Table Of Contents

Getting Started

Accessing the Appliance Command-Line Interface

Configuring ASDM Access for Appliances

Accessing ASDM Using the Factory Default Configuration

Accessing ASDM Using a Non-Default Configuration (ASA 5505)

Accessing ASDM Using a Non-Default Configuration (ASA 5510 and Higher)

Starting ASDM

Connecting to ASDM for the First Time

Starting ASDM from the ASDM-IDM Launcher

Starting ASDM from the Java Web Start Application

Using ASDM in Demo Mode

Factory Default Configurations

Restoring the Factory Default Configuration

ASA 5505 Default Configuration

ASA 5505 Routed Mode Default Configuration

ASA 5505 Transparent Mode Sample Configuration

ASA 5510 and Higher Default Configuration

Getting Started with the Configuration

Using the Command Line Interface Tool in ASDM

Using the Command Line Interface Tool

Handling Command Errors

Using Interactive Commands

Avoiding Conflicts with Other Administrators

Showing Commands Ignored by ASDM on the Device

Applying Configuration Changes to Connections

Getting Started

---

This chapter describes how to get started with your ASA. This chapter includes the following sections:

•Accessing the Appliance Command-Line Interface

•Configuring ASDM Access for Appliances

•Starting ASDM

•Factory Default Configurations

•Getting Started with the Configuration

•Using the Command Line Interface Tool in ASDM

•Applying Configuration Changes to Connections

Accessing the Appliance Command-Line Interface

In some cases, you may need to use the CLI to configure basic settings for ASDM access. See the "Configuring ASDM Access for Appliances" section to determine if you need to use the CLI.

For initial configuration, access the CLI directly from the console port. Later, you can configure remote access using Telnet or SSH according to Chapter 40 "Configuring Management Access." If your system is already in multiple context mode, then accessing the console port places you in the system execution space. See Chapter 11 "Configuring Multiple Context Mode," for more information about multiple context mode.

Detailed Steps

---

Step 1 Connect a PC to the console port using the provided console cable, and connect to the console using a terminal emulator set for 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control.

See the hardware guide for your ASA for more information about the console cable.

Step 2 Press the Enter key to see the following prompt:

hostname>

This prompt indicates that you are in user EXEC mode. Only basic commands are available from user EXEC mode.

Step 3 To access privileged EXEC mode, enter the following command:

hostname> enable

The following prompt appears:

Password:

All non-configuration commands are available in privileged EXEC mode. You can also enter configuration mode from privileged EXEC mode.

Step 4 Enter the enable password at the prompt.

By default, the password is blank, and you can press the Enter key to continue. See the "Configuring the Hostname, Domain Name, and Passwords" section to change the enable password.

The prompt changes to the following:

hostname#

To exit privileged mode, enter the disable, exit, or quit command.

Step 5 To access global configuration mode, enter the following command:

hostname# configure terminal

The prompt changes to the following:

hostname(config)#

You can begin to configure the ASA from global configuration mode. To exit global configuration mode, enter the exit, quit, or end command.

---

---

Configuring ASDM Access for Appliances

ASDM access requires some minimal configuration so you can communicate over the network with a management interface. This section includes the following topics:

•Accessing ASDM Using the Factory Default Configuration

•Accessing ASDM Using a Non-Default Configuration (ASA 5505)

•Accessing ASDM Using a Non-Default Configuration (ASA 5510 and Higher)

Accessing ASDM Using the Factory Default Configuration

With a factory default configuration (see the "Factory Default Configurations" section), ASDM connectivity is preconfigured with default network settings. Connect to ASDM using the following interface and network settings:

•The management interface depends on your model:

–ASA 5505—The switch port to which you connect to ASDM can be any port, except for Ethernet 0/0.

–ASA 5510 and higher—The interface to which you connect to ASDM is Management 0/0.

•The default management address is 192.168.1.1.

•The clients allowed to access ASDM must be on the 192.168.1.0/24 network. The default configuration enables DHCP so your management station can be assigned an IP address in this range. To allow other client IP addresses to access ASDM, see the "Configuring ASA Access for ASDM, Telnet, or SSH" section.

To launch ASDM, see the "Starting ASDM" section.

---

Note To change to multiple context mode, see the "Enabling or Disabling Multiple Context Mode" section. After changing to multiple context mode, you can access ASDM from the admin context using the network settings above.

---

Accessing ASDM Using a Non-Default Configuration (ASA 5505)

If you do not have a factory default configuration, or want to change to transparent firewall mode, perform the following steps. See also the sample configurations in the "ASA 5505 Default Configuration" section.

Prerequisites

Access the CLI according to the "Accessing the Appliance Command-Line Interface" section.

Detailed Steps

	Command	Purpose
Step 1	(Optional) firewall transparent Example: hostname(config)# firewall transparent	Enables transparent firewall mode. This command clears your configuration. See the "Configuring the Firewall Mode" section for more information.
Step 2	Do one of the following to configure a management interface, depending on your mode:
	Routed mode: interface vlan number    ip address ip_address [mask]    nameif name    security-level level Example: hostname(config)# interface vlan 1 hostname(config-if)# ip address 192.168.1.1 255.255.255.0 hostname(config-if)# nameif inside hostname(config-if)# security-level 100	Configures an interface in routed mode. The security-level is a number between 1 and 100, where 100 is the most secure.
	Transparent mode: interface bvi number    ip address ip_address [mask] interface vlan number    bridge-group bvi_number    nameif name    security-level level Example: hostname(config)# interface bvi 1 hostname(config-if)# ip address 192.168.1.1 255.255.255.0 hostname(config)# interface vlan 1 hostname(config-if)# bridge-group 1 hostname(config-if)# nameif inside hostname(config-if)# security-level 100	Configures a bridge virtual interface and assigns a management VLAN to the bridge group. The security-level is a number between 1 and 100, where 100 is the most secure.
Step 3	interface ethernet 0/n    switchport access vlan number    no shutdown Example: hostname(config)# interface ethernet 0/1 hostname(config-if)# switchport access vlan 1 hostname(config-if)# no shutdown	Enables the management switchport and assigns it to the management VLAN.
Step 4	dhcpd address ip_address-ip_address interface_name dhcpd enable interface_name Example: hostname(config)# dhcpd address 192.168.1.5-192.168.1.254 inside hostname(config)# dhcpd enable inside	Enables DHCP for the management host on the management interface network. Make sure you do not include the management address in the range. Note By default, the IPS module, if installed, uses 192.168.1.2 for its internal management address, so be sure not to use this address in the DHCP range. You can later change the IPS module management address using the ASA if required.
Step 5	http server enable Example: hostname(config)# http server enable	Enables the HTTP server for ASDM.
Step 6	http ip_address mask interface_name Example: hostname(config)# http 192.168.1.0 255.255.255.0 inside	Allows the management host to access ASDM.
Step 7	write memory Example: hostname(config)# write memory	Saves the configuration.
Step 8	To launch ASDM, see the "Starting ASDM" section.	Launches ASDM.

Examples

The following configuration converts the firewall mode to transparent mode, configures the VLAN 1 interface and assigns it to BVI 1, enables a switchport, and enables ASDM for a management host:

firewall transparent

interface bvi 1

ip address 192.168.1.1 255.255.255.0

interface vlan 1

bridge-group 1

nameif inside

security-level 100

interface ethernet 0/1

switchport access vlan 1 

no shutdown

dhcpd address 192.168.1.5-192.168.1.254 inside

dhcpd enable inside

http server enable

http 192.168.1.0 255.255.255.0 inside

Accessing ASDM Using a Non-Default Configuration (ASA 5510 and Higher)

If you do not have a factory default configuration, or want to change the firewall or context mode, perform the following steps.

Prerequisites

Access the CLI according to the "Accessing the Appliance Command-Line Interface" section.

Detailed Steps

	Command	Purpose
Step 1	(Optional) firewall transparent Example: hostname(config)# firewall transparent	Enables transparent firewall mode. This command clears your configuration. See the "Configuring the Firewall Mode" section for more information.
Step 2	interface management 0/0    ip address ip_address mask nameif name security-level number    no shutdown Example: hostname(config)# interface management 0/0 hostname(config-if)# ip address 192.168.1.1 255.255.255.0 hostname(config-if)# nameif management hostname(config-if)# security-level 100 hostname(config-if)# no shutdown	Configures the Management 0/0 interface. The security-level is a number between 1 and 100, where 100 is the most secure.
Step 3	dhcpd address ip_address-ip_address interface_name dhcpd enable interface_name Example: hostname(config)# dhcpd address 192.168.1.2-192.168.1.254 management hostname(config)# dhcpd enable management	Enables DHCP for the management host on the management interface network. Make sure you do not include the Management 0/0 address in the range.
Step 4	http server enable Example: hostname(config)# http server enable	Enables the HTTP server for ASDM.
Step 5	http ip_address mask interface_name Example: hostname(config)# http 192.168.1.0 255.255.255.0 management	Allows the management host to access ASDM.
Step 6	write memory Example: hostname(config)# write memory	Saves the configuration.
Step 7	(Optional) mode multiple Example: hostname(config)# mode multiple	Sets the mode to multiple mode. When prompted, confirm that you want to convert the existing configuration to be the admin context. You are then prompted to reload the ASASM. See Chapter 11 "Configuring Multiple Context Mode," for more information.
Step 8	To launch ASDM, see the "Starting ASDM" section.	Launches ASDM.

Examples

The following configuration converts the firewall mode to transparent mode, configures the Management 0/0 interface, and enables ASDM for a management host:

firewall transparent

interface management 0/0

ip address 192.168.1.1 255.255.255.0

nameif management

security-level 100

no shutdown

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

http server enable

http 192.168.1.0 255.255.255.0 management

Starting ASDM

You can start ASDM using two methods:

•ASDM-IDM Launcher (Windows only)—The Launcher is an application downloaded from the ASA using a web browser that you can use to connect to any ASA IP address. You do not need to re-download the launcher if you want to connect to other ASAs. The Launcher also lets you run a virtual ASDM in Demo mode using files downloaded locally.

•Java Web Start—For each ASA that you manage, you need to connect with a web browser and then save or launch the Java Web Start application. You can optionally save the application to your PC; however you need separate applications for each ASA IP address.

---

Note Within ASDM, you can choose a different ASA IP address to manage; the difference between the Launcher and Java Web Start application functionality rests primarily in how you initially connect to the ASA and launch ASDM.

---

This section describes how to connect to ASDM initially, and then launch ASDM using the Launcher or the Java Web Start application. This section includes the following topics:

•Connecting to ASDM for the First Time

•Starting ASDM from the ASDM-IDM Launcher

•Starting ASDM from the Java Web Start Application

•Using ASDM in Demo Mode

---

Note ASDM allows multiple PCs or workstations to each have one browser session open with the same ASA software. A single ASA can support up to five concurrent ASDM sessions in single, routed mode. Only one session per browser per PC or workstation is supported for a specified ASA. In multiple context mode, five concurrent ASDM sessions are supported per context, up to a maximum of 32 total connections for each ASA.

---

Connecting to ASDM for the First Time

To connect to ASDM for the first time to download the ASDM-IDM Launcher or Java Web Start application, perform the following steps:

---

Step 1 From a supported web browser on the ASA network, enter the following URL:

https://interface_ip_address/admin

Where interface_ip_address is the management IP address of the ASA. See the "Configuring ASDM Access for Appliances" section for more information about management access.

See the ASDM release notes for your release for the requirements to run ASDM.

The ASDM launch page appears with the following buttons:

•Install ASDM Launcher and Run ASDM (Windows only)

•Run ASDM

•Run Startup Wizard

Step 2 To download the Launcher:

a. Click Install ASDM Launcher and Run ASDM.

b. Enter the username and password, and click OK. For a factory default configuration, leave these fields empty. With no HTTPS authentication configured, you can gain access to ASDM with no username and the enable password, which is blank by default. With HTTPS authentication enabled, enter your username and associated password.

c. Save the installer to your PC, and then start the installer. The ASDM-IDM Launcher opens automatically after installation is complete.

d. See the "Starting ASDM from the ASDM-IDM Launcher" section to use the Launcher to connect to ASDM.

Step 3 To use the Java Web Start application:

a. Click Run ASDM or Run Startup Wizard.

b. Save the application to your PC when prompted. You can optionally open it instead of saving it.

c. See the "Starting ASDM from the Java Web Start Application" section to use the Java Web Start application to connect to ASDM.

---

Starting ASDM from the ASDM-IDM Launcher

To start ASDM from the ASDM-IDM Launcher, perform the following steps.

Prerequisites

Download the ASDM-IDM Launcher according to the "Connecting to ASDM for the First Time" section.

Detailed Steps

---

Step 1 Start the ASDM-IDM Launcher application.

Step 2 Enter or choose the ASA IP address or hostname to which you want to connect. To clear the list of IP addresses, click the trash can icon next to the Device/IP Address/Name field.

Step 3 Enter your username and your password, and then click OK.

For a factory default configuration, leave these fields empty. With no HTTPS authentication configured, you can gain access to ASDM with no username and the enable password, which is blank by default. With HTTPS authentication enabled, enter your username and associated password.

If there is a new version of ASDM on the ASA, the ASDM Launcher automatically downloads the new version and requests that you update the current version before starting ASDM.

The main ASDM window appears.

---

Starting ASDM from the Java Web Start Application

To start ASDM from the Java Web Start application, perform the following steps.

Prerequisites

Download the Java Web Start application according to the "Connecting to ASDM for the First Time" section.

Detailed Steps

---

Step 1 Start the Java Web Start application.

Step 2 Accept any certificates according to the dialog boxes that appear. The Cisco ASDM-IDM Launcher appears.

Step 3 Enter the username and password, and click OK. For a factory default configuration, leave these fields empty. With no HTTPS authentication configured, you can gain access to ASDM with no username and the enable password, which is blank by default. With HTTPS authentication enabled, enter your username and associated password.

The main ASDM window appears.

---

Using ASDM in Demo Mode

The ASDM Demo Mode, a separately installed application, lets you run ASDM without having a live device available. In this mode, you can do the following:

•Perform configuration and selected monitoring tasks via ASDM as though you were interacting with a real device.

•Demonstrate ASDM or ASA features using the ASDM interface.

•Perform configuration and monitoring tasks with the CSC SSM.

•Obtain simulated monitoring and logging data, including real-time syslog messages. The data shown is randomly generated; however, the experience is identical to what you would see when you are connected to a real device.

This mode has been updated to support the following features:

•For global policies, an ASA in single, routed mode and intrusion prevention

•For object NAT, an ASA in single, routed mode and a firewall DMZ.

•For the Botnet Traffic Filter, an ASA in single, routed mode and security contexts.

•Site-to-Site VPN with IPv6 (Clientless SSL VPN and IPsec VPN)

•Promiscuous IDS (intrusion prevention)

•Unified Communication Wizard

This mode does not support the following:

•Saving changes made to the configuration that appear in the GUI.

•File or disk operations.

•Historical monitoring data.

•Non-administrative users.

•These features:

–File menu:

Save Running Configuration to Flash

Save Running Configuration to TFTP Server

Save Running Configuration to Standby Unit

Save Internal Log Buffer to Flash

Clear Internal Log Buffer

–Tools menu:

Command Line Interface

Ping

File Management

Update Software

File Transfer

Upload Image from Local PC

System Reload

–Toolbar/Status bar > Save

–Configuration > Interface > Edit Interface > Renew DHCP Lease

–Configuring a standby device after failover

•Operations that cause a rereading of the configuration, in which the GUI reverts to the original configuration:

–Switching contexts

–Making changes in the Interface pane

–NAT pane changes

–Clock pane changes

To run ASDM in Demo Mode, perform the following steps:

---

Step 1 Download the ASDM Demo Mode installer, asdm-demo-version.msi, from the following location: http://www.cisco.com/cisco/web/download/index.html.

Step 2 Double-click the installer to install the software.

Step 3 Double-click the Cisco ASDM Launcher shortcut on your desktop, or open it from the Start menu.

Step 4 Check the Run in Demo Mode check box.

The Demo Mode window appears.

---

Factory Default Configurations

The factory default configuration is the configuration applied by Cisco to new ASAs.

•ASA 5505—The factory default configuration configures interfaces and NAT so that the ASA is ready to use in your network immediately.

•ASA 5510 and higher—The factory default configuration configures an interface for management so you can connect to it using ASDM, with which you can then complete your configuration.

The factory default configuration is available only for routed firewall mode and single context mode. See Chapter 11 "Configuring Multiple Context Mode," for more information about multiple context mode. See Chapter 10 "Configuring the Transparent or Routed Firewall," for more information about routed and transparent firewall mode. For the ASA 5505, a sample transparent mode configuration is provided in this section.

---

Note In addition to the image files and the (hidden) default configuration, the following folders and files are standard in flash memory: log/, crypto_archive/, and coredumpinfo/coredump.cfg. The date on these files may not match the date of the image files in flash memory. These files aid in potential troubleshooting; they do not indicate that a failure has occurred.

---

This section includes the following topics:

•Restoring the Factory Default Configuration

•ASA 5505 Default Configuration

•ASA 5510 and Higher Default Configuration

Restoring the Factory Default Configuration

This section describes how to restore the factory default configuration.

Limitations

This feature is available only in routed firewall mode; transparent mode does not support IP addresses for interfaces. In addition, this feature is available only in single context mode; an ASA with a cleared configuration does not have any defined contexts to configure automatically using this feature.

Detailed Steps

Using the CLI:

	Command	Purpose
Step 1	configure factory-default [ip_address [mask]] Example: hostname(config)# configure factory-default 10.1.1.1 255.255.255.0	Restores the factory default configuration. If you specify the ip_address, then you set the inside or management interface IP address, depending on your model, instead of using the default IP address of 192.168.1.1. The http command uses the subnet you specify. Similarly, the dhcpd address command range consists of addresses within the subnet that you specify. Note This command also clears the boot system command, if present, along with the rest of the configuration. The boot system command lets you boot from a specific image, including an image on the external flash memory card. The next time you reload the ASA after restoring the factory configuration, it boots from the first image in internal flash memory; if you do not have an image in internal flash memory, the ASA does not boot.
Step 2	write memory Example: active(config)# write memory	Saves the default configuration to flash memory. This command saves the running configuration to the default location for the startup configuration, even if you previously configured the boot config command to set a different location; when the configuration was cleared, this path was also cleared.

Using ASDM:

---

Step 1 In the main ASDM application window, choose File > Reset Device to the Factory Default Configuration.

The Reset Device to the Default Configuration dialog box appears.

Step 2 (Optional) Enter the Management IP address of the management interface, instead of using the default address, 192.168.1.1. (For an ASA with a dedicated management interface, the interface is called "Management0/0.")

Step 3 (Optional) Choose the Management Subnet Mask from the drop-down list.

Step 4 Click OK.

A confirmation dialog box appears.

---

Note This action also clears the location of the boot image location, if present, along with the rest of the configuration. The Configuration > Device Management > System Image/Configuration > Boot Image/Configuration pane lets you boot from a specific image, including an image on the external memory. The next time you reload the ASA after restoring the factory configuration, it boots from the first image in internal flash memory; if you do not have an image in internal flash memory, the ASA does not boot.

---

Step 5 Click Yes.

Step 6 After you restore the default configuration, save this configuration to internal flash memory. Choose File > Save Running Configuration to Flash.

Choosing this option saves the running configuration to the default location for the startup configuration, even if you have previously configured a different location. When the configuration was cleared, this path was also cleared.

---

What to Do Next

See the "Getting Started with the Configuration" section to start configuring the ASA.

ASA 5505 Default Configuration

The default configuration is available for routed mode only. This section describes the default configuration and also provides a sample transparent mode configuration that you can copy and paste as a starting point. This section includes the following topics:

•ASA 5505 Routed Mode Default Configuration

•ASA 5505 Transparent Mode Sample Configuration

ASA 5505 Routed Mode Default Configuration

The default factory configuration for the ASA 5505 configures the following:

•Interfaces—Inside (VLAN 1) and outside (VLAN 2).

•Switchports enabled and assigned—Ethernet 0/1 through 0/7 switch ports assigned to inside. Ethernet 0/0 assigned to outside.

•IP addresses— Outside address from DHCP; inside address set manually to 192.168.1.1/24.

•Network Address Translation (NAT)—All inside IP addresses are translated when accessing the outside using interface PAT.

•Traffic flow—IPv4 and IPv6 traffic allowed from inside to outside (this behavior is implicit on the ASA). Outside users are prevented from accessing the inside.

•DHCP server—Enabled for inside hosts, so a PC connecting to the inside interface receives an address between 192.168.1.5 and 192.168.1.254. DNS, WINS, and domain information obtained from the DHCP client on the outside interface is passed to the DHCP clients on the inside interface.

•Default route—Derived from DHCP.

•ASDM access—Inside hosts allowed.

Figure 3-1 shows the traffic flow for an ASA 5505 in routed mode.

Figure 3-1 ASA 5505 Routed Mode

The configuration consists of the following commands:

interface Ethernet 0/0

   switchport access vlan 2

   no shutdown

interface Ethernet 0/1

   switchport access vlan 1

   no shutdown

interface Ethernet 0/2

   switchport access vlan 1

   no shutdown

interface Ethernet 0/3

   switchport access vlan 1

   no shutdown

interface Ethernet 0/4

   switchport access vlan 1

   no shutdown

interface Ethernet 0/5

   switchport access vlan 1

   no shutdown

interface Ethernet 0/6

   switchport access vlan 1

   no shutdown

interface Ethernet 0/7

   switchport access vlan 1

   no shutdown

interface vlan2

   nameif outside

   no shutdown

   ip address dhcp setroute

interface vlan1

   nameif inside

   ip address 192.168.1.1 255.255.255.0

   security-level 100

   no shutdown

object network obj_any

   subnet 0 0

   nat (inside,outside) dynamic interface

http server enable

http 192.168.1.0 255.255.255.0 inside

dhcpd address 192.168.1.5-192.168.1.254 inside

dhcpd auto_config outside

dhcpd enable inside

logging asdm informational

---

Note For testing purposes, you can allow ping from inside to outside by enabling ICMP inspection. Add the following commands to the default configuration:

policy-map global_policy

   class inspection_default

      inspect icmp

---

ASA 5505 Transparent Mode Sample Configuration

When you change the mode to transparent mode, the configuration is erased. You can copy and paste the following sample configuration at the CLI to get started. This configuration uses the default configuration as a starting point. Note the following areas you may need to modify:

•IP addresses—The IP addresses configured should be changed to match the network to which you are connecting.

•Static routes—For some kinds of traffic, static routes are required. See the "MAC Address vs. Route Lookups" section.

•Figure 3-2 shows the traffic flow for an ASA 5505 in transparent mode.

Figure 3-2 ASA 5505 Transparent Mode

firewall transparent

interface Ethernet 0/0

   switchport access vlan 2

   no shutdown

interface Ethernet 0/1

   switchport access vlan 1

   no shutdown

interface Ethernet 0/2

   switchport access vlan 1

   no shutdown

interface Ethernet 0/3

   switchport access vlan 1

   no shutdown

interface Ethernet 0/4

   switchport access vlan 1

   no shutdown

interface Ethernet 0/5

   switchport access vlan 1

   no shutdown

interface Ethernet 0/6

   switchport access vlan 1

   no shutdown

interface Ethernet 0/7

   switchport access vlan 1

   no shutdown

interface bvi 1

   ip address 192.168.1.1 255.255.255.0

interface vlan2

   nameif outside

   security-level 0

   bridge-group 1

   no shutdown

interface vlan1

   nameif inside

   security-level 100

   bridge-group 1

   no shutdown

http server enable

http 192.168.1.0 255.255.255.0 inside

dhcpd address 192.168.1.5-192.168.1.254 inside

dhcpd enable inside

---

Note For testing purposes, you can allow ping from inside to outside by enabling ICMP inspection. Add the following commands to the sample configuration:

policy-map global_policy

   class inspection_default

      inspect icmp

---

ASA 5510 and Higher Default Configuration

The default factory configuration for the ASA 5510 and higher configures the following:

•Management interface—Management 0/0 (management).

•IP address—The management address is 192.168.1.1/24.

•DHCP server—Enabled for management hosts, so a PC connecting to the management interface receives an address between 192.168.1.2 and 192.168.1.254.

•ASDM access—Management hosts allowed.

The configuration consists of the following commands:

interface management 0/0

   ip address 192.168.1.1 255.255.255.0

   nameif management

   security-level 100

   no shutdown

asdm logging informational 100

asdm history enable

http server enable

http 192.168.1.0 255.255.255.0 management

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd enable management

Getting Started with the Configuration

To configure and monitor the ASA, perform the following steps:

---

Step 1 For initial configuration using the Startup Wizard, choose Wizards > Startup Wizard.

Step 2 To use the IPsec VPN Wizard to configure IPsec VPN connections, choose Wizards > IPsec VPN Wizard and complete each screen that appears.

Step 3 To use the SSL VPN Wizard to configure SSL VPN connections, choose Wizards > SSL VPN Wizard and complete each screen that appears.

Step 4 To configure high availability and scalability settings, choose Wizards > High Availability and Scalability Wizard. See the "Configuring Failover with the High Availability and Scalability Wizard" section for more information.

Step 5 To use the Packet Capture Wizard to configure packet capture, choose Wizards > Packet Capture Wizard.

Step 6 To display different colors and styles available in the ASDM GUI, choose View > Office Look and Feel.

Step 7 To configure features, click the Configuration button on the toolbar and then click one of the feature buttons to display the associated configuration pane.

---

Note If the Configuration screen is blank, click Refresh on the toolbar to display the screen content.

---

Step 8 To monitor the ASA, click the Monitoring button on the toolbar and then click a feature button to display the associated monitoring pane.

---

---

Note ASDM supports up to a maximum of a 512 KB configuration. If you exceed this amount, you may experience performance issues.

---

Using the Command Line Interface Tool in ASDM

This section tells how to enter commands using ASDM, and how to work with the CLI. This section includes the following topics:

•Using the Command Line Interface Tool

•Handling Command Errors

•Using Interactive Commands

•Avoiding Conflicts with Other Administrators

•Showing Commands Ignored by ASDM on the Device

Using the Command Line Interface Tool

This feature provides a text-based tool for sending commands to the ASA and viewing the results.

The commands you can enter with the CLI tool depend on your user privileges. See the "Information About Authorization" section for more information. Review your privilege level in the status bar at the bottom of the main ASDM application window to ensure that you have the required privileges to execute privileged-level CLI commands.

---

Note Commands entered via the ASDM CLI tool might function differently from those entered through a terminal connection to the ASA.

---

To use the CLI tool, perform the following steps:

---

Step 1 In the main ASDM application window, choose Tools > Command Line Interface.

The Command Line Interface dialog box appears.

Step 2 Choose the type of command (single line or multiple line) that you want, and then choose the command from the drop-down list, or type it in the field provided.

Step 3 Click Send to execute the command.

Step 4 To enter a new command, click Clear Response, and then choose (or type) another command to execute.

Step 5 Check the Enable context-sensitive help (?) check box to provide context-sensitive help for this feature. Uncheck this check box to disable the context-sensitive help.

Step 6 After you have closed the Command Line Interface dialog box, if you changed the configuration, click Refresh to view the changes in ASDM.

---

Handling Command Errors

If an error occurs because you entered an incorrect command, the incorrect command is skipped and the remaining commands are processed. A message appears in the Response area to inform you whether or not any error occurred, as well as other related information.

---

Note ASDM supports almost all CLI commands. See the command reference for a list of commands.

---

Using Interactive Commands

Interactive commands are not supported in the CLI tool. To use these commands in ASDM, use the noconfirm keyword if available, as shown in the following command:

crypto key generate rsa modulus 1024 noconfirm

Avoiding Conflicts with Other Administrators

Multiple administrative users can update the running configuration of the ASA. Before using the ASDM CLI tool to make configuration changes, check for other active administrative sessions. If more than one user is configuring the ASA at the same time, the most recent changes take effect.

To view other administrative sessions that are currently active on the same ASA, choose Monitoring > Properties > Device Access.

Showing Commands Ignored by ASDM on the Device

This feature lets you show the list of commands that ASDM does not support. Typically, ASDM ignores them. ASDM does not change or remove these commands from your running configuration. See the "Unsupported Commands" section for more information.

To display the list of unsupported commands for ASDM, perform the following steps:

---

Step 1 In the main ASDM application window, choose Tools > Show Commands Ignored by ASDM on Device.

Step 2 Click OK when you are done.

---

Applying Configuration Changes to Connections

When you make security policy changes to the configuration, all new connections use the new security policy. Existing connections continue to use the policy that was configured at the time of the connection establishment. show command output for old connections reflect the old configuration, and in some cases will not include data about the old connections.

For example, if you remove a QoS service-policy from an interface, then re-add a modified version, then the show service-policy command only displays QoS counters associated with new connections that match the new service policy; existing connections on the old policy no longer show in the command output.

To ensure that all connections use the new policy, you need to disconnect the current connections so they can reconnect using the new policy.

To disconnect connections, enter one of the following commands.

Detailed Steps

Command	Purpose
clear local-host [ip_address] [all] Example: hostname(config)# clear local-host all	This command reinitializes per-client run-time states such as connection limits and embryonic limits. As a result, this command removes any connection that uses those limits. See the show local-host all command to view all current connections per host. With no arguments, this command clears all affected through-the-box connections. To also clear to-the-box connections (including your current management session), use the all keyword. To clear connections to and from a particular IP address, use the ip_address argument.
clear conn [all] [protocol {tcp | udp}] [address src_ip[-src_ip] [netmask mask]] [port src_port[-src_port]] [address dest_ip[-dest_ip] [netmask mask]] [port dest_port[-dest_port]] Example: hostname(config)# clear conn all	This command terminates connections in any state. See the show conn command to view all current connections. With no arguments, this command clears all through-the-box connections. To also clear to-the-box connections (including your current management session), use the all keyword. To clear specific connections based on the source IP address, destination IP address, port, and/or protocol, you can specify the desired options.