Cisco Cisco ASA Series User manual

Getting Started
This chapter describes how to get started with your Cisco ASA.
•Access the Console for the Command-Line Interface, page 1
•Configure ASDM Access, page 9
•Start ASDM, page 15
•Factory Default Configurations, page 16
•Work with the Configuration, page 24
•Apply Configuration Changes to Connections, page 28
•Reload the ASA, page 28
Access the Console for the Command-Line Interface
For initial configuration, access the CLI directly from the console port. Later, you can configure remote access
using Telnet or SSH according to Management Access. If your system is already in multiple context mode,
then accessing the console port places you in the system execution space.
For ASAv console access, see the ASAv quick start guide.Note
Access the Appliance Console
Follow these steps to access the appliance console.
Procedure
Step 1 Connect a computer to the console port using the provided console cable, and connect to the console using a
terminal emulator set for 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control.
See the hardware guide for your ASA for more information about the console cable.
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
1

Step 2 Press the Enter key to see the following prompt:
ciscoasa>
This prompt indicates that you are in user EXEC mode. Only basic commands are available from user EXEC
mode.
Step 3 To access privileged EXEC mode, enter the following command:
ciscoasa> enable
The following prompt appears:
Password:
All non-configuration commands are available in privileged EXEC mode. You can also enter configuration
mode from privileged EXEC mode.
Step 4 Enter the enable password at the prompt.
By default, the password is blank, and you can press the Enter key to continue. See Set the Hostname, Domain
Name, and the Enable and Telnet Passwords to change the enable password.
The prompt changes to:
ciscoasa#
To exit privileged mode, enter the disable,exit, or quit command.
Step 5 To access global configuration mode, enter the following command:
ciscoasa# configure terminal
The prompt changes to the following:
ciscoasa(config)#
You can begin to configure the ASA from global configuration mode. To exit global configuration mode,
enter the exit,quit, or end command.
Access the ASA Console on the Firepower 9300 Chassis
For initial configuration, access the command-line interface by connecting to the Firepower 9300 chassis
supervisor (either to the console port or remotely using Telnet or SSH) and then connecting to the ASA security
module.
Procedure
Step 1 Connect to the Firepower 9300 chassis supervisor CLI (console or SSH), and then session to the ASA:
connect module slot console
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
2
Getting Started
Access the ASA Console on the Firepower 9300 Chassis

The first time you access the module console, you access the FXOS module CLI. You must then connect to
the ASA application. Subsequent connections automatically connect to the ASA application, so you can skip
the following command.
connect asa
Example:
Firepower# connect module 1 console
Firepower-module1> connect asa
asa>
Step 2 Access privileged EXEC mode, which is the highest privilege level:
enable
Example:
asa> enable
Password:
asa#
Enter the enable password at the prompt. By default, the password is blank.
To exit privileged EXEC mode, enter the disable,exit, or quit command.
Step 3 Enter global configuration mode:
configure terminal
Example:
asa# configure terminal
asa(config)#
To exit global configuration mode, enter the disable,exit, or quit command.
Step 4 Exit the ASA console session by typing~to exit to the Telnet application, then quit to exit to the FXOS
supervisor CLI.
If you want to exit first to the FXOS module CLI for troubleshooting purposes, enter Ctrl-A-D.
Example:
Firepower# connect module 1 console
Telnet escape character is '~'.
Trying 127.5.1.1...
Connected to 127.5.1.1.
Escape character is '~'.
CISCO Serial Over LAN:
Close Network Connection to Exit
Firepower-module1> connect asa
asa> enable
Password:
asa# configure terminal
asa(config)#
asa(config)# [Ctrl-A-D]
Firepower-module1> ~
telnet> quit
Connection closed.
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
3
Getting Started
Access the ASA Console on the Firepower 9300 Chassis

Firepower#
Access the ASA Services Module Console
For initial configuration, access the command-line interface by connecting to the switch (either to the console
port or remotely using Telnet or SSH) and then connecting to the ASASM. This section describes how to
access the ASASM CLI.
About Connection Methods
From the switch CLI, you can use two methods to connect to the ASASM:
•Virtual console connection—Using the service-module session command, you create a virtual console
connection to the ASASM, with all the benefits and limitations of an actual console connection.
Benefits include:
◦The connection is persistent across reloads and does not time out.
◦You can stay connected through ASASM reloads and view startup messages.
◦You can access ROMMON if the ASASM cannot load the image.
◦No initial password configuration is required.
Limitations include:
◦The connection is slow (9600 baud).
◦You can only have one console connection active at a time.
◦You cannot use this command in conjunction with a terminal server where Ctrl-Shift-6,xis the
escape sequence to return to the terminal server prompt. Ctrl-Shift-6,xis also the sequence to
escape the ASASM console and return to the switch prompt. Therefore, if you try to exit the
ASASM console in this situation, you instead exit all the way to the terminal server prompt. If you
reconnect the terminal server to the switch, the ASASM console session is still active; you can
never exit to the switch prompt. You must use a direct serial connection to return the console to
the switch prompt. In this case, either change the terminal server or switch escape character in
Cisco IOS software, or use the Telnet session command instead.
Because of the persistence of the console connection, if you do not properly log out of
the ASASM, the connection may exist longer than intended. If someone else wants to
log in, they will need to kill the existing connection.
Note
•Telnet connection—Using the session command, you create a Telnet connection to the ASASM.
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
4
Getting Started
Access the ASA Services Module Console

You cannot connect using this method for a new ASASM; this method requires you to
configure a Telnet login password on the ASASM (there is no default password). After
you set a password using the passwd command, you can use this method.
Note
Benefits include:
◦You can have multiple sessions to the ASASM at the same time.
◦The Telnet session is a fast connection.
Limitations include:
◦The Telnet session is terminated when the ASASM reloads, and can time out.
◦You cannot access the ASASM until it completely loads; you cannot access ROMMON.
◦You must first set a Telnet login password; there is no default password.
Log Into the ASA Services Module
For initial configuration, access the command-line interface by connecting to the switch (either to the switch
console port or remotely using Telnet or SSH) and then connecting to the ASASM.
If your system is already in multiple context mode, then accessing the ASASM from the switch places you
in the system execution space.
Later, you can configure remote access directly to the ASASM using Telnet or SSH.
Procedure
Step 1 From the switch, perform one of the following:
•Available for initial access—From the switch CLI, enter this command to gain console access to the
ASASM:
service-module session [switch {1|2}] slot number
Example:
Router# service-module session slot 3
ciscoasa>
For a switch in a VSS, enter the switch argument.
To view the module slot numbers, enter the show module command at the switch prompt.
You access user EXEC mode.
•Available after you configure a login password—From the switch CLI, enter this command to Telnet
to the ASASM over the backplane:
session [switch {1 | |2}] slot number processor 1
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
5
Getting Started
Access the ASA Services Module Console

You are prompted for the login password:
ciscoasa passwd:
Example:
Router# session slot 3 processor 1
ciscoasa passwd: cisco
ciscoasa>
For a switch in a VSS, enter the switch argument.
The session slot processor 0 command, which is supported on other services modules, is not supported
on the ASASM; the ASASM does not have a processor 0.
To view the module slot numbers, enter the show module command at the switch prompt.
Enter the login password to the ASASM. Set the password using the passwd command. There is no
default password.
You access user EXEC mode.
Step 2 Access privileged EXEC mode, which is the highest privilege level:
enable
Example:
ciscoasa> enable
Password:
ciscoasa#
Enter the enable password at the prompt. By default, the password is blank.
To exit privileged EXEC mode, enter the disable,exit, or quit command.
Step 3 Access global configuration mode:
configure terminal
To exit global configuration mode, enter the disable,exit, or quit command.
Related Topics
Set the Hostname, Domain Name, and the Enable and Telnet Passwords
Log Out of a Console Session
If you do not log out of the ASASM, the console connection persists; there is no timeout. To end the ASASM
console session and access the switch CLI, perform the following steps.
To kill another user’s active connection, which may have been unintentionally left open, see Kill an Active
Console Connection, on page 7.
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
6
Getting Started
Access the ASA Services Module Console

Procedure
To return to the switch CLI, type the following:
Ctrl-Shift-6,x
You return to the switch prompt:
asasm# [Ctrl-Shift-6, x]
Router#
Shift-6 on US and UK keyboards issues the caret (^) character. If you have a different keyboard and
cannot issue the caret (^) character as a standalone character, you can temporarily or permanently
change the escape character to a different character. Use the terminal escape-character ascii_number
command (to change for this session) or the default escape-character ascii_number command (to
change permanently). For example, to change the sequence for the current session to Ctrl-w,x, enter
terminal escape-character 23.
Note
Kill an Active Console Connection
Because of the persistence of a console connection, if you do not properly log out of the ASASM, the connection
may exist longer than intended. If someone else wants to log in, they will need to kill the existing connection.
Procedure
Step 1 From the switch CLI, show the connected users using the show users command. A console user is called
“con”. The Host address shown is 127.0.0.slot0, where slot is the slot number of the module.
show users
For example, the following command output shows a user “con”on line 0 on a module in slot 2:
Router# show users
Line User Host(s) Idle Location
* 0 con 0 127.0.0.20 00:00:02
Step 2 To clear the line with the console connection, enter the following command:
clear line number
For example:
Router# clear line 0
Log Out of a Telnet Session
To end the Telnet session and access the switch CLI, perform the following steps.
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
7
Getting Started
Access the ASA Services Module Console

Procedure
To return to the switch CLI, type exit from the ASASM privileged or user EXEC mode. If you are in a
configuration mode, enter exit repeatedly until you exit the Telnet session.
You return to the switch prompt:
asasm# exit
Router#
You can alternatively escape the Telnet session using the escape sequence Ctrl-Shift-6,x; this escape
sequence lets you resume the Telnet session by pressing the Enter key at the switch prompt. To
disconnect your Telnet session from the switch, enter disconnect at the switch CLI. If you do not
disconnect the session, it will eventually time out according to the ASASM configuration.
Note
Access the Software Module Console
If you have a software module installed, such as the ASA FirePOWER module on the ASA 5506-X, you can
session to the module console.
You cannot access the hardware module CLI over the ASA backplane using the session command.
Note
Procedure
From the ASA CLI, session to the module:
session {sfr |cxsc |ips}console
Example:
ciscoasa# session sfr console
Opening console session with module sfr.
Connected to module sfr. Escape character sequence is 'CTRL-^X'.
Cisco ASA SFR Boot Image 5.3.1
asasfr login: admin
Password: Admin123
Access the ASA 5506W-X Wireless Access Point Console
To access the wireless access point console, perform the following steps.
Procedure
Step 1 From the ASA CLI, session to the access point:
session wlan console
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
8
Getting Started
Access the Software Module Console

Example:
ciscoasa# session wlan console
opening console session with module wlan
connected to module wlan. Escape character sequence is ‘CTRL-^X’
ap>
Step 2 See the Cisco IOS Configuration Guide for Autonomous Aironet Access Points for information about the
access point CLI.
Configure ASDM Access
This section describes how to access ASDM with a default configuration and how to configure access if you
do not have a default configuration.
Use the Factory Default Configuration for ASDM Access (Appliances, ASAv)
With a factory default configuration, ASDM connectivity is pre-configured with default network settings.
Procedure
Connect to ASDM using the following interface and network settings:
•The management interface depends on your model:
◦ASA 5506-X, ASA 5508-X, and ASA 5516-X—The interface to which you connect to ASDM is
GigabitEthernet 1/2.
◦ASA 5512-X and higher—The interface to which you connect to ASDM is Management 0/0.
◦ASAv—The interface to which you connect to ASDM is Management 0/0.
◦ISA 3000—The interface to which you connect to ASDM is Management 1/1.
◦ASA on the Firepower 9300 chassis—The interface to which you connect to ASDM is the
Management type interface of your choice defined on the FXOS Chassis supervisor
•The default management address is:
◦ASA appliances—192.168.1.1.
◦ASAv—You set the management interface IP address during deployment.
◦ASA on the Firepower 9300 chassis—You set the management interface IP address during
deployment.
•The clients allowed to access ASDM:
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
9
Getting Started
Configure ASDM Access

◦ASA appliances—Clients must be on the 192.168.1.0/24 network. The default configuration enables
DHCP so that your management station can be assigned an IP address in this range.
◦ASAv—You set the management client IP address during deployment. The ASAv does not act as
the DHCP server for connected clients.
◦ASA on the Firepower 9300 chassis—All hosts are allowed to access ASDM on the management
interface. The ASAv does not act as the DHCP server for connected clients.
If you change to multiple context mode, you can access ASDM from the admin context using the
network settings above.
Note
Related Topics
Factory Default Configurations, on page 16
Enable or Disable Multiple Context Mode
Start ASDM, on page 15
Customize ASDM Access
This procedure applies to all models except the ASA Services Module.
Use this procedure if one or more of the following conditions applies:
•You do not have a factory default configuration
•You want to change the management IP address
•You want to change to transparent firewall mode
•You want to change to multiple context mode
For routed, single mode, for quick and easy ASDM access, we recommend applying the factory default
configuration with the option to set your own management IP address. Use the procedure in this section only
if you have special needs such as setting transparent or multiple context mode, or if you have other configuration
that you need to preserve.
For the ASAv, you can configure transparent mode when you deploy, so this procedure is primarily useful
after you deploy if you need to clear your configuration, for example.
Note
Procedure
Step 1 Access the CLI at the console port.
Step 2 (Optional) Enable transparent firewall mode:
This command clears your configuration.
firewall transparent
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
10
Getting Started
Customize ASDM Access

Step 3 Configure the management interface:
interface interface_id
nameif name
security-level level
no shutdown
ip address ip_address mask
Example:
ciscoasa(config)# interface management 0/0
ciscoasa(config-if)# nameif management
ciscoasa(config-if)# security-level 100
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# ip address 192.168.1.1 255.255.255.0
The security-level is a number between 1 and 100, where 100 is the most secure.
Step 4 (For directly-connected management hosts) Set the DHCP pool for the management network:
dhcpd address ip_address-ip_address interface_name
dhcpd enable interface_name
Example:
ciscoasa(config)# dhcpd address 192.168.1.2-192.168.1.254 management
ciscoasa(config)# dhcpd enable management
Make sure you do not include the interface address in the range.
Step 5 (For remote management hosts) Configure a route to the management hosts:
route management_ifc management_host_ip mask gateway_ip 1
Example:
ciscoasa(config)# route management 10.1.1.0 255.255.255.0 192.168.1.50 1
Step 6 Enable the HTTP server for ASDM:
http server enable
Step 7 Allow the management host(s) to access ASDM:
http ip_address mask interface_name
Example:
ciscoasa(config)# http 192.168.1.0 255.255.255.0 management
Step 8 Save the configuration:
write memory
Step 9 (Optional) Set the mode to multiple mode:
mode multiple
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
11
Getting Started
Customize ASDM Access

When prompted, confirm that you want to convert the existing configuration to be the admin context. You
are then prompted to reload the ASA.
Examples
The following configuration converts the firewall mode to transparent mode, configures the Management 0/0
interface, and enables ASDM for a management host:
firewall transparent
interface management 0/0
ip address 192.168.1.1 255.255.255.0
nameif management
security-level 100
no shutdown
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
http server enable
http 192.168.1.0 255.255.255.0 management
Related Topics
Restore the Factory Default Configuration, on page 17
Set the Firewall Mode
Access the Appliance Console, on page 1
Start ASDM, on page 15
Configure ASDM Access for the ASA Services Module
Because the ASASM does not have physical interfaces, it does not come pre-configured for ASDM access;
you must configure ASDM access using the CLI on the ASASM. To configure the ASASM for ASDM access,
perform the following steps.
Before You Begin
Assign a VLAN interface to the ASASM according to ASASM quick start guide.
Procedure
Step 1 Connect to the ASASM and access global configuration mode.
Step 2 (Optional) Enable transparent firewall mode:
firewall transparent
This command clears your configuration.
Step 3 Do one of the following to configure a management interface, depending on your mode:
•Routed mode—Configure an interface in routed mode:
interface vlan number
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
12
Getting Started
Configure ASDM Access for the ASA Services Module

ip address ip_address [mask]
nameif name
security-level level
Example:
ciscoasa(config)# interface vlan 1
ciscoasa(config-if)# ip address 192.168.1.1 255.255.255.0
ciscoasa(config-if)# nameif inside
ciscoasa(config-if)# security-level 100
The security-level is a number between 1 and 100, where 100 is the most secure.
•Transparent mode—Configure a bridge virtual interface and assigns a management VLAN to the bridge
group:
interface bvi number
ip address ip_address [mask]
interface vlan number
bridge-group bvi_number
nameif name
security-level level
Example:
ciscoasa(config)# interface bvi 1
ciscoasa(config-if)# ip address 192.168.1.1 255.255.255.0
ciscoasa(config)# interface vlan 1
ciscoasa(config-if)# bridge-group 1
ciscoasa(config-if)# nameif inside
ciscoasa(config-if)# security-level 100
The security-level is a number between 1 and 100, where 100 is the most secure.
Step 4 (For directly-connected management hosts) Enable DHCP for the management host on the management
interface network:
dhcpd address ip_address-ip_address interface_name
dhcpd enable interface_name
Example:
ciscoasa(config)# dhcpd address 192.168.1.2-192.168.1.254 inside
ciscoasa(config)# dhcpd enable inside
Make sure you do not include the management address in the range.
Step 5 (For remote management hosts) Configure a route to the management hosts:
route management_ifc management_host_ip mask gateway_ip 1
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
13
Getting Started
Configure ASDM Access for the ASA Services Module

Example:
ciscoasa(config)# route management 10.1.1.0 255.255.255.0 192.168.1.50
Step 6 Enable the HTTP server for ASDM:
http server enable
Step 7 Allow the management host to access ASDM:
http ip_address mask interface_name
Example:
ciscoasa(config)# http 192.168.1.0 255.255.255.0 management
Step 8 Save the configuration:
write memory
Step 9 (Optional) Set the mode to multiple mode:
mode multiple
When prompted, confirm that you want to convert the existing configuration to be the admin context. You
are then prompted to reload the ASASM.
Examples
The following routed mode configuration configures the VLAN 1 interface and enables ASDM for a
management host:
interface vlan 1
nameif inside
ip address 192.168.1.1 255.255.255.0
security-level 100
dhcpd address 192.168.1.3-192.168.1.254 inside
dhcpd enable inside
http server enable
http 192.168.1.0 255.255.255.0 inside
The following configuration converts the firewall mode to transparent mode, configures the VLAN 1 interface
and assigns it to BVI 1, and enables ASDM for a management host:
firewall transparent
interface bvi 1
ip address 192.168.1.1 255.255.255.0
interface vlan 1
bridge-group 1
nameif inside
security-level 100
dhcpd address 192.168.1.3-192.168.1.254 inside
dhcpd enable inside
http server enable
http 192.168.1.0 255.255.255.0 inside
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
14
Getting Started
Configure ASDM Access for the ASA Services Module

Related Topics
Access the ASA Services Module Console, on page 4
Set the Firewall Mode
Start ASDM
You can start ASDM using two methods:
•ASDM-IDM Launcher—The Launcher is an application downloaded from the ASA using a web browser
that you can use to connect to any ASA IP address. You do not need to re-download the launcher if you
want to connect to other ASAs.
•Java Web Start—For each ASA that you manage, you need to connect with a web browser and then
save or launch the Java Web Start application. You can optionally save the shortcut to your computer;
however you need separate shortcuts for each ASA IP address.
If you use web start, clear the Java cache or you might lose changes to some pre-login policies such as
Hostscan. This problem does not occur if you use the launcher.
Note
Within ASDM, you can choose a different ASA IP address to manage; the difference between the Launcher
and Java Web Start functionality rests primarily in how you initially connect to the ASA and launch ASDM.
This section describes how to connect to ASDM initially, and then launch ASDM using the Launcher or the
Java Web Start.
ASDM stores files in the local \Users\<user_id>\.asdm directory, including cache, log, and preferences, and
also in the Temp directory, including AnyConnect profiles.
Procedure
Step 1 On the computer that you specified as the ASDM client, enter the following URL:
https://asa_ip_address/admin
The ASDM launch page appears with the following buttons:
•Install ASDM Launcher and Run ASDM
•Run ASDM
•Run Startup Wizard
Step 2 To download the Launcher:
a) Click Install ASDM Launcher and Run ASDM.
b) Leave the username and password fields empty (for a new installation), and click OK. With no HTTPS
authentication configured, you can gain access to ASDM with no username and the enable password,
which is blank by default. Note: If you enabled HTTPS authentication, enter your username and associated
password. Even without authentication, if you enter a username and password at the login screen (instead
of leaving the username blank), ASDM checks the local database for a match.
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
15
Getting Started
Start ASDM

c) Save the installer to your computer, and then start the installer. The ASDM-IDM Launcher opens
automatically after installation is complete.
d) Enter the management IP address, the same username and password (blank for a new installation), and
then click OK.
Step 3 To use Java Web Start:
a) Click Run ASDM or Run Startup Wizard.
b) Save the shortcut to your computer when prompted. You can optionally open it instead of saving it.
c) Start Java Web Start from the shortcut.
d) Accept any certificates according to the dialog boxes that appear. The Cisco ASDM-IDM Launcher appears.
e) Leave the username and password fields empty (for a new installation), and click OK. With no HTTPS
authentication configured, you can gain access to ASDM with no username and the enable password,
which is blank by default. Note: If you enabled HTTPS authentication, enter your username and associated
password. Even without authentication, if you enter a username and password at the login screen (instead
of leaving the username blank), ASDM checks the local database for a match.
Factory Default Configurations
The factory default configuration is the configuration applied by Cisco to new ASAs.
•ASA appliances—The factory default configuration configures an interface for management so that you
can connect to it using ASDM, with which you can then complete your configuration.
•ASA on the Firepower 9300 chassis—When you deploy the standalone or cluster of ASAs, the factory
default configuration configures an interface for management so that you can connect to it using ASDM,
with which you can then complete your configuration.
•ASAv—Depending on your hypervisor, as part of deployment, the deployment configuration (the initial
virtual deployment settings) configures an interface for management so that you can connect to it using
ASDM, with which you can then complete your configuration. You can also configure failover IP
addresses. You can also apply a “factory default”configuration if desired.
•ASASM—No default configuration. See Access the ASA Services Module Console, on page 4 to
start configuration.
For appliances and the ASA on the Firepower 9300 chassis, the factory default configuration is available only
for routed firewall mode and single context mode. For the ASAv, you can choose transparent or routed mode
at deployment.
In addition to the image files and the (hidden) default configuration, the following folders and files are
standard in flash memory: log/, crypto_archive/, and coredumpinfo/coredump.cfg. The date on these files
may not match the date of the image files in flash memory. These files aid in potential troubleshooting;
they do not indicate that a failure has occurred.
Note
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
16
Getting Started
Factory Default Configurations

Restore the Factory Default Configuration
This section describes how to restore the factory default configuration. For the ASAv, this procedure erases
the deployment configuration and applies the same factory default configuration as for the ASA appliances.
On the ASASM, restoring the factory default configuration simply erases the configuration; there is no
factory default configuration. On the Firepower 9300 ASA security module, restoring the factory default
configuration simply erases the configuration; to restore the default configuration, you must re-deploy the
ASA from the supervisor.
Note
Before You Begin
This feature is available only in routed firewall mode; transparent mode does not support IP addresses for
interfaces. In addition, this feature is available only in single context mode; an ASA with a cleared configuration
does not have any defined contexts to configure automatically using this feature.
Procedure
Step 1 Restore the factory default configuration:
configure factory-default [ip_address [mask]]
Example:
ciscoasa(config)# configure factory-default 10.1.1.1 255.255.255.0
If you specify the ip_address, then you set the inside or management interface IP address, depending on your
model, instead of using the default IP address of 192.168.1.1. The http command uses the subnet you specify.
Similarly, the dhcpd address command range consists of addresses within the subnet that you specify.
This command also clears the boot system command, if present, along with the rest of the configuration. The
boot system command lets you boot from a specific image, including an image on the external flash memory
card. The next time you reload the ASA after restoring the factory configuration, it boots from the first image
in internal flash memory; if you do not have an image in internal flash memory, the ASA does not boot.
Step 2 Save the default configuration to flash memory:
write memory
This command saves the running configuration to the default location for the startup configuration, even if
you previously configured the boot config command to set a different location; when the configuration was
cleared, this path was also cleared.
Restore the ASAv Deployment Configuration
This section describes how to restore the ASAv deployment (Day 0) configuration.
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
17
Getting Started
Restore the Factory Default Configuration

Procedure
Step 1 For failover, power off the standby unit.
To prevent the standby unit from becoming active, you must power it off. If you leave it on, when you erase
the active unit configuration, then the standby unit becomes active. When the former active unit reloads and
reconnects over the failover link, the old configuration will sync from the new active unit, wiping out the
deployment configuration you wanted.
Step 2 Restore the deployment configuration after you reload. For failover, enter this command on the active unit:
write erase
The ASAv boots the current running image, so you are not reverted to the original boot image. To
use the original boot image, see the boot image command.
Do not save the configuration.
Note
Step 3 Reload the ASAv and load the deployment configuration:
reload
Step 4 For failover, power on the standby unit.
After the active unit reloads, power on the standby unit. The deployment configuration will sync to the standby
unit.
ASA 5506-X, 5508-X, and 5516-X Default Configuration
The default factory configuration for the ASA 5506-X series, 5508-X, and 5516-X configures the following:
•inside --> outside traffic flow—GigabitEthernet 1/1 (outside), GigabitEthernet 1/2 (inside)
•outside IP address from DHCP, inside IP address—192.168.1.1
•(ASA 5506W-X) wifi <--> inside, wifi --> outside traffic flow—GigabitEthernet 1/9 (wifi)
•(ASA 5506W-X) wifi IP address—192.168.10.1
•DHCP for clients on inside and wifi. The access point itself and all its clients use the ASA as the DHCP
server.
•Management 1/1 interface is Up, but otherwise unconfigured. The ASA FirePOWER module can then
use this interface to access the ASA inside network and use the inside interface as the gateway to the
Internet.
•ASDM access—inside and wifi hosts allowed.
•NAT—Interface PAT for all traffic from inside, wifi, and management to outside.
The configuration consists of the following commands:
interface Management1/1
management-only
no nameif
no security-level
no ip address
no shutdown
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
18
Getting Started
ASA 5506-X, 5508-X, and 5516-X Default Configuration

interface GigabitEthernet1/1
nameif outside
security-level 0
ip address dhcp setroute
no shutdown
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
no shutdown
!
object network obj_any
subnet 0.0.0.0 0.0.0.0
nat (any,outside) dynamic interface
!
http server enable
http 192.168.1.0 255.255.255.0 inside
!
dhcpd auto_config outside
dhcpd address 192.168.1.5-192.168.1.254 inside
dhcpd enable inside
!
logging asdm informational
For the ASA 5506W-X, the following commands are also included:
same-security-traffic permit inter-interface
!
interface GigabitEthernet 1/9
security-level 100
nameif wifi
ip address 192.168.10.1 255.255.255.0
no shutdown
!
http 192.168.10.0 255.255.255.0 wifi
!
dhcpd address 192.168.10.2-192.168.10.254 wifi
dhcpd enable wifi
ASA 5512-X, 5515-X, 5525-X and Above Default Configuration
The default factory configuration for the ASA 5512-X, 5515-X, 5525-X and above configures the following:
•Management interface—Management 0/0 (management).
•IP address—The management address is 192.168.1.1/24.
•DHCP server—Enabled for management hosts so that a computer connecting to the management interface
receives an address between 192.168.1.2 and 192.168.1.254.
•ASDM access—Management hosts allowed.
The configuration consists of the following commands:
interface management 0/0
ip address 192.168.1.1 255.255.255.0
nameif management
security-level 100
no shutdown
!
asdm logging informational
asdm history enable
!
http server enable
http 192.168.1.0 255.255.255.0 management
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
19
Getting Started
ASA 5512-X, 5515-X, 5525-X and Above Default Configuration

!
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
ASA on the Firepower 9300 Chassis Default Configuration
When you deploy the ASA on the Firepower 9300 chassis, you can pre-set many parameters that let you
connect to the Management interface using ASDM. A typical configuration includes the following settings:
•Management interface:
◦Management type interface of your choice defined on the Firepower 9300 Chassis supervisor
◦Named “management”
◦IP address of your choice
◦Security level 0
◦Management-only
•Default route through the management interface
•ASDM access—All hosts allowed.
The configuration for a standalone unit consists of the following commands. For additional configuration for
clustered units, see Deploy the Cluster from the Firepower 9300 Chassis Supervisor.
interface <management_ifc>
management-only
ip address <ip_address> <mask>
ipv6 address <ipv6_address>
ipv6 enable
nameif management
security-level 0
no shutdown
http server enable
http 0.0.0.0 0.0.0.0 management
http ::/0 management
route management 0.0.0.0 0.0.0.0 <gateway_ip> 1
ipv6 route management ::/0 <gateway_ipv6>
ISA 3000 Default Configuration
The default factory configuration for the ISA 3000 configures the following:
•Transparent firewall mode—A transparent firewall is a Layer 2 firewall that acts like a “bump in the
wire,”or a “stealth firewall,”and is not seen as a router hop to connected devices.
•1 Bridge Virtual Interface—All member interfaces are in the same network (IP address not
pre-configured; you must set to match your network): GigabitEthernet 1/1 (outside1), GigabitEthernet
1/2 (inside1), GigabitEthernet 1/3 (outside2), GigabitEthernet 1/4 (inside2)
•All inside and outside interfaces can communicate with each other.
•Management 1/1 interface—192.168.1.1/24 for ASDM access.
CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5
20
Getting Started
ASA on the Firepower 9300 Chassis Default Configuration