Cisco 5505 - ASA Firewall Edition Bundle User manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco ASA 5505
Getting Started Guide
Software Version 7.2
Customer Order Number: DOC-7817612=
Text Part Number: 78-17612-02

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT
NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT
ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR
THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION
PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO
LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as
part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE
PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED
OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL
DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR
INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We
Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP,
CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the
Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink,
Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers
logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast,
SMARTnet, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates
in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply
a partnership relationship between Cisco and any other company. (0601R)
Cisco ASA 5505 Getting Started Guide
© 2006 Cisco Systems, Inc. All rights reserved.

1
Cisco ASA 5505 Getting Started Guide
78-17612-02
CONTENTS
CHAPTER 1Before You Begin 1-1
CHAPTER 2Deployment Planning 2-1
Scenarios for Deployment Planning and Configuration 2-1
Scenario 1: Private Network with External Connectivity 2-3
Scenario 2: Basic Installation with DMZ 2-4
Scenario 3: IPSec Remote-Access VPN 2-5
Scenario 4: Site-to-Site VPN 2-6
Scenario 5: ASA 5505 Deployed as a Hardware VPN Client 2-7
Configuration Procedures for Scenarios 2-8
What to Do Next 2-9
CHAPTER 3Planning for a VLAN Configuration 3-1
Understanding VLANs on the ASA 5505 3-1
About Physical Ports on the ASA 5505 3-2
About VLANs 3-2
Maximum Number and Types of VLANs 3-3
Deployment Scenarios Using VLANs 3-4
Basic Deployment Using Two VLANs 3-5
DMZ Deployment 3-7
Teleworker Deployment Using Three VLANs 3-8
What to Do Next 3-9

Contents
2
Cisco ASA 5505 Getting Started Guide
78-17612-02
CHAPTER 4Installing the ASA 5505 4-1
Verifying the Package Contents 4-1
PoE Ports and Devices 4-3
Installing the Chassis 4-4
Connecting to Network Interfaces 4-4
Powering on the Cisco ASA 5505 4-6
Setting Up a PC for System Administration 4-6
Optional Procedures 4-7
Connecting to the Console 4-8
Installing a Cable Lock 4-9
Ports and LEDs 4-9
Front Panel Components 4-9
Rear Panel Components 4-12
What to Do Next 4-13
CHAPTER 5Configuring the Adaptive Security Appliance 5-1
About the Factory Default Configuration 5-1
About the Adaptive Security Device Manager 5-3
Using the Startup Wizard 5-4
Before Launching the Startup Wizard 5-4
Running the Startup Wizard 5-5
What to Do Next 5-7
CHAPTER 6Scenario: DMZ Configuration 6-1
Example DMZ Network Topology 6-1
Configuring the Security Appliance for a DMZ Deployment 6-5
Configuration Requirements 6-5
Starting ASDM 6-6

3
Cisco ASA 5505 Getting Started Guide
78-17612-02
Contents
Enabling Inside Clients to Communicate with Devices on the Internet 6-7
Enabling Inside Clients to Communicate with the DMZ Web Server 6-8
Translating Internal Client IP Addresses Between the Inside and DMZ
Interfaces 6-8
Translating the Public Address of the Web Server to its Real
Address 6-10
Configuring an External Identity for the DMZ Web Server 6-12
Providing Public HTTP Access to the DMZ Web Server 6-15
What to Do Next 6-18
CHAPTER 7Scenario: IPSec Remote-Access VPN Configuration 7-1
Example IPSec Remote-Access VPN Network Topology 7-1
Implementing the IPSec Remote-Access VPN Scenario 7-2
Information to Have Available 7-3
Starting ASDM 7-3
Configuring the ASA 5505 for an IPSec Remote-Access VPN 7-5
Selecting VPN Client Types 7-6
Specifying the VPN Tunnel Group Name and Authentication Method 7-7
Specifying a User Authentication Method 7-8
(Optional) Configuring User Accounts 7-10
Configuring Address Pools 7-11
Configuring Client Attributes 7-12
Configuring the IKE Policy 7-13
Configuring IPSec Encryption and Authentication Parameters 7-15
Specifying Address Translation Exception and Split Tunneling 7-16
Verifying the Remote-Access VPN Configuration 7-17
What to Do Next 7-18
CHAPTER 8Scenario: Site-to-Site VPN Configuration 8-1
Example Site-to-Site VPN Network Topology 8-1

Contents
4
Cisco ASA 5505 Getting Started Guide
78-17612-02
Implementing the Site-to-Site Scenario 8-2
Information to Have Available 8-3
Configuring the Site-to-Site VPN 8-3
Starting ASDM 8-3
Configuring the Security Appliance at the Local Site 8-4
Providing Information About the Remote VPN Peer 8-6
Configuring the IKE Policy 8-7
Configuring IPSec Encryption and Authentication Parameters 8-9
Specifying Hosts and Networks 8-10
Viewing VPN Attributes and Completing the Wizard 8-11
Configuring the Other Side of the VPN Connection 8-13
What to Do Next 8-14
CHAPTER 9Scenario: Easy VPN Hardware Client Configuration 9-1
Using an ASA 5505 as an Easy VPN Hardware Client 9-1
Client Mode and Network Extension Mode 9-3
Configuring the Easy VPN Hardware Client 9-5
Configuring Advanced Easy VPN Attributes 9-8
What to Do Next 9-9
APPENDIX AObtaining a 3DES/AES License A-1

CHAPTER
1-1
Cisco ASA 5505 Getting Started Guide
78-17612-02
1
Before You Begin
Use the following table to find the installation and configuration steps that are
required for your implementation of the adaptive security appliance.
To Do This... See...
Learn about typical deployments of the
ASA 5505
Chapter 2, “Deployment Planning”
Learn about VLANs and port allocation
on the ASA 5505
Chapter 3, “Planning for a VLAN
Configuration”
Install the chassis Chapter 4, “Installing the ASA 5505”
Perform initial setup of the adaptive
security appliance
Chapter 5, “Configuring the
Adaptive Security Appliance”
Configure the adaptive security
appliance for your implementation
Chapter 6, “Scenario: DMZ
Configuration”
Chapter 7, “Scenario: IPSec
Remote-Access VPN Configuration”
Chapter 8, “Scenario: Site-to-Site
VPN Configuration”
Chapter 9, “Scenario: Easy VPN
Hardware Client Configuration”

Chapter 1 Before You Begin
1-2
Cisco ASA 5505 Getting Started Guide
78-17612-02
Refine configuration
Configure optional and advanced
features
Cisco Security Appliance Command
Line Configuration Guide
Cisco Security Appliance Command
Reference
Cisco Security Appliance Logging
Configuration and System Log
Messages
To Do This... (continued) See...

CHAPTER
2-1
Cisco ASA 5505 Getting Started Guide
78-17612-02
2
Deployment Planning
This document is based on several example scenarios that represent typical
customer deployments of the ASA 5505. The deployment scenarios in this
chapter correspond to subsequent configuration chapters.
This chapter includes the following sections:
• Scenarios for Deployment Planning and Configuration, page 2-1
• Scenario 1: Private Network with External Connectivity, page 2-3
• Scenario 2: Basic Installation with DMZ, page 2-4
• Scenario 3: IPSec Remote-Access VPN, page 2-5
• Scenario 4: Site-to-Site VPN, page 2-6
• Scenario 5: ASA 5505 Deployed as a Hardware VPN Client, page 2-7
Scenarios for Deployment Planning and
Configuration
An extended adaptive security appliance deployment can include two or more of
the different deployment scenarios described in this chapter. You can use the
deployment scenarios in this chapter to help you determine how you want to
deploy the adaptive security appliance on your network, and then determine which
configuration chapters apply to you.
Figure 2-1 illustrates an extended network that includes most of the deployment
and configuration scenarios included in this document.

Chapter 2 Deployment Planning
Scenarios for Deployment Planning and Configuration
2-2
Cisco ASA 5505 Getting Started Guide
78-17612-02
Figure 2-1 Extended Network Deployment
190924
Web Server
Remote Site
Adaptive Security
Appliance
Mobile Client
Using VPN
software client
Scenario 3: IPSec VPN
Connection
Scenario 6: Site-to-site VPN
Connection
Email Server
Adaptive Security
Appliance
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
543210
Scenario 2: Basic Installation
with DMZ
Scenario 1: Basic Installation
Internet
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
543210
Mobile Client
Using Cisco SSL
VPN Client software
Scenario 4: Cisco SSL
VPN Client
Mobile Client
Clientless SSL VPN
Scenario 5: Cisco SSL
VPN Client

2-3
Cisco ASA 5505 Getting Started Guide
78-17612-02
Chapter 2 Deployment Planning
Scenario 1: Private Network with External Connectivity
Scenario 1: Private Network with External
Connectivity
A basic deployment that is typical for a small private network is shown in
Figure 2-2.
Figure 2-2 Private (Inside) Network with External Connectivity
190925
Personal
computer
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
543 2 1 0
ISP Router
Laptop
computer
Printer
Internet
Private Network
Adaptive Security
Appliance
IP Phone
Outside Network
In this example, the adaptive security appliance enables all devices on the private
network to communicate with each other and enables users on the private network
to communicate with devices on the Internet.
Note This deployment is similar to the security deployments using the PIX 501. If you
already have a security deployment with PIX 501 security appliances in which
devices behind the firewall can communicate internally and externally, you can
keep the same deployment and replace the PIX 501 devices with ASA 5505
devices.

Chapter 2 Deployment Planning
Scenario 2: Basic Installation with DMZ
2-4
Cisco ASA 5505 Getting Started Guide
78-17612-02
For information about how to configure your adaptive security appliance for this
deployment, see Chapter 5, “Configuring the Adaptive Security Appliance.”
Scenario 2: Basic Installation with DMZ
In this scenario, the adaptive security appliance is used to protect network
resources located in a demilitarized zone (DMZ) in addition to the inside network.
A DMZ is a separate network located in the neutral zone between a private
(inside) network and a public (outside) network.
HTTP clients on the private network can access the web server in the DMZ and
can also communicate with devices on the Internet.
Figure 2-3 Private Network with DMZ
190926
Web Server
Email Server
Adaptive Security
Appliance
Private (Inside) Network
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
543210
Internet
ISP
Router DMZ
Outside Network
(Internet Connection)
Personal computers
Printer

2-5
Cisco ASA 5505 Getting Started Guide
78-17612-02
Chapter 2 Deployment Planning
Scenario 3: IPSec Remote-Access VPN
For information about configuring a DMZ deployment, see Chapter 6, “Scenario:
DMZ Configuration.”
Scenario 3: IPSec Remote-Access VPN
In this scenario, the adaptive security appliance is configured to accept
remote-access IPSec VPN connections. A remote-access VPN allows you to
create secure connections, or tunnels, across the Internet, which provides secure
access to off-site users.
Figure 2-4 IPSec Remote-Access VPN Connection
190927
WINS Server
DNS Server
Adaptive Security
Appliance
Private (Inside) Network
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
543210
ISP
Router
IPSec VPN
Connection
Mobile Client
running Cisco VPN
Client software
Personal computers
running Cisco VPN
Client software
Internet
Personal
computer
For information about how to configure an IPSec remote-access VPN
deployment, see Chapter 7, “Scenario: IPSec Remote-Access VPN
Configuration.”

Chapter 2 Deployment Planning
Scenario 4: Site-to-Site VPN
2-6
Cisco ASA 5505 Getting Started Guide
78-17612-02
Scenario 4: Site-to-Site VPN
In this scenario, two adaptive security appliances are configured to create a
site-to-site VPN.
Deploying a site-to-site VPN enables businesses to extend their networks across
low-cost public Internet connections to business partners and remote offices
worldwide while maintaining their network security. A VPN connection enables
you to send data from one location to another over a secure connection, or tunnel,
first by authenticating both ends of the connection, and then by automatically
encrypting all data sent between the two sites.
Figure 2-5 Network Layout for Site-to-Site VPN Configuration Scenario
Internet
190928
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERover ETHERNET
6
543 2 1 0
ISP Router
Site A
Adaptive Security
Appliance 1
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
5432 1 0
Site B
Adaptive Security
Appliance 2
Personal
computers
Printer
Personal
computers
Printer
For information about configuring a site-to-site VPN deployment, see Chapter 8,
“Scenario: Site-to-Site VPN Configuration.”

2-7
Cisco ASA 5505 Getting Started Guide
78-17612-02
Chapter 2 Deployment Planning
Scenario 5: ASA 5505 Deployed as a Hardware VPN Client
Scenario 5: ASA 5505 Deployed as a Hardware VPN
Client
In this scenario, an ASA 5505 is deployed as a hardware client (sometimes called
a remote device). Deploying one or more VPN hardware clients in conjunction
with a VPN headend device enables companies with multiple sites to establish
secure communications among them and share network resources.
Deploying an Easy VPN solution with hardware clients simplifies the deployment
and management of a VPN in the following ways:
• Hosts at remote sites no longer have to run VPN client software.
• Security policies reside on a central server and are pushed to the remote
hardware clients when a VPN connection is established.
• Few configuration parameters need to be set locally, minimizing the need for
on-site administration.
Figure 2-6 illustrates how the different Easy VPN components can be deployed.

Chapter 2 Deployment Planning
Configuration Procedures for Scenarios
2-8
Cisco ASA 5505 Getting Started Guide
78-17612-02
Figure 2-6 ASA 5505 Installed as VPN Hardware Client
Internet
190930
ISP
Router
ISP
router
Push remote
configuration
Central LAN
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERover ETHERNET
6
543 2 1 0
ASA 5505
VPN Headend
Device
VPN Hardware
Client
CiscoASA SSC-05
Status
Security
Services
CardSlot
1
2
console
RESET
POWER
48
VDC
7
POWERoverETHERNET
6
54210
ASA 5500 series
Cisco IOS router
with IPSec support
For information about how to configure the ASA 5505 as a VPN hardware client,
see Chapter 9, “Scenario: Easy VPN Hardware Client Configuration.”
Configuration Procedures for Scenarios
Each deployment scenario in this chapter has a corresponding configuration
chapter in this document that describes how to configure the ASA 5505 for that
type of deployment.

To Configure the ASA 5505 For This
Scenario.... See This Chapter...
Scenario 1: Private Network with
External Connectivity
Chapter 5, “Configuring the
Adaptive Security Appliance”
Scenario 2: Basic Installation with
DMZ
Chapter 6, “Scenario: DMZ
Configuration”
Scenario 3: IPSec Remote-Access
VPN
Chapter 7, “Scenario: IPSec
Remote-Access VPN Configuration”
Scenario 4: Site-to-Site VPN Chapter 8, “Scenario: Site-to-Site
VPN Configuration”
Scenario 5: ASA 5505 Deployed as a
Hardware VPN Client
Chapter 9, “Scenario: Easy VPN
Hardware Client Configuration”
2-9
Cisco ASA 5505 Getting Started Guide
78-17612-02
Chapter 2 Deployment Planning
What to Do Next
What to Do Next
Continue with Chapter 3, “Planning for a VLAN Configuration.”

Chapter 2 Deployment Planning
What to Do Next
2-10
Cisco ASA 5505 Getting Started Guide
78-17612-02

CHAPTER
3-1
Cisco ASA 5505 Getting Started Guide
78-17612-02
3
Planning for a VLAN Configuration
Grouping ports into logical VLANs on the ASA 5505 enables you to segment
large private networks and provide additional protection to critical network
segments that may host resources such as servers, corporate computers, and IP
phones.
This chapter describes the options of deploying the ASA 5505 in a VLAN
configuration and how to determine how many VLANs you need. It also describes
allocating ports for each of the VLANs.
This chapter includes the following sections:
• Understanding VLANs on the ASA 5505, page 3-1
• Deployment Scenarios Using VLANs, page 3-4
• What to Do Next, page 3-9
Understanding VLANs on the ASA 5505
After you have made a decision about how to deploy the ASA 5505 in your
network, you must decide how many VLANs you need to support that deployment
and how many ports to allocate to each VLAN.
This section describes how VLANs work on the ASA 5505 to help you make those
decisions.
This section includes the following topics:
• About Physical Ports on the ASA 5505, page 3-2
• About VLANs, page 3-2

Chapter 3 Planning for a VLAN Configuration
Understanding VLANs on the ASA 5505
3-2
Cisco ASA 5505 Getting Started Guide
78-17612-02
• Maximum Number and Types of VLANs, page 3-3
• Basic Deployment Using Two VLANs, page 3-5
• DMZ Deployment, page 3-7
• Teleworker Deployment Using Three VLANs, page 3-8
About Physical Ports on the ASA 5505
The ASA 5505 has a built-in switch with eight Fast Ethernet ports, called switch
ports. Two of the eight physical ports are Power Over Ethernet (PoE) ports. You
can connect PoE ports directly to user equipment such as PCs, IP phones, or a
DSL modem. You can also connect to another switch. For more information, see
Ports and LEDs, page 4-9.
About VLANs
You can divide the eight physical ports into groups, called VLANs, that function
as separate networks. This enables you to improve the security of your business
because devices in different VLANs can only communicate with each other by
passing the traffic through the adaptive security appliance where relevant security
policies are applied.
The ASA 5505 comes preconfigured with two VLANs: VLAN1 and VLAN2. By
default, Ethernet switch port 0/0 is allocated to VLAN2. All other switch ports are
allocated by default to VLAN1.
Physical ports on the same VLAN communicate with each other using hardware
switching. VLANs communicate with each other using routes and bridges. For
example, when a switch port on VLAN1 is communicating with a switch port on
VLAN2, the adaptive security appliance applies configured security policies to
the traffic and routes or bridges the traffic between the two VLANs.
To impose strict access control and provide protection of sensitive devices, you
can apply security policies to VLANs that restrict communications between
VLANs. You can also apply security policies to individual ports. You might want
to apply security policies at the port level if, for example, there are two ports on
the same VLAN connecting devices that you do not want to be able to
communicate with each other.