Cisco 5510 - ASA SSL / IPsec VPN Edition User manual

Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco ASA 5500 Series Getting
Started Guide
For the Cisco ASA 5510, ASA 5520, ASA 5540, and ASA 5550
Software Version 8.3
Customer Order Number: DOC-78-19186-01
Text Part Number: 78-19186-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT
NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT
ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR
THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION
PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO
LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as
part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE
PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED
OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL
DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR
INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
CCDE, CCENT, CCSI, Cisco Eos, Cisco Explorer, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse,
Cisco SensorBase, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco TrustSec, Cisco Unified Computing System, Cisco WebEx,
DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to
the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed
(Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS,
Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert
logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity,
Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS,
iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking
Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet,
Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco and/or its affiliates in the United States and certain
other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply
a partnership relationship between Cisco and any other company. (1002R)
Cisco ASA 5500 Series Getting Started Guide
© 2010 Cisco Systems, Inc. All rights reserved.

iii
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
CONTENTS
iii
CHAPTER 1Before You Begin 1-1
ASA 5500 1-1
ASA 5500 with AIP SSM 1-2
ASA 5500 with CSC SSM 1-3
ASA 5500 with 4GE SSM 1-4
ASA 5550 1-5
Related Documents 1-5
CHAPTER 2Maximizing Throughput on the ASA 5550 2-1
Embedded Network Interfaces 2-1
Balancing Traffic to Maximize Throughput 2-2
What to Do Next 2-5
CHAPTER 3Installing the ASA 5550 3-1
Verifying the Package Contents 3-2
Installing the Chassis 3-3
Rack-Mounting the Chassis 3-4
Installing SFP Modules 3-6
SFP Module 3-6
Installing an SFP Module 3-8
Ports and LEDs 3-9

Contents
iv
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
Front Panel LEDs 3-9
Rear Panel LEDs and Ports in Slot 0 3-10
Ports and LEDs in Slot 1 3-12
Connecting Interface Cables 3-13
What to Do Next 3-19
CHAPTER 4Installing the ASA 5500, ASA 5510, ASA 5520, and ASA 5540 4-1
Verifying the Package Contents 4-2
Installing the Chassis 4-3
Rack-Mounting the Chassis 4-4
Ports and LEDs 4-7
What to Do Next 4-10
CHAPTER 5Installing Optional SSMs 5-1
Cisco 4GE SSM 5-1
4GE SSM Components 5-2
Installing the Cisco 4GE SSM 5-3
Installing the SFP Modules 5-4
SFP Module 5-5
Installing the SFP Module 5-6
Cisco AIP SSM and CSC SSM 5-8
Installing an SSM 5-9
What to Do Next 5-10
CHAPTER 6Connecting Interface Cables on the ASA 5500, ASA 5510, ASA 5520, and ASA
5540 Platforms 6-1
Connecting Interface Cables 6-2
Connecting to SSMs 6-4
Connecting to a 4GE SSM 6-6

v
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
Contents
Powering On the Adaptive Security Appliance 6-9
What to Do Next 6-9
CHAPTER 7Configuring the Adaptive Security Appliance 7-1
About the Factory Default Configuration 7-1
Using the CLI for Configuration 7-2
Using the Adaptive Security Device Manager for Configuration 7-3
Preparing to Use ASDM 7-4
Gathering Configuration Information for Initial Setup 7-4
Installing the ASDM Launcher 7-5
Starting ASDM with a Web Browser 7-8
Running the ASDM Startup Wizard 7-8
What to Do Next 7-9
CHAPTER 8Scenario: DMZ Configuration 8-1
Example DMZ Network Topology 8-1
An Inside User Visits a Web Server on the Internet 8-3
An Internet User Visits the DMZ Web Server 8-4
An Inside User Visits the DMZ Web Server 8-6
Configuring the Adaptive Security Appliance for a DMZ Deployment 8-8
Configuration Requirements 8-9
Information to Have Available 8-10
Enabling Inside Clients to Communicate with Devices on the Internet 8-10
Enabling Inside Clients to Communicate with the DMZ Web Server 8-10
Translating Internal Client IP Addresses Between the Inside and DMZ
Interfaces 8-11
Translating the Public Address of the Web Server to its Real Address on
the Inside Interface 8-14
Configuring Static PAT for Public Access to the DMZ Web Server (Port
Forwarding) 8-17

Contents
vi
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
Providing Public HTTP Access to the DMZ Web Server 8-20
What to Do Next 8-23
CHAPTER 9Scenario: IPsec Remote-Access VPN Configuration 9-1
Example IPsec Remote-Access VPN Network Topology 9-1
Implementing the IPsec Remote-Access VPN Scenario 9-2
Information to Have Available 9-3
Configuring an IPsec Remote-Access VPN 9-3
Selecting VPN Client Types 9-5
Specifying the VPN Tunnel Group Name and Authentication Method 9-6
Specifying a User Authentication Method 9-7
(Optional) Configuring User Accounts 9-9
Configuring Address Pools 9-10
Configuring Client Attributes 9-11
Configuring the IKE Policy 9-12
Specifying Address Translation Exception and Split Tunneling 9-14
Verifying the Remote-Access VPN Configuration 9-16
What to Do Next 9-17
CHAPTER 10 Scenario: Configuring Connections for a Cisco AnyConnect VPN Client 10-1
About SSL VPN Client Connections 10-1
Obtaining the Cisco AnyConnect VPN Client Software 10-2
Example Topology Using AnyConnect SSL VPN Clients 10-3
Implementing the Cisco SSL VPN Scenario 10-3
Information to Have Available 10-4
Configuring the Adaptive Security Appliance for the Cisco AnyConnect VPN
Client 10-5
Specifying the SSL VPN Interface 10-6
Specifying a User Authentication Method 10-7

vii
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
Contents
Specifying a Group Policy 10-8
Configuring the Cisco AnyConnect VPN Client 10-9
Verifying the Remote-Access VPN Configuration 10-11
What to Do Next 10-12
CHAPTER 11 Scenario: SSL VPN Clientless Connections 11-1
About Clientless SSL VPN 11-1
Security Considerations for Clientless SSL VPN Connections 11-2
Example Network with Browser-Based SSL VPN Access 11-3
Implementing the Clientless SSL VPN Scenario 11-4
Information to Have Available 11-5
Configuring the Adaptive Security Appliance for Browser-Based SSL VPN
Connections 11-6
Specifying the SSL VPN Interface 11-7
Specifying a User Authentication Method 11-8
Specifying a Group Policy 11-10
Creating a Bookmark List for Remote Users 11-11
Verifying the Configuration 11-15
What to Do Next 11-16
CHAPTER 12 Scenario: Site-to-Site VPN Configuration 12-1
Example Site-to-Site VPN Network Topology 12-1
Implementing the Site-to-Site Scenario 12-2
Information to Have Available 12-3
Configuring the Site-to-Site VPN 12-3
Configuring the Security Appliance at the Local Site 12-3
Providing Information About the Remote VPN Peer 12-5
Configuring the IKE Policy 12-6
Configuring IPsec Encryption and Authentication Parameters 12-8

Contents
viii
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
Specifying Hosts and Networks 12-9
Viewing VPN Attributes and Completing the Wizard 12-10
Configuring the Other Side of the VPN Connection 12-12
What to Do Next 12-13
CHAPTER 13 Configuring the AIP SSM 13-1
Understanding the AIP SSM 13-2
How the AIP SSM Works with the Adaptive Security Appliance 13-2
Operating Modes 13-3
Using Virtual Sensors 13-4
Configuring the AIP SSM 13-6
AIP SSM Procedure Overview 13-6
Sessioning to the AIP SSM 13-6
Configuring the Security Policy on the AIP SSM 13-8
Assigning Virtual Sensors to Security Contexts 13-9
Diverting Traffic to the AIP SSM 13-11
What to Do Next 13-14
CHAPTER 14 Configuring the CSC SSM 14-1
About the CSC SSM 14-1
About Deploying the Adaptive Security Appliance with the CSC SSM 14-2
Scenario: Security Appliance with CSC SSM Deployed for Content Security 14-4
Configuration Requirements 14-5
Configuring the CSC SSM for Content Security 14-6
Obtain Software Activation Key from Cisco.com 14-6
Gather Information 14-7
Verify Time Settings 14-7
Run the CSC Setup Wizard 14-8
What to Do Next 14-17

ix
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
Contents
CHAPTER 15 Configuring the 4GE SSM for Fiber 15-1
Cabling 4GE SSM Interfaces 15-2
Setting the 4GE SSM Media Type for Fiber Interfaces (Optional) 15-3
What to Do Next 15-5
APPENDIX AObtaining a 3DES/AES License A-1

Contents
x
Cisco ASA 5500 Series Getting Started Guide
78-19186-01

1-1
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
CHAPTER
1
Before You Begin
Use the following table to find the installation and configuration steps that are
required for your implementation of the Cisco ASA 5500 series adaptive security
appliance.
The adaptive security appliance implementations included in this document are as
follows:
• ASA 5500, page 1-1
• ASA 5500 with AIP SSM, page 1-2
• ASA 5500 with CSC SSM, page 1-3
• ASA 5500 with 4GE SSM, page 1-4
• ASA 5550, page 1-5
• Related Documents, page 1-5
ASA 5500
To Do This ... See ...
Install the chassis Chapter 4, “Installing the ASA 5500,
ASA 5510, ASA 5520, and ASA
5540”

Chapter 1 Before You Begin
ASA 5500 with AIP SSM
1-2
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
ASA 5500 with AIP SSM
Connect interface cables Chapter 6, “Connecting Interface
Cables on the ASA 5500, ASA 5510,
ASA 5520, and ASA 5540
Platforms”
Perform initial setup of the adaptive security
appliance
Chapter 7, “Configuring the
Adaptive Security Appliance”
Configure the adaptive security appliance for
your implementation
Chapter 8, “Scenario: DMZ
Configuration”
Chapter 9, “Scenario: IPsec
Remote-Access VPN Configuration”
Chapter 10, “Scenario: Configuring
Connections for a Cisco AnyConnect
VPN Client”
Chapter 11, “Scenario: SSL VPN
Clientless Connections”
Chapter 12, “Scenario: Site-to-Site
VPN Configuration”
Configure optional and advanced features Cisco ASA 5500 Series Configuration
Guide using the CLI
Operate the system on a daily basis Cisco ASA 5500 Series Command
Reference
Cisco ASA 5500 Series System Log
Messages
To Do This ... See ...
Install the chassis Chapter 4, “Installing the ASA 5500,
ASA 5510, ASA 5520, and ASA
5540”
Install the AIP SSM Chapter 5, “Installing Optional
SSMs”

1-3
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
Chapter 1 Before You Begin
ASA 5500 with CSC SSM
ASA 5500 with CSC SSM
Connect interface cables Chapter 6, “Connecting Interface
Cables on the ASA 5500, ASA 5510,
ASA 5520, and ASA 5540
Platforms”
Perform initial setup the adaptive security
appliance
Chapter 7, “Configuring the
Adaptive Security Appliance”
Configure the adaptive security appliance for
AIP SSM
Chapter 9, “Scenario: IPsec
Remote-Access VPN Configuration”
Configure IPS software for intrusion
prevention
Configuring the Cisco Intrusion
Prevention System Sensor Using the
Command Line Interface
Refine configuration and configure optional
and advanced features
Cisco ASA 5500 Series Configuration
Guide using the CLI
Cisco ASA 5500 Series Command
Reference
Cisco ASA 5500 Series System Log
Messages
To Do This ... See ...
Install the chassis Chapter 4, “Installing the ASA 5500,
ASA 5510, ASA 5520, and ASA
5540”
Install the CSC SSM Chapter 5, “Installing Optional
SSMs”
Connect interface cables Chapter 6, “Connecting Interface
Cables on the ASA 5500, ASA 5510,
ASA 5520, and ASA 5540
Platforms”
Perform initial setup of the adaptive
security appliance
Chapter 7, “Configuring the
Adaptive Security Appliance”

Chapter 1 Before You Begin
ASA 5500 with 4GE SSM
1-4
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
ASA 5500 with 4GE SSM
Configure the adaptive security appliance
for content security
Chapter 14, “Configuring the CSC
SSM”
Configure the CSC SSM Cisco Content Security and Control
SSM Administrator Guide
Refine configuration and configure
optional and advanced features
Cisco ASA 5500 Series Configuration
Guide using the CLI
Cisco ASA 5500 Series Command
Reference
Cisco ASA 5500 Series System Log
Messages
To Do This ... See ...
Install the chassis Chapter 4, “Installing the ASA 5500,
ASA 5510, ASA 5520, and ASA
5540”
Install the 4GE SSM Chapter 5, “Installing Optional
SSMs”
Connect interface cables Chapter 6, “Connecting Interface
Cables on the ASA 5500, ASA 5510,
ASA 5520, and ASA 5540
Platforms”
Perform initial setup of the adaptive
security appliance
Chapter 7, “Configuring the
Adaptive Security Appliance”

1-5
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
Chapter 1 Before You Begin
ASA 5550
ASA 5550
Related Documents
For more information, see the following documentation:
• Documentation Roadmap for the Cisco ASA 5500 Series
• Cisco ASA 5500 Series Release Notes
• Release Notes for Cisco ASDM
Install the fiber optic module Chapter 5, “Installing Optional
SSMs”
Refine configuration and configure
optional and advanced features
Cisco ASA 5500 Series Configuration
Guide using the CLI
Cisco ASA 5500 Series Command
Reference
Cisco ASA 5500 Series System Log
Messages
To Do This ... See ...
Install the chassis
Install the fiber optic module, if any
Connect interface cables
Chapter 3, “Installing the ASA 5550”
Perform initial setup of the adaptive
security appliance
Chapter 7, “Configuring the
Adaptive Security Appliance”
Refine configuration and configure
optional and advanced features
Cisco ASA 5500 Series Configuration
Guide using the CLI
Cisco ASA 5500 Series Command
Reference
Cisco ASA 5500 Series System Log
Messages

Chapter 1 Before You Begin
Related Documents
1-6
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
• Cisco ASA 5500 Series Command Reference
• Cisco ASA 5500 Series Configuration Guide using the CLI
• Cisco ASA 5500 Series System Log Messages
• Migrating to ASA for VPN 3000 Series Concentrator Administrators
• Cisco Secure Desktop Configuration Guide for Cisco ASA 5500 Series
Administrators
• Open Source Software Licenses for ASA and PIX Security Appliances

2-1
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
CHAPTER
2
Maximizing Throughput on the ASA
5550
Note This chapter applies only to the Cisco ASA 5550.
The Cisco ASA 5550 adaptive security appliance is designed to deliver maximum
throughput when configured according to the guidelines described in this chapter.
This chapter includes the following sections:
• Embedded Network Interfaces, page 2-1
• Balancing Traffic to Maximize Throughput, page 2-2
• What to Do Next, page 2-5
Embedded Network Interfaces
The adaptive security appliance has two internal buses providing copper Gigabit
Ethernet and fiber Gigabit Ethernet connectivity:
• Slot 0 (corresponding to Bus 0) has four embedded copper Gigabit Ethernet
ports
• Slot 1 (corresponding to Bus 1) has four embedded copper Gigabit Ethernet
ports and four embedded SFPs that support fiber Gigabit Ethernet
connectivity

Chapter 2 Maximizing Throughput on the ASA 5550
Balancing Traffic to Maximize Throughput
2-2
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
Note To establish fiber connectivity on the adaptive security appliance, you must order
and install SFP modules for each fiber port you want to use. For more information
on fiber ports and SFP modules, see the “Installing SFP Modules” section on
page 3-6.
Figure 2-1 shows the embedded ports on the Cisco ASA 5550.
Figure 2-1 Embedded Ports on the ASA 5550
Note Although Slot 1 has four copper Ethernet ports and four fiber Ethernet ports, you
can use only four Slot 1 ports at a time. For example, you could use two Slot 1
copper ports and two fiber ports, but you cannot use fiber ports if you are already
using all four Slot 1 copper ports.
Balancing Traffic to Maximize Throughput
To maximize traffic throughput, configure the adaptive security appliance so that
traffic is distributed equally between the two buses in the device. To achieve this,
lay out the network so that all traffic flows through both Bus 0 (Slot 0) and Bus 1
(Slot 1), entering through one bus and exiting through the other.
153217
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT USB2 USB1
FLASH
CONSOLE AUX
POWER
STATU S
FLASH
VPN
ACTIVE
PWR STATUS
LNK SPD0123
Slot 1 Slot 0
Ethernet Fiber Ethernet

2-3
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
Chapter 2 Maximizing Throughput on the ASA 5550
Balancing Traffic to Maximize Throughput
In Figure 2-2 and Figure 2-3, network traffic is distributed so that all traffic flows
through both buses in the device, enabling the adaptive security appliance to
deliver maximum throughput.
Figure 2-2 Traffic Evenly Distributed for Maximum Throughput (Copper to Copper)
Figure 2-3 Traffic Evenly Distributed for Maximum Throughput (Copper to Fiber)
153104
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT USB2 USB1
FLASH
CONSOLE AUX
POWER
STATUS
FLASH
VPN
ACTIVE
PWR STATUS
LNK SPD0123
Slot 1 Slot 0
Incoming and
outgoing traffic
Incoming and
outgoing traffic
Maximum
throughput
153305
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT USB2 USB1
FLASH
CONSOLE AUX
POWER
STATUS
FLASH
VPN
ACTIVE
PWR STATUS
LNK SPD0123
Slot 1 Slot 0
Maximum
throughput
Incoming and
outgoing traffic
Incoming and
outgoing traffic

Chapter 2 Maximizing Throughput on the ASA 5550
Balancing Traffic to Maximize Throughput
2-4
Cisco ASA 5500 Series Getting Started Guide
78-19186-01
Figure 2-4 illustrates several configurations that do not enable the adaptive
security appliance to deliver maximum throughput because network traffic flows
through only one bus on the device.
Figure 2-4 Configurations Not Enabling Maximum Throughput
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT USB2 USB1
FLASH
CONSOLE AUX
POWER
STATUS
FLASH
VPN
ACTIVE
PWR STATUS
LNK SPD0123
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT USB2 USB1
FLASH
CONSOLE AUX
POWER
STATU S
FLASH
VPN
ACTIVE
PWR STATUS
LNK SPD0123
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT USB2 USB1
FLASH
CONSOLE AUX
POWER
STATU S
FLASH
VPN
ACTIVE
PWR STATUS
LNK SPD0123
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT USB2 USB1
FLASH
CONSOLE AUX
POWER
STATUS
FLASH
VPN
ACTIVE
PWR STATUS
LNK SPD0123
Slot 1 Slot 0
Incoming and
outgoing traffic
Slot 1 Slot 0
Slot 1 Slot 0
153306
Slot 1 Slot 0
Incoming and
outgoing traffic
Incoming and
outgoing traffic
Incoming and outgoing traffic