Cisco ASA 5550 Series User manual

Corporate Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Cisco ASA 5550
Getting Started Guide
Customer Order Number: DOC-7817644=
Text Part Number: 78-17644-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT
NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT
ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR
THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION
PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO
LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as
part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE
PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED
OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL
DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR
INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH
DAMAGES.
CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We
Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP,
CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the
Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink,
Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers
logo, Networking Academy, Network Registrar, Packe t, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast,
SMARTnet, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates
in the United States and certain other countries.
All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply
a partnership relationship between Cisco and any other company. (0601R)
Cisco ASA 5550 Getting Started Guide
© 2006 Cisco Systems, Inc. All rights reserved.

iii
Cisco ASA 5550 Getting Started Guide
78-17644-01
CONTENTS
CHAPTER 1Before You Begin 1-1
CHAPTER 2Maximizing Throughput on the ASA 5550 Adaptive Security Appliance 2-1
Embedded Network Interfaces 2-1
Balancing Traffic to Maximize Throughput 2-2
What to Do Next 2-5
CHAPTER 3Installing the Cisco ASA 5550 Security Appliance 3-1
Verifying the Package Contents 3-2
Installing the Chassis 3-3
Rack-Mounting the Chassis 3-4
Installing SFP Modules 3-5
SFP Module 3-6
Installing an SFP Module 3-7
Ports and LEDs 3-9
Front Panel LEDs 3-9
Rear Panel LEDs and Ports in Slot 0 3-10
Ports and LEDs in Slot 1 3-12
What to Do Next 3-13
CHAPTER 4Connecting Cables to Network Interfaces 4-1
Connecting Interface Cables 4-1
What to Do Next 4-7

Contents
iv
Cisco ASA 5550 Getting Started Guide
78-17644-01
CHAPTER 5Configuring the Adaptive Security Appliance 5-1
About the Factory-Default Configuration 5-2
About the Adaptive Security Device Manager 5-2
Using the Startup Wizard 5-3
Before Launching the Startup Wizard 5-4
Running the Startup Wizard 5-4
Setting the Media Type for Fiber Interfaces 5-6
What to Do Next 5-7
CHAPTER 6Scenario: DMZ Configuration 6-1
Example DMZ Network Topology 6-1
Configuring the Security Appliance for a DMZ Deployment 6-4
Configuration Requirements 6-5
Starting ASDM 6-6
Creating IP Pools for Network Address Translation 6-7
Configuring NAT for Inside Clients to Communicate with the DMZ Web
Server 6-12
Configuring NAT for Inside Clients to Communicate with Devices on the
Internet 6-15
Configuring an External Identity for the DMZ Web Server 6-16
Providing Public HTTP Access to the DMZ Web Server 6-18
What to Do Next 6-24
CHAPTER 7Scenario: Remote-Access VPN Configuration 7-1
Example IPsec Remote-Access VPN Network Topology 7-1
Implementing the IPsec Remote-Access VPN Scenario 7-2
Information to Have Available 7-3
Starting ASDM 7-4
Configuring the ASA 5550 for an IPsec Remote-Access VPN 7-5

v
Cisco ASA 5550 Getting Started Guide
78-17644-01
Contents
Selecting VPN Client Types 7-6
Specifying the VPN Tunnel Group Name and Authentication Method 7-7
Specifying a User Authentication Method 7-8
(Optional) Configuring User Accounts 7-10
Configuring Address Pools 7-11
Configuring Client Attributes 7-12
Configuring the IKE Policy 7-13
Configuring IPsec Encryption and Authentication Parameters 7-15
Specifying Address Translation Exception and Split Tunneling 7-16
Verifying the Remote-Access VPN Configuration 7-17
What to Do Next 7-18
CHAPTER 8Scenario: Site-to-Site VPN Configuration 8-1
Example Site-to-Site VPN Network Topology 8-1
Implementing the Site-to-Site Scenario 8-2
Information to Have Available 8-2
Configuring the Site-to-Site VPN 8-3
Starting ASDM 8-3
Configuring the Security Appliance at the Local Site 8-4
Providing Information About the Remote VPN Peer 8-6
Configuring the IKE Policy 8-7
Configuring IPsec Encryption and Authentication Parameters 8-9
Specifying Hosts and Networks 8-10
Viewing VPN Attributes and Completing the Wizard 8-11
Configuring the Other Side of the VPN Connection 8-13
What to Do Next 8-13
APPENDIX AObtaining a DES License or a 3DES-AES License A-1

Contents
vi
Cisco ASA 5550 Getting Started Guide
78-17644-01

CHAPTER
1-1
Cisco ASA 5550 Getting Started Guide
78-17644-01
1
Before You Begin
Use the following table to find the installation and configuration steps that are
required for your implementation of the adaptive security appliance.
To Do This ... See ...
Install the chassis Chapter 3, “Installing the Cisco ASA
5550 Security Appliance”
Connect cables to network interfaces Chapter 4, “Connecting Cables to
Network Interfaces”
Perform initial setup of the adaptive
security appliance
Chapter 5, “Configuring the Adaptive
Security Appliance”
Configure the adaptive security
appliance for your implementation
Chapter 6, “Scenario: DMZ
Configuration”
Chapter 7, “Scenario: Remote-Access
VPN Configuration”
Chapter 8, “Scenario: Site-to-Site VPN
Configuration”
Refine configuration
Configure optional and advanced
features
Cisco Security Appliance Command
Line Configuration Guide
Cisco Security Appliance Command
Reference
Cisco Security Appliance Logging
Configuration and System Log
Messages

Chapter 1 Before You Begin
1-2
Cisco ASA 5550 Getting Started Guide
78-17644-01

CHAPTER
2-1
Cisco ASA 5550 Getting Started Guide
78-17644-01
2
Maximizing Throughput on the ASA
5550 Adaptive Security Appliance
The Cisco ASA 5550 Series Security Appliance is designed to deliver maximum
throughput when configured according to the guidelines described in this chapter.
This chapter includes the following sections:
•Embedded Network Interfaces, page 2-1
•Balancing Traffic to Maximize Throughput, page 2-2
•What to Do Next, page 2-5
Embedded Network Interfaces
The adaptive security appliance has two internal buses providing copper Gigabit
Ethernet and fiber Gigabit Ethernet connectivity:
•Slot 0 (corresponding to Bus 0) has four embedded copper Gigabit Ethernet
ports
•Slot 1 (corresponding to Bus 1) has four embedded copper Gigabit Ethernet
ports and four embedded SFPs that support fiber Gigabit Ethernet
connectivity

Chapter 2 Maximizing Throughput on the ASA 5550 Adaptive Security Appliance
Balancing Traffic to Maximize Throughput
2-2
Cisco ASA 5550 Getting Started Guide
78-17644-01
Note To establish fiber connectivity on the adaptive security appliance, you must order
and install SFP modules for each fiber port you want to use. For more information
on fiber ports and SFP modules, see the “Installing SFP Modules” section on
page 3-5.
Figure 2-1 shows the embedded ports on the FWSM.
Figure 2-1 Embedded Ports on the ASA 5550
Note Although Slot 1 has four copper Ethernet ports and four fiber Ethernet ports, you
can use only four Slot 1 ports at a time. For example, you could use two Slot 1
copper ports and two fiber ports, but you cannot use fiber ports if you are already
using all four Slot 1 copper ports.
Balancing Traffic to Maximize Throughput
To maximize traffic throughput, configure the adaptive security appliance so that
traffic is distributed equally between the two buses in the device. To achieve this,
lay out the network so that all traffic flows through both Bus 0 (Slot 0) and Bus 1
(Slot 1), entering through one bus and exiting through the other.
153217
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT USB2 USB1
FLASH
CONSOLE AUX
POWER
STATUS
FLASH
VPN
ACTIVE
PWR STATUS
LNK SPD0123
Slot 1 Slot 0
Ethernet Fiber Ethernet

2-3
Cisco ASA 5550 Getting Started Guide
78-17644-01
Chapter 2 Maximizing Throughput on the ASA 5550 Adaptive Security Appliance
Balancing Traffic to Maximize Throughput
In Figure 2-2 and Figure 2-3, network traffic is distributed so that all traffic flows
through both buses in the device, enabling the adaptive security appliance to
deliver maximum throughput.
Figure 2-2 Traffic Evenly Distributed for Maximum Throughput (Copper to Copper)
Figure 2-3 Traffic Evenly Distributed for Maximum Throughput (Copper to Fiber)
153104
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT USB2 USB1
FLASH
CONSOLE AUX
POWER
STATUS
FLASH
VPN
ACTIVE
PWR STATUS
LNK SPD0123
Slot 1 Slot 0
Incoming and
outgoing traffic
Incoming and
outgoing traffic
Maximum
throughput
153305
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT USB2 USB1
FLASH
CONSOLE AUX
POWER
STATUS
FLASH
VPN
ACTIVE
PWR STATUS
LNK SPD0123
Slot 1 Slot 0
Maximum
throughput
Incoming and
outgoing traffic
Incoming and
outgoing traffic

Chapter 2 Maximizing Throughput on the ASA 5550 Adaptive Security Appliance
Balancing Traffic to Maximize Throughput
2-4
Cisco ASA 5550 Getting Started Guide
78-17644-01
Figure 2-4 illustrates several configurations that do not enable the adaptive
security appliance to deliver maximum throughput because network traffic flows
through only one bus on the device.
Figure 2-4 Configurations Not Enabling Maximum Throughput
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT USB2 USB1
FLASH
CONSOLE AUX
POWER
STATUS
FLASH
VPN
ACTIVE
PWR STATUS
LNK SPD0123
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT USB2 USB1
FLASH
CONSOLE AUX
POWER
STAT U S
FLASH
VPN
ACTIVE
PWR STATUS
LNK SPD0123
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT USB2 USB1
FLASH
CONSOLE AUX
POWER
STAT U S
FLASH
VPN
ACTIVE
PWR STATUS
LNK SPD0123
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT USB2 USB1
FLASH
CONSOLE AUX
POWER
STAT U S
FLASH
VPN
ACTIVE
PWR STATUS
LNK SPD0123
Slot 1 Slot 0
Incoming and
outgoing traffic
Slot 1 Slot 0
Slot 1 Slot 0
153306
Slot 1 Slot 0
Incoming and
outgoing traffic
Incoming and
outgoing traffic
Incoming and outgoing traffic

2-5
Cisco ASA 5550 Getting Started Guide
78-17644-01
Chapter 2 Maximizing Throughput on the ASA 5550 Adaptive Security Appliance
What to Do Next
Note You can use the show traffic command to see the traffic throughput over each bus.
For more information about using the command, see the Cisco Security Appliance
Command Reference.
What to Do Next
Continue with Chapter 3, “Installing the Cisco ASA 5550 Security Appliance.”

Chapter 2 Maximizing Throughput on the ASA 5550 Adaptive Security Appliance
What to Do Next
2-6
Cisco ASA 5550 Getting Started Guide
78-17644-01

CHAPTER
3-1
Cisco ASA 5550 Getting Started Guide
78-17644-01
3
Installing the Cisco ASA 5550 Security
Appliance
Warning Only trained and qualified personnel should be allowed to install, replace, or
service this equipment.
Caution Read the safety warnings in the Regulatory Compliance and Safety Information
for the Cisco ASA 5500 Series and follow proper safety procedures when
performing these steps.
This chapter describes the ASA 5550 adaptive security appliance and rack-mount
and installation procedures for the adaptive security appliance. This chapter
includes the following sections:
•Verifying the Package Contents, page 3-2
•Installing the Chassis, page 3-3
•Installing SFP Modules, page 3-5
•Ports and LEDs, page 3-9
•What to Do Next, page 3-13

Chapter 3 Installing the Cisco ASA 5550 Security Appliance
Verifying the Package Contents
3-2
Cisco ASA 5550 Getting Started Guide
78-17644-01
Verifying the Package Contents
Verify the contents of the packing box, shown in Figure 3-1, to ensure that you
have received all items necessary to install the Cisco ASA 5550.
Figure 3-1 Contents of ASA 5550 Package
Yellow Ethernet cable
(72-1482-01)
Mounting brackets
(700-18797-01 AO) right
(700-18798-01 AO) left
4 flathead screws
(48-0451-01 AO)
2 long cap screws
(48-0654-01 AO)
4 cap screws
(48-0523-01 AO)
Safety and
Compliance
Guide
Cisco ASA 5550 adaptive
security appliance
Documentation
Cisco ASA
5550 Adaptive
Security Appliance
Product CD
4 rubber feet
Cable holder
153215
Blue console cable
PC terminal adapter
LINKSPD
3
LINKSPD
2
LINKSPD
1
LINKSPD
0
MGMT USB2 USB1
FLASH
POWER
STATUS
FLASH
VPN
ACTIVE
Cisco SSM-4GE
LNKSPD
0
1
2
3
POWER
STATUS

3-3
Cisco ASA 5550 Getting Started Guide
78-17644-01
Chapter 3 Installing the Cisco ASA 5550 Security Appliance
Installing the Chassis
Installing the Chassis
This section describes how to rack-mount and install the adaptive security
appliance. You can mount the adaptive security appliance in a 19-inch rack (with
a 17.5- or 17.75-inch opening).
Warning To prevent bodily injury when mounting or servicing this unit in a rack, you must
take special precautions to ensure that the system remains stable. The
following guidelines are provided to ensure your safety.
The following information can help plan equipment rack installation:
•Allow clearance around the rack for maintenance.
•When mounting a device in an enclosed rack ensure adequate ventilation. An
enclosed rack should never be overcrowded. Make sure that the rack is not
congested, because each unit generates heat.
•When mounting a device in an open rack, make sure that the rack frame does
not block the intake or exhaust ports.
•If the rack contains only one unit, mount the unit at the bottom of the rack.
•If the rack is partially filled, load the rack from the bottom to the top, with the
heaviest component at the bottom of the rack.
•If the rack contains stabilizing devices, install the stabilizers prior to
mounting or servicing the unit in the rack.
Warning Before performing any of the following procedures, ensure that the power
source is off. (AC or DC). To ensure that power is removed from the DC circuit,
locate the circuit breaker on the panel board that services the DC circuit,
switch the circuit breaker to the OFF position, and tape the switch handle of the
circuit breaker in the OFF position.

Chapter 3 Installing the Cisco ASA 5550 Security Appliance
Installing the Chassis
3-4
Cisco ASA 5550 Getting Started Guide
78-17644-01
Rack-Mounting the Chassis
To rack-mount the chassis, perform the following steps:
Step 1 Attach the rack-mount brackets to the chassis using the supplied screws. Attach
the brackets to the holes as shown in Figure 3-2. After the brackets are secured to
the chassis, you can rack-mount it.
Figure 3-2 Installing the Right and Left Brackets
Step 2 Attach the chassis to the rack using the supplied screws, as shown in Figure 3-3.
153216
LNK 1
2
3

3-5
Cisco ASA 5550 Getting Started Guide
78-17644-01
Chapter 3 Installing the Cisco ASA 5550 Security Appliance
Installing SFP Modules
Figure 3-3 Rack-Mounting the Chassis
To remove the chassis from the rack, remove the screws that attach the chassis to
the rack, and then remove the chassis.
Installing SFP Modules
The adaptive security appliance uses a field-replaceable SFP module to establish
fiber Gigabit Ethernet connections.
This section describes how to install and remove SFP modules in the adaptive
security appliance. This section includes the following topics:
•SFP Module, page 3-6
•Installing an SFP Module, page 3-7
119633
POWER STATUS FLASH
ACTIVE VPN
CISCO ASA5540
SERIES
AdaptiveSecurity Appliance

Chapter 3 Installing the Cisco ASA 5550 Security Appliance
Installing SFP Modules
3-6
Cisco ASA 5550 Getting Started Guide
78-17644-01
SFP Module
The SFP (Small Form-Factor Pluggable) module is a hot-swappable input/output
device that plugs into the fiber ports.
Note If you install an SFP module after the switch has powered on, you must reload the
adaptive security appliance to enable the SFP module.
Table 3-1 lists the SFP modules that are supported by the adaptive security
appliance.
The 1000BASE-LX/LH and 1000BASE-SX SFP modules are used to establish
fiber connections. Use fiber cables with LC connectors to connect to an SFP
module. The SFP modules support 850 to 1550 nm nominal wavelengths. The
cables must not exceed the required cable length for reliable communications.
Table 3-2 lists the cable length requirements.
Table 3-2 Cabling Requirements for Fiber-Optic SFP Modules
Table 3-1 Supported SFP Modules
SFP Module Type of Connection Cisco Part Number
1000BASE-LX/LH Fiber GLC-LH-SM=
1000BASE-SX Fiber GLC-SX-MM=
SFP Module
62.5/125 micron
Multimode 850
nm Fiber
50/125 micron
Multimode 850
nm Fiber
62.5/125 micron
Multimode
1310 nm Fiber
50/125 micron
Multimode
1310 nm Fiber
9/125 micron
Single-mode
1310 nm Fiber
LX/LH
— — 550 m at
500 Mhz-km
550 m at
400 Mhz-km
10 km
SX
275 m at
200 Mhz-km
550 m at
500 Mhz-km
———