Cisco Cisco ASA 5500 Series Manuals

Manuals and User Guides for Cisco Cisco ASA 5500 Series. We have 3 Cisco Cisco ASA 5500 Series manuals available for free PDF download: Configuration Manual, Datasheet

Cisco Cisco ASA 5500 Series Configuration Manual (1140 pages)

Security Appliance Command Line

Brand: Cisco | Category: Security System | Size: 12.22 MB

Table of Contents
3
About this Guide

39
- Document Objectives
  39
- Related Documentation
  40
- Document Organization
  40
- Document Conventions
  43
CHAPTER 1 Introduction to the Security Appliance

47
Chapter 2 Getting Started

53
CHAPTER 3 Enabling Multiple Context Mode

64
- Security Context Overview
  64
  - Unsupported Features
    64
  - Context Configuration Files
    64
    
    Admin Context Configuration
    64
    
    Context Configurations
    64
    
    System Configuration
    64
  - How the Security Appliance Classifies Packets
    65
    
    Valid Classifier Criteria
    65
    
    Invalid Classifier Criteria
    66
    
    Classification Examples
    67
  - Cascading Security Contexts
    70
  - Management Access to Security Contexts
    71
    
    System Administrator Access
    71
    
    Context Administrator Access
    72
- Enabling or Disabling Multiple Context Mode
  72
CHAPTER 4 Configuring Switch Ports and Vlan Interfaces for the Cisco Asa 5505 Adaptive Security

75
Appliance

75
- Interface Overview
  75
CHAPTER 5 Configuring Ethernet Settings, Redundant Interfaces, and Subinterfaces

89
CHAPTER 6 Adding and Managing Security Contexts6-1

100
- Configuring Resource Management
  100
  - Resource Limits
    100
  - Default Class
    101
  - Class Members
    102
  - Configuring a Class
    102
- Configuring a Security Context
  105
- Automatically Assigning MAC Addresses to Context Interfaces
  109
- Changing between Contexts and the System Execution Space
  110
- Managing Security Contexts
  110
  - Removing a Security Context
    110
  - Changing the Admin Context
    111
  - Changing the Security Context URL
    111
  - Reloading a Security Context
    112
    
    Reloading by Clearing the Configuration
    112
    
    Reloading by Removing and Re-Adding the Context
    112
  - Monitoring Security Contexts
    113
    
    Viewing Context Information
    113
    
    Viewing Resource Allocation
    114
    
    Viewing Resource Usage
    117
    
    Monitoring SYN Attacks in Contexts
    118
Chapter 7 Configuring Interface Parameters

121
- Security Level Overview
  121
- Configuring Interface Parameters
  122
  - Interface Parameters Overview
    122
    
    Default Security Level
    123
    
    Default State of Interfaces
    123
    
    Multiple Context Mode Guidelines
    123
  - Configuring the Interface
    123
- Allowing Communication between Interfaces on the same Security Level
  127
Chapter 8 Configuring Basic Settings

129
CHAPTER 9 Configuring Ip Routing

135
- Configuring Static and Default Routes
  135
- Defining Route Maps
  140
- Configuring OSPF
  141
  - OSPF Overview
    142
  - Enabling OSPF
    142
  - Redistributing Routes into OSPF
    143
  - Configuring OSPF Interface Parameters
    144
  - Configuring OSPF Area Parameters
    147
  - Configuring OSPF NSSA
    147
  - Configuring Route Summarization between OSPF Areas
    149
  - Configuring Route Summarization When Redistributing Routes into OSPF
    149
  - Defining Static OSPF Neighbors
    150
  - Generating a Default Route
    150
  - Configuring Route Calculation Timers
    151
  - Logging Neighbors Going up or down
    151
  - Displaying OSPF Update Packet Pacing
    152
  - Monitoring OSPF
    152
  - Restarting the OSPF Process
    153
- Configuring RIP
  153
- Configuring EIGRP
  157
- The Routing Table
  165
  - Displaying the Routing Table
    165
  - How the Routing Table Is Populated
    166
    
    Backup Routes
    167
  - How Forwarding Decisions Are Made
    167
- Dynamic Routing and Failover
  168
CHAPTER 10 Configuring Dhcp, Ddns, and Wccp Services

169
CHAPTER 11 Configuring Multicast Routing

181
Chapter 12 Configuring Ipv6

191
- Ipv6-Enabled Commands
  191
- Verifying the Ipv6 Configuration
  201
  - The Show Ipv6 Interface Command
    201
  - The Show Ipv6 Route Command
    202
CHAPTER 13 Configuring Aaa Servers and the Local Database

203
- AAA Overview
  203
  - About Authentication
    204
  - About Authorization
    204
  - About Accounting
    204
- AAA Server and Local Database Support
  205
  - Summary of Support
    205
  - RADIUS Server Support
    206
    
    Attribute Support
    206
    
    Authentication Methods
    206
    
    RADIUS Authorization Functions
    206
  - TACACS+ Server Support
    206
  - SDI Server Support
    207
    
    SDI Primary and Replica Servers
    207
    
    SDI Version Support
    207
    
    Two-Step Authentication Process
    207
  - NT Server Support
    207
  - Kerberos Server Support
    207
  - LDAP Server Support
    208
  - SSO Support for Webvpn with HTTP Forms
    208
  - Local Database Support
    208
    
    User Profiles
    208
    
    Fallback Support
    209
- Configuring the Local Database
  209
- Identifying AAA Server Groups and Servers
  211
- Configuring an LDAP Server
  214
  - Authentication with LDAP
    214
  - Authorization with LDAP for VPN
    216
  - LDAP Attribute Mapping
    216
- Using Certificates and User Login Credentials
  218
  - Using User Login Credentials
    218
  - Using Certificates
    218
- Supporting a Zone Labs Integrity Server
  219
  - Overview of Integrity Server and Security Appliance Interaction
    219
  - Configuring Integrity Server Support
    220
CHAPTER 14 Configuring Failover14-1

221
- Understanding Failover
  221
  - Failover System Requirements
    222
    
    Hardware Requirements
    222
    
    License Requirements
    222
    
    Software Requirements
    222
  - The Failover and Stateful Failover Links
    223
    
    Failover Link
    223
    
    Stateful Failover Link
    225
  - Active/Active and Active/Standby Failover
    226
    
    Active/Standby Failover
    226
    
    Active/Active Failover
    230
    
    Determining Which Type of Failover to Use
    235
  - Regular and Stateful Failover
    235
    
    Regular Failover
    235
    
    Stateful Failover
    235
  - Failover Health Monitoring
    236
    
    Interface Monitoring
    237
    
    Unit Health Monitoring
    237
  - Failover Feature/Platform Matrix
    238
  - Failover Times by Platform
    238
- Configuring Failover
  239
Configuring the Firewall

277
CHAPTER 15 Firewall Mode Overview15-1

279
CHAPTER 16 Identifying Traffic with Access Lists16-1

295
- Access List Overview
  295
  - Access List Types
    296
  - Access Control Entry Order
    296
  - Access Control Implicit Deny
    297
  - IP Addresses Used for Access Lists When You Use NAT
    297
- Adding an Extended Access List
  299
- Adding an Ethertype Access List
  302
  - Ethertype Access List Overview
    302
    
    Implicit and Explicit Deny ACE at the End of an Access List
    302
    
    Implicit Permit of IP and Arps Only
    302
    
    Supported Ethertypes
    302
    
    Allowing MPLS
    303
    
    Ipv6 Unsupported
    303
    
    Using Extended and Ethertype Access Lists on the same Interface
    303
  - Adding an Ethertype ACE
    304
- Adding a Standard Access List
  304
- Adding a Webtype Access List
  305
- Simplifying Access Lists with Object Grouping
  305
  - How Object Grouping Works
    305
  - Adding Object Groups
    306
    
    Adding a Network Object Group
    306
    
    Adding a Protocol Object Group
    306
    
    Adding a Service Object Group
    306
    
    Adding an ICMP Type Object Group
    306
  - Nesting Object Groups
    309
  - Using Object Groups with an Access List
    310
  - Displaying Object Groups
    311
  - Removing Object Groups
    311
- Adding Remarks to Access Lists
  311
- Scheduling Extended Access List Activation
  312
  - Adding a Time Range
    312
  - Applying the Time Range to an ACE
    313
- Logging Access List Activity
  313
CHAPTER 17 Configuring NAT

317
- NAT Overview
  317
  - Introduction to NAT
    317
  - NAT in Routed Mode
    318
  - NAT in Transparent Mode
    319
  - NAT Control
    320
  - NAT Types
    322
    
    Dynamic NAT
    322
    
    Pat
    324
    
    Static NAT
    324
    
    Static PAT
    325
    
    Bypassing NAT When NAT Control Is Enabled
    326
  - Policy NAT
    326
  - NAT and same Security Level Interfaces
    329
  - Order of NAT Commands Used to Match Real Addresses
    330
  - Mapped Address Guidelines
    330
  - DNS and NAT
    331
- Configuring NAT Control
  332
- Using Dynamic NAT and PAT
  333
  - Dynamic NAT and PAT Implementation
    333
  - Configuring Dynamic NAT or PAT
    339
- Using Static NAT
  342
- Using Static PAT
  343
- Bypassing NAT
  346
  - Configuring Identity NAT
    346
  - Configuring Static Identity NAT
    347
  - Configuring NAT Exemption
    349
- NAT Examples
  350
  - Overlapping Networks
    350
  - Redirecting Ports
    352
Chapter 18 Permitting or Denying Network Access

355
- Inbound and Outbound Access List Overview
  355
- Applying an Access List to an Interface
  356
Chapter 19 Applying AAA for Network Access

359
Chapter 20 Applying Filtering Services

377
- Filtering Overview
  377
- Filtering Activex Objects
  378
  - Activex Filtering Overview
    378
  - Enabling Activex Filtering
    378
- Filtering Java Applets
  379
- Filtering Urls and FTP Requests with an External Server
  380
  - URL Filtering Overview
    380
  - Identifying the Filtering Server
    380
  - Buffering the Content Server Response
    382
  - Caching Server Addresses
    382
  - Filtering HTTP Urls
    383
    
    Configuring HTTP Filtering
    383
    
    Enabling Filtering of Long HTTP Urls
    383
    
    Truncating Long HTTP Urls
    383
    
    Exempting Traffic from Filtering
    384
  - Filtering HTTPS Urls
    384
  - Filtering FTP Requests
    385
- Viewing Filtering Statistics and Configuration
  385
Chapter 21 Using Modular Policy Framework

389
Chapter 22 Managing the AIP SSM and CSC SSM

411
- Managing the AIP SSM
  411
  - AIP SSM Overview
    411
    
    How the AIP SSM Works with the Adaptive Security Appliance
    412
    
    Operating Modes
    412
    
    Using Virtual Sensors
    413
    
    AIP SSM Procedure Overview
    414
  - Sessioning to the AIP SSM
    415
  - Configuring the Security Policy on the AIP SSM
    416
  - Assigning Virtual Sensors to Security Contexts
    416
  - Diverting Traffic to the AIP SSM
    418
- Managing the CSC SSM
  419
  - About the CSC SSM
    420
  - Getting Started with the CSC SSM
    422
  - Determining What Traffic to Scan
    423
  - Limiting Connections through the CSC SSM
    425
  - Diverting Traffic to the CSC SSM
    426
- Checking SSM Status
  428
- Transferring an Image Onto an SSM
  429
Chapter 23 Preventing Network Attacks

431
- Configuring Threat Detection
  431
  - Configuring Basic Threat Detection
    431
    
    Basic Threat Detection Overview
    432
    
    Configuring Basic Threat Detection
    432
    
    Managing Basic Threat Statistics
    434
  - Configuring Scanning Threat Detection
    435
    
    Enabling Scanning Threat Detection
    435
    
    Managing Shunned Hosts
    436
    
    Viewing Attackers and Targets
    437
  - Configuring and Viewing Threat Statistics
    437
    
    Configuring Threat Statistics
    437
    
    Viewing Threat Statistics
    438
- Configuring TCP Normalization
  441
- Configuring Connection Limits and Timeouts
  444
  - Connection Limit Overview
    444
    
    Disabling TCP Intercept for Management Packets for Webvpn Compatibility
    444
    
    TCP Intercept Overview
    444
    
    Dead Connection Detection Overview
    445
    
    TCP Sequence Randomization Overview
    445
  - Enabling Connection Limits
    445
- Preventing IP Spoofing
  446
- Configuring the Fragment Size
  447
- Blocking Unwanted Connections
  447
- Configuring IP Audit for Basic IPS Support
  448
Chapter 24 Applying Qos Policies

449
- Overview
  449
- Qos Concepts
  450
- Implementing Qos
  450
- Identifying Traffic for Qos
  452
- Defining a Qos Policy Map
  453
- Applying Rate Limiting
  454
- Activating the Service Policy
  455
- Applying Low Latency Queueing
  456
  - Configuring Priority Queuing
    456
  - Sizing the Priority Queue
    456
  - Reducing Queue Latency
    457
- Configuring Qos
  457
- Viewing Qos Configuration
  460
- Viewing Qos Statistics
  462

Cisco Cisco ASA 5500 Series Configuration Manual (989 pages)

Security Appliance Command Line

Brand: Cisco | Category: Firewall | Size: 11.23 MB

Table of Contents
4
About this Guide
33
Related Documentation
34
Document Conventions
37
Documentation Feedback
38
Intrusion Prevention Services Functional Overview
49
Security Context Overview
50
Chapter 2 Getting Started

51
Chapter 3 Enabling Multiple Context Mode

62
- Security Context Overview
  62
  - Unsupported Features
    62
  - Context Configuration Files
    62
    
    Context Configurations
    62
    
    System Configuration
    62
    
    Admin Context Configuration
    62
  - How the Security Appliance Classifies Packets
    63
    
    Valid Classifier Criteria
    63
    
    Invalid Classifier Criteria
    64
    
    Classification Examples
    65
  - Cascading Security Contexts
    68
  - Management Access to Security Contexts
    69
    
    System Administrator Access
    69
    
    Context Administrator Access
    70
- Enabling or Disabling Multiple Context Mode
  70
Configuring Switch Ports and VLAN Interfaces for the Cisco ASA 5505 Adaptive Security Appliance

73
Chapter 5 Configuring Ethernet Settings and Subinterfaces

87
Chapter 6 Adding and Managing Security Contexts

92
- Configuring Resource Management
  92
  - Resource Limits
    92
  - Default Class
    93
  - Class Members
    94
  - Configuring a Class
    94
- Configuring a Security Context
  97
- Automatically Assigning MAC Addresses to Context Interfaces
  101
- Changing between Contexts and the System Execution Space
  101
- Managing Security Contexts
  102
  - Removing a Security Context
    102
  - Changing the Admin Context
    103
  - Changing the Security Context URL
    103
  - Reloading a Security Context
    104
    
    Reloading by Clearing the Configuration
    104
    
    Reloading by Removing and Re-Adding the Context
    105
    
    Viewing Context Information
    105
    
    Viewing Resource Allocation
    106
    
    Viewing Resource Usage
    109
    
    Monitoring SYN Attacks in Contexts
    110
Chapter 7 Configuring Interface Parameters

113
- Security Level Overview
  113
- Configuring the Interface
  114
- Allowing Communication between Interfaces on the same Security Level
  118
- Changing the Login Password
  119
- Changing the Enable Password
  119
- Setting the Hostname
  120
- Setting the Domain Name
  120
- Setting the Date and Time
  120
Chapter 8 Configuring Basic Setting

120
Chapter 9 Configuring IP Routing

125
- Configuring Static and Default Routes
  125
  - Configuring a Static Route
    126
  - Configuring a Default Route
    127
  - Configuring Static Route Tracking
    127
- Defining Route Maps
  130
- Configuring OSPF
  131
  - OSPF Overview
    132
  - Enabling OSPF
    132
  - Redistributing Routes into OSPF
    133
  - Configuring OSPF Interface Parameters
    134
  - Configuring OSPF Area Parameters
    136
  - Configuring OSPF NSSA
    137
  - Configuring Route Summarization between OSPF Areas
    138
  - Configuring Route Summarization When Redistributing Routes into OSPF
    138
  - Defining Static OSPF Neighbors
    139
  - Generating a Default Route
    140
  - Configuring Route Calculation Timers
    140
  - Logging Neighbors Going up or down
    141
  - Displaying OSPF Update Packet Pacing
    141
  - Monitoring OSPF
    142
  - Restarting the OSPF Process
    142
- Configuring RIP
  143
- The Routing Table
  146
  - Displaying the Routing Table
    146
  - How the Routing Table Is Populated
    147
    
    Backup Routes
    148
  - How Forwarding Decisions Are Made
    148
CHAPTER 10 Configuring DHCP, DDNS, and WCCP Services

151
Configuring Multicast Routing

163
Chapter 12 Configuring Ipv6

173
- Ipv6-Enabled Commands
  173
- Verifying the Ipv6 Configuration
  183
  - The Show Ipv6 Interface Command
    183
  - The Show Ipv6 Route Command
    184
Configuring AAA Servers and the Local Database

185
- AAA Overview
  185
  - About Authentication
    185
  - About Authorization
    186
  - About Accounting
    186
- AAA Server and Local Database Support
  186
  - C H a P T E R 13 Configuring AAA Servers and the Local Database
    186
  - RADIUS Server Support
    187
    
    Authentication Methods
    188
    
    Attribute Support
    188
    
    RADIUS Authorization Functions
    188
  - Summary of Support
    187
  - SDI Server Support
    188
    
    SDI Version Support
    189
    
    Two-Step Authentication Process
    189
    
    SDI Primary and Replica Servers
    189
  - TACACS+ Server Support
    188
  - Kerberos Server Support
    189
  - NT Server Support
    189
  - LDAP Server Support
    190
    
    Authentication with LDAP
    190
    
    Authorization with LDAP for VPN
    191
    
    LDAP Attribute Mapping
    192
  - Local Database Support
    193
    
    User Profiles
    194
    
    Fallback Support
    194
  - SSO Support for Webvpn with HTTP Forms
    193
- Configuring the Local Database
  194
- Identifying AAA Server Groups and Servers
  196
- Using Certificates and User Login Credentials
  199
  - Using User Login Credentials
    199
  - Using Certificates
    200
- Supporting a Zone Labs Integrity Server
  200
  - Overview of Integrity Server and Security Appliance Interaction
    201
  - Configuring Integrity Server Support
    201
- Understanding Failover
  203
Chapter 14 Configuring Failover

204
- The Failover and Stateful Failover Links
  205
  - Stateful Failover Link
    207
- Active/Active and Active/Standby Failover
  208
  - Active/Active Failover
    211
  - Determining Which Type of Failover to Use
    216
- Failover Health Monitoring
  217
  - Interface Monitoring
    218
- Failover Feature/Platform Matrix
  219
- Failover Configuration Limitations
  220
  - Configuring LAN-Based Active/Standby Failover
    222
  - Configuring Optional Active/Standby Failover Settings
    225
- Configuring Active/Active Failover
  228
  - Configuring LAN-Based Active/Active Failover
    230
  - Configuring Optional Active/Active Failover Settings
    234
- Configuring Unit Health Monitoring
  238
- Verifying the Failover Configuration
  239
  - Viewing Monitored Interfaces
    247
  - Testing the Failover Functionality
    248
- Disabling Failover
  249
  - Failover System Messages
    250
- Routed Mode Overview
  253
Chapter 15 Firewall Mode Overview

254
CHAPTER 16 Identifying Traffic with Access Lists

269
- Access List Overview
  269
  - Access List Types
    270
  - C H a P T E R 16 Identifying Traffic with Access Lists
    271
- Adding an Extended Access List
  273
  - Allowing Special IP Traffic through the Transparent Firewall
    274
- Adding an Ethertype Access List
  276
- Adding a Standard Access List
  277
- Adding a Webtype Access List
  278
  - Adding Object Groups
    279
    
    Adding a Network Object Group
    280
    
    Adding an ICMP Type Object Group
    281
  - Nesting Object Groups
    282
  - Using Object Groups with an Access List
    283
  - Displaying Object Groups
    284
- Scheduling Extended Access List Activation
  285
- NAT Overview
  291
  - Introduction to NAT
    292
Chapter 17 Applying NAT

293
- NAT Types
  295
  - Static NAT
    297
  - Bypassing NAT When NAT Control Is Enabled
    299
- NAT and same Security Level Interfaces
  302
- Order of NAT Commands Used to Match Real Addresses
  303
- Configuring NAT Control
  305
- Using Dynamic NAT and PAT
  306
  - Configuring Dynamic NAT or PAT
    312
- Using Static NAT
  315
- Using Static PAT
  316
- Bypassing NAT
  318
  - Configuring Static Identity NAT
    319
  - Configuring NAT Exemption
    321
- NAT Examples
  322
  - Overlapping Networks
    323
  - Redirecting Ports
    324
  - C H a P T E R 18 Permitting or Denying Network Access
    328
CHAPTER 18 Permitting or Denying Network Access

331
- Applying an Access List to an Interface
  331
- AAA Performance
  333
Chapter 19 Applying AAA for Network Acces

334
CHAPTER 20 Applying Filtering Services 20-1

347
- Filtering Overview
  347
- C H a P T E R 20 Applying Filtering Services
  348
- Filtering Java Applets
  349
  - URL Filtering Overview
    350
  - Buffering the Content Server Response
    351
  - Caching Server Addresses
    352
    
    Enabling Filtering of Long HTTP Urls
    353
  - Filtering HTTPS Urls
    354
- Viewing Filtering Statistics and Configuration
  355
  - Viewing Buffer Configuration and Statistics
    356
  - Viewing Caching Statistics
    357
- Modular Policy Framework Overview
  359

Cisco Cisco ASA 5500 Series Datasheet (20 pages)

adaptive security appliances ASA SOFTWARE VERSION 7.0

Brand: Cisco | Category: Software | Size: 0.43 MB

Cisco Categories

Switch IP Phone

Network Router Wireless Access Point Conference System

More Cisco Manuals

Cisco Cisco ASA 5500 Series Manuals

Cisco Cisco ASA 5500 Series Configuration Manual (1140 pages)

Table of Contents

About this Guide

CHAPTER 1 Introduction to the Security Appliance

Chapter 2 Getting Started

CHAPTER 3 Enabling Multiple Context Mode

CHAPTER 4 Configuring Switch Ports and Vlan Interfaces for the Cisco Asa 5505 Adaptive Security

Appliance

CHAPTER 5 Configuring Ethernet Settings, Redundant Interfaces, and Subinterfaces

CHAPTER 6 Adding and Managing Security Contexts6-1

Chapter 7 Configuring Interface Parameters

Chapter 8 Configuring Basic Settings

CHAPTER 9 Configuring Ip Routing

CHAPTER 10 Configuring Dhcp, Ddns, and Wccp Services

CHAPTER 11 Configuring Multicast Routing

Chapter 12 Configuring Ipv6

CHAPTER 13 Configuring Aaa Servers and the Local Database

CHAPTER 14 Configuring Failover14-1

Configuring the Firewall

CHAPTER 15 Firewall Mode Overview15-1

CHAPTER 16 Identifying Traffic with Access Lists16-1

CHAPTER 17 Configuring NAT

Chapter 18 Permitting or Denying Network Access

Chapter 19 Applying AAA for Network Access

Chapter 20 Applying Filtering Services

Chapter 21 Using Modular Policy Framework

Chapter 22 Managing the AIP SSM and CSC SSM

Chapter 23 Preventing Network Attacks

Chapter 24 Applying Qos Policies

Cisco Cisco ASA 5500 Series Configuration Manual (989 pages)

Table of Contents

Chapter 2 Getting Started

Chapter 3 Enabling Multiple Context Mode

Configuring Switch Ports and VLAN Interfaces for the Cisco ASA 5505 Adaptive Security Appliance

Chapter 5 Configuring Ethernet Settings and Subinterfaces

Chapter 6 Adding and Managing Security Contexts

Chapter 7 Configuring Interface Parameters

Chapter 8 Configuring Basic Setting

Chapter 9 Configuring IP Routing

CHAPTER 10 Configuring DHCP, DDNS, and WCCP Services

Configuring Multicast Routing

Chapter 12 Configuring Ipv6

Configuring AAA Servers and the Local Database

Chapter 14 Configuring Failover

Chapter 15 Firewall Mode Overview

CHAPTER 16 Identifying Traffic with Access Lists

Chapter 17 Applying NAT

CHAPTER 18 Permitting or Denying Network Access

Chapter 19 Applying AAA for Network Acces

CHAPTER 20 Applying Filtering Services 20-1

Cisco Cisco ASA 5500 Series Datasheet (20 pages)

Table of Contents

Related Products

Cisco Categories