Cisco 500 Series Manuals

Manuals and User Guides for Cisco 500 Series. We have 4 Cisco 500 Series manuals available for free PDF download: Configuration Manual, Manual, Hardware Installation Manual

Cisco 500 Series Configuration Manual (1140 pages)

Security Appliance Command Line

Brand: Cisco | Category: Security System | Size: 12.22 MB

Table Of Contents3................................................................................................................................................................

About This Guide39................................................................................................................................................................

Document Objectives39................................................................................................................................................................

Related Documentation40................................................................................................................................................................

Document Organization40................................................................................................................................................................

Document Conventions43................................................................................................................................................................

Introduction To The Security Appliance47................................................................................................................................................................

Firewall Functional Overview47................................................................................................................................................................

Security Policy Overview48................................................................................................................................................................

Permitting Or Denying Traffic With Access Lists48................................................................................................................................................................

Applying Http, Https, Or Ftp Filtering49................................................................................................................................................................

Applying Application Inspection49................................................................................................................................................................

Vpn Functional Overview51................................................................................................................................................................

Intrusion Prevention Services Functional Overview52................................................................................................................................................................

Getting Started53................................................................................................................................................................

Getting Started With Your Platform Model53................................................................................................................................................................

Factory Default Configurations53................................................................................................................................................................

Restoring The Factory Default Configuration54................................................................................................................................................................

Asa 5505 Default Configuration54................................................................................................................................................................

Asa 5510 And Higher Default Configuration55................................................................................................................................................................

Pix 515/515e Default Configuration56................................................................................................................................................................

Accessing The Command-line Interface56................................................................................................................................................................

Setting Transparent Or Routed Firewall Mode57................................................................................................................................................................

Working With The Configuration58................................................................................................................................................................

Saving Configuration Changes58................................................................................................................................................................

Saving Configuration Changes In Single Context Mode59................................................................................................................................................................

Saving Configuration Changes In Multiple Context Mode59................................................................................................................................................................

Copying The Startup Configuration To The Running Configuration60................................................................................................................................................................

Viewing The Configuration60................................................................................................................................................................

Clearing And Removing Configuration Settings61................................................................................................................................................................

Creating Text Configuration Files Offline61................................................................................................................................................................

How The Security Appliance Classifies Packets65................................................................................................................................................................

Valid Classifier Criteria65................................................................................................................................................................

Invalid Classifier Criteria66................................................................................................................................................................

Classification Examples67................................................................................................................................................................

Cascading Security Contexts70................................................................................................................................................................

Management Access To Security Contexts71................................................................................................................................................................

System Administrator Access71................................................................................................................................................................

Context Administrator Access72................................................................................................................................................................

Enabling Or Disabling Multiple Context Mode72................................................................................................................................................................

Restoring Single Context Mode73................................................................................................................................................................

Interface Overview75................................................................................................................................................................

Configuring Switch Ports And Vlan Interfaces For The Cisco Asa 5505 Adaptive Security75................................................................................................................................................................

Understanding Asa 5505 Ports And Interfaces76................................................................................................................................................................

Maximum Active Vlan Interfaces For Your License76................................................................................................................................................................

Default Interface Configuration78................................................................................................................................................................

Vlan Mac Addresses78................................................................................................................................................................

Configuring A Switch Port As A Trunk Port85................................................................................................................................................................

Allowing Communication Between Vlan Interfaces On The Same Security Level87................................................................................................................................................................

Configuring Ethernet Settings, Redundant Interfaces, And Subinterfaces89................................................................................................................................................................

Configuring And Enabling Rj-45 Interfaces89................................................................................................................................................................

Configuring And Enabling Fiber Interfaces91................................................................................................................................................................

Configuring The Fiber Interface92................................................................................................................................................................

Configuring A Redundant Interface92................................................................................................................................................................

Redundant Interface Overview93................................................................................................................................................................

Default State Of Redundant Interfaces93................................................................................................................................................................

Adding A Redundant Interface94................................................................................................................................................................

Changing The Active Interface95................................................................................................................................................................

Configuring Vlan Subinterfaces And 802.1q Trunking95................................................................................................................................................................

Maximum Subinterfaces96................................................................................................................................................................

Preventing Untagged Packets On The Physical Interface96................................................................................................................................................................

Resource Limits100................................................................................................................................................................

Class Members102................................................................................................................................................................

Configuring A Class102................................................................................................................................................................

Configuring A Security Context105................................................................................................................................................................

Automatically Assigning Mac Addresses To Context Interfaces109................................................................................................................................................................

Changing Between Contexts And The System Execution Space110................................................................................................................................................................

Removing A Security Context110................................................................................................................................................................

Changing The Admin Context111................................................................................................................................................................

Changing The Security Context Url111................................................................................................................................................................

Reloading A Security Context112................................................................................................................................................................

Reloading By Clearing The Configuration112................................................................................................................................................................

Reloading By Removing And Re-adding The Context113................................................................................................................................................................

Monitoring Security Contexts113................................................................................................................................................................

Viewing Resource Allocation114................................................................................................................................................................

Viewing Resource Usage117................................................................................................................................................................

Monitoring Syn Attacks In Contexts118................................................................................................................................................................

Configuring Interface Parameters121................................................................................................................................................................

Interface Parameters Overview122................................................................................................................................................................

Default State Of Interfaces123................................................................................................................................................................

Default Security Level123................................................................................................................................................................

Allowing Communication Between Interfaces On The Same Security Level127................................................................................................................................................................

Configuring Basic Settings129................................................................................................................................................................

Changing The Login Password129................................................................................................................................................................

Setting The Date And Time130................................................................................................................................................................

Setting The Hostname130................................................................................................................................................................

Setting The Domain Name130................................................................................................................................................................

Setting The Time Zone And Daylight Saving Time Date Range131................................................................................................................................................................

Setting The Date And Time Using An Ntp Server132................................................................................................................................................................

Setting The Date And Time Manually132................................................................................................................................................................

Setting The Management Ip Address For A Transparent Firewall133................................................................................................................................................................

Configuring Ip Routing135................................................................................................................................................................

Configuring Static And Default Routes135................................................................................................................................................................

Configuring A Static Route136................................................................................................................................................................

Configuring A Default Static Route137................................................................................................................................................................

Configuring Static Route Tracking138................................................................................................................................................................

Defining Route Maps140................................................................................................................................................................

Configuring Ospf141................................................................................................................................................................

Ospf Overview142................................................................................................................................................................

Enabling Ospf142................................................................................................................................................................

Redistributing Routes Into Ospf143................................................................................................................................................................

Configuring Ospf Interface Parameters144................................................................................................................................................................

Configuring Ospf Area Parameters147................................................................................................................................................................

Configuring Ospf Nssa147................................................................................................................................................................

Configuring Route Summarization Between Ospf Areas149................................................................................................................................................................

Configuring Route Summarization When Redistributing Routes Into Ospf149................................................................................................................................................................

Defining Static Ospf Neighbors150................................................................................................................................................................

Generating A Default Route150................................................................................................................................................................

Configuring Route Calculation Timers151................................................................................................................................................................

Logging Neighbors Going Up Or Down151................................................................................................................................................................

Displaying Ospf Update Packet Pacing152................................................................................................................................................................

Monitoring Ospf152................................................................................................................................................................

Restarting The Ospf Process153................................................................................................................................................................

Configuring Rip153................................................................................................................................................................

Redistributing Routes Into The Rip Routing Process155................................................................................................................................................................

Configuring Rip Send/receive Version On An Interface155................................................................................................................................................................

Enabling Rip Authentication156................................................................................................................................................................

Monitoring Rip156................................................................................................................................................................

Configuring Eigrp157................................................................................................................................................................

Eigrp Routing Overview157................................................................................................................................................................

Enabling And Configuring Eigrp Routing158................................................................................................................................................................

Enabling And Configuring Eigrp Stub Routing159................................................................................................................................................................

Enabling Eigrp Authentication160................................................................................................................................................................

Defining An Eigrp Neighbor161................................................................................................................................................................

Redistributing Routes Into Eigrp161................................................................................................................................................................

Configuring The Eigrp Hello Interval And Hold Time162................................................................................................................................................................

Disabling Automatic Route Summarization162................................................................................................................................................................

Configuring Summary Aggregate Addresses163................................................................................................................................................................

Disabling Eigrp Split Horizon163................................................................................................................................................................

Changing The Interface Delay Value164................................................................................................................................................................

Monitoring Eigrp164................................................................................................................................................................

Disabling Neighbor Change And Warning Message Logging165................................................................................................................................................................

The Routing Table165................................................................................................................................................................

How The Routing Table Is Populated166................................................................................................................................................................

Backup Routes167................................................................................................................................................................

How Forwarding Decisions Are Made167................................................................................................................................................................

Dynamic Routing And Failover168................................................................................................................................................................

Configuring Dhcp, Ddns, And Wccp Services169................................................................................................................................................................

Configuring A Dhcp Server169................................................................................................................................................................

Enabling The Dhcp Server170................................................................................................................................................................

Configuring Dhcp Options171................................................................................................................................................................

Using Cisco Ip Phones With A Dhcp Server172................................................................................................................................................................

Configuring Dhcp Relay Services173................................................................................................................................................................

Configuring Dynamic Dns174................................................................................................................................................................

Example 1: Client Updates Both A And Ptr Rrs For Static Ip Addresses175................................................................................................................................................................

Example 5: Client Updates A Rr; Server Updates Ptr Rr177................................................................................................................................................................

Configuring Web Cache Services Using Wccp177................................................................................................................................................................

Wccp Interaction With Other Features178................................................................................................................................................................

Enabling Wccp Redirection178................................................................................................................................................................

Configuring Multicast Routing181................................................................................................................................................................

Multicast Routing Overview181................................................................................................................................................................

Enabling Multicast Routing182................................................................................................................................................................

Configuring Igmp Features182................................................................................................................................................................

Disabling Igmp On An Interface183................................................................................................................................................................

Configuring Group Membership183................................................................................................................................................................

Limiting The Number Of Igmp States On An Interface184................................................................................................................................................................

Modifying The Query Interval And Query Timeout184................................................................................................................................................................

Changing The Query Response Time185................................................................................................................................................................

Changing The Igmp Version185................................................................................................................................................................

Configuring Pim Features186................................................................................................................................................................

Disabling Pim On An Interface186................................................................................................................................................................

Configuring A Static Rendezvous Point Address187................................................................................................................................................................

Configuring The Designated Router Priority187................................................................................................................................................................

Configuring Pim Message Intervals188................................................................................................................................................................

Configuring A Multicast Boundary188................................................................................................................................................................

Supporting Mixed Bidirctional/sparse-mode Pim Networks189................................................................................................................................................................

For More Information About Multicast Routing190................................................................................................................................................................

Configuring Ipv6 On An Interface193................................................................................................................................................................

Configuring A Dual Ip Stack On An Interface194................................................................................................................................................................

Enforcing The Use Of Modified Eui-64 Interface Ids In Ipv6 Addresses194................................................................................................................................................................

Configuring Ipv6 Default And Static Routes195................................................................................................................................................................

Configuring Ipv6 Access Lists196................................................................................................................................................................

Configuring Ipv6 Neighbor Discovery197................................................................................................................................................................

Configuring Neighbor Solicitation Messages197................................................................................................................................................................

Configuring Router Advertisement Messages199................................................................................................................................................................

Configuring A Static Ipv6 Neighbor201................................................................................................................................................................

Verifying The Ipv6 Configuration201................................................................................................................................................................

The Show Ipv6 Route Command202................................................................................................................................................................

Configuring Aaa Servers And The Local Database203................................................................................................................................................................

Aaa Overview203................................................................................................................................................................

About Authentication204................................................................................................................................................................

About Authorization204................................................................................................................................................................

Aaa Server And Local Database Support205................................................................................................................................................................

Summary Of Support205................................................................................................................................................................

Radius Server Support206................................................................................................................................................................

Authentication Methods206................................................................................................................................................................

Sdi Server Support207................................................................................................................................................................

Sdi Version Support207................................................................................................................................................................

Ldap Server Support208................................................................................................................................................................

Sso Support For Webvpn With Http Forms208................................................................................................................................................................

Fallback Support209................................................................................................................................................................

Configuring The Local Database209................................................................................................................................................................

Identifying Aaa Server Groups And Servers211................................................................................................................................................................

Configuring An Ldap Server214................................................................................................................................................................

Authentication With Ldap214................................................................................................................................................................

Authorization With Ldap For Vpn216................................................................................................................................................................

Ldap Attribute Mapping216................................................................................................................................................................

Using Certificates And User Login Credentials218................................................................................................................................................................

Using User Login Credentials218................................................................................................................................................................

Supporting A Zone Labs Integrity Server219................................................................................................................................................................

Overview Of Integrity Server And Security Appliance Interaction219................................................................................................................................................................

Configuring Integrity Server Support220................................................................................................................................................................

Hardware Requirements222................................................................................................................................................................

Software Requirements222................................................................................................................................................................

The Failover And Stateful Failover Links223................................................................................................................................................................

Stateful Failover Link225................................................................................................................................................................

Active/active And Active/standby Failover226................................................................................................................................................................

Determining Which Type Of Failover To Use235................................................................................................................................................................

Regular And Stateful Failover235................................................................................................................................................................

Failover Health Monitoring236................................................................................................................................................................

Unit Health Monitoring237................................................................................................................................................................

Failover Feature/platform Matrix238................................................................................................................................................................

Failover Times By Platform238................................................................................................................................................................

Failover Configuration Limitations239................................................................................................................................................................

Configuring Active/standby Failover239................................................................................................................................................................

Configuring Lan-based Active/standby Failover241................................................................................................................................................................

Configuring Optional Active/standby Failover Settings245................................................................................................................................................................

Configuring Active/active Failover247................................................................................................................................................................

Configuring Cable-based Active/active Failover (pix 500 Series Security Appliance)247................................................................................................................................................................

Configuring Lan-based Active/active Failover249................................................................................................................................................................

Configuring Optional Active/active Failover Settings253................................................................................................................................................................

Configuring Unit Health Monitoring259................................................................................................................................................................

Configuring Failover Communication Authentication/encryption259................................................................................................................................................................

Verifying The Failover Configuration260................................................................................................................................................................

Using The Show Failover Command260................................................................................................................................................................

Viewing Monitored Interfaces268................................................................................................................................................................

Displaying The Failover Commands In The Running Configuration268................................................................................................................................................................

Testing The Failover Functionality269................................................................................................................................................................

Controlling And Monitoring Failover269................................................................................................................................................................

Disabling Failover270................................................................................................................................................................

Restoring A Failed Unit Or Failover Group270................................................................................................................................................................

Failover System Messages271................................................................................................................................................................

Remote Command Execution271................................................................................................................................................................

Changing Command Modes272................................................................................................................................................................

Security Considerations273................................................................................................................................................................

Limitations Of Remote Command Execution273................................................................................................................................................................

Monitoring The Auto Update Process275................................................................................................................................................................

Routed Mode Overview279................................................................................................................................................................

Ip Routing Support279................................................................................................................................................................

An Outside User Visits A Web Server On The Dmz281................................................................................................................................................................

An Inside User Visits A Web Server On The Dmz282................................................................................................................................................................

A Dmz User Attempts To Access An Inside Host284................................................................................................................................................................

Transparent Firewall Network285................................................................................................................................................................

Allowing Layer 3 Traffic285................................................................................................................................................................

Mac Address Vs. Route Lookups286................................................................................................................................................................

Using The Transparent Firewall In Your Network287................................................................................................................................................................

Unsupported Features In Transparent Mode288................................................................................................................................................................

An Inside User Visits A Web Server Using Nat291................................................................................................................................................................

Access List Types296................................................................................................................................................................

Access Control Entry Order296................................................................................................................................................................

Access Control Implicit Deny297................................................................................................................................................................

Ip Addresses Used For Access Lists When You Use Nat297................................................................................................................................................................

Adding An Extended Access List299................................................................................................................................................................

Extended Access List Overview299................................................................................................................................................................

Allowing Broadcast And Multicast Traffic Through The Transparent Firewall300................................................................................................................................................................

Adding An Extended Ace300................................................................................................................................................................

Adding An Ethertype Access List302................................................................................................................................................................

Ethertype Access List Overview302................................................................................................................................................................

Implicit Permit Of Ip And Arps Only303................................................................................................................................................................

Implicit And Explicit Deny Ace At The End Of An Access List303................................................................................................................................................................

Adding An Ethertype Ace304................................................................................................................................................................

Adding A Standard Access List304................................................................................................................................................................

Adding A Webtype Access List305................................................................................................................................................................

Simplifying Access Lists With Object Grouping305................................................................................................................................................................

Adding Object Groups306................................................................................................................................................................

Adding A Protocol Object Group306................................................................................................................................................................

Adding A Network Object Group307................................................................................................................................................................

Adding A Service Object Group307................................................................................................................................................................

Adding An Icmp Type Object Group308................................................................................................................................................................

Nesting Object Groups309................................................................................................................................................................

Using Object Groups With An Access List310................................................................................................................................................................

Displaying Object Groups311................................................................................................................................................................

Removing Object Groups311................................................................................................................................................................

Scheduling Extended Access List Activation312................................................................................................................................................................

Adding A Time Range312................................................................................................................................................................

Applying The Time Range To An Ace313................................................................................................................................................................

Logging Access List Activity313................................................................................................................................................................

Configuring Logging For An Access Control Entry314................................................................................................................................................................

Managing Deny Flows315................................................................................................................................................................

Nat Overview317................................................................................................................................................................

Nat In Routed Mode318................................................................................................................................................................

Nat In Transparent Mode319................................................................................................................................................................

Nat Control320................................................................................................................................................................

Nat Types322................................................................................................................................................................

Bypassing Nat When Nat Control Is Enabled326................................................................................................................................................................

Nat And Same Security Level Interfaces329................................................................................................................................................................

Order Of Nat Commands Used To Match Real Addresses330................................................................................................................................................................

Mapped Address Guidelines330................................................................................................................................................................

Dns And Nat331................................................................................................................................................................

Configuring Nat Control332................................................................................................................................................................

Configuring Dynamic Nat Or Pat339................................................................................................................................................................

Using Static Nat342................................................................................................................................................................

Using Static Pat343................................................................................................................................................................

Configuring Static Identity Nat347................................................................................................................................................................

Configuring Nat Exemption349................................................................................................................................................................

Nat Examples350................................................................................................................................................................

Overlapping Networks350................................................................................................................................................................

Redirecting Ports352................................................................................................................................................................

Permitting Or Denying Network Access355................................................................................................................................................................

Inbound And Outbound Access List Overview355................................................................................................................................................................

Applying An Access List To An Interface356................................................................................................................................................................

Applying Aaa For Network Access359................................................................................................................................................................

Aaa Performance359................................................................................................................................................................

Authentication Overview360................................................................................................................................................................

One-time Authentication360................................................................................................................................................................

Static Pat And Http361................................................................................................................................................................

Enabling Network Access Authentication361................................................................................................................................................................

Enabling Secure Authentication Of Web Clients363................................................................................................................................................................

Authenticating Directly With The Security Appliance364................................................................................................................................................................

Enabling Direct Authentication Using Http And Https364................................................................................................................................................................

Enabling Direct Authentication Using Telnet365................................................................................................................................................................

Configuring Authorization For Network Access366................................................................................................................................................................

Configuring Tacacs+ Authorization366................................................................................................................................................................

Configuring Radius Authorization368................................................................................................................................................................

Configuring A Radius Server To Send Downloadable Access Control Lists368................................................................................................................................................................

Configuring A Radius Server To Download Per-user Access Control List Names372................................................................................................................................................................

Configuring Accounting For Network Access372................................................................................................................................................................

Using Mac Addresses To Exempt Traffic From Authentication And Authorization374................................................................................................................................................................

Applying Filtering Services377................................................................................................................................................................

Filtering Overview377................................................................................................................................................................

Filtering Activex Objects378................................................................................................................................................................

Activex Filtering Overview378................................................................................................................................................................

Filtering Java Applets379................................................................................................................................................................

Filtering Urls And Ftp Requests With An External Server380................................................................................................................................................................

Url Filtering Overview380................................................................................................................................................................

Buffering The Content Server Response382................................................................................................................................................................

Caching Server Addresses382................................................................................................................................................................

Filtering Http Urls383................................................................................................................................................................

Configuring Http Filtering383................................................................................................................................................................

Exempting Traffic From Filtering384................................................................................................................................................................

Filtering Https Urls384................................................................................................................................................................

Filtering Ftp Requests385................................................................................................................................................................

Viewing Filtering Statistics And Configuration385................................................................................................................................................................

Viewing Filtering Server Statistics386................................................................................................................................................................

Viewing Buffer Configuration And Statistics387................................................................................................................................................................

Viewing Caching Statistics387................................................................................................................................................................

Viewing Filtering Configuration388................................................................................................................................................................

Using Modular Policy Framework389................................................................................................................................................................

Modular Policy Framework Overview389................................................................................................................................................................

Default Global Policy390................................................................................................................................................................

Identifying Traffic Using A Layer 3/4 Class Map390................................................................................................................................................................

Creating A Layer 3/4 Class Map For Through Traffic391................................................................................................................................................................

Creating A Layer 3/4 Class Map For Management Traffic393................................................................................................................................................................

Configuring Special Actions For Application Inspections394................................................................................................................................................................

Creating A Regular Expression394................................................................................................................................................................

Creating A Regular Expression Class Map397................................................................................................................................................................

Identifying Traffic In An Inspection Class Map398................................................................................................................................................................

Defining Actions In An Inspection Policy Map399................................................................................................................................................................

Defining Actions Using A Layer 3/4 Policy Map401................................................................................................................................................................

Layer 3/4 Policy Map Overview401................................................................................................................................................................

Policy Map Guidelines402................................................................................................................................................................

Supported Feature Types402................................................................................................................................................................

Feature Matching Guidelines Within A Policy Map403................................................................................................................................................................

Feature Matching Guidelines For Multiple Policy Maps403................................................................................................................................................................

Order In Which Multiple Feature Actions Are Applied404................................................................................................................................................................

Default Layer 3/4 Policy Map404................................................................................................................................................................

Modular Policy Framework Examples407................................................................................................................................................................

Applying Inspection And Qos Policing To Http Traffic407................................................................................................................................................................

Applying Inspection To Http Traffic Globally408................................................................................................................................................................

Applying Inspection And Connection Limits To Http Traffic To Specific Servers409................................................................................................................................................................

Applying Inspection To Http Traffic With Nat410................................................................................................................................................................

Managing The Aip Ssm And Csc Ssm411................................................................................................................................................................

Managing The Aip Ssm411................................................................................................................................................................

How The Aip Ssm Works With The Adaptive Security Appliance412................................................................................................................................................................

Operating Modes412................................................................................................................................................................

Using Virtual Sensors413................................................................................................................................................................

Aip Ssm Procedure Overview414................................................................................................................................................................

Sessioning To The Aip Ssm415................................................................................................................................................................

Configuring The Security Policy On The Aip Ssm416................................................................................................................................................................

Assigning Virtual Sensors To Security Contexts416................................................................................................................................................................

Diverting Traffic To The Aip Ssm418................................................................................................................................................................

Managing The Csc Ssm419................................................................................................................................................................

About The Csc Ssm420................................................................................................................................................................

Getting Started With The Csc Ssm422................................................................................................................................................................

Limiting Connections Through The Csc Ssm425................................................................................................................................................................

Diverting Traffic To The Csc Ssm426................................................................................................................................................................

Checking Ssm Status428................................................................................................................................................................

Transferring An Image Onto An Ssm429................................................................................................................................................................

Basic Threat Detection Overview432................................................................................................................................................................

Managing Basic Threat Statistics434................................................................................................................................................................

Configuring Scanning Threat Detection435................................................................................................................................................................

Enabling Scanning Threat Detection435................................................................................................................................................................

Managing Shunned Hosts436................................................................................................................................................................

Viewing Attackers And Targets437................................................................................................................................................................

Configuring And Viewing Threat Statistics437................................................................................................................................................................

Viewing Threat Statistics438................................................................................................................................................................

Configuring Tcp Normalization441................................................................................................................................................................

Configuring Connection Limits And Timeouts444................................................................................................................................................................

Connection Limit Overview444................................................................................................................................................................

Dead Connection Detection Overview445................................................................................................................................................................

Tcp Sequence Randomization Overview445................................................................................................................................................................

Preventing Ip Spoofing446................................................................................................................................................................

Configuring The Fragment Size447................................................................................................................................................................

Blocking Unwanted Connections447................................................................................................................................................................

Configuring Ip Audit For Basic Ips Support448................................................................................................................................................................

Qos Concepts450................................................................................................................................................................

Implementing Qos450................................................................................................................................................................

Identifying Traffic For Qos452................................................................................................................................................................

Defining A Qos Policy Map453................................................................................................................................................................

Applying Rate Limiting454................................................................................................................................................................

Activating The Service Policy455................................................................................................................................................................

Applying Low Latency Queueing456................................................................................................................................................................

Configuring Priority Queuing456................................................................................................................................................................

Reducing Queue Latency457................................................................................................................................................................

Configuring Qos457................................................................................................................................................................

Viewing Qos Configuration460................................................................................................................................................................

Viewing Qos Service Policy Configuration460................................................................................................................................................................

Viewing Qos Policy Map Configuration461................................................................................................................................................................

Viewing The Priority-queue Configuration For An Interface461................................................................................................................................................................

Viewing Qos Priority Queue Statistics463................................................................................................................................................................

Inspection Engine Overview466................................................................................................................................................................

When To Use Application Protocol Inspection466................................................................................................................................................................

Inspection Limitations467................................................................................................................................................................

Default Inspection Policy467................................................................................................................................................................

Configuring Application Inspection469................................................................................................................................................................

Ctiqbe Inspection474................................................................................................................................................................

Ctiqbe Inspection Overview474................................................................................................................................................................

Verifying And Monitoring Ctiqbe Inspection475................................................................................................................................................................

Dcerpc Inspection476................................................................................................................................................................

Dcerpc Overview476................................................................................................................................................................

Dns Inspection477................................................................................................................................................................

How Dns Application Inspection Works478................................................................................................................................................................

How Dns Rewrite Works478................................................................................................................................................................

Configuring Dns Rewrite479................................................................................................................................................................

Using The Static Command For Dns Rewrite480................................................................................................................................................................

Using The Alias Command For Dns Rewrite480................................................................................................................................................................

Dns Rewrite With Three Nat Zones481................................................................................................................................................................

Configuring Dns Rewrite With Three Nat Zones483................................................................................................................................................................

Verifying And Monitoring Dns Inspection484................................................................................................................................................................

Configuring A Dns Inspection Policy Map For Additional Inspection Control485................................................................................................................................................................

Esmtp Inspection488................................................................................................................................................................

Configuring An Esmtp Inspection Policy Map For Additional Inspection Control488................................................................................................................................................................

Configuring An Ftp Inspection Policy Map For Additional Inspection Control491................................................................................................................................................................

Verifying And Monitoring Ftp Inspection495................................................................................................................................................................

Gtp Inspection Overview495................................................................................................................................................................

Configuring A Gtp Inspection Policy Map For Additional Inspection Control496................................................................................................................................................................

Verifying And Monitoring Gtp Inspection500................................................................................................................................................................

H.323 Inspection Overview502................................................................................................................................................................

How H.323 Works502................................................................................................................................................................

Configuring An H.323 Inspection Policy Map For Additional Inspection Control503................................................................................................................................................................

Configuring H.323 And H.225 Timeout Values506................................................................................................................................................................

Verifying And Monitoring H.323 Inspection506................................................................................................................................................................

Monitoring H.245 Sessions507................................................................................................................................................................

Monitoring H.323 Ras Sessions508................................................................................................................................................................

Http Inspection Overview508................................................................................................................................................................

Configuring An Http Inspection Policy Map For Additional Inspection Control509................................................................................................................................................................

Im Inspection Overview513................................................................................................................................................................

Configuring An Instant Messaging Inspection Policy Map For Additional Inspection Control513................................................................................................................................................................

Icmp Inspection516................................................................................................................................................................

Icmp Error Inspection516................................................................................................................................................................

Mgcp Inspection Overview518................................................................................................................................................................

Configuring An Mgcp Inspection Policy Map For Additional Inspection Control520................................................................................................................................................................

Configuring Mgcp Timeout Values521................................................................................................................................................................

Verifying And Monitoring Mgcp Inspection521................................................................................................................................................................

Netbios Inspection522................................................................................................................................................................

Configuring A Netbios Inspection Policy Map For Additional Inspection Control522................................................................................................................................................................

Pptp Inspection524................................................................................................................................................................

Radius Accounting Inspection524................................................................................................................................................................

Configuring A Radius Inspection Policy Map For Additional Inspection Control525................................................................................................................................................................

Rsh Inspection525................................................................................................................................................................

Using Realplayer526................................................................................................................................................................

Configuring An Rtsp Inspection Policy Map For Additional Inspection Control527................................................................................................................................................................

Configuring A Sip Inspection Policy Map For Additional Inspection Control531................................................................................................................................................................

Configuring Sip Timeout Values534................................................................................................................................................................

Verifying And Monitoring Sip Inspection535................................................................................................................................................................

Skinny (sccp) Inspection535................................................................................................................................................................

Sccp Inspection Overview536................................................................................................................................................................

Supporting Cisco Ip Phones536................................................................................................................................................................

Verifying And Monitoring Sccp Inspection537................................................................................................................................................................

Configuring A Skinny (sccp) Inspection Policy Map For Additional Inspection Control537................................................................................................................................................................

Smtp And Extended Smtp Inspection539................................................................................................................................................................

Snmp Inspection540................................................................................................................................................................

Sql*net Inspection541................................................................................................................................................................

Sun Rpc Inspection Overview542................................................................................................................................................................

Managing Sun Rpc Services542................................................................................................................................................................

Verifying And Monitoring Sun Rpc Inspection543................................................................................................................................................................

Tftp Inspection544................................................................................................................................................................

Tls Proxy For Encrypted Voice Inspection544................................................................................................................................................................

Maximum Tls Proxy Sessions545................................................................................................................................................................

Configuring Tls Proxy546................................................................................................................................................................

Debugging Tls Proxy549................................................................................................................................................................

Ctl Client552................................................................................................................................................................

Xdmcp Inspection554................................................................................................................................................................

Configuring Arp Inspection555................................................................................................................................................................

Arp Inspection Overview555................................................................................................................................................................

Adding A Static Arp Entry556................................................................................................................................................................

Enabling Arp Inspection556................................................................................................................................................................

Customizing The Mac Address Table557................................................................................................................................................................

Mac Address Table Overview557................................................................................................................................................................

Setting The Mac Address Timeout558................................................................................................................................................................

Disabling Mac Address Learning558................................................................................................................................................................

Configuring Vpn561................................................................................................................................................................

Ipsec Overview564................................................................................................................................................................

Configuring Isakmp564................................................................................................................................................................

Configuring Isakmp Policies567................................................................................................................................................................

Enabling Isakmp On The Outside Interface568................................................................................................................................................................

Disabling Isakmp In Aggressive Mode568................................................................................................................................................................

Enabling Ipsec Over Tcp570................................................................................................................................................................

Waiting For Active Sessions To Terminate Before Rebooting571................................................................................................................................................................

Alerting Peers Before Disconnecting571................................................................................................................................................................

Creating A Certificate Group Matching Rule And Policy572................................................................................................................................................................

Using The Tunnel-group-map Default-group Command573................................................................................................................................................................

Understanding Ipsec Tunnels573................................................................................................................................................................

Understanding Transform Sets574................................................................................................................................................................

Defining Crypto Maps574................................................................................................................................................................

Changing Ipsec Sa Lifetimes584................................................................................................................................................................

Creating A Basic Ipsec Configuration584................................................................................................................................................................

Using Dynamic Crypto Maps586................................................................................................................................................................

Providing Site-to-site Redundancy588................................................................................................................................................................

Viewing An Ipsec Configuration588................................................................................................................................................................

Clearing Security Associations589................................................................................................................................................................

Clearing Crypto Map Configurations589................................................................................................................................................................

Supporting The Nokia Vpn Client590................................................................................................................................................................

Configuring L2tp Over Ipsec593................................................................................................................................................................

L2tp Overview593................................................................................................................................................................

Ipsec Transport And Tunnel Modes594................................................................................................................................................................

Configuring L2tp Over Ipsec Connections595................................................................................................................................................................

Tunnel Group Switching597................................................................................................................................................................

Viewing L2tp Over Ipsec Connection Information597................................................................................................................................................................

Using L2tp Debug Commands599................................................................................................................................................................

Enabling Ipsec Debug600................................................................................................................................................................

Getting Additional Information600................................................................................................................................................................

Setting General Ipsec Vpn Parameters603................................................................................................................................................................

Configuring Vpns In Single, Routed Mode603................................................................................................................................................................

Permitting Intra-interface Traffic604................................................................................................................................................................

Nat Considerations For Intra-interface Traffic605................................................................................................................................................................

Setting Maximum Active Ipsec Vpn Sessions605................................................................................................................................................................

Understanding Load Balancing607................................................................................................................................................................

Implementing Load Balancing608................................................................................................................................................................

Some Typical Mixed Cluster Scenarios610................................................................................................................................................................

Scenario 1: Mixed Cluster With No Webvpn Connections610................................................................................................................................................................

Configuring Load Balancing611................................................................................................................................................................

Configuring The Public And Private Interfaces For Load Balancing611................................................................................................................................................................

Configuring The Load Balancing Cluster Attributes612................................................................................................................................................................

Enabling Redirection Using A Fully-qualified Domain Name613................................................................................................................................................................

Configuring Vpn Session Limits614................................................................................................................................................................

Configuring Connection Profiles, Group Policies, And Users617................................................................................................................................................................

Overview Of Connection Profiles, Group Policies, And Users617................................................................................................................................................................

Connection Profiles618................................................................................................................................................................

General Connection Profile Connection Parameters619................................................................................................................................................................

Ipsec Tunnel-group Connection Parameters620................................................................................................................................................................

Connection Profile Connection Parameters For Clientless Ssl Vpn Sessions621................................................................................................................................................................

Configuring Connection Profiles622................................................................................................................................................................

Default Ipsec Remote Access Connection Profile Configuration622................................................................................................................................................................

Configuring Ipsec Tunnel-group General Attributes623................................................................................................................................................................

Configuring Ipsec Remote-access Connection Profiles623................................................................................................................................................................

Configuring Ipsec Remote-access Connection Profile General Attributes624................................................................................................................................................................

Enabling Ipv6 Vpn Access627................................................................................................................................................................

Configuring Ipsec Remote-access Connection Profile Ipsec Attributes628................................................................................................................................................................

Configuring Ipsec Remote-access Connection Profile Ppp Attributes630................................................................................................................................................................

Configuring Lan-to-lan Connection Profiles631................................................................................................................................................................

Default Lan-to-lan Connection Profile Configuration632................................................................................................................................................................

Specifying A Name And Type For A Lan-to-lan Connection Profile632................................................................................................................................................................

Configuring Lan-to-lan Ipsec Attributes633................................................................................................................................................................

Configuring Connection Profiles For Clientless Ssl Vpn Sessions635................................................................................................................................................................

Specifying A Connection Profile Name And Type For Clientless Ssl Vpn Sessions635................................................................................................................................................................

Configuring Tunnel-group Attributes For Clientless Ssl Vpn Sessions638................................................................................................................................................................

Customizing Login Windows For Users Of Clientless Ssl Vpn Sessions642................................................................................................................................................................

Configuring Microsoft Active Directory Settings For Password Management643................................................................................................................................................................

Using Active Directory To Force The User To Change Password At Next Logon644................................................................................................................................................................

Using Active Directory To Specify Maximum Password Age645................................................................................................................................................................

Using Active Directory To Override An Account Disabled Aaa Indicator646................................................................................................................................................................

Using Active Directory To Enforce Minimum Password Length647................................................................................................................................................................

Using Active Directory To Enforce Password Complexity648................................................................................................................................................................

Group Policies649................................................................................................................................................................

Default Group Policy650................................................................................................................................................................

Configuring Group Policies652................................................................................................................................................................

Configuring An External Group Policy652................................................................................................................................................................

Configuring An Internal Group Policy653................................................................................................................................................................

Configuring Group Policy Attributes653................................................................................................................................................................

Configuring Vpn-specific Attributes654................................................................................................................................................................

Configuring Security Attributes657................................................................................................................................................................

Configuring The Banner Message659................................................................................................................................................................

Configuring Ipsec-udp Attributes660................................................................................................................................................................

Configuring Split-tunneling Attributes660................................................................................................................................................................

Configuring Domain Attributes For Tunneling662................................................................................................................................................................

Configuring Attributes For Vpn Hardware Clients663................................................................................................................................................................

Configuring Backup Server Attributes667................................................................................................................................................................

Configuring Microsoft Internet Explorer Client Parameters668................................................................................................................................................................

Configuring Network Admission Control Parameters670................................................................................................................................................................

Configuring Address Pools673................................................................................................................................................................

Configuring Firewall Policies674................................................................................................................................................................

Configuring Client Access Rules677................................................................................................................................................................

Configuring Group-policy Attributes For Clientless Ssl Vpn Sessions678................................................................................................................................................................

Setting A User Password And Privilege Level690................................................................................................................................................................

Configuring Vpn User Attributes691................................................................................................................................................................

Configuring Clientless Ssl Vpn Access For Specific Users695................................................................................................................................................................

Configuring Ip Addresses For Vpns707................................................................................................................................................................

Configuring An Ip Address Assignment Method707................................................................................................................................................................

Configuring Dhcp Addressing709................................................................................................................................................................

Configuring Remote Access Ipsec Vpns711................................................................................................................................................................

Configuring Isakmp Policy And Enabling Isakmp On The Outside Interface713................................................................................................................................................................

Adding A User714................................................................................................................................................................

Configuring An Address Pool714................................................................................................................................................................

Creating A Dynamic Crypto Map716................................................................................................................................................................

Creating A Crypto Map Entry To Use The Dynamic Crypto Map717................................................................................................................................................................

Configuring Network Admission Control719................................................................................................................................................................

Adding, Accessing, Or Removing A Nac Policy722................................................................................................................................................................

Configuring A Nac Policy723................................................................................................................................................................

Specifying The Access Control Server Group723................................................................................................................................................................

Setting The Revalidation Timer724................................................................................................................................................................

Configuring The Default Acl For Nac724................................................................................................................................................................

Configuring Exemptions From Nac725................................................................................................................................................................

Assigning A Nac Policy To A Group Policy726................................................................................................................................................................

Changing Global Nac Framework Settings726................................................................................................................................................................

Enabling And Disabling Clientless Authentication727................................................................................................................................................................

Changing The Login Credentials Used For Clientless Authentication727................................................................................................................................................................

Changing Nac Framework Session Attributes728................................................................................................................................................................

Configuring Easy Vpn Services On The Asa731................................................................................................................................................................

Specifying The Primary And Secondary Servers733................................................................................................................................................................

Specifying The Mode733................................................................................................................................................................

Configuring Automatic Xauth Authentication734................................................................................................................................................................

Configuring Ipsec Over Tcp734................................................................................................................................................................

Comparing Tunneling Options735................................................................................................................................................................

Specifying The Tunnel Group Or Trustpoint736................................................................................................................................................................

Specifying The Tunnel Group736................................................................................................................................................................

Specifying The Trustpoint737................................................................................................................................................................

Configuring Split Tunneling738................................................................................................................................................................

Configuring Device Pass-through738................................................................................................................................................................

Configuring Remote Management739................................................................................................................................................................

Guidelines For Configuring The Easy Vpn Server739................................................................................................................................................................

Group Policy And User Attributes Pushed To The Client740................................................................................................................................................................

Authentication Options742................................................................................................................................................................

Configuring The Pppoe Client743................................................................................................................................................................

Pppoe Client Overview743................................................................................................................................................................

Configuring The Pppoe Client Username And Password744................................................................................................................................................................

Enabling Pppoe745................................................................................................................................................................

Using Pppoe With A Fixed Ip Address745................................................................................................................................................................

Monitoring And Debugging The Pppoe Client746................................................................................................................................................................

Clearing The Configuration747................................................................................................................................................................

Using Related Commands747................................................................................................................................................................

Configuring Lan-to-lan Ipsec Vpns749................................................................................................................................................................

Configuring An Acl752................................................................................................................................................................

Creating A Crypto Map And Applying It To An Interface754................................................................................................................................................................

Observing Clientless Ssl Vpn Security Precautions758................................................................................................................................................................

Understanding Features Not Supported In Clientless Ssl Vpn759................................................................................................................................................................

Using Ssl To Access The Central Site759................................................................................................................................................................

Configuring Clientless Ssl Vpn And Asdm Ports760................................................................................................................................................................

Configuring Support For Proxy Servers760................................................................................................................................................................

Configuring Ssl/tls Encryption Protocols761................................................................................................................................................................

Using Single Sign-on With Clientless Ssl Vpn764................................................................................................................................................................

Configuring Sso With Http Basic Or Ntlm Authentication764................................................................................................................................................................

Configuring Sso Authentication Using Siteminder765................................................................................................................................................................

Configuring Sso Authentication Using Saml Browser Post Profile768................................................................................................................................................................

Configuring Sso With The Http Form Protocol770................................................................................................................................................................

Creating And Applying Clientless Ssl Vpn Resources777................................................................................................................................................................

Using The Security Appliance Authentication Server777................................................................................................................................................................

Configuring Browser Access To Client-server Plug-ins779................................................................................................................................................................

About Installing Browser Plug-ins780................................................................................................................................................................

Preparing The Security Appliance For A Plug-in781................................................................................................................................................................

Providing Access To Plug-ins Redistributed By Cisco781................................................................................................................................................................

Preparing The Citrix Metraframe Server For Clientless Ssl Vpn Access784................................................................................................................................................................

Creating And Installing The Citrix Plug-in784................................................................................................................................................................

Providing A Bookmark And Optional Sso Support For Citrix Sessions785................................................................................................................................................................

Viewing The Plug-ins Installed On The Security Appliance786................................................................................................................................................................

Configuring Application Access786................................................................................................................................................................

Why Port Forwarding787................................................................................................................................................................

Port Forwarding Restrictions787................................................................................................................................................................

Adding Applications To Be Eligible For Port Forwarding788................................................................................................................................................................

Assigning A Port Forwarding List789................................................................................................................................................................

Automating Port Forwarding789................................................................................................................................................................

Enabling And Disabling Port Forwarding790................................................................................................................................................................

Configuring Smart Tunnel Access790................................................................................................................................................................

About Smart Tunnels791................................................................................................................................................................

Why Smart Tunnels791................................................................................................................................................................

Adding Applications To Be Eligible For Smart Tunnel Access792................................................................................................................................................................

Assigning A Smart Tunnel List794................................................................................................................................................................

Automating Smart Tunnel Access794................................................................................................................................................................

Enabling And Disabling Smart Tunnel Access795................................................................................................................................................................

Application Access User Notes795................................................................................................................................................................

Recovering From Hosts File Errors When Using Application Access796................................................................................................................................................................

Configuring File Access799................................................................................................................................................................

Adding Support For File Access799................................................................................................................................................................

Using Clientless Ssl Vpn With Pdas801................................................................................................................................................................

Using E-mail Over Clientless Ssl Vpn801................................................................................................................................................................

Configuring E-mail Proxies802................................................................................................................................................................

E-mail Proxy Certificate Authentication802................................................................................................................................................................

Configuring Web E-mail: Ms Outlook Web Access803................................................................................................................................................................

Optimizing Clientless Ssl Vpn Performance803................................................................................................................................................................

Configuring Content Transformation804................................................................................................................................................................

Configuring A Certificate For Signing Rewritten Java Content804................................................................................................................................................................

Using Proxy Bypass805................................................................................................................................................................

Configuring Application Profile Customization Framework805................................................................................................................................................................

Apcf Syntax806................................................................................................................................................................

Apcf Example807................................................................................................................................................................

Clientless Ssl Vpn End User Setup808................................................................................................................................................................

Defining The End User Interface809................................................................................................................................................................

Viewing The Clientless Ssl Vpn Home Page810................................................................................................................................................................

Viewing The Clientless Ssl Vpn Application Access Panel811................................................................................................................................................................

Viewing The Floating Toolbar812................................................................................................................................................................

Customizing Clientless Ssl Vpn Pages812................................................................................................................................................................

How Customization Works813................................................................................................................................................................

Exporting A Customization Template813................................................................................................................................................................

Editing The Customization Template814................................................................................................................................................................

Importing A Customization Object819................................................................................................................................................................

Applying Customizations To Connection Profiles, Group Policies And Users820................................................................................................................................................................

Customizing Help821................................................................................................................................................................

Customizing A Help File Provided By Cisco822................................................................................................................................................................

Creating Help Files For Languages Not Provided By Cisco822................................................................................................................................................................

Importing A Help File To Flash Memory823................................................................................................................................................................

Exporting A Previously Imported Help File From Flash Memory823................................................................................................................................................................

Communicating Security Tips824................................................................................................................................................................

Configuring Remote Systems To Use Clientless Ssl Vpn Features824................................................................................................................................................................

Translating The Language Of User Messages829................................................................................................................................................................

Referencing The Language In A Customization Object832................................................................................................................................................................

Changing A Group Policy Or User Attributes To Use The Customization Object834................................................................................................................................................................

Capturing Data834................................................................................................................................................................

Using A Browser To Display Capture Data835................................................................................................................................................................

Configuring Anyconnect Vpn Client Connections837................................................................................................................................................................

Remote Pc System Requirements838................................................................................................................................................................

Installing The Anyconnect Ssl Vpn Client838................................................................................................................................................................

Installing The Anyconnect Client838................................................................................................................................................................

Enabling Anyconnect Client Connections839................................................................................................................................................................

Enabling Permanent Client Installation841................................................................................................................................................................

Configuring Dtls841................................................................................................................................................................

Ensuring Reliable Dtls Connections Through Third-party Firewalls842................................................................................................................................................................

Prompting Remote Users842................................................................................................................................................................

Enabling Anyconnect Client Profile Downloads843................................................................................................................................................................

Enabling Additional Anyconnect Client Features845................................................................................................................................................................

Enabling Start Before Logon846................................................................................................................................................................

Translating Languages For Anyconnect User Messages846................................................................................................................................................................

Configuring Advanced Ssl Vpn Features849................................................................................................................................................................

Enabling Rekey849................................................................................................................................................................

Enabling Keepalive850................................................................................................................................................................

Using Compression851................................................................................................................................................................

Adjusting Mtu Size851................................................................................................................................................................

Viewing Ssl Vpn Sessions852................................................................................................................................................................

Logging Off Svc Sessions852................................................................................................................................................................

Updating Ssl Vpn Client Images853................................................................................................................................................................

Configuring Certificates855................................................................................................................................................................

About Public Key Cryptography855................................................................................................................................................................

Certificate Scalability856................................................................................................................................................................

About Key Pairs856................................................................................................................................................................

About Trustpoints857................................................................................................................................................................

About Revocation Checking857................................................................................................................................................................

About Ocsp858................................................................................................................................................................

Supported Ca Servers859................................................................................................................................................................

Certificate Configuration859................................................................................................................................................................

Configuring Key Pairs860................................................................................................................................................................

Generating Key Pairs860................................................................................................................................................................

Removing Key Pairs861................................................................................................................................................................

Configuring Trustpoints861................................................................................................................................................................

Obtaining Certificates863................................................................................................................................................................

Obtaining Certificates With Scep863................................................................................................................................................................

Obtaining Certificates Manually865................................................................................................................................................................

Configuring Crls For A Trustpoint867................................................................................................................................................................

Exporting And Importing Trustpoints868................................................................................................................................................................

Exporting A Trustpoint Configuration869................................................................................................................................................................

Importing A Trustpoint Configuration869................................................................................................................................................................

The Local Ca870................................................................................................................................................................

Configuring The Local Ca Server871................................................................................................................................................................

The Default Local Ca Server871................................................................................................................................................................

Customizing The Local Ca Server873................................................................................................................................................................

Certificate Characteristics874................................................................................................................................................................

Defining Storage For Local Ca Files876................................................................................................................................................................

Default Flash Memory Data Storage876................................................................................................................................................................

Setting Up External Local Ca File Storage877................................................................................................................................................................

Crl Storage877................................................................................................................................................................

Crl Downloading878................................................................................................................................................................

Enrolling Local Ca Users878................................................................................................................................................................

Setting Up Enrollment Parameters879................................................................................................................................................................

Enrollment Requirements880................................................................................................................................................................

Starting And Stopping The Local Ca Server881................................................................................................................................................................

Enabling The Local Ca Server881................................................................................................................................................................

Debugging The Local Ca Server882................................................................................................................................................................

Disabling The Local Ca Server882................................................................................................................................................................

Adding And Enrolling Users883................................................................................................................................................................

Renewing Users884................................................................................................................................................................

Revoking Certificates And Removing Or Restoring Users884................................................................................................................................................................

Revocation Checking885................................................................................................................................................................

Displaying Local Ca Server Information885................................................................................................................................................................

Display The Local Ca Certificate886................................................................................................................................................................

Display The Crl886................................................................................................................................................................

Display The User Database887................................................................................................................................................................

Local Ca Server Maintenance And Backup Procedures888................................................................................................................................................................

Maintaining The Local Ca User Database888................................................................................................................................................................

Local Ca Certificate Rollover889................................................................................................................................................................

Archiving The Local Ca Server Certificate And Keypair889................................................................................................................................................................

Managing System Access893................................................................................................................................................................

Allowing Telnet Access893................................................................................................................................................................

Allowing Ssh Access894................................................................................................................................................................

Configuring Ssh Access894................................................................................................................................................................

Using An Ssh Client895................................................................................................................................................................

Allowing Https Access For Asdm895................................................................................................................................................................

Enabling Https Access896................................................................................................................................................................

Accessing Asdm From Your Pc896................................................................................................................................................................

Configuring Aaa For System Administrators897................................................................................................................................................................

Configuring Authentication For Cli And Asdm Access897................................................................................................................................................................

Configuring Authentication To Access Privileged Exec Mode (the Enable Command)898................................................................................................................................................................

Configuring Authentication For The Enable Command898................................................................................................................................................................

Authenticating Users Using The Login Command899................................................................................................................................................................

Limiting User Cli And Asdm Access With Management Authorization899................................................................................................................................................................

Configuring Command Authorization900................................................................................................................................................................

Command Authorization Overview901................................................................................................................................................................

Configuring Local Command Authorization902................................................................................................................................................................

Configuring Tacacs+ Command Authorization905................................................................................................................................................................

Configuring Command Accounting909................................................................................................................................................................

Viewing The Current Logged-in User909................................................................................................................................................................

Recovering From A Lockout910................................................................................................................................................................

Configuring A Login Banner911................................................................................................................................................................

Managing Software, Licenses, And Configurations913................................................................................................................................................................

Obtaining An Activation Key913................................................................................................................................................................

Entering A New Activation Key914................................................................................................................................................................

Downloading Software Or Configuration Files To Flash Memory915................................................................................................................................................................

Downloading A File To A Specific Location915................................................................................................................................................................

Downloading A File To The Startup Or Running Configuration916................................................................................................................................................................

Configuring The Application Image And Asdm Image To Boot917................................................................................................................................................................

Configuring The File To Boot As The Startup Configuration918................................................................................................................................................................

Performing Zero Downtime Upgrades For Failover Pairs918................................................................................................................................................................

Upgrading An Active/standby Failover Configuration919................................................................................................................................................................

Upgrading And Active/active Failover Configuration919................................................................................................................................................................

Backing Up Configuration Files920................................................................................................................................................................

Backing Up The Single Mode Configuration Or Multiple Mode System Configuration920................................................................................................................................................................

Backing Up A Context Configuration In Flash Memory921................................................................................................................................................................

Backing Up A Context Configuration Within A Context921................................................................................................................................................................

Using A Script To Back Up And Restore Files922................................................................................................................................................................

Running The Script923................................................................................................................................................................

Sample Script923................................................................................................................................................................

Configuring Auto Update Support931................................................................................................................................................................

Configuring Communication With An Auto Update Server932................................................................................................................................................................

Configuring Client Updates As An Auto Update Server934................................................................................................................................................................

Viewing Auto Update Status935................................................................................................................................................................

Monitoring The Security Appliance937................................................................................................................................................................

Using Snmp937................................................................................................................................................................

Enabling Snmp939................................................................................................................................................................

Configuring And Managing Logs941................................................................................................................................................................

Logging Overview941................................................................................................................................................................

Enabling And Disabling Logging942................................................................................................................................................................

Enabling Logging To All Configured Output Destinations942................................................................................................................................................................

Configuring Log Output Destinations943................................................................................................................................................................

Sending System Log Messages To A Syslog Server943................................................................................................................................................................

Sending System Log Messages To The Console Port944................................................................................................................................................................

Sending System Log Messages To An E-mail Address945................................................................................................................................................................

Sending System Log Messages To Asdm946................................................................................................................................................................

Sending System Log Messages To A Telnet Or Ssh Session948................................................................................................................................................................

Sending System Log Messages To The Log Buffer949................................................................................................................................................................

Filtering System Log Messages951................................................................................................................................................................

Message Filtering Overview951................................................................................................................................................................

Filtering System Log Messages By Class952................................................................................................................................................................

Filtering System Log Messages With Custom Message Lists954................................................................................................................................................................

Customizing The Log Configuration955................................................................................................................................................................

Configuring The Logging Queue955................................................................................................................................................................

Including The Date And Time In System Log Messages956................................................................................................................................................................

Including The Device Id In System Log Messages956................................................................................................................................................................

Generating System Log Messages In Emblem Format957................................................................................................................................................................

Disabling A System Log Message957................................................................................................................................................................

Changing The Severity Level Of A System Log Message958................................................................................................................................................................

Changing The Amount Of Internal Flash Memory Available For Logs959................................................................................................................................................................

Understanding System Log Messages960................................................................................................................................................................

System Log Message Format960................................................................................................................................................................

Testing Your Configuration961................................................................................................................................................................

Troubleshooting The Security Appliance961................................................................................................................................................................

Enabling Icmp Debug Messages And System Log Messages961................................................................................................................................................................

Pinging Security Appliance Interfaces962................................................................................................................................................................

Pinging Through The Security Appliance964................................................................................................................................................................

Disabling The Test Configuration965................................................................................................................................................................

Packet Tracer966................................................................................................................................................................

Reloading The Security Appliance966................................................................................................................................................................

Recovering Passwords For The Asa 5500 Series Adaptive Security Appliance967................................................................................................................................................................

Recovering Passwords For The Pix 500 Series Security Appliance968................................................................................................................................................................

Disabling Password Recovery969................................................................................................................................................................

Resetting The Password On The Ssm Hardware Module970................................................................................................................................................................

Using The Rom Monitor To Load A Software Image970................................................................................................................................................................

Erasing The Flash File System972................................................................................................................................................................

Other Troubleshooting Tools972................................................................................................................................................................

Common Problems973................................................................................................................................................................

Viewing The Crash Dump973................................................................................................................................................................

Cisco Vpn Client Support987................................................................................................................................................................

Cisco Secure Desktop Support987................................................................................................................................................................

Cryptographic Standards988................................................................................................................................................................

Example 1: System Configuration990................................................................................................................................................................

Example 1: Admin Context Configuration992................................................................................................................................................................

Example 1: Customer A Context Configuration992................................................................................................................................................................

Example 1: Customer C Context Configuration993................................................................................................................................................................

Example 2: Single Mode Firewall Using Same Security Level994................................................................................................................................................................

Example 3: Department 1 Context Configuration998................................................................................................................................................................

Example 3: Department 2 Context Configuration999................................................................................................................................................................

Example 4: Multiple Mode, Transparent Firewall With Outside Access1000................................................................................................................................................................

Example 4: System Configuration1001................................................................................................................................................................

Example 4: Admin Context Configuration1002................................................................................................................................................................

Example 4: Customer A Context Configuration1003................................................................................................................................................................

Example 4: Customer B Context Configuration1003................................................................................................................................................................

Example 4: Customer C Context Configuration1004................................................................................................................................................................

Example 5: Clientless Ssl Vpn Configuration1004................................................................................................................................................................

Example 6: Ipv6 Configuration1006................................................................................................................................................................

Example 7: Cable-based Active/standby Failover (routed Mode)1008................................................................................................................................................................

Example 8: Lan-based Active/standby Failover (routed Mode)1009................................................................................................................................................................

Example 8: Primary Unit Configuration1009................................................................................................................................................................

Example 8: Secondary Unit Configuration1010................................................................................................................................................................

Example 9: Lan-based Active/active Failover (routed Mode)1010................................................................................................................................................................

Example 9: Primary Unit Configuration1011................................................................................................................................................................

Example 9: Primary System Configuration1011................................................................................................................................................................

Example 9: Primary Admin Context Configuration1012................................................................................................................................................................

Example 9: Primary Ctx1 Context Configuration1013................................................................................................................................................................

Example 9: Secondary Unit Configuration1013................................................................................................................................................................

Example 11: Primary Unit Configuration1016................................................................................................................................................................

Example 11: Secondary Unit Configuration1017................................................................................................................................................................

Example 12: Primary Unit Configuration1018................................................................................................................................................................

Example 12: Primary System Configuration1019................................................................................................................................................................

Example 12: Primary Admin Context Configuration1019................................................................................................................................................................

Example 12: Primary Ctx1 Context Configuration1020................................................................................................................................................................

Example 12: Secondary Unit Configuration1020................................................................................................................................................................

Example 13: Dual Isp Support Using Static Route Tracking1021................................................................................................................................................................

Example 14: Asa 5505 Base License1022................................................................................................................................................................

Example 15: Primary Unit Configuration1024................................................................................................................................................................

Example 15: Secondary Unit Configuration1026................................................................................................................................................................

Using The Command-line Interface1027................................................................................................................................................................

Firewall Mode And Security Context Mode1027................................................................................................................................................................

Command Modes And Prompts1028................................................................................................................................................................

Command Completion1030................................................................................................................................................................

Command Help1030................................................................................................................................................................

Automatic Text Entries1033................................................................................................................................................................

Line Order1033................................................................................................................................................................

Ipv6 Address Types1040................................................................................................................................................................

Unicast Addresses1040................................................................................................................................................................

Multicast Address1042................................................................................................................................................................

Anycast Address1043................................................................................................................................................................

Required Addresses1044................................................................................................................................................................

Ipv6 Address Prefixes1044................................................................................................................................................................

Protocols And Applications1045................................................................................................................................................................

Tcp And Udp Ports1045................................................................................................................................................................

Local Ports And Protocols1048................................................................................................................................................................

Icmp Types1049................................................................................................................................................................

Understanding Policy Enforcement Of Permissions And Attributes1052................................................................................................................................................................

Reviewing The Ldap Directory Structure And Configuration Procedure1053................................................................................................................................................................

Organizing The Security Appliance Ldap Schema1053................................................................................................................................................................

Searching The Hierarchy1054................................................................................................................................................................

Binding The Security Appliance To The Ldap Server1055................................................................................................................................................................

Defining The Security Appliance Ldap Schema1055................................................................................................................................................................

Cisco-av-pair Attribute Syntax1063................................................................................................................................................................

Example Security Appliance Authorization Schema1065................................................................................................................................................................

Loading The Schema In The Ldap Server1067................................................................................................................................................................

Defining User Permissions1067................................................................................................................................................................

Example User File1068................................................................................................................................................................

Reviewing Examples Of Active Directory Configurations1068................................................................................................................................................................

Example 2: Configuring Ldap Authentication With Microsoft Active Directory1070................................................................................................................................................................

Example 3: Ldap Authentication And Ldap Authorization With Microsoft Active Directory1072................................................................................................................................................................

Security Appliance Tacacs+ Attributes1090................................................................................................................................................................

L O S S A R Y1093................................................................................................................................................................

Cisco 500 Series Configuration Manual (989 pages)

Security Appliance Command Line

Brand: Cisco | Category: Firewall | Size: 11.23 MB

Table Of Contents4................................................................................................................................................................

About This Guide33................................................................................................................................................................

Related Documentation34................................................................................................................................................................

Document Conventions37................................................................................................................................................................

Documentation Feedback38................................................................................................................................................................

Intrusion Prevention Services Functional Overview49................................................................................................................................................................

Security Context Overview50................................................................................................................................................................

Chapter 2 Getting Started51................................................................................................................................................................

Getting Started With Your Platform Model51................................................................................................................................................................

Factory Default Configurations51................................................................................................................................................................

Restoring The Factory Default Configuration52................................................................................................................................................................

Asa 5505 Default Configuration52................................................................................................................................................................

Asa 5510 And Higher Default Configuration53................................................................................................................................................................

Pix 515/515e Default Configuration54................................................................................................................................................................

Accessing The Command-line Interface54................................................................................................................................................................

Setting Transparent Or Routed Firewall Mode55................................................................................................................................................................

Working With The Configuration56................................................................................................................................................................

Saving Configuration Changes56................................................................................................................................................................

Saving Configuration Changes In Single Context Mode57................................................................................................................................................................

Saving Configuration Changes In Multiple Context Mode57................................................................................................................................................................

Copying The Startup Configuration To The Running Configuration58................................................................................................................................................................

Viewing The Configuration58................................................................................................................................................................

Clearing And Removing Configuration Settings59................................................................................................................................................................

Creating Text Configuration Files Offline59................................................................................................................................................................

Chapter 3 Enabling Multiple Context Mode62................................................................................................................................................................

Unsupported Features62................................................................................................................................................................

Context Configuration Files62................................................................................................................................................................

Context Configurations62................................................................................................................................................................

System Configuration62................................................................................................................................................................

Admin Context Configuration62................................................................................................................................................................

How The Security Appliance Classifies Packets63................................................................................................................................................................

Valid Classifier Criteria63................................................................................................................................................................

Invalid Classifier Criteria64................................................................................................................................................................

Classification Examples65................................................................................................................................................................

Cascading Security Contexts68................................................................................................................................................................

Management Access To Security Contexts69................................................................................................................................................................

System Administrator Access69................................................................................................................................................................

Context Administrator Access70................................................................................................................................................................

Enabling Or Disabling Multiple Context Mode70................................................................................................................................................................

Backing Up The Single Mode Configuration70................................................................................................................................................................

Enabling Multiple Context Mode70................................................................................................................................................................

Restoring Single Context Mode71................................................................................................................................................................

Configuring Switch Ports And Vlan Interfaces For The Cisco Asa 5505 Adaptive Security Appliance73................................................................................................................................................................

Interface Overview73................................................................................................................................................................

Understanding Asa 5505 Ports And Interfaces74................................................................................................................................................................

Maximum Active Vlan Interfaces For Your License74................................................................................................................................................................

Default Interface Configuration75................................................................................................................................................................

Vlan Mac Addresses76................................................................................................................................................................

Power Over Ethernet76................................................................................................................................................................

Monitoring Traffic Using Span76................................................................................................................................................................

Security Level Overview77................................................................................................................................................................

Configuring Vlan Interfaces77................................................................................................................................................................

Configuring Switch Ports As Access Ports81................................................................................................................................................................

Configuring A Switch Port As A Trunk Port83................................................................................................................................................................

Allowing Communication Between Vlan Interfaces On The Same Security Level85................................................................................................................................................................

Chapter 5 Configuring Ethernet Settings And Subinterfaces87................................................................................................................................................................

Configuring And Enabling Rj-45 Interfaces87................................................................................................................................................................

Configuring And Enabling Fiber Interfaces88................................................................................................................................................................

Configuring And Enabling Subinterfaces89................................................................................................................................................................

Chapter 6 Adding And Managing Security Contexts92................................................................................................................................................................

Configuring Resource Management92................................................................................................................................................................

Resource Limits92................................................................................................................................................................

Default Class93................................................................................................................................................................

Class Members94................................................................................................................................................................

Configuring A Class94................................................................................................................................................................

Configuring A Security Context97................................................................................................................................................................

Automatically Assigning Mac Addresses To Context Interfaces101................................................................................................................................................................

Changing Between Contexts And The System Execution Space101................................................................................................................................................................

Managing Security Contexts102................................................................................................................................................................

Removing A Security Context102................................................................................................................................................................

Changing The Admin Context103................................................................................................................................................................

Changing The Security Context Url103................................................................................................................................................................

Reloading A Security Context104................................................................................................................................................................

Reloading By Clearing The Configuration104................................................................................................................................................................

Reloading By Removing And Re-adding The Context105................................................................................................................................................................

Viewing Context Information105................................................................................................................................................................

Viewing Resource Allocation106................................................................................................................................................................

Viewing Resource Usage109................................................................................................................................................................

Monitoring Syn Attacks In Contexts110................................................................................................................................................................

Chapter 7 Configuring Interface Parameters113................................................................................................................................................................

Configuring The Interface114................................................................................................................................................................

Allowing Communication Between Interfaces On The Same Security Level118................................................................................................................................................................

Changing The Login Password119................................................................................................................................................................

Changing The Enable Password119................................................................................................................................................................

Setting The Hostname120................................................................................................................................................................

Setting The Domain Name120................................................................................................................................................................

Setting The Date And Time120................................................................................................................................................................

Chapter 8 Configuring Basic Setting120................................................................................................................................................................

Setting The Time Zone And Daylight Saving Time Date Range121................................................................................................................................................................

Setting The Date And Time Using An Ntp Server122................................................................................................................................................................

Setting The Date And Time Manually122................................................................................................................................................................

Setting The Management Ip Address For A Transparent Firewall123................................................................................................................................................................

Chapter 9 Configuring Ip Routing125................................................................................................................................................................

Configuring Static And Default Routes125................................................................................................................................................................

Configuring A Static Route126................................................................................................................................................................

Configuring A Default Route127................................................................................................................................................................

Configuring Static Route Tracking127................................................................................................................................................................

Defining Route Maps130................................................................................................................................................................

Configuring Ospf131................................................................................................................................................................

Ospf Overview132................................................................................................................................................................

Enabling Ospf132................................................................................................................................................................

Redistributing Routes Into Ospf133................................................................................................................................................................

Configuring Ospf Interface Parameters134................................................................................................................................................................

Configuring Ospf Area Parameters136................................................................................................................................................................

Configuring Ospf Nssa137................................................................................................................................................................

Configuring Route Summarization Between Ospf Areas138................................................................................................................................................................

Configuring Route Summarization When Redistributing Routes Into Ospf138................................................................................................................................................................

Defining Static Ospf Neighbors139................................................................................................................................................................

Generating A Default Route140................................................................................................................................................................

Configuring Route Calculation Timers140................................................................................................................................................................

Logging Neighbors Going Up Or Down141................................................................................................................................................................

Displaying Ospf Update Packet Pacing141................................................................................................................................................................

Monitoring Ospf142................................................................................................................................................................

Restarting The Ospf Process142................................................................................................................................................................

Configuring Rip143................................................................................................................................................................

Enabling And Configuring Rip143................................................................................................................................................................

Redistributing Routes Into The Rip Routing Process144................................................................................................................................................................

Configuring Rip Send/receive Version On An Interface145................................................................................................................................................................

Enabling Rip Authentication145................................................................................................................................................................

Monitoring Rip146................................................................................................................................................................

The Routing Table146................................................................................................................................................................

Displaying The Routing Table146................................................................................................................................................................

How The Routing Table Is Populated147................................................................................................................................................................

Backup Routes148................................................................................................................................................................

How Forwarding Decisions Are Made148................................................................................................................................................................

Configuring A Dhcp Server151................................................................................................................................................................

Enabling The Dhcp Server152................................................................................................................................................................

C H A P T E R 10 Configuring Dhcp, Ddns, And Wccp Services152................................................................................................................................................................

Configuring Dhcp Options153................................................................................................................................................................

Using Cisco Ip Phones With A Dhcp Server154................................................................................................................................................................

Configuring Dhcp Relay Services155................................................................................................................................................................

Configuring Dynamic Dns156................................................................................................................................................................

Example 1: Client Updates Both A And Ptr Rrs For Static Ip Addresses156................................................................................................................................................................

Client And Updates Both Rrs158................................................................................................................................................................

Honors Client Request And Updates Both A And Ptr Rr158................................................................................................................................................................

Example 5: Client Updates A Rr; Server Updates Ptr Rr159................................................................................................................................................................

Configuring Web Cache Services Using Wccp159................................................................................................................................................................

Wccp Feature Support159................................................................................................................................................................

Wccp Interaction With Other Features160................................................................................................................................................................

Enabling Wccp Redirection160................................................................................................................................................................

Configuring Multicast Routing163................................................................................................................................................................

Multicast Routing Overview163................................................................................................................................................................

Enabling Multicast Routing164................................................................................................................................................................

C H A P T E R 11 Configuring Multicast Routing164................................................................................................................................................................

Disabling Igmp On An Interface165................................................................................................................................................................

Configuring Group Membership165................................................................................................................................................................

Configuring A Statically Joined Group165................................................................................................................................................................

Controlling Access To Multicast Groups165................................................................................................................................................................

Limiting The Number Of Igmp States On An Interface166................................................................................................................................................................

Modifying The Query Interval And Query Timeout166................................................................................................................................................................

Changing The Query Response Time167................................................................................................................................................................

Changing The Igmp Version167................................................................................................................................................................

Configuring Stub Multicast Routing167................................................................................................................................................................

Configuring A Static Multicast Route167................................................................................................................................................................

Disabling Pim On An Interface168................................................................................................................................................................

Configuring Pim Features168................................................................................................................................................................

Configuring A Static Rendezvous Point Address169................................................................................................................................................................

Configuring The Designated Router Priority169................................................................................................................................................................

Filtering Pim Register Messages169................................................................................................................................................................

Configuring Pim Message Intervals169................................................................................................................................................................

Configuring A Multicast Boundary170................................................................................................................................................................

Filtering Pim Neighbors170................................................................................................................................................................

Supporting Mixed Bidirctional/sparse-mode Pim Networks171................................................................................................................................................................

For More Information About Multicast Routing171................................................................................................................................................................

Chapter 12 Configuring Ipv6173................................................................................................................................................................

Ipv6-enabled Commands173................................................................................................................................................................

Configuring Ipv6 On An Interface175................................................................................................................................................................

Configuring A Dual Ip Stack On An Interface176................................................................................................................................................................

Enforcing The Use Of Modified Eui-64 Interface Ids In Ipv6 Addresses176................................................................................................................................................................

Configuring Ipv6 Duplicate Address Detection176................................................................................................................................................................

Configuring Ipv6 Default And Static Routes177................................................................................................................................................................

Configuring Ipv6 Access Lists178................................................................................................................................................................

Configuring Ipv6 Neighbor Discovery179................................................................................................................................................................

Configuring Neighbor Solicitation Messages179................................................................................................................................................................

Configuring Router Advertisement Messages181................................................................................................................................................................

Configuring A Static Ipv6 Neighbor183................................................................................................................................................................

Verifying The Ipv6 Configuration183................................................................................................................................................................

The Show Ipv6 Interface Command183................................................................................................................................................................

The Show Ipv6 Route Command184................................................................................................................................................................

Configuring Aaa Servers And The Local Database185................................................................................................................................................................

Aaa Overview185................................................................................................................................................................

About Authentication185................................................................................................................................................................

About Authorization186................................................................................................................................................................

About Accounting186................................................................................................................................................................

Aaa Server And Local Database Support186................................................................................................................................................................

C H A P T E R 13 Configuring Aaa Servers And The Local Database186................................................................................................................................................................

Summary Of Support187................................................................................................................................................................

Radius Server Support187................................................................................................................................................................

Authentication Methods188................................................................................................................................................................

Attribute Support188................................................................................................................................................................

Radius Authorization Functions188................................................................................................................................................................

Tacacs+ Server Support188................................................................................................................................................................

Sdi Server Support188................................................................................................................................................................

Sdi Version Support189................................................................................................................................................................

Two-step Authentication Process189................................................................................................................................................................

Sdi Primary And Replica Servers189................................................................................................................................................................

Nt Server Support189................................................................................................................................................................

Kerberos Server Support189................................................................................................................................................................

Ldap Server Support190................................................................................................................................................................

Authentication With Ldap190................................................................................................................................................................

Authorization With Ldap For Vpn191................................................................................................................................................................

Ldap Attribute Mapping192................................................................................................................................................................

Sso Support For Webvpn With Http Forms193................................................................................................................................................................

Local Database Support193................................................................................................................................................................

User Profiles194................................................................................................................................................................

Fallback Support194................................................................................................................................................................

Configuring The Local Database194................................................................................................................................................................

Identifying Aaa Server Groups And Servers196................................................................................................................................................................

Using Certificates And User Login Credentials199................................................................................................................................................................

Using User Login Credentials199................................................................................................................................................................

Using Certificates200................................................................................................................................................................

Supporting A Zone Labs Integrity Server200................................................................................................................................................................

Overview Of Integrity Server And Security Appliance Interaction201................................................................................................................................................................

Configuring Integrity Server Support201................................................................................................................................................................

Understanding Failover203................................................................................................................................................................

Chapter 14 Configuring Failover204................................................................................................................................................................

The Failover And Stateful Failover Links205................................................................................................................................................................

Stateful Failover Link207................................................................................................................................................................

Active/active And Active/standby Failover208................................................................................................................................................................

Active/active Failover211................................................................................................................................................................

Determining Which Type Of Failover To Use216................................................................................................................................................................

Failover Health Monitoring217................................................................................................................................................................

Interface Monitoring218................................................................................................................................................................

Failover Feature/platform Matrix219................................................................................................................................................................

Failover Configuration Limitations220................................................................................................................................................................

Configuring Lan-based Active/standby Failover222................................................................................................................................................................

Configuring Optional Active/standby Failover Settings225................................................................................................................................................................

Configuring Active/active Failover228................................................................................................................................................................

Configuring Lan-based Active/active Failover230................................................................................................................................................................

Configuring Optional Active/active Failover Settings234................................................................................................................................................................

Configuring Unit Health Monitoring238................................................................................................................................................................

Verifying The Failover Configuration239................................................................................................................................................................

Viewing Monitored Interfaces247................................................................................................................................................................

Testing The Failover Functionality248................................................................................................................................................................

Disabling Failover249................................................................................................................................................................

Failover System Messages250................................................................................................................................................................

Routed Mode Overview253................................................................................................................................................................

Chapter 15 Firewall Mode Overview254................................................................................................................................................................

An Inside User Visits A Web Server255................................................................................................................................................................

An Outside User Visits A Web Server On The Dmz256................................................................................................................................................................

An Inside User Visits A Web Server On The Dmz257................................................................................................................................................................

An Outside User Attempts To Access An Inside Host258................................................................................................................................................................

A Dmz User Attempts To Access An Inside Host259................................................................................................................................................................

Transparent Firewall Network260................................................................................................................................................................

Mac Address Lookups261................................................................................................................................................................

Unsupported Features In Transparent Mode262................................................................................................................................................................

How Data Moves Through The Transparent Firewall263................................................................................................................................................................

An Outside User Visits A Web Server On The Inside Network265................................................................................................................................................................

Access List Overview269................................................................................................................................................................

Access List Types270................................................................................................................................................................

C H A P T E R 16 Identifying Traffic With Access Lists271................................................................................................................................................................

Adding An Extended Access List273................................................................................................................................................................

Allowing Special Ip Traffic Through The Transparent Firewall274................................................................................................................................................................

Adding An Ethertype Access List276................................................................................................................................................................

Adding A Standard Access List277................................................................................................................................................................

Adding A Webtype Access List278................................................................................................................................................................

Adding Object Groups279................................................................................................................................................................

Adding A Network Object Group280................................................................................................................................................................

Adding An Icmp Type Object Group281................................................................................................................................................................

Nesting Object Groups282................................................................................................................................................................

Using Object Groups With An Access List283................................................................................................................................................................

Displaying Object Groups284................................................................................................................................................................

Scheduling Extended Access List Activation285................................................................................................................................................................

Applying The Time Range To An Ace286................................................................................................................................................................

Configuring Logging For An Access Control Entry287................................................................................................................................................................

Managing Deny Flows288................................................................................................................................................................

Nat Overview291................................................................................................................................................................

Introduction To Nat292................................................................................................................................................................

Chapter 17 Applying Nat293................................................................................................................................................................

Nat Types295................................................................................................................................................................

Static Nat297................................................................................................................................................................

Bypassing Nat When Nat Control Is Enabled299................................................................................................................................................................

Nat And Same Security Level Interfaces302................................................................................................................................................................

Order Of Nat Commands Used To Match Real Addresses303................................................................................................................................................................

Configuring Nat Control305................................................................................................................................................................

Using Dynamic Nat And Pat306................................................................................................................................................................

Configuring Dynamic Nat Or Pat312................................................................................................................................................................

Using Static Nat315................................................................................................................................................................

Using Static Pat316................................................................................................................................................................

Bypassing Nat318................................................................................................................................................................

Configuring Static Identity Nat319................................................................................................................................................................

Configuring Nat Exemption321................................................................................................................................................................

Nat Examples322................................................................................................................................................................

Overlapping Networks323................................................................................................................................................................

Redirecting Ports324................................................................................................................................................................

C H A P T E R 18 Permitting Or Denying Network Access328................................................................................................................................................................

Applying An Access List To An Interface331................................................................................................................................................................

Aaa Performance333................................................................................................................................................................

Chapter 19 Applying Aaa For Network Acces334................................................................................................................................................................

Static Pat And Http335................................................................................................................................................................

Enabling Secure Authentication Of Web Clients337................................................................................................................................................................

Configuring Radius Authorization339................................................................................................................................................................

Configuring A Radius Server To Download Per-user Access Control List Names343................................................................................................................................................................

Configuring Accounting For Network Access344................................................................................................................................................................

Using Mac Addresses To Exempt Traffic From Authentication And Authorization345................................................................................................................................................................

Filtering Overview347................................................................................................................................................................

C H A P T E R 20 Applying Filtering Services348................................................................................................................................................................

Filtering Java Applets349................................................................................................................................................................

Url Filtering Overview350................................................................................................................................................................

Buffering The Content Server Response351................................................................................................................................................................

Caching Server Addresses352................................................................................................................................................................

Enabling Filtering Of Long Http Urls353................................................................................................................................................................

Filtering Https Urls354................................................................................................................................................................

Viewing Filtering Statistics And Configuration355................................................................................................................................................................

Viewing Buffer Configuration And Statistics356................................................................................................................................................................

Viewing Caching Statistics357................................................................................................................................................................

Modular Policy Framework Overview359................................................................................................................................................................

Chapter 21 Using Modular Policy Framework360................................................................................................................................................................

Creating A Layer 3/4 Class Map For Through Traffic361................................................................................................................................................................

Creating A Layer 3/4 Class Map For Management Traffic363................................................................................................................................................................

Creating A Regular Expression364................................................................................................................................................................

Creating A Regular Expression Class Map366................................................................................................................................................................

Identifying Traffic In An Inspection Class Map367................................................................................................................................................................

Defining Actions In An Inspection Policy Map368................................................................................................................................................................

Defining Actions Using A Layer 3/4 Policy Map371................................................................................................................................................................

Default Layer 3/4 Policy Map372................................................................................................................................................................

Adding A Layer 3/4 Policy Map373................................................................................................................................................................

Applying A Layer 3/4 Policy To An Interface Using A Service Policy375................................................................................................................................................................

Applying Inspection And Qos Policing To Http Traffic376................................................................................................................................................................

Applying Inspection And Connection Limits To Http Traffic To Specific Servers377................................................................................................................................................................

Applying Inspection To Http Traffic With Nat378................................................................................................................................................................

Managing The Aip Ssm379................................................................................................................................................................

Chapter 22 Managing Aip Ssm And Csc Ssm380................................................................................................................................................................

Sessioning To The Aip Ssm And Running Setup382................................................................................................................................................................

Managing The Csc Ssm383................................................................................................................................................................

Getting Started With The Csc Ssm385................................................................................................................................................................

Determining What Traffic To Scan387................................................................................................................................................................

Limiting Connections Through The Csc Ssm389................................................................................................................................................................

Checking Ssm Status391................................................................................................................................................................

Transferring An Image Onto An Ssm392................................................................................................................................................................

Configuring Tcp Normalization395................................................................................................................................................................

Chapter 23 Preventing Network Attack396................................................................................................................................................................

Configuring Connection Limits And Timeouts398................................................................................................................................................................

Preventing Ip Spoofing399................................................................................................................................................................

Configuring The Fragment Size400................................................................................................................................................................

Configuring Ip Audit For Basic Ips Support401................................................................................................................................................................

Overview403................................................................................................................................................................

Chapter 24 Applying Qo Policie404................................................................................................................................................................

Identifying Traffic For Qos406................................................................................................................................................................

Defining A Qos Policy Map407................................................................................................................................................................

Applying Rate Limiting408................................................................................................................................................................

Activating The Service Policy409................................................................................................................................................................

Applying Low Latency Queueing410................................................................................................................................................................

Reducing Queue Latency411................................................................................................................................................................

Viewing Qos Configuration414................................................................................................................................................................

Viewing Qos Policy Map Configuration415................................................................................................................................................................

Viewing Qos Statistics416................................................................................................................................................................

Viewing Qos Priority Queue Statistics417................................................................................................................................................................

C H A P T E R 25 Configuring Application Layer Protocol Inspection420................................................................................................................................................................

Default Inspection Policy421................................................................................................................................................................

Configuring Application Inspection423................................................................................................................................................................

Ctiqbe Inspection427................................................................................................................................................................

Limitations And Restrictions428................................................................................................................................................................

Dcerpc Inspection429................................................................................................................................................................

Configuring A Dcerpc Inspection Policy Map For Additional Inspection Control430................................................................................................................................................................

Dns Inspection431................................................................................................................................................................

How Dns Rewrite Works432................................................................................................................................................................

Configuring Dns Rewrite433................................................................................................................................................................

Using The Alias Command For Dns Rewrite434................................................................................................................................................................

Dns Rewrite With Three Nat Zones435................................................................................................................................................................

Configuring Dns Rewrite With Three Nat Zones437................................................................................................................................................................

Verifying And Monitoring Dns Inspection438................................................................................................................................................................

Esmtp Inspection442................................................................................................................................................................

Ftp Inspection443................................................................................................................................................................

Ftp Inspection Overview444................................................................................................................................................................

Configuring An Ftp Inspection Policy Map For Additional Inspection Control445................................................................................................................................................................

Verifying And Monitoring Ftp Inspection448................................................................................................................................................................

Gtp Inspection449................................................................................................................................................................

Configuring A Gtp Inspection Policy Map For Additional Inspection Control450................................................................................................................................................................

Verifying And Monitoring Gtp Inspection454................................................................................................................................................................

H.323 Inspection455................................................................................................................................................................

Configuring H.323 And H.225 Timeout Values459................................................................................................................................................................

Monitoring H.245 Sessions460................................................................................................................................................................

Monitoring H.323 Ras Sessions461................................................................................................................................................................

Configuring An Http Inspection Policy Map For Additional Inspection Control462................................................................................................................................................................

Instant Messaging Inspection465................................................................................................................................................................

Im Inspection Overview466................................................................................................................................................................

Icmp Inspection469................................................................................................................................................................

Mgcp Inspection470................................................................................................................................................................

Mgcp Inspection Overview471................................................................................................................................................................

Configuring An Mgcp Inspection Policy Map For Additional Inspection Control472................................................................................................................................................................

Configuring Mgcp Timeout Values474................................................................................................................................................................

Configuring A Netbios Inspection Policy Map For Additional Inspection Control475................................................................................................................................................................

Pptp Inspection476................................................................................................................................................................

Radius Accounting Inspection477................................................................................................................................................................

Rsh Inspection478................................................................................................................................................................

Restrictions And Limitations479................................................................................................................................................................

Sip Instant Messaging480................................................................................................................................................................

Configuring A Sip Inspection Policy Map For Additional Inspection Control481................................................................................................................................................................

Configuring Sip Timeout Values484................................................................................................................................................................

Verifying And Monitoring Sip Inspection485................................................................................................................................................................

Sccp Inspection Overview486................................................................................................................................................................

Verifying And Monitoring Sccp Inspection487................................................................................................................................................................

Smtp And Extended Smtp Inspection489................................................................................................................................................................

Snmp Inspection490................................................................................................................................................................

Sql*net Inspection491................................................................................................................................................................

Sun Rpc Inspection Overview492................................................................................................................................................................

Verifying And Monitoring Sun Rpc Inspection493................................................................................................................................................................

Tftp Inspection494................................................................................................................................................................

Configuring Arp Inspection495................................................................................................................................................................

C H A P T E R 26 Configuring Arp Inspection And Bridging Parameters496................................................................................................................................................................

Customizing The Mac Address Table497................................................................................................................................................................

Setting The Mac Address Timeout498................................................................................................................................................................

Tunneling Overview503................................................................................................................................................................

Chapter 27 Configuring Ipsec And Isakmp504................................................................................................................................................................

Configuring Isakmp Policies507................................................................................................................................................................

Enabling Isakmp On The Outside Interface508................................................................................................................................................................

Enabling Ipsec Over Nat-t509................................................................................................................................................................

Enabling Ipsec Over Tcp510................................................................................................................................................................

Waiting For Active Sessions To Terminate Before Rebooting511................................................................................................................................................................

Creating A Certificate Group Matching Rule And Policy512................................................................................................................................................................

Using The Tunnel-group-map Default-group Command513................................................................................................................................................................

Understanding Transform Sets514................................................................................................................................................................

Applying Crypto Maps To Interfaces522................................................................................................................................................................

Changing Ipsec Sa Lifetimes524................................................................................................................................................................

Using Dynamic Crypto Maps526................................................................................................................................................................

Providing Site-to-site Redundancy528................................................................................................................................................................

Clearing Security Associations529................................................................................................................................................................

Supporting The Nokia Vpn Client530................................................................................................................................................................

L2tp Overview533................................................................................................................................................................

Ipsec Transport And Tunnel Modes534................................................................................................................................................................

Chapter 28 Configuring L2tp Over Ipsec535................................................................................................................................................................

Tunnel Group Switching537................................................................................................................................................................

Using L2tp Debug Commands539................................................................................................................................................................

Enabling Ipsec Debug540................................................................................................................................................................

Configuring Vpns In Single, Routed Mode543................................................................................................................................................................

C H A P T E R 29 Setting General Ipsec Vpn Parameters544................................................................................................................................................................

Nat Considerations For Intra-interface Traffic545................................................................................................................................................................

Understanding Load Balancing547................................................................................................................................................................

Implementing Load Balancing548................................................................................................................................................................

Eligible Platforms549................................................................................................................................................................

Some Typical Mixed Cluster Scenarios550................................................................................................................................................................

Configuring Load Balancing551................................................................................................................................................................

Configuring The Load Balancing Cluster Attributes552................................................................................................................................................................

Configuring Vpn Session Limits553................................................................................................................................................................

Overview Of Tunnel Groups, Group Policies, And Users555................................................................................................................................................................

C H A P T E R 30 Configuring Tunnel Groups, Group Policies, And Users556................................................................................................................................................................

Ipsec Tunnel-group Connection Parameters557................................................................................................................................................................

Webvpn Tunnel-group Connection Parameters558................................................................................................................................................................

Configuring Tunnel Groups559................................................................................................................................................................

Configuring Ipsec Tunnel-group General Attributes560................................................................................................................................................................

Configuring Ipsec Remote-access Tunnel Group Ipsec Attributes564................................................................................................................................................................

Configuring Ipsec Remote-access Tunnel Group Ppp Attributes566................................................................................................................................................................

Configuring Lan-to-lan Tunnel Groups567................................................................................................................................................................

Configuring Lan-to-lan Tunnel Group General Attributes568................................................................................................................................................................

Configuring Webvpn Tunnel Groups570................................................................................................................................................................

Configuring Webvpn Tunnel-group General Attributes571................................................................................................................................................................

Configuring Webvpn Tunnel-group Webvpn Attributes574................................................................................................................................................................

Customizing Login Windows For Webvpn Users577................................................................................................................................................................

Configuring Microsoft Active Directory Settings For Password Management578................................................................................................................................................................

Using Active Directory To Specify Maximum Password Age580................................................................................................................................................................

Using Active Directory To Override An Account Disabled Aaa Indicator581................................................................................................................................................................

Using Active Directory To Enforce Minimum Password Length582................................................................................................................................................................

Using Active Directory To Enforce Password Complexity583................................................................................................................................................................

Group Policies584................................................................................................................................................................

Default Group Policy585................................................................................................................................................................

Configuring Group Policies587................................................................................................................................................................

Configuring An Internal Group Policy588................................................................................................................................................................

Configuring Vpn-specific Attributes589................................................................................................................................................................

Configuring Security Attributes592................................................................................................................................................................

Configuring The Banner Message594................................................................................................................................................................

Configuring Split-tunneling Attributes595................................................................................................................................................................

Configuring Domain Attributes For Tunneling596................................................................................................................................................................

Configuring Attributes For Vpn Hardware Clients598................................................................................................................................................................

Configuring Backup Server Attributes601................................................................................................................................................................

Configuring Microsoft Internet Explorer Client Parameters602................................................................................................................................................................

Configuring Network Admission Control Parameters604................................................................................................................................................................

Configuring Address Pools607................................................................................................................................................................

Configuring Firewall Policies608................................................................................................................................................................

Configuring Client Access Rules611................................................................................................................................................................

Configuring Group-policy Webvpn Attributes612................................................................................................................................................................

Configuring User Attributes623................................................................................................................................................................

Viewing The Username Configuration624................................................................................................................................................................

Configuring Webvpn For Specific Users629................................................................................................................................................................

Configuring An Ip Address Assignment Method643................................................................................................................................................................

Chapter 31 Configuring Ip Addresse For Vpn644................................................................................................................................................................

Configuring Dhcp Addressing645................................................................................................................................................................

Summary Of The Configuration647................................................................................................................................................................

C H A P T E R 32 Configuring Remote Access Ipsec Vpns648................................................................................................................................................................

Configuring Isakmp Policy And Enabling Isakmp On The Outside Interface649................................................................................................................................................................

Configuring An Address Pool650................................................................................................................................................................

Defining A Tunnel Group651................................................................................................................................................................

Creating A Dynamic Crypto Map652................................................................................................................................................................

Creating A Crypto Map Entry To Use The Dynamic Crypto Map653................................................................................................................................................................

Uses, Requirements, And Limitations655................................................................................................................................................................

C H A P T E R 33 Configuring Network Admission Control656................................................................................................................................................................

Configuring The Default Acl For Nac657................................................................................................................................................................

Configuring Exemptions From Nac658................................................................................................................................................................

Changing Advanced Settings659................................................................................................................................................................

Changing The Login Credentials Used For Clientless Authentication660................................................................................................................................................................

Configuring Nac Session Attributes661................................................................................................................................................................

Setting The Query-for-posture-changes Timer663................................................................................................................................................................

Specifying The Client/server Role Of The Cisco Asa 5505666................................................................................................................................................................

Specifying The Primary And Secondary Servers667................................................................................................................................................................

Configuring Automatic Xauth Authentication668................................................................................................................................................................

Comparing Tunneling Options669................................................................................................................................................................

Specifying The Tunnel Group Or Trustpoint670................................................................................................................................................................

Specifying The Trustpoint671................................................................................................................................................................

Configuring Split Tunneling672................................................................................................................................................................

Configuring Remote Management673................................................................................................................................................................

Group Policy And User Attributes Pushed To The Client674................................................................................................................................................................

Authentication Options676................................................................................................................................................................

Pppoe Client Overview677................................................................................................................................................................

Chapter 35 Configuring The Pppoe Client678................................................................................................................................................................

Enabling Pppoe679................................................................................................................................................................

Monitoring And Debugging The Pppoe Client680................................................................................................................................................................

Clearing The Configuration681................................................................................................................................................................

C H A P T E R 36 Configuring Lan-to-lan Ipsec Vpns684................................................................................................................................................................

Creating A Transform Set686................................................................................................................................................................

Creating A Crypto Map And Applying It To An Interface688................................................................................................................................................................

Getting Started With Webvpn691................................................................................................................................................................

Chapter 37 Configuring Webvpn692................................................................................................................................................................

Using Ssl To Access The Central Site693................................................................................................................................................................

Setting Webvpn Http/https Proxy694................................................................................................................................................................

Enabling Cookies On Browsers For Webvpn695................................................................................................................................................................

Configuring Sso With Http Basic Or Ntlm Authentication696................................................................................................................................................................

Configuring Sso Authentication Using Siteminder697................................................................................................................................................................

Configuring Sso With The Http Form Protocol699................................................................................................................................................................

Authenticating With Digital Certificates704................................................................................................................................................................

Creating Port Forwarding, Url, And Access Lists In Global Configuration Mode705................................................................................................................................................................

Configuring Webvpn Tunnel Group Attributes706................................................................................................................................................................

Configuring Application Access707................................................................................................................................................................

Recovering From Hosts File Errors When Using Application Access708................................................................................................................................................................

Stopping Application Access Improperly709................................................................................................................................................................

Configuring File Access711................................................................................................................................................................

Configuring Access To Citrix Metaframe Services713................................................................................................................................................................

Using Webvpn With Pdas714................................................................................................................................................................

Using E-mail Over Webvpn715................................................................................................................................................................

E-mail Proxy Certificate Authentication716................................................................................................................................................................

Optimizing Webvpn Performance717................................................................................................................................................................

Configuring A Certificate For Signing Rewritten Java Content718................................................................................................................................................................

Configuring Application Profile Customization Framework719................................................................................................................................................................

Apcf Example721................................................................................................................................................................

Viewing The Webvpn Home Page722................................................................................................................................................................

Viewing The Floating Toolbar723................................................................................................................................................................

Customizing Webvpn Pages724................................................................................................................................................................

Customizing The Webvpn Login Page725................................................................................................................................................................

Customizing The Webvpn Logout Page726................................................................................................................................................................

Customizing The Webvpn Home Page727................................................................................................................................................................

Customizing The Application Access Window729................................................................................................................................................................

Customizing The Prompt Dialogs730................................................................................................................................................................

Applying Customizations To Tunnel Groups, Groups And Users731................................................................................................................................................................

Requiring Usernames And Passwords732................................................................................................................................................................

Communicating Security Tips733................................................................................................................................................................

Capturing Webvpn Data739................................................................................................................................................................

Creating A Capture File740................................................................................................................................................................

Installing Svc743................................................................................................................................................................

Chapter 38 Configuring Ssl Vpn Client744................................................................................................................................................................

Enabling Svc745................................................................................................................................................................

Enabling Permanent Svc Installation746................................................................................................................................................................

Enabling Rekey747................................................................................................................................................................

Enabling Keepalive748................................................................................................................................................................

Viewing Svc Sessions749................................................................................................................................................................

Logging Off Svc Sessions750................................................................................................................................................................

Public Key Cryptography751................................................................................................................................................................

C H A P T E R 39 Configuring Certificates752................................................................................................................................................................

About Trustpoints753................................................................................................................................................................

About Ocsp754................................................................................................................................................................

Supported Ca Servers755................................................................................................................................................................

Configuring Key Pairs756................................................................................................................................................................

Removing Key Pairs757................................................................................................................................................................

Obtaining Certificates759................................................................................................................................................................

Obtaining Certificates Manually761................................................................................................................................................................

Configuring Crls For A Trustpoint763................................................................................................................................................................

Exporting And Importing Trustpoints764................................................................................................................................................................

Exporting A Trustpoint Configuration765................................................................................................................................................................

Allowing Telnet Access769................................................................................................................................................................

Chapter 40 Managing System Acces770................................................................................................................................................................

Using An Ssh Client771................................................................................................................................................................

Configuring Aaa For System Administrators772................................................................................................................................................................

Configuring Authentication For Cli Access773................................................................................................................................................................

Configuring Authentication For The Enable Command774................................................................................................................................................................

Configuring Command Authorization775................................................................................................................................................................

Configuring Tacacs+ Command Authorization778................................................................................................................................................................

Configuring Command Accounting782................................................................................................................................................................

Recovering From A Lockout783................................................................................................................................................................

Configuring A Login Banner784................................................................................................................................................................

Managing Licenses785................................................................................................................................................................

C H A P T E R 41 Managing Software, Licenses, And Configurations786................................................................................................................................................................

Downloading Software Or Configuration Files To Flash Memory787................................................................................................................................................................

Downloading A File To The Startup Or Running Configuration788................................................................................................................................................................

Configuring The Application Image And Asdm Image To Boot789................................................................................................................................................................

Performing Zero Downtime Upgrades For Failover Pairs790................................................................................................................................................................

Upgrading And Active/active Failover Configuration791................................................................................................................................................................

Backing Up Configuration Files792................................................................................................................................................................

Backing Up A Context Configuration Within A Context793................................................................................................................................................................

Configuring Client Updates As An Auto Update Server795................................................................................................................................................................

Viewing Auto Update Status796................................................................................................................................................................

Using Snmp799................................................................................................................................................................

C H A P T E R 42 Monitoring The Security Appliance800................................................................................................................................................................

Enabling Snmp801................................................................................................................................................................

Configuring And Managing Logs803................................................................................................................................................................

Enabling And Disabling Logging804................................................................................................................................................................

Configuring Log Output Destinations805................................................................................................................................................................

Sending System Log Messages To The Console Port806................................................................................................................................................................

Sending System Log Messages To An E-mail Address807................................................................................................................................................................

Sending System Log Messages To Asdm808................................................................................................................................................................

Sending System Log Messages To A Telnet Or Ssh Session809................................................................................................................................................................

Sending System Log Messages To The Log Buffer810................................................................................................................................................................

Filtering System Log Messages812................................................................................................................................................................

Message Filtering Overview813................................................................................................................................................................

Filtering System Log Messages With Custom Message Lists815................................................................................................................................................................

Customizing The Log Configuration816................................................................................................................................................................

Configuring The Logging Queue817................................................................................................................................................................

Generating System Log Messages In Emblem Format818................................................................................................................................................................

Changing The Severity Level Of A System Log Message819................................................................................................................................................................

Changing The Amount Of Internal Flash Memory Available For Logs820................................................................................................................................................................

Understanding System Log Messages821................................................................................................................................................................

Testing Your Configuration823................................................................................................................................................................

C H A P T E R 43 Troubleshooting The Security Appliance824................................................................................................................................................................

Pinging Through The Security Appliance826................................................................................................................................................................

Disabling The Test Configuration827................................................................................................................................................................

Traceroute828................................................................................................................................................................

Performing Password Recovery For The Asa 5500 Series Adaptive Security Appliance829................................................................................................................................................................

Password Recovery For The Pix 500 Series Security Appliance830................................................................................................................................................................

Disabling Password Recovery831................................................................................................................................................................

Other Troubleshooting Tools832................................................................................................................................................................

Supported Platforms And Feature Licenses837................................................................................................................................................................

A P P E N D I X A Feature Licenses And Specifications838................................................................................................................................................................

Security Services Module Support845................................................................................................................................................................

Vpn Specifications846................................................................................................................................................................

Cisco Vpn Client Support847................................................................................................................................................................

Cryptographic Standards848................................................................................................................................................................

Example 1: Multiple Mode Firewall With Outside Access849................................................................................................................................................................

Appendix B Sample Configuration850................................................................................................................................................................

Example 1: Admin Context Configuration852................................................................................................................................................................

Example 1: Customer C Context Configuration853................................................................................................................................................................

Example 2: Single Mode Firewall Using Same Security Level854................................................................................................................................................................

Example 3: Shared Resources For Multiple Contexts856................................................................................................................................................................

Example 3: System Configuration857................................................................................................................................................................

Example 3: Department 1 Context Configuration858................................................................................................................................................................

Example 3: Department 2 Context Configuration859................................................................................................................................................................

Example 4: Multiple Mode, Transparent Firewall With Outside Access860................................................................................................................................................................

Example 4: System Configuration861................................................................................................................................................................

Example 4: Admin Context Configuration862................................................................................................................................................................

Example 4: Customer A Context Configuration863................................................................................................................................................................

Example 4: Customer C Context Configuration864................................................................................................................................................................

Example 6: Ipv6 Configuration866................................................................................................................................................................

Example 7: Cable-based Active/standby Failover (routed Mode)868................................................................................................................................................................

Example 8: Lan-based Active/standby Failover (routed Mode)869................................................................................................................................................................

Example 8: Secondary Unit Configuration870................................................................................................................................................................

Example 9: Primary Unit Configuration871................................................................................................................................................................

Example 9: Primary Admin Context Configuration872................................................................................................................................................................

Example 9: Primary Ctx1 Context Configuration873................................................................................................................................................................

Example 10: Cable-based Active/standby Failover (transparent Mode)874................................................................................................................................................................

Example 11: Lan-based Active/standby Failover (transparent Mode)876................................................................................................................................................................

Example 11: Secondary Unit Configuration877................................................................................................................................................................

Example 12: Lan-based Active/active Failover (transparent Mode)878................................................................................................................................................................

Example 12: Primary System Configuration879................................................................................................................................................................

Example 12: Primary Ctx1 Context Configuration880................................................................................................................................................................

Example 14: Dual Isp Support Using Static Route Tracking881................................................................................................................................................................

Example 14: Asa 5505 Base License882................................................................................................................................................................

Example 15: Asa 5505 Security Plus License With Failover And Dual-isp Backup884................................................................................................................................................................

Example 15: Secondary Unit Configuration886................................................................................................................................................................

Local Ports And Protocols895................................................................................................................................................................

Ipv6 Addresses899................................................................................................................................................................

Icmp Types909................................................................................................................................................................

Selecting Ldap, Radius, Or Local Authentication And Authorization911................................................................................................................................................................

A P P E N D I X E Configuring An External Server For Authorization And Authentication912................................................................................................................................................................

Reviewing The Ldap Directory Structure And Configuration Procedure913................................................................................................................................................................

Searching The Hierarchy914................................................................................................................................................................

Binding The Security Appliance To The Ldap Server915................................................................................................................................................................

Cisco -av-pair Attribute Syntax924................................................................................................................................................................

Example Security Appliance Authorization Schema925................................................................................................................................................................

Loading The Schema In The Ldap Server928................................................................................................................................................................

Reviewing Examples Of Active Directory Configurations929................................................................................................................................................................

Example 2: Configuring Ldap Authentication With Microsoft Active Directory930................................................................................................................................................................

Example 3: Ldap Authentication And Ldap Authorization With Microsoft Active Directory932................................................................................................................................................................

Configuring An External Radius Server934................................................................................................................................................................

Security Appliance Radius Authorization Attributes935................................................................................................................................................................

Adding Comments C968................................................................................................................................................................

Passwords C980................................................................................................................................................................

Private Networks D981................................................................................................................................................................