Example 1: Customer C Context Configuration - Cisco FirePOWER ASA 5500 series Configuration Manual

Appendix B Sample Configurations
no shutdown
interface gigabitethernet 0/1.6
nameif inside
security-level 100
ip address 10.1.3.1 255.255.255.0
no shutdown
passwd tenac10us
enable password defen$e
route outside 0 0 209.165.201.1 1
nat (inside) 1 10.1.3.0 255.255.255.0
! This context uses dynamic PAT for inside users that access the outside
global (outside) 1 209.165.201.9 netmask 255.255.255.255
access-list INTERNET remark Inside users only access HTTP and HTTPS servers on the outside
access-list INTERNET extended permit tcp any any eq http
access-list INTERNET extended permit tcp any any eq https
access-group INTERNET in interface inside

Example 1: Customer C Context Configuration

interface gigabitethernet 0/0.3
nameif outside
security-level 0
ip address 209.165.201.5 255.255.255.224
no shutdown
interface gigabitethernet 0/1.7
nameif inside
security-level 100
ip address 10.1.4.1 255.255.255.0
no shutdown
interface gigabitethernet 0/1.8
nameif dmz
security-level 50
ip address 192.168.2.1 255.255.255.0
no shutdown
passwd fl0wer
enable password treeh0u$e
route outside 0 0 209.165.201.1 1
url-server (dmz) vendor websense host 192.168.2.2 url-block block 50
url-cache dst 128
filter url http 10.1.4.0 255.255.255.0 0 0
! When inside users access an HTTP server, the security appliance consults with a
! Websense server to determine if the traffic is allowed
nat (inside) 1 10.1.4.0 255.255.255.0
! This context uses dynamic NAT for inside users that access the outside
global (outside) 1 209.165.201.9 netmask 255.255.255.255
! A host on the admin context requires access to the Websense server for management using
! pcAnywhere, so the Websense server uses a static translation for its private address
static (dmz,outside) 209.165.201.6 192.168.2.2 netmask 255.255.255.255
access-list MANAGE remark Allows the management host to use pcAnywhere on the Websense
server
access-list MANAGE extended permit tcp host 209.165.201.30 host 209.165.201.6 eq
pcanywhere-data
access-list MANAGE extended permit udp host 209.165.201.30 host 209.165.201.6 eq
pcanywhere-status
access-group MANAGE in interface outside
OL-10088-01
Example 1: Multiple Mode Firewall With Outside Access
Cisco Security Appliance Command Line Configuration Guide
B-5