Firewall - Cx-Cisco ASA5500 5505 5510 5520 Etc Series Firewall Security Appliance Startup Configuration Amp Basic C

firewall.
cx
http://www.firewall.cx/cisco-technical-knowledgebase/cisco-firewalls/964-cisco-asa5500-startup.html
Cisco ASA5500 (5505, 5510, 5520, etc) Series Firewall Security

Appliance Startup Configuration & Basic Concepts
inShare
Introducing the Cisco ASA 5500 Series Firewall Appliance

The Cisco ASA 5500 series security appliances have been around
for quite some time and are amongst the most popular hardware
firewalls available in the market. Today Firewall.cx takes a look at
how to easily setup a Cisco ASA5500 series firewall to perform basic
functions, more than enough to provide secure & restricted access to
the Internet, securely access and manage the ASA Firewall and
more.
While many consider the Cisco ASA Firewalls complex and difficult
to configure devices, Firewall.cx aims to break that myth and show
how easy you can setup an ASA Firewall to deliver basic and advanced functionality. Weve done it with other Cisco
technologies and devices, and well do it again :)
The table below provides a brief comparison between the different ASA5500 series security appliances:
Feature
Cisco ASA 5505
Cisco ASA 5510
Cisco ASA
5520
Cisco ASA
5540
Cisco ASA
5550
Users/Nodes
10, 50, or
unlimited
Unlimited
Unlimited
Unlimited
Unlimited
Firewall Throughput
Up to 150 Mbps
Up to 300 Mbps
Up to 450
Mbps
Up to 650
Mbps
Up to 1.2 Gbps
Maximum Firewall
and IPS Throughput
Up to 150 Mbps
with AIP-SSC-5
Up to 150 Mbps with

AIP-SSM-10
Up to 225
Mbps with
AIP-SSM10
Up to 500
Mbps with
AIP-SSM20
Not available
Up to 375
Mbps with
AIP-SSM20
Up to 650
Mbps with
AIP-SSM40
Up to 300 Mbps with

AIP-SSM-20
Up to 450
Mbps with
AIP-SSM40
3DES/AES VPN
Throughput***
IPsec VPN Peers
Up to 100 Mbps
Up to 170 Mbps
10; 25
250
Up to 225
Mbps
Up to 325
Mbps
750
5000
Up to 425 Mbps
5000
Premium
AnyConnect VPN
Peers*
(Included/Maximum)
2/25
2/250
2/750
2/2500
2/5000
Concurrent
Connections
10,000; 25,000 *
50,000; 130,000 *
280,000
400,000
650,000
New
Connections/Second
4000
9000
12,000
25,000
33,000
Integrated Network
Ports
8-port Fast
Ethernet switch
(including 2 PoE
ports)
5 Fast Ethernet ports;

2 Gigabit Ethernet + 3
Fast Ethernet ports*
4 Gigabit
Ethernet,
1 Fast
Ethernet
4 Gigabit
Ethernet,
1 Fast
Ethernet
8 Gigabit
Ethernet, 4 SFP
Fiber, 1 Fast
Ethernet
Virtual Interfaces
(VLANs)
3 (no trunking
support)/20 (with
trunking
support)*
50/100*
150
200
400
Users can also download the complete technical datasheet for the Cisco ASA 5500 series firewalls by visiting our
Cisco Product Datasheet & Guides Download section.
Perhaps one of the most important points, especially for an engineer with limited experience, is that configuring the
smaller ASA 5505 Firewall does not really differ from configuring the larger ASA5520 Firewall. The same steps are
required to setup pretty much all ASA 5500 series Firewalls which is Great News!
The main differences besides the licenses, which
enable or disable features, are the physical
interfaces of each ASA model (mainly between
the ASA 5505 and the larger 5510/5520) and
possibly modules that might be installed. In any
case, we should keep in mind that if we are able
to configure a small ASA5505 then configuring
the larger models wont be an issue.
At the time of writing of this article Firewall.cx
came across a Cisco ASA5505, so we decided
to put it to good use for this article, however, do
note that all commands and configuration
philosophy is the same across all ASA5500 series security appliances.
Note: ASA software version 8.3.0 and above use different NAT configuration commands. This article provides both
old style (up to v8.2.5) and new style (v8.3 onwards) NAT configuration commands.
Additional reading material: Users seeking nothing but the best security information on ASA Firewalls, written by
leading Cisco Security Engineers, should consider the following highly recommended Cisco Press titles:
Cisco ASA: All-in-One Firewall, IPS, Anti-X, and VPN Adaptive Security Appliance, 2nd Edition
Cisco ASA, PIX, and FWSM Firewall Handbook, 2nd Edition
ASA5500 Series Configuration Check-List

Weve created a simple configuration check-list that will help us keep track of the configured services on our ASA
Firewall. Here is the list of items that will be covered in this article:
Erase existing configuration
Configure Hostname, Users, Enable password & Disable Anonymous Reporting
Configure interface IP addresses or Vlan IP addresses (ASA5505) & Descriptions
Setup Inside (private) & Outside (public) Interfaces
Configure default route (default Gateway) & static routes
Configure Network Address Translation (NAT) for Internal Networks
Configure ASA DHCP Server
Configure AAA authentication for local database user authentication
Enable HTTP Management for inside interface
Enable SSH & Telnet Management for inside and outside interfaces
Create, configure and apply TCP/UDP Object-Groups to firewall access lists
Configuration of access-lists for ICMP packets to the Internet
Apply Firewall access lists to inside and outside interfaces
Configure logging/debugging of events and errors
Note: it is highly advisable to frequently save the ASA configuration to ensure no work is lost in the event of a power
failure or accident restart.
Saving the configuration can be easily done using the write memory command:
ASA5505(config)# write memory
Building configuration...
Cryptochecksum: c0aee665 598d7cd3 7fbfe1a5 a2d40ab1
3270 bytes copied in 1.520 secs (3270 bytes/sec)
[OK]
Erasing Existing Configuration

This first step is optional as it will erase the firewalls configuration. If the firewall has been previously configured or
used it is a good idea to start off with the factory defaults. If we are not certain, we prefer to wipe it clean and start
from scratch. Once the configuration is deleted we need to force a reboot, however, take note that its important not
to save the system config to ensure the running-config is not copied to the startup-config otherwise well have to start
this process again:
ciscoasa(config)# write erase
Erase configuration in flash memory? [confirm]

[OK]
ciscoasa(config)# reload
System config has been modified. Save? [Y]es/[N]o: N
Proceed with reload? [confirm]
ciscoasa(config)#
***
*** --- START GRACEFUL SHUTDOWN --Shutting down isakmp
Shutting down webvpn
Shutting down File system
***
*** --- SHUTDOWN NOW --Process shutdown finished
Rebooting.....
Configure Hostname, Users, 'Enable' Password & Disable Anonymous Reporting

Next, we need to configure the Enable password, required for privileged exec mode access, and then user accounts
that will have access to the firewall.
The ASA Firewall wont ask for a username/password when logging in next, however, the default enable password of
cisco, will be required to gain access to privileged mode:
Ciscoasa> enable
Password: cisco
ciscoasa# configure terminal
ciscoasa(config)#
***************************** NOTICE *****************************
Help to improve the ASA platform by enabling anonymous reporting,
which allows Cisco to securely receive minimal error and health
information from the device. To learn more about this feature,
please visit: http://www.cisco.com/go/smartcall
Would you like to enable anonymous error reporting to help improve

the product? [Y]es, [N]o, [A]sk later: N
In the future, if you would like to enable this feature,

issue the command "call-home reporting anonymous".
Please remember to save your configuration.
At this point we need to note that when starting off with the factory default configuration, as soon as we enter the
configure terminal command, the system will ask if we would like to enable Ciscos call-home reporting feature. We
declined the offer and continued with our setup:
ciscoasa(config)# hostname ASA5505
ASA5505(config)# enable password firewall.cx
ASA5505(config)# username admin password s1jw$528ds2 privilege 15
The privilege 15 parameter at the end of the command line ensures the system is aware that this is an account with
full privileges and has access to all configuration commands including erasing the configuration and files on the
devices flash disk, such as the operating system.
Configure Interface IP addresses / VLAN IP Addresses & Descriptions

Depending on the ASA appliance we have, we can configure physical interfaces (inside/outside) with IP addresses,
usually done with ASA5510 and larger models, or create VLANs (inside/outside) and configure them with IP
addresses, usually with the smaller ASA5505 models.
In many cases network engineers use VLAN interfaces on the larger ASA5500 models, however, this depends on the
licensing capabilities of the device, existing network setup and more.
In the case of the ASA5505 we must use VLAN interfaces, which are configured with their appropriate IP addresses
and then (next step) characterised as inside (private) or outside (public) interfaces:
ASA5505(config)# interface vlan 1
ASA5505(config)# description Private-Interface
ASA5505(config-if)# ip address 10.71.0.1 255.255.255.0
ASA5505(config-if)# no shutdown
!
ASA5505(config)# description Public-Interface
ASA5505(config-if)# ip address 192.168.3.50 255.255.255.0

!
ASA5505(config)# interface ethernet 0/0
ASA5505(config-if)# switchport access vlan 2
Alternatively, the Public interface (VLAN2) can be configured to obtain its IP address automatically via DHCP with
the following command:
ASA5505(config)# description Public-Interface
ASA5505(config-if)# ip address dhcp setroute
The setrouteparameter at the end of the command will ensure the ASA Firewall sets its default route (gateway) using
the default gateway parameter the DHCP server provides.
After configuring VLAN1 & VLAN2 with the appropriate IP addresses, we configured ethernet 0/0 as an access link
for VLAN2 so we can use it as a physical public interface. Out of the 8 total Ethernet interfaces the ASA5505 has, at
least one must be set with the switchport access vlan 2 otherwise there wont be any physical public interface on
the ASA for our frontend router to connect to. Ethernet ports 0/1 to 0/7 must also be configured with the no shutdown
command in order make them operational. All of these ports are, by default, access links for VLAN1. Provided are the
configuration commands for the first two ethernet interface as the configuration is identical for all:
ASA5505(config)# interface ethernet 0/1
ASA5505(config-if)# interface ethernet 0/2
Setup Inside (private) & Outside (public) Interfaces

Next, we must designate the Inside (private) and Outside (public) interfaces. This step is essential and will help the
ASA Firewall understand which interface is connected to the trusted (private) and untrusted (public) network:
ASA5505(config-if)# nameif inside
INFO: Security level for "inside" set to 100 by default.
!

ASA5505(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
The ASA Firewall will automatically set the security level to 100 for inside interfaces and 0 to outside interfaces.
Traffic can flow from higher security levels to lower (private to public), but not the other way around (public to private)
unless stated by an access-lists.
To change the security-level of an interface use the security-level xxx command by substituting xxx with a number
from 0 to 100. The higher the number, the higher the security level. DMZ interfaces are usually configured with a
security level of 50.
It is extremely important the necessary caution is taken when selecting and applying the inside/outside interfaces on
any ASA Firewall.
Configure Default Route (default gateway) & Static Routes

The default route configuration command is necessary for the ASA Firewall to route packets outside the network via
the next hop, usually a router. In case the public interface (VLAN2) is configured using the ip address dhcp setroute
command, configuration of the default gateway is not required.
ASA5505(config)# route outside 0.0.0.0 0.0.0.0 192.168.3.1
At this point, its a good idea to try testing the next-hop router and confirm the ASA Firewall can reach it:
ASA5505(config)# ping 192.168.3.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.3.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
For networks with multiple internal VLANs, it is necessary to configure static routes to ensure the ASA Firewall knows
how to reach them. Usually these networks can be reached via a Layer3 switch or an internal router. For our
example, well assume we have two networks: 10.75.0.0/24 & 10.76.0.0/24 which we need to provide Internet access
to. These additional networks are contactable via a Layer3 device with IP address 10.71.0.100:
Configure Network Address Translation (NAT) for Internal Networks

This is the last step required to successfully provide Internet access to our internal networks. Network Address
Translation is essential to masquerade our internal network using the single IP address our Public interface has been
configured with. Network Address Translation, along with all its variations (Static, Dynamic etc), is covered in great
depth in our popular Network Address Translation section.

We should note at this point that NAT configuration has slightly changed with ASA software version 8.3 and above.
We will provide both commands to cover installations with software version up to v8.2.5 and from v8.3 and above.
The following commands apply to ASA appliances with software version up to 8.2.5:
ASA5505(config)# global (outside) 1 interface
INFO: outside interface address added to PAT pool
ASA5505(config)# nat (inside) 1 10.71.0.0 255.255.255.0
In the above configuration, the ASA Firewall is instructed to NAT all internal networks using the NAT Group 1. The
number 1 is used to identify the NAT groups for the NAT process between the inside and outside interfaces.
The global (outside) 1 interface command instructs the ASA Firewall to perform NAT using the IP address assigned
to the outside interface.
Another method of configuring NAT is with the use of access lists. In this case, we define the internal IP addresses to
be NATed with the use of access lists:
ASA5505(config)# access-list NAT-ACLs extended permit ip 10.71.0.0 255.255.255.0 any
ASA5505(config)# global (outside) 1 interface
INFO: outside interface address added to PAT pool
ASA5505(config)# nat (inside) 1 access-list NAT-ACLs
NAT with the use of access lists provides greater flexibility and control which IP addresses or networks will use the
NAT service.
With software version 8.3 and newer, things have changed dramatically and there are no more access lists in NAT
configuration lines.
The new NAT format now utilizes "object network", "object service" and "object-group network" to define the
parameters of the NAT configuration.
The following commands (software version 8.3 and above) will provide NAT services to our internal networks so they
can access the Internet:
ASA5505(config)# object network network1
ASA5505(config-network-object)# subnet 10.71.0.0 255.255.255.0
ASA5505(config-network-object)# nat (inside,outside) dynamic interface
!

!
Configuring the ASA DHCP Server

The existence of a DHCP server is necessary in most cases as it helps manage the assignment of IP address to our
internal hosts. The ASA Firewall can be configured to provide DHCP services to our internal network, a very handy
and welcome feature.
Again, there are some limitations with the DHCP service configuration which vary with the ASA model used. In our
ASA5505, the maximum assigned IP addreses for the DHCP pool was just 128!
Note that the DHCP service can run on all ASA interfaces so it is necessary to specify which interface the DHCP
configuration parameters are for:
ASA5505(config)# dhcpd address 10.71.0.50-10.71.0.200 inside
Warning, DHCP pool range is limited to 128 addresses, set address range as: 10.71.0.50-10.71.0.177
ASA5505(config)# dhcpd address 10.71.0.50-10.71.0.128 inside
ASA5505(config)# dhcpd dns 8.8.8.8 interface inside
Once configured, the DHCP service will begin working and assigning IP addresses to the clients. The Gateway IP
address parameter is automatically provided to client and is not required to be configured on the ASA Firewall
appliance.
We can verify the DHCP service is working using the show dhcpd statistics command:
ASA5505(config)# show dhcpd statistics
DHCP UDP Unreachable Errors: 0
DHCP Other UDP Errors: 0
Address pools
Automatic bindings 1
Expired bindings
Malformed messages 0
Message
BOOTREQUEST
Received
0
DHCPDISCOVER
DHCPREQUEST
DHCPDECLINE
DHCPRELEASE
DHCPINFORM
If required, we can clear the DHCP bindings (assigned IP addresses) using the clear dhcpd binding command.
Configure AAA Authentication for Local Database User Authentication

Configuring AAA authentication is always a good idea as it instructs the ASA Firewall to use the local user database
for the various services it's running. For example, we can tell the ASA Firewall to use a radius server for VPN user
authentication, but use its local database for telnet, ssh or HTTP (ASDM) management access to the Firewall
appliance.
As mentioned, our example instructs the ASA Firewall to use its local database:
ASA5505(config)# aaa authentication telnet console LOCAL
ASA5505(config)# aaa authentication http console LOCAL
ASA5505(config)# aaa authentication ssh console LOCAL
Enable HTTP Management for Inside Interface

We now turn to the management settings of our ASA Firewall to enable and configure HTTP management. This will
allow access to the Firewalls management via the popular ASDM management application:
ASA5505(config)# http 10.71.0.0 255.255.255.0 inside
WARNING: http server is not yet enabled to allow ASDM access.
ASA5505(config)# http server enable
The above commands enable HTTP management on the ASA Firewall only for the network 10.71.0.0/24.
Enable SSH & Telnet Management for Inside and Outside Interfaces
Enabling SSH and Telnet access to the Cisco Firewall is pretty straightforward. While we always recommend the use
of SSH, especially when accessing the Firewall from public IPs, telnet is also an option, however, we must keep in
mind that telnet management methods do not provide any security as all data (including username, passwords and
configurations) are sent in clear text.
Before enabling SSH, we must generate RSA key pairs for identity certificates. Telnet does not require any such step
as it does not provide any encryption or security:
ASA5505(config)# crypto key generate rsa modulus 1024
INFO: The name for the keys will be:
Keypair generation process begin. Please wait...
ASA5505(config)# ssh 10.71.0.0 255.255.255.0 inside
ASA5505(config)# ssh 200.200.90.5 255.255.255.255 outside
ASA5505(config)# telnet 10.71.0.0 255.255.255.0 inside
Note that the ASA Firewall appliance will only accept SSH connections from host 200.200.90.5 arriving on its public
interface, while SSH and telnet connections are permitted from network 10.71.0.0/24 on the inside interface.
Create, Configure and Apply TCP/UDP Object-Groups

An essential part of any firewall configure is to define the Internet services our users will have access to. This is done
by either creating a number of lengthy access lists for each protocol/service and then applying them to the
appropriate interfaces, or utilising the ASA Firewall Object-Groups which are then applied to the interfaces. Using
Object-groups is easy and recommended as they provide a great deal of flexibility and ease of management.
The logic is simple: Create your Object-Groups, insert the protocols and services required, and then reference them
in the firewall access -lists. As a last step, we apply them to the interfaces we need.
Lets use an example to help visualise the concept. Our needs require us to create two Object-Groups, one for TCP
and one for UDP services:
ASA5505(config)#object-group service Internet-udp udp
ASA5505(config-service)# description UDP Standard Internet Services
ASA5505(config-service)# port-object eq domain
ASA5505(config-service)# port-object eq ntp
ASA5505(config-service)# port-object eq isakmp
ASA5505(config-service)# port-object eq 4500
!
ASA5505(config-service)#object-group service Internet-tcp tcp
ASA5505(config-service)# description TCP Standard Internet Services
ASA5505(config-service)# port-object eq www

ASA5505(config-service)# port-object eq https
ASA5505(config-service)# port-object eq smtp
ASA5505(config-service)# port-object eq pop3
ASA5505(config-service)# port-object eq ftp
ASA5505(config-service)# port-object eq ftp-data
ASA5505(config-service)# port-object eq domain
ASA5505(config-service)# port-object eq ssh
ASA5505(config-service)# port-object eq telnet
Now we need to reference our two Object-groups using the firewall access lists. Here we can also define which
networks will have access to the services listed in each Object-group:
ASA5505(config)# access-list inside-in remark -=[Access Lists For Outgoing Packets from Inside interface]=ASA5505(config)# access-list inside-in extended permit udp 10.71.0.0 255.255.255.0 any object-group Internetudp
ASA5505(config)# access-list inside-in extended permit tcp 10.71.0.0 255.255.255.0 any object-group Internettcp
Note that the 10.71.0.0/25 network has access to both Object-groups services, our other networks are restricted to
only the services defined in the TCP Object-group. To understand how Object-groups help simplify access list
management: without them, we would require 37 access lists commands instead of just 4!
Configuration of Access-Lists for ICMP Packets to the Internet

To complete our access list configuration we configure our ASA Firewall to allow ICMP echo packets (ping) to any
destination, and their replies (echo-reply):
ASA5505(config)# access-list inside-in extended permit icmp 10.71.0.0 255.255.255.0 any
ASA5505(config)# access-list outside-in remark -=[Access Lists For Incoming Packets on OUTSIDE
interface]=-
ASA5505(config)# access-list outside-in extended permit icmp any any echo-reply
Appling Firewall Access-Lists to inside and outside Interfaces

The last step in configuring our firewall rules involves applying the two access lists, inside-in & outside-in, to the
appropriate interfaces. Once this step is complete the firewall rules are in effect immediately:
ASA5505(config)# access-group inside-in in interface inside
ASA5505(config)# access-group outside-in in interface outside
Configure Logging/Debugging of Events & Errors

This last step in our ASA Firewall configuration guide will enable logging and debugging so that we can easily trace
events and errors. It is highly recommended to enable logging because it will certainly help troubleshooting the ASA
Firewall when problems occur.
ASA5505(config)# logging buffered 7
ASA5505(config)# logging buffer-size 30000
ASA5505(config)# logging enable
The commands used above enable log in the debugging level (7) and sets the buffer size in RAM to 30,000 bytes
(~30Kbytes).
Issuing the show log command will reveal a number of important logs including any packets that are processed or
denied due to access-lists:
ASA5505(config)# show log
Syslog logging: enabled
Facility: 20
Timestamp logging: disabled
Standby logging: disabled
Debug-trace logging: disabled
Console logging: disabled
Monitor logging: disabled
Buffer logging: level debugging, 39925 messages logged
Trap logging: disabled
History logging: disabled
Device ID: disabled
Mail logging: disabled
ASDM logging: disabled
n" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside:10.71.0.50/54843 dst outside:10.0.0.10/445 by access-group "inside-in" [0x0,
0x0]
0x0]
0x0]
0x0]
0x0]
0x0]
0x0]
0x0]
%ASA-4-106023: Deny udp src inside:10.71.0.50/137 dst outside:10.0.0.10/137 by access-group "inside-in" [0x0,
0x0]
%ASA-6-302014: Teardown TCP connection 4718 for outside:173.194.40.49/443 to inside:10.71.0.50/54803 duration
0:02:00 bytes 1554462 TCP FINs
Conclusion
This article serves as an introduction configuration guide for the ASA5500 series Firewall appliances. We covered all
necessary commands required to get any ASA5500 Firewall working and servicing network clients, while also
explaining in detail all commands used during the configuration process.
Back to Cisco Firewalls Section

Firewall - Cx-Cisco ASA5500 5505 5510 5520 Etc Series Firewall Security Appliance Startup Configuration Amp Basic C

Hochgeladen von

Dokumentinformationen

Originalbeschreibung:

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Firewall - Cx-Cisco ASA5500 5505 5510 5520 Etc Series Firewall Security Appliance Startup Configuration Amp Basic C

Hochgeladen von

Copyright:

Verfügbare Formate

firewall.

Cisco ASA5500 (5505, 5510, 5520, etc) Series Firewall Security

Introducing the Cisco ASA 5500 Series Firewall Appliance

Cisco ASA 5505

Cisco ASA 5510

Up to 150 Mbps with

Up to 300 Mbps with

5 Fast Ethernet ports;

ASA5500 Series Configuration Check-List

Erasing Existing Configuration

Erase configuration in flash memory? [confirm]

Configure Hostname, Users, 'Enable' Password & Disable Anonymous Reporting

Would you like to enable anonymous error reporting to help improve

In the future, if you would like to enable this feature,

Configure Interface IP addresses / VLAN IP Addresses & Descriptions

ASA5505(config-if)# ip address 192.168.3.50 255.255.255.0

Setup Inside (private) & Outside (public) Interfaces

ASA5505(config)# interface vlan 2

Configure Default Route (default gateway) & Static Routes

Configure Network Address Translation (NAT) for Internal Networks

depth in our popular Network Address Translation section.

ASA5505(config)# object network network2

Configuring the ASA DHCP Server

Configure AAA Authentication for Local Database User Authentication

Enable HTTP Management for Inside Interface

Create, Configure and Apply TCP/UDP Object-Groups

ASA5505(config-service)# port-object eq www

Configuration of Access-Lists for ICMP Packets to the Internet

ASA5505(config)# access-list outside-in extended permit icmp any any echo-reply

Appling Firewall Access-Lists to inside and outside Interfaces

Configure Logging/Debugging of Events & Errors

Das könnte Ihnen auch gefallen