Cisco 5505 - ASA Firewall Edition Bundle User manual

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco ASA 5500 Series Configuration
Guide using ASDM
Software Version 6.3, for use with Cisco ASA 5500 Version 8.3
Customer Order Number: N/A, Online only
Text Part Number: OL-20339-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at
www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1005R)
Cisco ASA 5500 Series Configuration Guide using ASDM
Copyright © 2010 Cisco Systems, Inc. All rights reserved.

iii
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
CONTENTS
About This Guide lix
Document Objectives lix
Audience lix
Related Documentation lx
Document Conventions lx
Obtaining Documentation, Obtaining Support, and Security Guidelines lx
PART 1Getting Started and General Information
CHAPTER 1Introduction to the Cisco ASA 5500 Series Adaptive Security Appliance 1-1
ASDM Client Operating System and Browser Requirements 1-1
ASA 5500 Model Support 1-2
Module Support 1-2
VPN Specifications 1-3
New Features 1-3
New Features in Version 6.3(2)/8.3(2) 1-3
New Features in Version 6.3(1)/8.3(1) 1-6
Unsupported Commands 1-13
Ignored and View-Only Commands 1-13
Effects of Unsupported Commands 1-14
Discontinuous Subnet Masks Not Supported 1-14
Interactive User Commands Not Supported by the ASDM CLI Tool 1-14
Firewall Functional Overview 1-15
Security Policy Overview 1-15
Permitting or Denying Traffic with Access Rules 1-16
Applying NAT 1-16
Protecting from IP Fragments 1-16
Using AAA for Through Traffic 1-16
Applying HTTP, HTTPS, or FTP Filtering 1-16
Applying Application Inspection 1-16
Sending Traffic to the Advanced Inspection and Prevention Security Services Module 1-16
Sending Traffic to the Content Security and Control Security Services Module 1-17
Applying QoS Policies 1-17
Applying Connection Limits and TCP Normalization 1-17

Contents
iv
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
Enabling Threat Detection 1-17
Enabling the Botnet Traffic Filter 1-17
Configuring Cisco Unified Communications 1-18
Firewall Mode Overview 1-18
Stateful Inspection Overview 1-18
VPN Functional Overview 1-19
Security Context Overview 1-20
CHAPTER 2Getting Started 2-1
Configuring the Security Appliance for ASDM Access 2-1
Starting ASDM 2-1
Downloading the ASDM Launcher 2-2
Starting ASDM from the ASDM Launcher 2-2
Using ASDM in Demo Mode 2-3
Starting ASDM from a Web Browser 2-4
Multiple ASDM Session Support 2-5
Factory Default Configurations 2-5
Restoring the Factory Default Configuration 2-5
ASA 5505 Default Configuration 2-6
ASA 5510 and Higher Default Configuration 2-7
Getting Started With the Configuration 2-8
Using the Command Line Interface 2-8
Using the Command Line Interface Tool 2-9
Handling Command Errors 2-9
Using Interactive Commands 2-9
Avoiding Conflicts with Other Administrators 2-10
Showing Commands Ignored by ASDM on the Device 2-10
CHAPTER 3Using the ASDM User Interface 3-1
Information About the ASDM User Interface 3-1
Navigating in the ASDM User Interface 3-3
Menus 3-4
File Menu 3-4
View Menu 3-5
Tools Menu 3-6
Wizards Menu 3-8
Window Menu 3-9
Help Menu 3-9

Contents
v
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
Toolbar 3-10
ASDM Assistant 3-10
Status Bar 3-11
Connection to Device 3-11
Device List 3-11
Common Buttons 3-12
Keyboard Shortcuts 3-13
Enabling Extended Screen Reader Support 3-14
Organizational Folder 3-15
About the Help Window 3-15
Header Buttons 3-15
Browser Window 3-15
Home Pane (Single Mode and Context) 3-16
Device Dashboard Tab 3-16
Device Information Pane 3-17
Interface Status Pane 3-17
VPN Sessions Pane 3-17
Failover Status Pane 3-18
System Resources Status Pane 3-18
Traffic Status Pane 3-18
Latest ASDM Syslog Messages Pane 3-18
Firewall Dashboard Tab 3-19
Traffic Overview Pane 3-20
Top 10 Access Rules Pane 3-20
Top Usage Status Pane 3-20
Top Ten Protected Servers Under SYN Attack Pane 3-21
Top 200 Hosts Pane 3-21
Top Botnet Traffic Filter Hits Pane 3-21
Content Security Tab 3-21
Intrusion Prevention Tab 3-22
Home Pane (System) 3-24
CHAPTER 4Managing Feature Licenses 4-1
Supported Feature Licenses Per Model 4-1
Licenses Per Model 4-2
License Notes 4-9
VPN License and Feature Compatibility 4-11
Information About Feature Licenses 4-11

Contents
vi
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
Preinstalled License 4-12
Permanent License 4-12
Time-Based Licenses 4-12
Time-Based License Activation Guidelines 4-12
How the Time-Based License Timer Works 4-12
How Permanent and Time-Based Licenses Combine 4-13
Stacking Time-Based Licenses 4-14
Time-Based License Expiration 4-14
Shared SSL VPN Licenses 4-14
Information About the Shared Licensing Server and Participants 4-15
Communication Issues Between Participant and Server 4-16
Information About the Shared Licensing Backup Server 4-16
Failover and Shared Licenses 4-17
Maximum Number of Participants 4-18
Failover Licenses 4-19
Failover License Requirements 4-19
How Failover Licenses Combine 4-19
Loss of Communication Between Failover Units 4-20
Upgrading Failover Pairs 4-20
Licenses FAQ 4-20
Guidelines and Limitations 4-21
Viewing Your Current License 4-23
Obtaining an Activation Key 4-23
Activating or Deactivating Keys 4-24
Configuring a Shared License 4-25
Configuring the Shared Licensing Server 4-25
Configuring the Shared Licensing Participant and the Optional Backup Server 4-26
Monitoring the Shared License 4-27
Feature History for Licensing 4-27
CHAPTER 5Configuring the Transparent or Routed Firewall 5-1
Configuring the Firewall Mode 5-1
Information About the Firewall Mode 5-1
Information About Routed Firewall Mode 5-2
Information About Transparent Firewall Mode 5-2
Licensing Requirements for the Firewall Mode 5-4
Default Settings 5-4
Guidelines and Limitations 5-5
Setting the Firewall Mode 5-7

Contents
vii
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
Configuring ARP Inspection for the Transparent Firewall 5-8
Information About ARP Inspection 5-8
Licensing Requirements for ARP Inspection 5-8
Default Settings 5-9
Guidelines and Limitations 5-9
Configuring ARP Inspection 5-9
Task Flow for Configuring ARP Inspection 5-9
Adding a Static ARP Entry 5-9
Enabling ARP Inspection 5-10
Feature History for ARP Inspection 5-11
Customizing the MAC Address Table for the Transparent Firewall 5-11
Information About the MAC Address Table 5-11
Licensing Requirements for the MAC Address Table 5-12
Default Settings 5-12
Guidelines and Limitations 5-12
Configuring the MAC Address Table 5-13
Adding a Static MAC Address 5-13
Disabling MAC Address Learning 5-13
Feature History for the MAC Address Table 5-14
Firewall Mode Examples 5-14
How Data Moves Through the Security Appliance in Routed Firewall Mode 5-14
An Inside User Visits a Web Server 5-15
An Outside User Visits a Web Server on the DMZ 5-16
An Inside User Visits a Web Server on the DMZ 5-17
An Outside User Attempts to Access an Inside Host 5-18
A DMZ User Attempts to Access an Inside Host 5-19
How Data Moves Through the Transparent Firewall 5-20
An Inside User Visits a Web Server 5-21
An Inside User Visits a Web Server Using NAT 5-22
An Outside User Visits a Web Server on the Inside Network 5-23
An Outside User Attempts to Access an Inside Host 5-24
PART 2Setting up the Adaptive Security Appliance
CHAPTER 6Configuring Multiple Context Mode 6-1
Information About Security Contexts 6-1
Common Uses for Security Contexts 6-2
Context Configuration Files 6-2
Context Configurations 6-2

Contents
viii
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
System Configuration 6-2
Admin Context Configuration 6-2
How the Security Appliance Classifies Packets 6-3
Valid Classifier Criteria 6-3
Classification Examples 6-4
Cascading Security Contexts 6-6
Management Access to Security Contexts 6-7
System Administrator Access 6-7
Context Administrator Access 6-8
Information About Resource Management 6-8
Resource Limits 6-8
Default Class 6-9
Class Members 6-10
Information About MAC Addresses 6-11
Default MAC Address 6-11
Interaction with Manual MAC Addresses 6-11
Failover MAC Addresses 6-11
MAC Address Format 6-11
Licensing Requirements for Multiple Context Mode 6-12
Guidelines and Limitations 6-12
Default Settings 6-13
Configuring Multiple Contexts 6-13
Task Flow for Configuring Multiple Context Mode 6-13
Enabling or Disabling Multiple Context Mode 6-14
Enabling Multiple Context Mode 6-14
Restoring Single Context Mode 6-14
Configuring a Class for Resource Management 6-15
Configuring a Security Context 6-17
Automatically Assigning MAC Addresses to Context Interfaces 6-19
Monitoring Security Contexts 6-20
Monitoring Context Resource Usage 6-20
Viewing Assigned MAC Addresses 6-21
Viewing MAC Addresses in the System Configuration 6-21
Viewing MAC Addresses Within a Context 6-22
Feature History for Multiple Context Mode 6-23
CHAPTER 7Using the Startup Wizard 7-1
Information About the Startup Wizard 7-1
Licensing Requirements for the Startup Wizard 7-1

Contents
ix
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
Prerequisites for the Startup Wizard 7-2
Guidelines and Limitations 7-2
Startup Wizard Screens for ASA 5500 Series Adaptive Security Appliances 7-3
Startup Wizard Screens for the ASA 5505 Adaptive Security Appliance 7-3
Step 1 - Starting Point or Welcome 7-4
Step 2 - Basic Configuration 7-5
Step 3 - Time Zone and Clock Configuration 7-5
Step 4 - Auto Update Server 7-6
Step 5 - Management IP Address Configuration 7-6
Step 6 - Interface Selection 7-6
Step 7 - Switch Port Allocation 7-7
Step 8 - Interface IP Address Configuration 7-8
Step 9 - Internet Interface Configuration - PPPoE 7-8
Step 10 - Business Interface Configuration - PPPoE 7-9
Step 11 - Home Interface Configuration - PPPoE 7-10
Step 12 - General Interface Configuration 7-10
Step 13 - Static Routes 7-11
Adding or Editing Static Routes 7-11
Step 14 - DHCP Server 7-11
Step 15 - Address Translation (NAT/PAT) 7-12
Step 16 - Administrative Access 7-13
Adding or Editing Administrative Access Entry 7-13
Step 17 - Easy VPN Remote Configuration 7-14
Step 18 - Startup Wizard Summary 7-16
Other Interfaces Configuration 7-16
Editing Interfaces 7-16
Configuring IPv6 Neighbor Discovery 7-18
Configuring Neighbor Solicitation Messages 7-18
Configuring the Neighbor Solicitation Message Interval 7-19
Configuring the Neighbor Reachable Time 7-19
Configuring DAD Settings 7-20
Configuring IPv6 Addresses on an Interface 7-21
Configuring IPv6 Prefixes on an Interface 7-21
Configuring Router Advertisement Messages 7-22
Configuring the Router Advertisement Transmission Interval 7-23
Configuring the Router Lifetime Value 7-24
Suppressing Router Advertisement Messages 7-25
Configuring IPv6 Static Neighbors 7-25
Adding an IPv6 Static Neighbor 7-25

Contents
x
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
Editing Static Neighbors 7-26
Deleting Static Neighbors 7-26
Viewing and Clearing Dynamic Neighbors 7-27
Interface Configuration 7-27
Outside Interface Configuration - PPPoE 7-27
Outside Interface Configuration 7-28
Feature History for the Startup Wizard 7-29
CHAPTER 8Configuring Interfaces 8-1
Information About Interfaces 8-1
ASA 5505 Interfaces 8-2
Understanding ASA 5505 Ports and Interfaces 8-2
Maximum Active VLAN Interfaces for Your License 8-2
VLAN MAC Addresses 8-4
Power over Ethernet 8-4
Monitoring Traffic Using SPAN 8-4
ASA 5580 Interfaces 8-5
Auto-MDI/MDIX Feature 8-5
Security Levels 8-5
Dual IP Stack 8-6
Management Interface (ASA 5510 and Higher) 8-6
Licensing Requirements for Interfaces 8-6
Guidelines and Limitations 8-7
Default Settings 8-8
Starting Interface Configuration (ASA 5510 and Higher) 8-9
Task Flow for Starting Interface Configuration 8-9
Enabling the Physical Interface and Configuring Ethernet Parameters 8-10
Configuring a Redundant Interface 8-12
Configuring a Redundant Interface 8-12
Changing the Active Interface 8-14
Configuring VLAN Subinterfaces and 802.1Q Trunking 8-14
Assigning Interfaces to Contexts and Automatically Assigning MAC Addresses (Multiple Context
Mode) 8-16
Starting Interface Configuration (ASA 5505) 8-16
Task Flow for Starting Interface Configuration 8-16
Configuring VLAN Interfaces 8-17
Configuring and Enabling Switch Ports as Access Ports 8-18
Configuring and Enabling Switch Ports as Trunk Ports 8-19
Completing Interface Configuration (All Models) 8-21