[PDF] Cisco ASA Series General Operations CLI Configuration Guide 9.2

View - Download Cisco ASA Series General Operations CLI Configuration Guide 9.2

Previous PDF

Next PDF

Cisco Systems, Inc.

www.cisco.com

Cisco has more than 200 offices worldwide.

Addresses, phone numbers, and fax numbers

are listed on the Cisco website at www.cisco.com/go/offices.

Cisco ASA Series General Operations CLI

Configuration Guide

Software Version 9.2

For the ASA 5505, ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA

5555-X, ASA 5585-X, ASA Services Module, and the

Adaptive Security Virtual Appliance

Released: April 24, 2014

Updated: September 16, 2014

Text Part Number: N/A, Online only

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL

STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT

WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT

SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE

OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public

domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED "AS IS" WITH

ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT

LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF

DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,

WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO

OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this

URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership

relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display

output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in

illustrative content is unintentional and coincidental. Cisco ASA Series General Operations CLI Configuration Guide Copyright © 2014 Cisco Systems, Inc. All rights reserved. iii Cisco ASA Series General Operations CLI Configuration Guide

CONTENTS

About This Guidexxxv

Document Objectivesxxxv

Related Documentationxxxv

Conventionsxxxv

Obtaining Documentation and Submitting a Service Requestxxxvi

PART 1Getting Started with the ASA

CHAPTER 1Introduction to the Cisco ASA1-1

Hardware and Software Compatibility1-1

VPN Compatibility1-1

New Features1-2

New Features in ASA 9.2(2.4)1-2

New Features in ASA 9.2(1)1-2

How the ASA Services Module Works with the Switch1-8

Firewall Functional Overview1-9

Security Policy Overview1-10

Firewall Mode Overview1-12

Stateful Inspection Overview1-13

VPN Functional Overview1-14

Security Context Overview1-14

ASA Clustering Overview1-15

Legacy Features1-15

CHAPTER 2Switch Configuration for the ASA Services Module2-1

Information About the Switch2-1

Supported Switch Hardware and Software2-1

Backplane Connection2-2

ASA and IOS Feature Interaction2-2

Information About SVIs2-3

Guidelines and Limitations2-3

Verifying the Module Installation2-4

Assigning VLANs to the ASA Services Module2-5

Contents

iv Cisco ASA Series General Operations CLI Configuration Guide Using the MSFC as a Directly Connected Router (SVIs)2-8

Configuring the Switch for ASA Failover2-9

Assigning VLANs to the Secondary ASA Services Module2-9 Adding a Trunk Between a Primary Switch and Secondary Switch2-9 Ensuring Compatibility with Transparent Firewall Mode2-9 Enabling Autostate Messaging for Rapid Link Failure Detection2-9

Resetting the ASA Services Module2-10

Monitoring the ASA Services Module2-10

Feature History for the Switch for Use with the ASA Services Module2-13 CHAPTER 3Cisco Adaptive Security Virtual Appliance Deployment3-1

Information About the ASAv3-1

VMware System Requirements3-1

VMware Feature Support for the ASAv3-2

Prerequisites for the ASAv3-2

Guidelines and Limitations for the ASAv3-3

Licensing Requirements for the ASAv3-5

Deploying the ASAv3-5

Accessing the vSphere Web Client and Installing the Client Integration Plug-In3-5 Deploying the ASAv Using the VMware vSphere Web Client3-7

Connecting to the CLI or ASDM3-12

Managing the ASAv License3-13

Applying the ASAv License3-13

Upgrading the vCPU License3-13

CHAPTER 4Getting Started4-1

Accessing the Console for Command-Line Interface4-1

Accessing the Appliance Console4-1

Accessing the ASA Services Module Console4-2

Accessing the ASAv Console4-6

Configuring ASDM Access4-8

Configuring ASDM Access for Appliances and the ASAv4-8 Configuring ASDM Access for the ASA Services Module4-13

Starting ASDM4-17

Factory Default Configurations4-18

Restoring the Factory Default Configuration4-19

Restoring the ASAv Deployment Configuration4-20

ASA 5505 Default Configuration4-20

Contents

v Cisco ASA Series General Operations CLI Configuration Guide

ASA 5512-X and Higher Default Configuration4-24

ASAv Deployment Configuration4-24

Working with the Configuration4-25

Saving Configuration Changes4-26

Copying the Startup Configuration to the Running Configuration4-27

Viewing the Configuration4-28

Clearing and Removing Configuration Settings4-28

Creating Text Configuration Files Offline4-29

Applying Configuration Changes to Connections4-29

Reloading the ASA4-30

CHAPTER 5Feature Licenses5-1

Supported Feature Licenses Per Model5-1

Licenses Per Model5-1

License Notes5-15

VPN License and Feature Compatibility5-20

Information About Feature Licenses5-21

Preinstalled License5-21

Permanent License5-21

Time-Based Licenses5-21

Shared AnyConnect Premium Licenses5-24

Failover or ASA Cluster Licenses5-27

No Payload Encryption Models5-30

Licenses FAQ5-30

Guidelines and Limitations5-31

Configuring Licenses5-32

Obtaining an Activation Key5-32

Activating or Deactivating Keys5-33

Configuring a Shared License5-34

Monitoring Licenses5-38

Viewing Your Current License5-38

Monitoring the Shared License5-49

Feature History for Licensing5-50

CHAPTER 6Transparent or Routed Firewall Mode6-1

Information About the Firewall Mode6-1

Information About Routed Firewall Mode6-1

Information About Transparent Firewall Mode6-2

Contents

vi Cisco ASA Series General Operations CLI Configuration Guide

Licensing Requirements for the Firewall Mode6-7

Default Settings6-7

Guidelines and Limitations6-8

Setting the Firewall Mode6-9

Configuring ARP Inspection for the Transparent Firewall6-10

Task Flow for Configuring ARP Inspection6-10

Adding a Static ARP Entry6-10

Enabling ARP Inspection6-11

Customizing the MAC Address Table for the Transparent Firewall6-12

Monitoring the Transparent Firewall6-13

Monitoring ARP Inspection6-13

Monitoring the MAC Address Table6-13

Firewall Mode Examples6-14

How Data Moves Through the ASA in Routed Firewall Mode6-14 How Data Moves Through the Transparent Firewall6-20

Feature History for the Firewall Mode6-25

PART 2High Availability and Scalability

CHAPTER 7Multiple Context Mode7-1

Information About Security Contexts7-1

Common Uses for Security Contexts7-2

Context Configuration Files7-2

How the ASA Classifies Packets7-3

Cascading Security Contexts7-6

Management Access to Security Contexts7-7

Information About Resource Management7-8

Information About MAC Addresses7-11

Licensing Requirements for Multiple Context Mode7-13

Prerequisites7-13

Guidelines and Limitations7-14

Default Settings7-14

Configuring Multiple Contexts7-15

Task Flow for Configuring Multiple Context Mode7-15

Enabling or Disabling Multiple Context Mode7-15

Configuring a Class for Resource Management7-16

Configuring a Security Context7-19

Automatically Assigning MAC Addresses to Context Interfaces7-24

Contents

vii Cisco ASA Series General Operations CLI Configuration Guide Changing Between Contexts and the System Execution Space7-24

Managing Security Contexts7-25

Removing a Security Context7-25

Changing the Admin Context7-26

Changing the Security Context URL7-26

Reloading a Security Context7-27

Monitoring Security Contexts7-28

Viewing Context Information7-29

Viewing Resource Allocation7-30

Viewing Resource Usage7-33

Monitoring SYN Attacks in Contexts7-34

Viewing Assigned MAC Addresses7-36

Configuration Examples for Multiple Context Mode7-39

Feature History for Multiple Context Mode7-40

CHAPTER 8Failover8-1

Introduction to Failover 8-1

Failover Overview8-2

Failover System Requirements8-2

Failover and Stateful Failover Links8-3

MAC Addresses and IP Addresses8-7

Intra- and Inter-Chassis Module Placement for the ASA Services Module8-8

Stateless and Stateful Failover8-12

quotesdbs_dbs23.pdfusesText_29

[PDF] Dresscode UBS ? l 'attention des collaborateurs PKB - Le Figaro

[PDF] Note technique : Procédures d affectation 2017 Post 3 (gestion

[PDF] vademecum des procedures d orientation et d affectation

[PDF] Documents annexes ? la « circulaire relative ? la mise en #339 uvre de

[PDF] Guide Après la 3e rentrée 2017 - Académie de Créteil - Onisep

[PDF] notice instructions pour APOGEE - fnege

[PDF] Burkina Faso - Loi n°2008-28 du 13 mai 2008 portant Code du

[PDF] COMMISSION DU CODEX ALIMENTARIUS

[PDF] programme des reunions du codex alimentarius pour l 'annee 2017

[PDF] CODE D 'USAGES INTERNATIONAL RECOMMAND -PRINCIPES

[PDF] le codex alimentarius - Food and Agriculture Organization of the

[PDF] PROJET DE NORME RVISE POUR LE MIEL

[PDF] Deux manuscrits retrouvés de Léonard de Vinci - unesdoc - Unesco

[PDF] Leonardo da Vinci 's Codex Leicester On View at MIA - Minneapolis

[PDF] norme générale pour les contaminants et les toxines présents dans