized zone (DMZ) in addition to the inside network.
A DMZ is a separate network located in the neutral zone between a private
(inside) network and a public (outside) network.
HTTP clients on the private network can access the web server in the DMZ and
can also communicate with devices on the Internet.
Figure 2-3 Private Network with DMZ
190926
Web Server
Email Server
Adaptive Security
Appliance
Private (Inside) Network
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
543210
Internet
ISP
Router DMZ
Outside Network
(Internet Connection)
Personal computers
Printer

Chapter 2 Deployment Planning
Scenario 3: IPsec Remote-Access VPN
2-6
ASA 5505 Getting Started Guide
78-18003-02
For information about configuring a DMZ deployment, see Chapter 6, “Scenario:
DMZ Configuration.”
Scenario 3: IPsec Remote-Access VPN
In this scenario, the adaptive security appliance is configured to accept
remote-access IPsec VPN connections. A remote-access VPN allows you to
create secure connections, or tunnels, across the Internet, which provides secure
access to off-site users.
Figure 2-4 IPsec Remote-Access VPN Connection
For information about how to configure an IPsec remote-access VPN deployment,
see Chapter 7, “Scenario: IPsec Remote-Access VPN Configuration.”
190927
WINS Server
DNS Server
Adaptive Security
Appliance
Private (Inside) Network
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
543210
ISP
Router
IPSec VPN
Connection
Mobile Client
running Cisco VPN
Client software
Personal computers
running Cisco VPN
Client software
Internet
Personal
computer

2-7
ASA 5505 Getting Started Guide
78-18003-02
Chapter 2 Deployment Planning
Scenario 4: SSL VPN
Scenario 4: SSL VPN
The adaptive security appliance supports two types of SSL VPN connections,
including:
•Remote clients running the Cisco SSL VPN AnyConnect Client software.
•Clientless SSL VPN connections, that is, SSL VPN connections established
with a remote system running a Web browser.
Figure 2-5 shows an adaptive security appliance configured to accept requests for
and establish both types of supported SSL VPN connections.
Figure 2-5 Network Layout for SSL VPN Scenario
Scenario 5: Site-to-Site VPN
In this scenario, two adaptive security appliances are configured to create a
site-to-site VPN.
Deploying a site-to-site VPN enables businesses to extend their networks across
low-cost public Internet connections to business partners and remote offices
worldwide while maintaining their network security. A VPN connection enables
191803
Inside
10.10.10.0
Outside
Security
Appliance
DNS Server
10.10.10.163
WINS Server
10.10.10.133
Internet
Internal
network
Clientless VPN access
Cisco AnyConnect
VPN Client
Cisco AnyConnect
VPN Client

Chapter 2 Deployment Planning
Scenario 6: Easy VPN Hardware Client
2-8
ASA 5505 Getting Started Guide
78-18003-02
you to send data from one location to another over a secure connection, or tunnel,
first by authenticating both ends of the connection, and then by automatically
encrypting all data sent between the two sites.
Figure 2-6 Network Layout for Site-to-Site VPN Configuration Scenario
For information about configuring a site-to-site VPN deployment, see Chapter 10,
“Scenario: Site-to-Site VPN Configuration.”
Scenario 6: Easy VPN Hardware Client
In this scenario, an ASA 5505 is deployed as a hardware client (sometimes called
a remote device). Deploying one or more VPN hardware clients in conjunction
with a VPN headend device enables companies with multiple sites to establish
secure communications among them and share network resources.
Deploying an Easy VPN solution with hardware clients simplifies the deployment
and management of a VPN in the following ways:
Internet
190928
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
543210
ISP Router
Site A
Adaptive Security
Appliance 1
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
543210
Site B
Adaptive Security
Appliance 2
Personal
computers
Printer
Personal
computers
Printer

2-9
ASA 5505 Getting Started Guide
78-18003-02
Chapter 2 Deployment Planning
Scenario 6: Easy VPN Hardware Client
•Hosts at remote sites no longer have to run VPN client software.
•Security policies reside on a central server and are pushed to the remote
hardware clients when a VPN connection is established.
•Few configuration parameters need to be set locally, minimizing the need for
on-site administration.
Figure 2-7 illustrates how the different Easy VPN components can be deployed.
Figure 2-7 ASA 5505 Installed as VPN Hardware Client
For information about how to configure the ASA 5505 as a VPN hardware client,
see Chapter 11, “Scenario: Easy VPN Hardware Client Configuration.”
Internet
190930
ISP
Router
ISP
router
Push remote
configuration
Central LAN
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
543210
ASA 5505
VPN Headend
Device
VPN Hardware
Client
CiscoASASSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
54210
ASA 5500 series
Cisco IOS router
with IPSec support

Chapter 2 Deployment Planning
Where to Find Configuration Procedures
2-10
ASA 5505 Getting Started Guide
78-18003-02
Where to Find Configuration Procedures
Each deployment scenario in this chapter has a corresponding configuration
chapter in this document that describes how to configure the ASA 5505 for that
type of deployment.
What to Do Next
Continue with Chapter 3, “Planning a VLAN Configuration.”
To Configure the ASA 5505 For This
Scenario.... See This Chapter...
Scenario 1: Private Network with
External Connectivity
Chapter 5, “Configuring the
Adaptive Security Appliance”
Scenario 2: Basic Installation with
DMZ
Chapter 6, “Scenario: DMZ
Configuration”
Scenario 3: IPsec Remote-Access VPN Chapter 7, “Scenario: IPsec
Remote-Access VPN Configuration”
Scenario 4: SSL VPN Chapter 8, “Scenario: Configuring
Connections for a Cisco AnyConnect
VPN Client”
Chapter 9, “Scenario: SSL VPN
Clientless Connections”
Scenario 5: Site-to-Site VPN Chapter 10, “Scenario: Site-to-Site
VPN Configuration”
Scenario 6: Easy VPN Hardware
Client
Chapter 11, “Scenario: Easy VPN
Hardware Client Configuration”