Page 1

Cisco ASA 5505 Getting Started Guide Software Version 8.0 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 Customer Order Number: DOC-78-18003= Text Part Number: 78-18003-02...
Page 2

DAMAGES. CCVP, the Cisco Logo, and the Cisco Square Bridge logo are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn is a service mark of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, Cisco,...
Page 3: Table Of Contents

2-10 Planning a VLAN Configuration C H A P T E R Understanding VLANs on the ASA 5505 About Physical Ports on the ASA 5505 About VLANs Maximum Number and Types of VLANs Deployment Scenarios Using VLANs Basic Deployment Using Two VLANs...
Page 4

C H A P T E R Verifying the Package Contents PoE Ports and Devices Installing the Chassis Connecting to Network Interfaces Powering on the ASA 5505 Setting Up a PC for System Administration Optional Procedures Connecting to the Console Installing a Cable Lock...
Page 5

Example IPsec Remote-Access VPN Network Topology Implementing the IPsec Remote-Access VPN Scenario Information to Have Available Starting ASDM Configuring the ASA 5505 for an IPsec Remote-Access VPN Selecting VPN Client Types Specifying the VPN Tunnel Group Name and Authentication Method Specifying a User Authentication Method...
Page 6

Example Topology Using AnyConnect SSL VPN Clients Implementing the Cisco SSL VPN Scenario Information to Have Available Starting ASDM Configuring the ASA 5505 for the Cisco AnyConnect VPN Client Specifying the SSL VPN Interface Specifying a User Authentication Method Specifying a Group Policy...
Page 7

What to Do Next 10-14 Scenario: Easy VPN Hardware Client Configuration 11-1 C H A P T E R Using an ASA 5505 as an Easy VPN Hardware Client 11-1 Client Mode and Network Extension Mode 11-2 Configuring the Easy VPN Hardware Client...
Page 8

Contents Configuring Advanced Easy VPN Attributes 11-11 What to Do Next 11-12 Obtaining a 3DES/AES License A P P E N D I X ASA 5505 Getting Started Guide viii 78-18003-02...
Page 9: Chapter 1 Before You Begin

C H A P T E R Before You Begin Use the following table to find the installation and configuration steps that are required for your implementation of the Cisco ASA 5505 Adaptive Security Appliance. To Do This... See... Learn about typical deployments of the Chapter 2, “Deployment Planning”...
Page 10

To Do This... (continued) See... Refine the configuration Cisco Security Appliance Command Line Configuration Guide Configure optional and advanced features Cisco Security Appliance Command Reference Cisco Security Appliance Logging Configuration and System Log Messages ASA 5505 Getting Started Guide 78-18003-02...
Page 11

C H A P T E R Deployment Planning This document is based on several example scenarios that represent typical customer deployments of the ASA 5505. The deployment scenarios in this chapter correspond to subsequent configuration chapters. This chapter includes the following sections: Scenarios for Deployment Planning and Configuration, page 2-2 •...
Page 12: Scenarios For Deployment Planning And Configuration

Figure 2-1 illustrates an extended network that includes most of the deployment and configuration scenarios included in this document. ASA 5505 Getting Started Guide 78-18003-02...
Page 13

Scenario 3: IPSec VPN Scenario 6: Site-to-site VPN Connection Connection Adaptive Security Appliance A SS r ETH co ns Web Server Email Server Scenario 1: Basic Installation Scenario 2: Basic Installation with DMZ ASA 5505 Getting Started Guide 78-18003-02...
Page 14: Scenario 1: Private Network With External Connectivity

PIX 501 security appliances in which devices behind the firewall can communicate internally and externally, you can keep the same deployment and replace the PIX 501 devices with ASA 5505 devices. ASA 5505 Getting Started Guide...
Page 15: Scenario 2: Basic Installation With Dmz

Internet. Figure 2-3 Private Network with DMZ Outside Network (Internet Connection) Internet Router Adaptive Security Appliance A SS r ETH co ns Web Server Printer Personal computers Email Server Private (Inside) Network ASA 5505 Getting Started Guide 78-18003-02...
Page 16: Scenario 3: Ipsec Remote-access Vpn

ETH co ns Adaptive Security Appliance Personal computers running Cisco VPN Personal Client software computer For information about how to configure an IPsec remote-access VPN deployment, see Chapter 7, “Scenario: IPsec Remote-Access VPN Configuration.” ASA 5505 Getting Started Guide 78-18003-02...
Page 17: Scenario 4: Ssl Vpn

Scenario 4: SSL VPN Scenario 4: SSL VPN The adaptive security appliance supports two types of SSL VPN connections, including: Remote clients running the Cisco SSL VPN AnyConnect Client software. • Clientless SSL VPN connections, that is, SSL VPN connections established •...
Page 18: Scenario 6: Easy Vpn Hardware Client

“Scenario: Site-to-Site VPN Configuration.” Scenario 6: Easy VPN Hardware Client In this scenario, an ASA 5505 is deployed as a hardware client (sometimes called a remote device). Deploying one or more VPN hardware clients in conjunction with a VPN headend device enables companies with multiple sites to establish secure communications among them and share network resources.
Page 19

ASA 5500 series Cisco IOS router with IPSec support Central LAN For information about how to configure the ASA 5505 as a VPN hardware client, see Chapter 11, “Scenario: Easy VPN Hardware Client Configuration.” ASA 5505 Getting Started Guide 78-18003-02...
Page 20: Where To Find Configuration Procedures

Where to Find Configuration Procedures Where to Find Configuration Procedures Each deployment scenario in this chapter has a corresponding configuration chapter in this document that describes how to configure the ASA 5505 for that type of deployment. To Configure the ASA 5505 For This Scenario..
Page 21: Chapter 3 Planning A Vlan Configuration

• Understanding VLANs on the ASA 5505 After you have made a decision about how to deploy the ASA 5505 in your network, you must decide how many VLANs you need to support that deployment and how many ports to allocate to each VLAN.
Page 22: About Physical Ports On The Asa 5505

VLAN connecting devices that you do not want to be able to communicate with each other. Before you can enable a switch port on the ASA 5505, it must be assigned to a VLAN. With the Base platform, each switch port can be assigned to only one VLAN at a time.
Page 23: Maximum Number And Types Of Vlans

Your license determines how many active VLANs that you can have on the ASA 5505. Although the ASA 5505 comes preconfigured with two VLANs, you can create a as many as three VLANs, depending on your license. For example, you could create VLANs for the Inside, Outside, and DMZ network segments.
Page 24: Deployment Scenarios Using Vlans

One active VLAN as a backup link to your ISP. The backup interface does not send or receive traffic unless the route through the primary interface fails. The ASA 5505 adaptive security appliance supports active and standby failover, Note but not Stateful Failover. Deployment Scenarios Using VLANs The number of VLANs you need depends on the complexity of the network into which you are installing the adaptive security appliance.
Page 25: Basic Deployment Using Two Vlans

In this scenario, the Outside VLAN consists of a single ISP connection using an external WAN router. In Figure 3-1, the Inside VLAN uses four switch ports on the ASA 5505 and the Outside VLAN uses only one. Three switch ports are unused.
Page 26

PIX 501 security appliances in which devices behind the firewall can communicate internally and externally, you can keep the same deployment and replace the PIX 501 devices with ASA 5505 devices. If this same customer needed to have two Internet connections, the Outside VLAN could be allocated an additional port, as shown in Figure 3-2.
Page 27: Dmz Deployment

In this example, three physical switch ports are allocated to the Inside VLAN, two switch ports are allocated to the DMZ VLAN, and one switch port is allocated to the Outside VLAN. Two switch ports are left unused. ASA 5505 Getting Started Guide 78-18003-02...
Page 28: Teleworker Deployment Using Three Vlans

VPN hardware client to support a teleworker. In Figure 3-4, an ASA 5505 is installed in a home office environment and used as a remote VPN hardware client. The ASA 5505 is configured for three VLANs: Inside (Work) VLAN that consists of all devices used to support access to the •...
Page 29

Game System DMZ (Home) VLAN In this example, the physical ports of the ASA 5505 are used as follows: The Inside (Work) VLAN consists of three physical switch ports, one of • which is a Power over Ethernet (PoE) switch port that is used for an IP phone.
Page 30

Chapter 3 Planning a VLAN Configuration What to Do Next ASA 5505 Getting Started Guide 3-10 78-18003-02...
Page 31: Verifying The Package Contents

C H A P T E R Installing the ASA 5505 This chapter describes how to install the ASA 5505 adaptive security appliance. This chapter includes the following sections: • Verifying the Package Contents, page 4-1 PoE Ports and Devices, page 4-3 •...
Page 32

Chapter 4 Installing the ASA 5505 Verifying the Package Contents Figure 4-1 Contents of ASA 5505 Package Se cu rit P O W E R Se rv ic es VD C C ar d Sl C O N SO PO W ER...
Page 33: Poe Ports And Devices

PoE Ports and Devices PoE Ports and Devices On the ASA 5505, switch ports Ethernet 0/6 and Ethernet 0/7 support PoE devices that are compliant with the IEEE 802.3af standard, such as IP phones and wireless access points. If you install a non-PoE device or do not connect to these switch ports, the adaptive security appliance does not supply power to the ports and the device must be powered on its own.
Page 34: Connecting To Network Interfaces

Connect one end of the Ethernet cable to an Ethernet port (ports 0 through 7) as Step 2 shown in Figure 4-2. (Typically Ethernet port 0 is used to connect to an Internet router.) ASA 5505 Getting Started Guide 78-18003-02...
Page 35: Powering On The Asa 5505

Connect the other end of the Ethernet cable to a device, such as a router, desktop computer, or printer. Powering on the ASA 5505 To power on the ASA 5505, perform the following steps: Connect the power supply with the power cable. Step 1...
Page 36: Setting Up A Pc For System Administration

For more information about using ASDM for setup and configuration, see Chapter 5, “Configuring the Adaptive Security Appliance.” To set up a PC from which you can configure and manage the ASA 5505, perform the following steps: Make sure that the speed of the PC interface to be connected to one of the ASA Step 1 5505 inside ports is set to autonegotiate.
Page 37: Optional Procedures

Connecting to the Console You can access the command line for administration using the console port on the ASA 5505. To do so, you must run a serial terminal emulator on a PC or workstation as shown in Figure 4-3.
Page 38: Installing A Cable Lock

1 stop bit. Installing a Cable Lock The ASA 5505 includes a slot that accepts standard desktop cable locks to provide physical security for small portable equipment, such as a laptop computer. The cable lock is not included.
Page 39: Ports And Leds

Follow the directions from the manufacturer for attaching the other end of the Step 1 cable for securing the adaptive security appliance. Attach the cable lock to the lock slot on the back panel of the ASA 5505. Step 2 Ports and LEDs This section describes the front and rear panels of the ASA 5505.
Page 40

Chapter 4 Installing the ASA 5505 Ports and LEDs Figure 4-4 illustrates the front panel of the ASA 5505. Figure 4-4 ASA 5505 Front Panel LINK/ACT Power Status Active 100 MBPS Cisco ASA 5505 series Adaptive Security Appliance Port / LED...
Page 41

If the LINK/ACT LED does not light up, the link could be down if there is a duplex mismatch. You can fix the problem by changing the settings either on the ASA 5505 or on the other end. If auto-negotiation is disabled (it is enabled by default), you might be using the wrong type of cable.
Page 42: Rear Panel Components

Chapter 4 Installing the ASA 5505 Ports and LEDs Rear Panel Components Figure 4-5 illustrates the back panel of the ASA 5505. Figure 4-5 ASA 5505 Rear Panel Security Console Services Card Slot power RESET POWER over ETHERNET Port or LED...
Page 43: What To Do Next

0 through 5. If a PoE device is not attached, power is not supplied to the port and the device must be powered on its own. What to Do Next Continue with Chapter 5, “Configuring the Adaptive Security Appliance.” ASA 5505 Getting Started Guide 4-13 78-18003-02...
Page 44

Chapter 4 Installing the ASA 5505 What to Do Next ASA 5505 Getting Started Guide 4-14 78-18003-02...
Page 45: Chapter 5 Configuring The Adaptive Security Appliance

What to Do Next, page 5-10 • About the Factory Default Configuration Cisco adaptive security appliances are shipped with a factory-default configuration that enables quick startup. The ASA 5505 comes preconfigured with the following: Two VLANs: VLAN 1 and VLAN2 •...
Page 46: Using The Cli For Configuration

LAN-to-LAN connections in the CLI itself by using the vpnsetup ipsec-remote-access steps and vpnsetup site-to-site steps commands. For more information about these commands, see the Cisco Security Appliance Command Reference. For step-by-step configuration procedures for all functional areas of the adaptive security appliance, see the Cisco Security Appliance Command Line Configuration Guide.
Page 47: Using The Adaptive Security Device Manager For Configuration

In addition to complete configuration and management capability, ASDM features intelligent wizards to simplify and accelerate the deployment of the adaptive security appliance. This section includes the following topics: Preparing to Use ASDM, page 5-4 • ASA 5505 Getting Started Guide 78-18003-02...
Page 48: Preparing To Use Asdm

Check the LINK LED on the MGMT interface. Step 3 When a connection is established, the LINK LED interface on the adaptive security appliance and the corresponding LINK LED on the switch or hub turn solid green. ASA 5505 Getting Started Guide 78-18003-02...
Page 49: Gathering Configuration Information For Initial Setup

Launcher software so that ASDM runs locally on your PC, or by enabling Java and JavaScript in your web browser and accessing ASDM remotely from your PC. This procedure describes how to set up your system to run ASDM locally. ASA 5505 Getting Started Guide 78-18003-02...
Page 50

It is not necessary to save the installation software to your hard drive. When the InstallShield Wizard appears, follow the instructions to install the ASDM Launcher software. From your desktop, start the Cisco ASDM Launcher software. Step 2 A dialog box appears. ASA 5505 Getting Started Guide...
Page 51

Step 3 Enter the IP address or the host name of your adaptive security appliance. Leave the Username and Password fields blank. Step 4 By default, there is no Username and Password set for the Cisco ASDM Note Launcher. Step 5 Click OK.
Page 52: Starting Asdm With A Web Browser

Using the Adaptive Security Device Manager for Configuration ASDM starts and the main window appears. Starting ASDM with a Web Browser To run ASDM in a web browser, enter the factory default IP address in the address field: https://192.168.1.1/admin/. ASA 5505 Getting Started Guide 78-18003-02...
Page 53: Running The Asdm Startup Wizard

ASDM. From the ASDM main page, click Configuration > Properties > ICMP Rules. Add an entry for the outside interface. Set the IP address to 0.0.0.0, the netmask to 0.0.0.0, and Action to deny. ASA 5505 Getting Started Guide 78-18003-02...
Page 54: What To Do Next

Configure the adaptive security appliance for Chapter 10, “Scenario: Site-to-Site VPN site-to-site VPN Configuration” Configure the adaptive security appliance as an Chapter 11, “Scenario: Easy VPN Hardware Client Easy VPN remote device Configuration” ASA 5505 Getting Started Guide 5-10 78-18003-02...
Page 55: Chapter 6 Scenario: Dmz Configuration

C H A P T E R Scenario: DMZ Configuration Cisco ASA 5505 DMZ configurations are possible only with the Security Plus Note license. A demilitarized zone (DMZ) is a separate network located in the neutral zone between a private (inside) network and a public (outside) network.
Page 56: Example Dmz Network Topology

Web Server Printer Personal computers Email Server Private (Inside) Network Example DMZ Network Topology The chapter describes how to configure a DMZ deployment of the adaptive security appliance as shown in Figure 6-2. ASA 5505 Getting Started Guide 78-18003-02...
Page 57

Clients on the private network can access the web server in the DMZ and can • also communicate with devices on the Internet. Clients on the Internet are permitted HTTP access to the DMZ web server; all • other traffic coming from the Internet is denied. ASA 5505 Getting Started Guide 78-18003-02...
Page 58: An Inside User Visits A Web Server On The Internet

An Inside User Visits a Web Server on the Internet Figure 6-3 shows the traffic flow through the adaptive security appliance when an inside user requests an HTTP page from a web server on the Internet. ASA 5505 Getting Started Guide 78-18003-02...
Page 59

The adaptive security appliance receives the packet and, because it is a new session, verifies that the packet is allowed. The adaptive security appliance performs network address translation (NAT) to translate the local source address (192.168.1.2) to the public address of the outside interface (209.165.200.225). ASA 5505 Getting Started Guide 78-18003-02...
Page 60: An Internet User Visits The Dmz Web Server

An Internet User Visits the DMZ Web Server Figure 6-4 shows the traffic flow through the adaptive security appliance when a user on the Internet requests a web page from the DMZ web server. ASA 5505 Getting Started Guide 78-18003-02...
Page 61

IP address of the adaptive security appliance (209.165.200.225, the IP address of the outside interface). The adaptive security appliance receives the packet and, because it is a new session, verifies that the packet is allowed. ASA 5505 Getting Started Guide 78-18003-02...
Page 62: An Inside User Visits The Dmz Web Server

DMZ web server (209.165.200.225). The adaptive security appliance forwards the packet to the outside user. An Inside User Visits the DMZ Web Server Figure 6-5 shows an inside user accessing the DMZ web server. ASA 5505 Getting Started Guide 78-18003-02...
Page 63

DNS server, internal client requests for the DMZ web server are handled as follows: A lookup request is sent to the DNS server of the ISP. The public IP address of the DMZ web server is returned to the client. ASA 5505 Getting Started Guide 78-18003-02...
Page 64: Configuring The Security Appliance For A Dmz Deployment

Information to Have Available, page 6-11 • Starting ASDM, page 6-12 • Enabling Inside Clients to Communicate with Devices on the Internet, • page 6-14 • Enabling Inside Clients to Communicate with the DMZ Web Server, page 6-15 ASA 5505 Getting Started Guide 6-10 78-18003-02...
Page 65: Configuration Requirements

Before you begin this configuration procedure, gather the following information: Internal IP address of the server inside the DMZ that you want to make • available to clients on the public network (in this scenario, a web server). ASA 5505 Getting Started Guide 6-11 78-18003-02...
Page 66: Starting Asdm

If you prefer to access ASDM directly with a web browser or using Java, see Starting ASDM with a Web Browser, page 5-8. To start ASDM using the ASDM Launcher software, perform the following steps: From your desktop, start the Cisco ASDM Launcher software. Step 1 A dialog box appears.
Page 67

Chapter 6 Scenario: DMZ Configuration Configuring the Security Appliance for a DMZ Deployment By default, there is no Username and Password set for the Cisco ASDM Note Launcher. Step 4 Click OK. If you receive a security warning containing a request to accept a certificate, click Step 5 Yes.
Page 68: Enabling Inside Clients To Communicate With Devices On The Internet

IP addresses of internal clients to the external address of the outside interface (that is, the public IP address of the adaptive security appliance). Outgoing traffic appears to come from this address. ASA 5505 Getting Started Guide 6-14 78-18003-02...
Page 69: Enabling Inside Clients To Communicate With The Dmz Web Server

Scenario: DMZ Configuration Configuring the Security Appliance for a DMZ Deployment The ASA 5505 comes with a default configuration that includes the necessary address translation rule. Unless you want to change the IP address of the inside interface, you do not need to configure any settings to allow inside clients to access the Internet.
Page 70: Translating Internal Client Ip Addresses Between The Inside And Dmz Interfaces

In the Firewall pane on the left side of the ASDM window, click NAT Rules. Step 3 Step 4 Click the green plus (+) icon and choose Add Static NAT Rule. The Add Static NAT Rule dialog box appears. ASA 5505 Getting Started Guide 6-16 78-18003-02...
Page 71

From the Interface drop-down list, choose the DMZ interface. In the IP Address field, enter the IP address of the internal client or network. In this scenario, the IP address of the network is 10.10.10.0. ASA 5505 Getting Started Guide 6-17 78-18003-02...
Page 72

Chapter 6 Scenario: DMZ Configuration Configuring the Security Appliance for a DMZ Deployment Click OK to add the Static NAT Rule and return to the Configuration > NAT pane. ASA 5505 Getting Started Guide 6-18 78-18003-02...
Page 73

Translating the Public Address of the Web Server to its Real Address To configure a NAT rule that translates the public IP address of the web server to its real IP address, perform the following steps: ASA 5505 Getting Started Guide 6-19 78-18003-02...
Page 74

Step 3 From the Interface drop-down list, choose Inside. Enter or choose from the IP Address drop-down list the real address of the DMZ web server. In this scenario, the IP address is 10.30.30.30. ASA 5505 Getting Started Guide 6-20 78-18003-02...
Page 75: Port Forwarding

IP address, which allows outside HTTP clients to access the web server without being aware of the adaptive security appliance. In this scenario the DMZ web server shares a public IP address with the outside interface of the adaptive security appliance (209.165.200.225). ASA 5505 Getting Started Guide 6-21 78-18003-02...
Page 76: Address

In the Translated area, specify the public IP address to be used for the web server: From the Interface drop-down list, choose Outside. Click the Interface IP radio button. This is the IP address for the specified interface, in this case, the outside interface. ASA 5505 Getting Started Guide 6-22 78-18003-02...
Page 77

To configure Port Address Translation, perform the following steps: Check the Enable Port Address Translation check box. Click the TCP Protocol radio button. In the Original Port field, enter 80. In the Translated Port field, enter 80. ASA 5505 Getting Started Guide 6-23 78-18003-02...
Page 78

Confirm that the rule was created the way you expected. The displayed Step 5 configuration should be similar to the following: Click Apply to complete the adaptive security appliance configuration changes. Step 6 ASA 5505 Getting Started Guide 6-24 78-18003-02...
Page 79: Providing Public Http Access To The Dmz Web Server

Click More Options. If you want the Access Control rule to be enabled immediately, check the Enable Rule check box. Next to Traffic Direction, click In. In the Source Service field, enter tcp/http. ASA 5505 Getting Started Guide 6-25 78-18003-02...
Page 80

At this point, the entries in the Add Access Rule dialog box should be similar to the following: Click OK to return to the Security Policy > Access Rules pane. The displayed configuration should be similar to the following. ASA 5505 Getting Started Guide 6-26 78-18003-02...
Page 81

DMZ web server, while keeping the private network secure. If you want the configuration changes to be saved to the startup configuration so Step 3 that they are applied the next time the device starts, from the File menu, click Save. ASA 5505 Getting Started Guide 6-27 78-18003-02...
Page 82: What To Do Next

To Do This... See... Configure a remote-access VPN Chapter 7, “Scenario: IPsec Remote-Access VPN Configuration” Configure an SSL VPN for Cisco Chapter 8, “Scenario: Configuring AnyConnect software clients Connections for a Cisco AnyConnect VPN Client” ASA 5505 Getting Started Guide...
Page 83

Scenario: DMZ Configuration What to Do Next To Do This... See... Configure a browser-based SSL VPN Chapter 9, “Scenario: SSL VPN Clientless Connections” Configure a site-to-site VPN Chapter 10, “Scenario: Site-to-Site VPN Configuration” ASA 5505 Getting Started Guide 6-29 78-18003-02...
Page 84

Chapter 6 Scenario: DMZ Configuration What to Do Next ASA 5505 Getting Started Guide 6-30 78-18003-02...
Page 85: Chapter 7 Scenario: Ipsec Remote-access Vpn Configuration

Example IPsec Remote-Access VPN Network Topology Figure 7-1 shows an adaptive security appliance configured to accept requests from and establish IPsec connections with VPN clients, such as a Cisco Easy VPN software or hardware clients, over the Internet. ASA 5505 Getting Started Guide...
Page 86: Implementing The Ipsec Remote-access Vpn Scenario

Information to Have Available, page 7-3 • Starting ASDM, page 7-3 • Configuring the ASA 5505 for an IPsec Remote-Access VPN, page 7-5 • Selecting VPN Client Types, page 7-7 • Specifying the VPN Tunnel Group Name and Authentication Method, •...
Page 87: Information To Have Available

Starting ASDM This section describes how to start ASDM using the ASDM Launcher software. If you have not installed the ASDM Launcher software, see Installing the ASDM Launcher, page 5-5. ASA 5505 Getting Started Guide 78-18003-02...
Page 88

Enter the IP address or the host name of your adaptive security appliance. Step 2 Leave the Username and Password fields blank. Step 3 By default, there is no Username and Password set for the Cisco ASDM Note Launcher. Click OK.
Page 89: Configuring The Asa 5505 For An Ipsec Remote-access Vpn

Chapter 7 Scenario: IPsec Remote-Access VPN Configuration Implementing the IPsec Remote-Access VPN Scenario Configuring the ASA 5505 for an IPsec Remote-Access VPN To begin the process for configuring a remote-access VPN, perform the following steps: In the main ASDM window, choose IPsec VPN Wizard from the Wizards Step 1 drop-down menu.
Page 90

In Step 1 of the VPN Wizard, perform the following steps: Step 2 Click the Remote Access radio button. From the drop-down list, choose Outside as the enabled interface for the incoming VPN tunnels. Click Next to continue. ASA 5505 Getting Started Guide 78-18003-02...
Page 91: Selecting Vpn Client Types

Specify the type of VPN client that will enable remote users to connect to this Step 1 adaptive security appliance. For this scenario, click the Cisco VPN Client radio button. You can also use any other Cisco Easy VPN remote product.
Page 92: Specifying The Vpn Tunnel Group Name And Authentication Method

To use a static preshared key for authentication, click the Pre-Shared Key • radio button and enter a preshared key (for example, “Cisco”). This key is used for IPsec negotiations between the adaptive security appliances. To use digital certificates for authentication, click the Certificate radio •...
Page 93: Specifying A User Authentication Method

Chapter 7 Scenario: IPsec Remote-Access VPN Configuration Implementing the IPsec Remote-Access VPN Scenario Enter a Tunnel Group Name (such as “Cisco”) for the set of users that use Step 2 common connection parameters and client attributes to connect to this adaptive security appliance.
Page 94

Click the Authenticate Using an AAA Server Group radio button. Choose a preconfigured server group from the Authenticate using an AAA server group drop-down list, or click New to add a new AAA server group. Click Next to continue. Step 3 ASA 5505 Getting Started Guide 7-10 78-18003-02...
Page 95: (optional) Configuring User Accounts

In Step 5 of the VPN Wizard, perform the following steps: To add a new user, enter a username and password, and then click Add. Step 1 When you have finished adding new users, click Next to continue. Step 2 ASA 5505 Getting Started Guide 7-11 78-18003-02...
Page 96: Configuring Address Pools

Enter a pool name or choose a preconfigured pool from the Pool Name drop-down Step 1 list. Alternatively, click New to create a new address pool. The Add IP Pool dialog box appears. ASA 5505 Getting Started Guide 7-12 78-18003-02...
Page 97: Configuring Client Attributes

Easy VPN hardware client when a connection is established. Make sure that you specify the correct values, or remote clients will not be able to use DNS names for resolution or use Windows networking. ASA 5505 Getting Started Guide 7-13 78-18003-02...
Page 98: Configuring The Ike Policy

IKE is a negotiation protocol that includes an encryption method to protect data and ensure privacy; it is also an authentication method to ensure the identity of the peers. In most cases, the ASDM default values are sufficient to establish secure VPN tunnels. ASA 5505 Getting Started Guide 7-14 78-18003-02...
Page 99

To specify the IKE policy in Step 8 of the VPN Wizard, perform the following steps: Choose the Encryption (DES/3DES/AES), authentication algorithms Step 1 (MD5/SHA), and the Diffie-Hellman group (1/2/5/7) used by the adaptive security appliance during an IKE security association. Click Next to continue. Step 2 ASA 5505 Getting Started Guide 7-15 78-18003-02...
Page 100: Configuring Ipsec Encryption And Authentication Parameters

Configuring IPsec Encryption and Authentication Parameters In Step 9 of the VPN Wizard, perform the following steps: Click the Encryption algorithm (DES/3DES/AES) and authentication algorithm Step 1 (MD5/SHA). Click Next to continue. Step 2 ASA 5505 Getting Started Guide 7-16 78-18003-02...
Page 101: Specifying Address Translation Exception And Split Tunneling

Specify hosts, groups, and networks that should be in the list of internal resources Step 1 made accessible to authenticated remote users. To add or remove hosts, groups, and networks dynamically from the Selected Hosts/Networks area, click Add or Delete, respectively. ASA 5505 Getting Started Guide 7-17 78-18003-02...
Page 102: Verifying The Remote-access Vpn Configuration

Click Next to continue. Step 2 Verifying the Remote-Access VPN Configuration In Step 11 of the VPN Wizard, review the configuration attributes for the new VPN tunnel. The displayed configuration should be similar to the following: ASA 5505 Getting Started Guide 7-18 78-18003-02...
Page 103: What To Do Next

To establish end-to-end, encrypted VPN tunnels for secure connectivity for mobile employees or teleworkers, obtain the Cisco VPN client software. For more information about the Cisco Systems VPN client, see the following URL: http://www.cisco.com/en/US/products/sw/secursw/ps2308/index.html. If you are deploying the adaptive security appliance solely in a remote-access VPN environment, you have completed the initial configuration.
Page 104

See... Configure the adaptive security Chapter 6, “Scenario: DMZ appliance to protect a web server in a Configuration” Configure an SSL VPN for the Cisco Chapter 8, “Scenario: Configuring AnyConnect software client Connections for a Cisco AnyConnect VPN Client” Configure a clientless (browser-based) Chapter 9, “Scenario: SSL VPN...
Page 105: Chapter 8 Scenario: Configuring Connections For A Cisco Anyconnect Vpn Client

Instead, remote users enter the IP address or DNS name of a Cisco SSL VPN interface in their browser. The browser connects to that interface and displays the SSL VPN login screen. If the...
Page 106: Obtaining The Cisco Anyconnect Vpn Client Software

The adaptive security appliance obtains the AnyConnect VPN Client software from the Cisco website. This chapter provides instructions for configuring the SSL VPN using a configuration Wizard. You can download the Cisco SSL VPN software during the configuration process. Users can download the AnyConnect VPN Client from the adaptive security appliance, or it can be installed manually on the remote PC by the system administrator.
Page 107: Example Topology Using Anyconnect Ssl Vpn Clients

Chapter 8 Scenario: Configuring Connections for a Cisco AnyConnect VPN Client Example Topology Using AnyConnect SSL VPN Clients Example Topology Using AnyConnect SSL VPN Clients Figure 8-1 shows an adaptive security appliance configured to accept requests for and establish SSL connections from clients running the AnyConnect SSL VPN software.
Page 108: Information To Have Available

Chapter 8 Scenario: Configuring Connections for a Cisco AnyConnect VPN Client Implementing the Cisco SSL VPN Scenario Configuring the ASA 5505 for the Cisco AnyConnect VPN Client, page 8-7 • Specifying the SSL VPN Interface, page 8-8 • Specifying a User Authentication Method, page 8-9 •...
Page 109: Starting Asdm

Enter the IP address or the host name of your adaptive security appliance. Step 2 Leave the Username and Password fields blank. Step 3 By default, there is no Username and Password set for the Cisco ASDM Note Launcher. Click OK.
Page 110

Chapter 8 Scenario: Configuring Connections for a Cisco AnyConnect VPN Client Implementing the Cisco SSL VPN Scenario The ASA checks to see if there is updated software and if so, downloads it automatically. The main ASDM window appears. ASA 5505 Getting Started Guide...
Page 111: Configuring The Asa 5505 For The Cisco Anyconnect Vpn Client

Scenario: Configuring Connections for a Cisco AnyConnect VPN Client Implementing the Cisco SSL VPN Scenario Configuring the ASA 5505 for the Cisco AnyConnect VPN Client To begin the configuration process, perform the following steps: In the main ASDM window, choose SSL VPN Wizard from the Wizards Step 1 drop-down menu.
Page 112: Specifying The Ssl Vpn Interface

Step 3 remote user to authenticate the ASA. Note The ASA 5505 generates a self-signed certificate by default. However, for enhanced security you may want to purchase a publicly trusted SSL VPN certificate before putting the system in a production environment.
Page 113: Specifying A User Authentication Method

Chapter 8 Scenario: Configuring Connections for a Cisco AnyConnect VPN Client Implementing the Cisco SSL VPN Scenario Click Next to continue. Step 4 Specifying a User Authentication Method In Step 3 of the SSL VPN Wizard, perform the following steps:...
Page 114

Chapter 8 Scenario: Configuring Connections for a Cisco AnyConnect VPN Client Implementing the Cisco SSL VPN Scenario Specify a AAA Server Group Name. You can either choose an existing AAA server group name from the drop down list, or you can create a new server group by clicking New.
Page 115: Specifying A Group Policy

Chapter 8 Scenario: Configuring Connections for a Cisco AnyConnect VPN Client Implementing the Cisco SSL VPN Scenario If you have chosen to authenticate users with the local user database, you can Step 2 create new user accounts here. You can also add users later using the ASDM configuration interface.
Page 116: Configuring The Cisco Anyconnect Vpn Client

VPN client connections, so click Next again. Configuring the Cisco AnyConnect VPN Client For remote clients to gain access to your network with a Cisco VPN Client, you must configure a pool of IP addresses that can be assigned to remote VPN clients as they are successfully connected.
Page 117

Specify the location of the AnyConnect VPN Client software image. Step 3 To obtain the most current version of the software, click Download Latest AnyConnect VPN Client from cisco.com. This downloads the client software to your PC. Click Next to continue.
Page 118: Verifying The Remote-access Vpn Configuration

Chapter 8 Scenario: Configuring Connections for a Cisco AnyConnect VPN Client Implementing the Cisco SSL VPN Scenario Verifying the Remote-Access VPN Configuration In Step 7 of the SSL VPN Wizard, review the configuration settings to ensure that they are correct. The displayed configuration should be similar to the following: If you are satisfied with the configuration, click Finish to apply the changes to the adaptive security appliance.
Page 119: What To Do Next

Chapter 8 Scenario: Configuring Connections for a Cisco AnyConnect VPN Client What to Do Next What to Do Next If you are deploying the adaptive security appliance solely to support AnyConnect VPN connections, you have completed the initial configuration. In addition, you may want to consider performing some of the following steps: To Do This...
Page 120

Chapter 8 Scenario: Configuring Connections for a Cisco AnyConnect VPN Client What to Do Next ASA 5505 Getting Started Guide 8-16 78-18003-02...
Page 121: Chapter 9 Scenario: Ssl Vpn Clientless Connections

Internet. They include: Internal websites • Web-enabled applications • • NT/Active Directory and FTP file shares E-mail proxies, including POP3S, IMAP4S, and SMTPS • ASA 5505 Getting Started Guide 78-18003-02...
Page 122: Security Considerations For Clientless Ssl Vpn Connections

SSL-enabled web-server presents before communicating with it. To minimize the risks involved with SSL certificates: Configure a group policy that consists of all users who need Clientless SSL VPN access and enable it only for that group policy. ASA 5505 Getting Started Guide 78-18003-02...
Page 123: Example Network With Browser-based Ssl Vpn Access

PAT, permitting multiple outbound sessions appear to originate from a single • IP address. Example Network with Browser-Based SSL VPN Access Figure 9-1 shows an adaptive security appliance configured to accept SSL VPN connection requests over the Internet using a web browser. ASA 5505 Getting Started Guide 78-18003-02...
Page 124: Implementing The Clientless Ssl Vpn Scenario

This section includes the following topics: Information to Have Available, page 9-5 • Starting ASDM, page 9-5 • Configuring the ASA 5505 for Browser-Based SSL VPN Connections, • page 9-7 Specifying the SSL VPN Interface, page 9-8 • Specifying a User Authentication Method, page 9-10 •...
Page 125: Information To Have Available

Portal Page is displayed. Digital certificate • The ASA 5505 generates a self-signed certificate by default. For improved security and to eliminate browser warning messages, you may want to purchase a publicly trusted SSL VPN certificate before putting the system in a production environment.
Page 126

Enter the IP address or the host name of your adaptive security appliance. Step 2 Leave the Username and Password fields blank. Step 3 By default, there is no Username and Password set for the Cisco ASDM Note Launcher. Click OK.
Page 127: Configuring The Asa 5505 For Browser-based Ssl Vpn Connections

Chapter 9 Scenario: SSL VPN Clientless Connections Implementing the Clientless SSL VPN Scenario Configuring the ASA 5505 for Browser-Based SSL VPN Connections To begin the process for configuring a browser-based SSL VPN, perform the following steps: In the main ASDM window, choose SSL VPN Wizard from the Wizards Step 1 drop-down menu.
Page 128: Specifying The Ssl Vpn Interface

Check the Browser-based SSL VPN (Web VPN) check box. Click Next to continue. Specifying the SSL VPN Interface In Step 2 of the SSL VPN Wizard, perform the following steps: Specify a Connection Name to which remote users connect. Step 1 ASA 5505 Getting Started Guide 78-18003-02...
Page 129

From the Certificate drop-down list, choose the certificate the ASA sends to the Step 3 remote user to authenticate the ASA. The ASA 5505 generates a self-signed certificate by default. For improved Note security and to eliminate browser warning messages, you may want to purchase a publicly trusted SSL VPN certificate before putting the system in a production environment.
Page 130: Specifying A User Authentication Method

New to add a new AAA server group. To create a new AAA Server Group, click New. The New Authentication Server Group dialog box appears. In this dialog box, specify the following: ASA 5505 Getting Started Guide 9-10 78-18003-02...
Page 131: Specifying A Group Policy

Step 1 Click the Create new group policy radio button and specify a group name. Click the Modify an existing group policy radio button and choose a group from the drop-down list. ASA 5505 Getting Started Guide 9-11 78-18003-02...
Page 132: Creating A Bookmark List For Remote Users

In Step 5 of the SSL VPN Wizard, specify URLs to appear on the VPN portal page by performing the following steps: To specify an existing bookmark list, choose the Bookmark List name from the Step 1 drop-down list. ASA 5505 Getting Started Guide 9-12 78-18003-02...
Page 133

Chapter 9 Scenario: SSL VPN Clientless Connections Implementing the Clientless SSL VPN Scenario To add a new list or edit an existing list, click Manage. The Configure GUI Customization Objects dialog box appears. ASA 5505 Getting Started Guide 9-13 78-18003-02...
Page 134

Implementing the Clientless SSL VPN Scenario To create a new bookmark list, click Add. Step 2 To edit an existing bookmark list, choose the list and click Edit. The Add Bookmark List dialog box appears. ASA 5505 Getting Started Guide 9-14 78-18003-02...
Page 135

From the URL Value drop-down list, choose the type of URL you are specifying. Step 6 For example, choose http, https, ftp, and so on. Then, specify the complete URL for the page. Click OK to return to the Add Bookmark List dialog box. Step 7 ASA 5505 Getting Started Guide 9-15 78-18003-02...
Page 136: Verifying The Configuration

Click Next to continue. Step 11 Verifying the Configuration In Step 7 of the SSL VPN Wizard, review the configuration settings to ensure that they are correct. The displayed configuration should be similar to the following: ASA 5505 Getting Started Guide 9-16 78-18003-02...
Page 137

Save. Alternatively, ASDM prompts you to save the configuration changes permanently when you exit ASDM. If you do not save the configuration changes, the old configuration takes effect the next time the device starts. ASA 5505 Getting Started Guide 9-17 78-18003-02...
Page 138: What To Do Next

Configure a remote-access VPN Chapter 7, “Scenario: IPsec Remote-Access VPN Configuration” Configure an AnyConnect VPN Chapter 8, “Scenario: Configuring Connections for a Cisco AnyConnect VPN Client” Configure a site-to-site VPN Chapter 10, “Scenario: Site-to-Site VPN Configuration” ASA 5505 Getting Started Guide 9-18 78-18003-02...
Page 139: Chapter 10 Scenario: Site-to-site Vpn Configuration

Configuring the Other Side of the VPN Connection, page 10-14 • What to Do Next, page 10-14 • Example Site-to-Site VPN Network Topology Figure 10-1 shows an example VPN tunnel between two adaptive security appliances. ASA 5505 Getting Started Guide 10-1 78-18003-02...
Page 140: Implementing The Site-to-site Scenario

VPN deployment, using example parameters from the remote-access scenario shown in Figure 10-1. This section includes the following topics: Information to Have Available, page 10-3 • • Configuring the Site-to-Site VPN, page 10-3 ASA 5505 Getting Started Guide 10-2 78-18003-02...
Page 141: Information To Have Available

If you prefer to access ASDM directly with a web browser or using Java, see Starting ASDM with a Web Browser, page 5-8. To start ASDM using the ASDM Launcher software, perform the following steps: ASA 5505 Getting Started Guide 10-3 78-18003-02...
Page 142

Enter the IP address or the host name of your adaptive security appliance. Step 2 Leave the Username and Password fields blank. Step 3 By default, there is no Username and Password set for the Cisco ASDM Note Launcher. Click OK.
Page 143

Configuring the Security Appliance at the Local Site The adaptive security appliance at the first site is referred to as Security Note Appliance 1 in this scenario. To configure the Security Appliance 1, perform the following steps: ASA 5505 Getting Started Guide 10-5 78-18003-02...
Page 144

VPN concentrators, or other devices that support site-to-site IPsec connectivity. From the VPN tunnel Interface drop-down list, choose Outside as the enabled interface for the current VPN tunnel. ASA 5505 Getting Started Guide 10-6 78-18003-02...
Page 145

To use a static preshared key for authentication, click the Pre-Shared Key • radio button and enter a preshared key (for example, “Cisco”). This key is used for IPsec negotiations between the adaptive security appliances. When using preshared key authentication, the Tunnel Group Name Note must be the IP address of the peer.
Page 146

In Step 3 of the VPN Wizard, perform the following steps: Click the Encryption (DES/3DES/AES), authentication algorithms (MD5/SHA), Step 1 and the Diffie-Hellman group (1/2/5) used by the adaptive security appliance during an IKE security association. ASA 5505 Getting Started Guide 10-8 78-18003-02...
Page 147

When configuring Security Appliance 2, enter the exact values for each of the options that you chose for Security Appliance 1. Encryption mismatches are a common cause of VPN tunnel failures and can slow down the process. Click Next to continue. Step 2 ASA 5505 Getting Started Guide 10-9 78-18003-02...
Page 148

In Step 4 of the VPN Wizard, perform the following steps: Choose the encryption algorithm (DES/3DES/AES) from the Encryption Step 1 drop-down list, and the authentication algorithm (MD5/SHA) from the Authentication drop-down list. Click Next to continue. Step 2 ASA 5505 Getting Started Guide 10-10 78-18003-02...
Page 149

(...) button to select from a list of hosts and networks. Enter the IP address of remote networks to be protected or not protected, or click Step 3 the ellipsis (...) button to select from a list of hosts and networks. ASA 5505 Getting Started Guide 10-11 78-18003-02...
Page 150

Implementing the Site-to-Site Scenario Click Next to continue. Step 4 Viewing VPN Attributes and Completing the Wizard In Step 6 of the VPN Wizard, review the configuration list for the VPN tunnel you just created. ASA 5505 Getting Started Guide 10-12 78-18003-02...
Page 151

Alternatively, ASDM prompts you to save the configuration changes permanently when you exit ASDM. If you do not save the configuration changes, the old configuration takes effect the next time the device starts. This concludes the configuration process for Security Appliance 1. ASA 5505 Getting Started Guide 10-13 78-18003-02...
Page 152: Configuring The Other Side Of The Vpn Connection

Refine configuration and configure Cisco Security Appliance Command optional and advanced features Line Configuration Guide Learn about daily operations Cisco Security Appliance Command Reference Cisco Security Appliance Logging Configuration and System Log Messages ASA 5505 Getting Started Guide 10-14 78-18003-02...
Page 153

Remote-Access VPN Configuration” Configure a clientless (browser-based) Chapter 9, “Scenario: SSL VPN SSL VPN Clientless Connections” Configure an SSL VPN for the Cisco Chapter 8, “Scenario: Configuring AnyConnect software client Connections for a Cisco AnyConnect VPN Client” ASA 5505 Getting Started Guide...
Page 154

Chapter 10 Scenario: Site-to-Site VPN Configuration What to Do Next ASA 5505 Getting Started Guide 10-16 78-18003-02...
Page 155: Chapter 11 Scenario: Easy Vpn Hardware Client Configuration

Easy VPN server at the main site and Easy VPN hardware clients at the remote offices. The Cisco ASA 5505 can function as a Cisco Easy VPN hardware client or as a Cisco Easy VPN server (sometimes called a “headend device”), but not both at the same time.
Page 156: Client Mode And Network Extension Mode

Cisco VPN 30xx, or Cisco IOS 12.2(8)T) When used as an Easy VPN hardware client, the ASA 5505 can also be configured to perform basic firewall services, such as protecting devices in a DMZ from from unauthorized access. However, if the ASA 5505 is configured to function as an Easy VPN hardware client, it cannot establish other types of tunnels.
Page 157

Easy VPN hardware client using the CLI, you must specify a mode. Figure 11-2 shows a sample network topology with the ASA 5505 running in Easy VPN Client Mode. When configured in Client Mode, devices on the inside interface of the ASA 5505 cannot be accessed by devices behind the Easy VPN server.
Page 158

LAN from remote LAN When configured in Easy VPN Network Extension Mode, the ASA 5505 does not hide the IP addresses of local hosts by substituting a public IP address. Therefore, hosts on the other side of the VPN connection can communicate directly with hosts on the local network.
Page 159: Configuring The Easy Vpn Hardware Client

Configuring the Easy VPN Hardware Client The Easy VPN server controls the security policies enforced on the ASA 5505 Easy VPN hardware client. However, to establish the initial connection to the Easy VPN server, you must complete some configuration locally.
Page 160: Starting Asdm With The Asdm Launcher

Launcher, page 5-5. If you prefer to access ASDM directly with a web browser or using Java, see Starting ASDM with a Web Browser, page 5-8. To start ASDM, perform the following steps: From your desktop, double-click the Cisco ASDM Launcher icon. The ASDM Step 1 Launcher dialog box appears.
Page 161

Chapter 11 Scenario: Easy VPN Hardware Client Configuration Configuring the Easy VPN Hardware Client By default, there is no Username and Password set for the Cisco ASDM Note Launcher. Step 4 Click OK. Click Yes to accept the certificates. Step 5 The ASA checks to see if there is updated software and if so, downloads it automatically.
Page 162

Chapter 11 Scenario: Easy VPN Hardware Client Configuration Configuring the Easy VPN Hardware Client ASA 5505 Getting Started Guide 11-8 78-18003-02...
Page 163: Configuring The Hardware Client

Scenario: Easy VPN Hardware Client Configuration Configuring the Easy VPN Hardware Client Configuring the Hardware Client To configure the ASA 5505 as an Easy VPN hardware client, perform the following steps: In the ASDM window, click the Configuration tool. Step 1...
Page 164

Pre shared key radio button and enter a Group Name and Group Password. In the User Settings area, specify the User Name and User Password to be used Step 6 by the ASA 5505 when establishing a VPN connection. ASA 5505 Getting Started Guide 11-10 78-18003-02...
Page 165

Easy VPN connection through the tunnel. The public address of the ASA 5505 is not accessible when behind the Note NAT device unless you add static NAT mappings on the NAT device.
Page 166

Refine configuration and configure Cisco Security Appliance Command optional and advanced features Line Configuration Guide Learn about daily operations Cisco Security Appliance Command Reference Cisco Security Appliance Logging Configuration and System Log Messages ASA 5505 Getting Started Guide 11-12 78-18003-02...
Page 167

(SSH, ASDM, and so on), site-to-site VPN, and remote access VPN. You need an encryption license key to enable this license. If you are a registered user of Cisco.com and would like to obtain a 3DES/AES encryption license, go to the following website: http://www.cisco.com/go/license...
Page 168

Step 4 Exits global configuration mode. hostname(config)# exit Step 5 Saves the configuration. hostname# copy running-config startup-config Step 6 Reboots the adaptive security appliance and hostname# reload reloads the configuration. ASA 5505 Getting Started Guide 78-18003-02...