Table of Contents

Configuring Device-Level Settings

Device-level settings are those settings that are specific to a device. We categorize such settings as basic or advanced.

Basic Settings

This section describes the settings that define the basic features installed on the firewall device and the settings that control the types of connections that can be made to the firewall device for administration. This section includes:

Setting the Firewall OS Version

Identifying the correct operating system (OS) version running on a firewall device ensures that Firewall MC generates the command syntax expected by the installed operating system.

Firewall MC 1.2 supports PIX Firewall software version 6.0(x) through 6.3(x) CLI commands, and Firewall Services Module (FWSM) software version 1.1(x) CLI commands; however, not all commands are fully supported in this release. A complete list of commands, along with the supported devices and software versions, can be found at:

http://www.cisco.com/en/US/products/sw/cscowork/ps3992/ products_device_support_tables_list.html

The Firewall Device OS Version page appears.

Step 2   Do one of the following:

---

Note    If you created a device manually, you must click the Supported Firewall OS Version radio button, then specify the operating system version for that device.

---

Step 3   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

Firewall OS Version Field-Level Elements and Descriptions

Configuring Interfaces

The Interfaces feature allows you to define, enable, disable, and edit network interface configurations. Each firewall device must be configured, and each active interface must be enabled. Inactive interfaces can be disabled. You can define interfaces manually, or you can import interface information using a comma-separated values (CSV) file. (See Importing an Interface.) When disabled, the interface does not transmit or receive data, but the configuration information is retained. To access this feature, select Configuration > Device Settings > Interfaces.

If you bootstrapped a new firewall device, the setup feature configures only the addresses and names associated with the inside interface. You must define the remaining interfaces on that device before you can specify access and translation rules for traffic traversing that firewall.

Tip If you imported an existing firewall device, you do not need to complete this procedure unless you want to modify the settings defined for the remaining interfaces.

Adding or Editing an Interface

The Interfaces page allows you to define the name, security level, type, speed, MTU, and IP address of an interface. You can enter a static IP address for an interface, or you can specify that the IP address be obtained using a DHCP client or PPPoE functionality. You can disable inactive interfaces, and you can import interface information using a comma-separated values (CSV) file. For more information on importing interfaces, see Importing an Interface.

Make sure that the number of interfaces and their respective hardware IDs defined in the GUI match those on the physical device. For example, if you define only ethernet0 and ethernet1 in the GUI when the device also contains ethernet2, Firewall MC tries to remove all configuration settings for the undefined interface, such as its IP address, during deployment. This causes deployment errors and possible failure, depending on the settings you established for error handling.

The Interfaces page appears.

Step 2   Do one of the following:

The Add Interface Name page appears.

The Add Interface Name page appears.

---

Note    If you change an interface, we recommend that you perform a clear translation. See Configuring Management Controls.

---

Step 3   Do one of the following:

Step 4   To define an interface for a FWSM:

---

Note    The inside and outside interfaces are partially defined for the Global group by default; however, you must edit the interfaces to include the additional information.

---

---

Note    You can define a dynamic NAT rule only for an interface that has a higher security level than the interface on which the traffic goes out, which has a global IP address pool assigned to it. Static NAT rules can be defined between interfaces of any security level.

---

Step 5   To define an interface for a PIX Firewall:

---

Note    The number of logical interfaces that you can configure on a PIX Firewall varies according to the model. For more information, refer to the documentation for your PIX Firewall.

---

---

Note    The inside and outside interfaces are partially defined for the Global group by default; however, you must edit the interfaces to include the additional information.

---

---

Note    We recommend that you specify the speed of the network interfaces, instead of using auto speed sensing, in case your network environment includes switches or other devices that do not handle autosensing correctly.

---

---

Note    You can define a dynamic NAT rule only for an interface that has a higher security level than the interface on which the traffic goes out, which has a global IP address pool assigned to it. Static NAT rules can be defined between interfaces of any security level.

---

---

Note    You can configure DHCP and PPPoE on the outside interface only.

---

Step 6   To configure DHCP on this interface:

The interface summary page appears.

---

Note    Settings enabled during the configuration process are displayed as true in the wizard summary page.

---

Step 7   To configure a static IP address on this interface:

---

Note    Do not use addresses previously used for routers, hosts, or any other firewall device commands, such as an IP address in the global pool or a static NAT entry.

---

---

Note    Do not use 255.255.255.254 or 255.255.255.255 for an interface connected to the network because this will stop traffic on that interface.

---

The interface summary page appears.

---

Note    Settings enabled during the configuration process are displayed as true in the wizard summary page.

---

Step 8   To configure PPPoE on this interface:

---

Note    If you select this option, Firewall MC does not generate the VPDN username/password command for this user and does not remove the existing password for this user during deployment.

---

The interface summary page appears.

---

Note    Settings enabled during the configuration process are displayed as true in the wizard summary page.

---

Step 9   Verify the information is correct, then click Finish.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

Important Note About Deploying a PPPoE Configuration

If you deploy a PPPoE configuration to a firewall device that already has PPPoE configured on the outside interface (ip address outside pppoe), any existing PPPoE connection to an access concentrator is reset and cleared. The firewall device must then reauthenticate itself and reconnect to the access concentrator.

Interfaces Field-Level Elements and Descriptions

Deleting an Interface

The Interfaces page appears.

Step 2   Select the check box for the interface, then click Delete.

You are prompted to confirm the delete request.

Step 3   Click OK.

The interface is removed from the table, and the information is removed from the assigned firewall device configuration files when the files are deployed.

Importing an Interface

This import method allows you to import interfaces in bulk using a comma-separated values (CSV) file. The default import directory is C:\Program Files\CSCOpx\MDC\PIXMC\import (assuming C:\Progam Files\ was the install directory). To change the default import directory, see Configuring Import Controls.

The CSV format has one row of data per interface, with several fields per row. The information required for each interface included in the CSV file depends on the configuration of the device and interface. For more information on the fields and values to use for a particular interface, see Interfaces Field-Level Elements and Descriptions.

The number of logical VLAN interfaces that you can configure on a PIX Firewall varies according to the PIX Firewall model. For more information, refer to the documentation for your PIX Firewall.

Note   To designate a line as a comment and prevent it from being imported, place a semicolon in front of that line.

The CSV format provides the following interface information:

You can write CSV information as shown in the following examples:

The Interfaces page appears.

Step 2   Click Import.

The Enter Interface File Name page appears.

Step 3   Enter the path and name of the CSV file to import or click Browse to navigate to the file location.

Step 4   Click Next.

The Interface Import Details page appears.

Note   If errors exist in the CSV file, the Interface Import Errors page appears. Any interfaces that contain errors will not be imported. You can continue to import the interfaces that do not contain errors, or you can cancel the import wizard, correct the errors, then reimport the interfaces.

Step 5   Review the interface details, then click Next.

The interface summary page appears.

Step 6   Verify the information is correct, then click Finish.

The interfaces are imported and are displayed in the Interfaces table. Changes are applied to the firewall device configuration files when they are generated.

Polling an FWSM for VLAN Information

The VLAN polling feature allows you to get the current status of VLAN interfaces from a Firewall Services Module (FWSM). You can use this feature to update Firewall MC with the current VLAN information.

The Interfaces page appears.

Step 2   Click Poll.

Firewall MC displays the Status of VLANs page, which contains a table showing the VLANs that are defined on the specified FWSM and those that are defined in Firewall MC. The Status of VLANs page is informational only, but you can use this information to update Firewall MC with the current VLAN information.

---

Note    You must enter the device contact information for the FWSM you are polling before clicking Poll. See Configuring Firewall Device Contact Info.

---

Step 3   Click Close.

Configuring Firewall Device Administration

Firewall device administration consists of:

Configuring Passwords

The Password feature allows you to set the enable and Telnet passwords. If you are a system administrator, you can log in to the firewall device using the following types of already configured connections:

You can define RADIUS or TACACS servers to authenticate any of these connection types. To access this feature, select Configuration > Device Settings > Firewall Device Administration > AAA Admin Authentication.

If you are an administrator using the CLI, you must use the enable password to enter privilege mode. Privilege mode enables you to view or change the firewall device configuration. The enable password is also required to authenticate administrators who are trying to connect by serial port, Telnet, SSH, HTTPS, or SSL.

The default Telnet password is "cisco". The same password is used to define authentication for administrators using SSH if firewall device administrative AAA authentication is not defined for the SSH protocol. To gain access to the PIX Firewall console using SSH: From the SSH client, enter the username pix and enter the Telnet password.

If you will use a AAA authentication server to authenticate users, you do not need to complete the Password page.

Note   SSH permits up to 100 characters in a username and up to 50 characters in a password.

Important Notes and Restrictions for Passwords

---

Note    Make sure Caps Lock or Num Lock on your keyboard is not set when you enter passwords.

---

Setting a Password

The Password page appears.

Step 2   Enter the new enable password.

The enable password sets the enable password on the firewall device so that you can enter privilege mode when administering CLI commands. See Important Notes and Restrictions for Passwords.

---

Note    Use the same enable password that you entered during bootstrapping. See "Preparing Your Firewall Devices."

---

Step 3   Reenter the new enable password in the Confirm New Password field.

---

Note    If you are deploying to a device, you must enter the enable password in the contact information for that device. See Configuring Firewall Device Contact Info.

---

Step 4   Enter the new Telnet password to set the Telnet password on the firewall device so you can connect to a device using Telnet.

Step 5   Reenter the new Telnet password in the Confirm New Password field.

Step 6   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

Password Field-Level Elements and Descriptions

Configuring Firewall Device Contact Info

The Firewall Device Contact Info feature allows you to authenticate a firewall device using the current username, password, and IP address. The username and password credentials are used by Firewall MC and AUS to authenticate to a firewall device. You can use the enable password with an empty username or a AAA username with associated password depending on the target firewall device setting. You can also enter a future username, password, and IP address, which will be recognized after the configuration files and activity reports are deployed to devices. To access the Firewall Device Contact Info feature, select Configuration > Device Settings > Firewall Device Administration > Firewall Device Contact Info.

Use the Firewall Device Contact Info feature if you are deploying configuration files to an AUS or directly to devices.

Applying Firewall Device Contact Info

The Firewall Device Contact Info page appears.

Step 2   Enter the username that the firewall device uses to authenticate with AAA in the Current Username field.

Step 3   Enter the IP address (optional) that Firewall MC uses to contact a firewall device using HTTPS.

Step 4   Enter the current password. Use one of the following:

Step 5   Reenter the current password in the Confirm Current Password field.

Step 6   Enter the future username that the firewall device will use to authenticate with AAA. If no AAA server is used, leave the field blank.

---

Note    Future fields are used if the elements will be changed on the target firewall device after the configuration file is deployed.

---

Step 7   Enter the future IP address that Firewall MC should use to contact a firewall device using HTTPS.

Step 8   Enter the future password.

Step 9   Reenter the future password in the Confirm Future Password field.

Step 10   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

Firewall Device Contact Info Field-Level Elements and Descriptions

Note

• If you are using the immediate auto update feature, you do not have to complete the GUI elements labeled "future."

Configuring HTTPS (SSL)

The HTTPS (SSL) feature allows you to configure rules that permit only specific hosts or networks to connect to the firewall device using HTTPS. To access this feature, select Configuration > Device Settings > Firewall Device Administration > HTTPS (SSL).

A secure connection is needed so that a PC or workstation client running a network browser or Firewall MC or both can communicate with the firewall device. The rules restrict HTTPS access through a firewall device interface to a specific IP address and netmask. Any HTTPS connection tries that comply with the rules must be authenticated through a configured AAA server or the enable password. Once established, Secure Sockets Layer (SSL) protocol is used to encrypt the data.

Adding or Editing an HTTPS (SSL) Rule

The HTTPS (SSL) page appears.

Step 2   Do one of the following:

The Enter HTTPS Client page appears.

The Enter HTTPS Client page appears.

Step 3   Enter the name of the firewall device interface that permits SSL connections. If you are using a wizard, a list displays all interfaces defined at the current scope.

Step 4   Enter the IP address that specifies the host or network authorized to initiate an HTTPS connection to a firewall device.

Step 5   Enter the IP mask.

Step 6   Click Next.

The HTTPS (SSL) summary page appears.

Step 7   Verify the information is correct, then click Finish.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

---

Note    Settings enabled during the configuration process are displayed as true in the wizard summary page.

---

HTTPS (SSL) Field-Level Elements and Descriptions

Deleting an HTTPS (SSL) Rule

The HTTPS (SSL) page appears.

Step 2   Select the check box for the row, then click Delete.

You are prompted to confirm the delete request.

Step 3   Click OK.

The row is removed from the table, and the information is removed from the assigned firewall device configuration files when the files are deployed.

Configuring Telnet

The Telnet feature allows you to configure rules that permit specific hosts or networks to connect to the firewall device through Telnet. The rules restrict administrative Telnet access through a firewall device to a specific IP address and netmask. Connection tries that comply with the rules must be authenticated by a configured AAA server or the Telnet password. To access this feature, select Configuration > Device Settings > Firewall Device Administration > Telnet.

If you will be using a AAA authentication server to authenticate users, you do not need to complete this page.

Applying a Telnet Rule

The Telnet page appears.

Step 2   Enter the timeout value. Values are 1 to 60 minutes.

Step 3   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

You are now ready to add or edit a Telnet rule.

Adding or Editing a Telnet Rule

The Telnet page appears.

Step 2   Do one of the following:

The Enter Telnet Client page appears.

The Enter Telnet Client page appears.

Step 3   Select the interface that should receive Telnet packets from the client. The list displays all interfaces defined at the current scope.

Step 4   Enter the IP address of the host or network that can access the firewall device Telnet console.

Step 5   Enter the IP address netmask.

Step 6   Click Next.

The Telnet summary page appears.

Step 7   Verify the information is correct, then click Finish.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

---

Note    Settings enabled during the configuration process are displayed as true in the wizard summary page.

---

Telnet Field-Level Elements and Descriptions

Deleting a Telnet Rule

The Telnet page appears.

Step 2   Select the check box for the row, then click Delete.

You are prompted to confirm the delete request.

Step 3   Click OK.

The row is removed from the table, and the information is removed from the assigned firewall device configuration files when the files are deployed.

Configuring Secure Shell

The Secure Shell feature allows you to configure rules that permit only specific hosts or networks to connect to the firewall device for administrative access using the Secure Shell (SSH) protocol. The rules restrict SSH access through a firewall device interface to a specific IP address and netmask. SSH connection attempts that comply with the rules must be authenticated by a preconfigured AAA Server or the Telnet password. To access this feature, select Configuration > Device Settings > Firewall Device Administration > Secure Shell.

Note   SSH is not required to use Firewall MC.

Applying SSH

The Secure Shell page appears.

Step 2   Verify the timeout value, which displays the number of minutes the secure shell session can remain idle before the firewall device closes it. Values are 1 to 60 minutes. Default is 5.

Step 3   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

You are now ready to add or edit an SSH rule.

Adding or Editing SSH

Step 2   The Secure Shell page appears.

Step 3   Do one of the following:

The Enter SSH Client page appears.

The Enter SSH Client page appears.

Step 4   Select the interface name of the firewall device that permits SSH connections. The list displays all interfaces defined at the current scope.

Step 5   Enter the IP address.

Step 6   Enter the netmask.

Step 7   Click Next.

The SSH summary page appears.

Step 8   Verify the information is correct, then click Finish.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

---

Note    Settings enabled during the configuration process are displayed as true in the wizard summary page.

---

SSH Field-Level Elements and Descriptions

Deleting SSH

The Secure Shell page appears.

Step 2   Select the check box for the row, then click Delete.

You are prompted to confirm the delete request.

Step 3   Click OK.

The row is removed from the table, and the information is removed from the assigned firewall device configuration files when the files are deployed.

Configuring SNMP

The SNMP feature allows you to configure the firewall device for monitoring by Simple Network Management Protocol (SNMP) management stations. SNMP defines a standard way for network management stations or workstations to monitor the health and status of many types of devices, including switches, routers, and the firewall device. To access this feature, select Configuration > Device Settings > Firewall Device Administration > SNMP.

Configuring MIBs

The firewall device supports these MIBs that management stations can browse:

Configuring OIDs

The SNMP MIB mib-2.system.sysObjectID variable now provides one of the following firewall device platform-specific OIDs. You can use a management station such as CiscoView to view:

For other firewall device platforms:

Configuring Traps

The firewall device supports many SNMP traps. SNMP trap settings can also be configured from Firewall MC. The logging feature allows you to enable or disable the sending of messages to an SNMP management station and to set the SNMP message level. Firewall MC supports a maximum of 32 management stations.

Applying Settings to an SNMP Management Station

The SNMP page appears.

Step 2   Verify the password community string, which the SNMP management station uses when sending requests to a firewall device. The default is "public".

Step 3   Enter the name of the system administrator for the firewall device.

Step 4   Enter the firewall device location.

Step 5   Select the Send syslog as SNMP traps check box.

Step 6   Select the logging level from the list. See Logging level list in the Field-Level Elements and Descriptions table.

Step 7   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

You are now ready to add or edit an SNMP rule.

Adding or Editing an SNMP Rule

The SNMP page appears.

Step 2   Do one of the following:

The Enter SNMP Client page appears.

The Enter SNMP Client page appears.

Step 3   Select the interface name from the list. The list displays all interfaces defined at the current scope.

Step 4   Enter the IP address.

Step 5   Determine whether to set polling or trap information, then select the respective check box.

Step 6   Click Next.

The SNMP summary page appears.

Step 7   Verify the information is correct, then click Finish.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

---

Note    Settings enabled during the configuration process are displayed as true in the wizard summary page.

---

SNMP Field-Level Elements and Descriptions

Deleting SNMP Client Information

The SNMP page appears.

Step 2   Select the check box for the row, then click Delete.

You are prompted to confirm the delete request.

Step 3   Click OK.

The row is removed from the table, and the information is removed from the assigned firewall device configuration files when the files are deployed.

Configuring ICMP Interface Rules

ICMP enables a network device to ping an IP address to discover the presence, identity, and function of other devices and to test intermediate communications links and network availability. The ICMP feature can enable or disable the ping response or echo of an interface on the firewall device. To access this feature, select Configuration > Device Settings > Firewall Device Administration > ICMP Interface Rules.

The rules table configures an access list that permits or denies ICMP traffic terminating at the firewall device. A permit or deny action is specified for each interface added to the rules table. If no interfaces are added to the rules table, the default action for each interface is to permit ICMP traffic.

When an interface receives an ICMP packet, the firewall device searches the access list. If the first matched entry is a permit entry, the packet continues to be processed. If the first matched entry is a deny entry or an entry is not matched, the firewall device discards the packet and generates the %PIX-3-313001 syslog message. An exception is when an ICMP access-list command statement is not configured; then, permit is assumed.

Note   We recommend that you grant permission for ICMP unreachable messages (type 3). Denying ICMP unreachable messages disables ICMP Path MTU discovery, which can halt IPSec and PPTP traffic. See RFC 1195 and RFC 1435 for details about Path MTU discovery.

Inserting or Editing an ICMP Interface Rule

The ICMP Interface Rules page appears.

Step 2   Do one of the following:

Step 3   Select the ICMP message type from the list. See ICMP message type in the Field-Level Elements and Descriptions table.

Step 4   Select the name of the interface at which the ICMP packet arrives using the list box.

Step 5   Enter the source IP of each host or network added to the ICMP rule table (access list) for the interface.

Step 6   Enter the source IP mask.

Step 7   Determine the action for the rule (permit or deny), then click the respective radio button.

Step 8   Click Next.

The ICMP summary page appears.

Step 9   Verify the information is correct, then click Finish.

Changes are applied to the assigned firewall device configuration files when the files are generated.

ICMP Interface Rules Field-Level Elements and Descriptions

Deleting an ICMP Rule

The ICMP Interface Rules page appears.

Step 2   Select the check box for the row, then click Delete.

You are prompted to confirm the delete request.

Step 3   Click OK.

The row is removed from the table, and the information is removed from the assigned firewall device configuration files when the files are deployed.

Configuring AAA Admin Authentication

The AAA Admin Authentication feature allows you to enable AAA access to a firewall device. When AAA authentication is enabled, all administrative requests are authenticated against and authorized by the AAA server. Local Enable and Telnet passwords are ignored when AAA authentication is enabled. To access this feature, select Configuration > Device Settings > Firewall Device Administration > AAA Admin Authentication.

If you are not using a AAA authentication server to authenticate users, you must complete the Passwords page to define enable and Telnet passwords. See Configuring Passwords.

Note   If you are using a AAA server for authentication, you must define a AAA server group before you enable this feature. To access the AAA server group, select Configuration > Building Blocks > AAA Server Group.

Applying AAA Admin Authentication

Before You Begin

The AAA Admin Authentication page appears.

Step 2   For each type of access, select the server group to use for AAA authentication. Disable, LOCAL, and any previously defined server groups are listed as options. To define a server group, see Defining AAA Server Groups.)

Firewall MC generates the aaa authentication [serial | enable | telnet | ssh | http] console <server_tag> command for each type of access specified. For information on the services that can be authenticated, see AAA Admin Authentication Field-Level Elements and Descriptions.

Caution   Before you enable AAA authentication for access to a firewall device, make sure that you have configured the LOCAL database or the AAA server that you want to use for authentication. You must define a user profile with the commands that the user is permitted to execute, and should test the authentication method before deploying a configuration that uses AAA authentication for device access. Failure to do so can result in a lockout condition. If you have locked yourself out of the firewall device and the aaa authentication http console <server_tag> command is not defined on the device, you can gain access to the PIX Firewall using PIX Device Manager with no username and the PIX Firewall enable password. If the aaa commands are defined but the HTTP authentication requests timeout, which implies the AAA servers may be down or not available, you can gain access to the PIX Firewall using PIX Device Manager with the username pix and the enable password. By default, the enable password is not set.

Step 3   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

AAA Admin Authentication Field-Level Elements and Descriptions

Configuring Authentication Prompts

The Authentication Prompts feature allows you to change the AAA challenge text for HTTP, FTP, and Telnet access. This text is displayed above the username and password prompts that users see when logging in. To access this feature, select Configuration > Device Settings > Servers and Services > Authentication Prompts.

Note

• Microsoft Internet Explorer displays up to a 37 character authentication prompt.

Enabling Authentication Prompts

The Authentication Prompt page appears.

Step 2   Select the Enable prompt check box, then enter the AAA challenge prompt string in the corresponding text box. The text can be up to 235 characters.

---

Note    If you deselect the check box, the text string is saved but not used by the firewall device. This is true of all check boxes on this page.

---

Step 3   Select the Enable user-accepted message check box, then enter the prompt string in the corresponding text box to have user authentication via Telnet accepted.

Step 4   Select the Enable user-rejected message check box, then enter the prompt string in the corresponding text box to have user authentication via Telnet rejected.

Step 5   Click Apply.

Changes are applied to the firewall device configuration files when generated.

Authentication Prompts Field-Level Elements and Descriptions

Advanced Settings

Advanced settings are optional features that provide advanced processing or security features. This section includes the following topics:

Configuring IDS Policy

The IDS Policy feature allows you to define Cisco Intrusion Detection System (IDS) policies. IDS policies instruct the firewall device to audit IP traffic going through the firewall. The firewall device looks for defined attack and informational signatures. For each IDS policy, you can instruct the firewall device to send an alarm (syslog), drop the offending packet, reset the offending connection, or a combination of the three. You can also enable your IDS policies selectively on one or more firewall device interfaces. To access this feature, select Configuration > Device Settings > Advanced Security > IDS Policy.

The firewall device audits IP traffic by checking the IP packets as they arrive at an interface. If a packet triggers a signature and the configured action does not drop the packet, then the same packet can trigger other signatures. The firewall device supports both inbound and outbound auditing.

Applying an IDS Policy

The IDS Policy page appears.

Step 2   Determine whether you want an alarm, drop, or reset for each of the policies listed, then select the respective check box or check boxes.

Step 3   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

IDS Policy Field-Level Elements and Descriptions

Configuring IDS Signatures

The IDS Signatures feature allows you to select which sensor signatures the firewall device IDS will search for. Sensors use a signature-based intrusion detection technology to detect misuse of network resources. Sensors scan network packets for known attack signatures and take user-defined actions when they detect an attack. When a signature is enabled, the firewall device audits the appropriate traffic and logs a message or takes other action if that signature is found. To access this feature, select Configuration > Device Settings > Advanced Security > IDS Signatures.

Signature-based detection, on a basic level, can be compared with virus-checking programs. Cisco Systems produces a list of signatures that the sensor compares to activity on the network. When a match is found, the sensor takes an action, such as logging the event or sending an alarm.

Important Notes About IDS Signatures

---

Note    You must be a registered Cisco.com user to access the Cisco IDS Signatures home page.

---

Applying IDS Signatures

The IDS Signatures page appears.

Step 2   From the Enabled column, select IDS signatures to disable, then click Disable => to move the selected IDS signatures to the Disabled column.

---

Note    For definitions of signature types, see Cisco PIX Firewall System Log Messages, Version 6.2 on Cisco.com at http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_ syst em_message_guide_book09186a008014638a.html.

---

Step 3   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

IDS Signature Field-Level Elements and Descriptions

Configuring Anti-Spoofing

The Anti-Spoofing feature allows you to specify which interfaces to protect from an IP spoofing attack using network filtering. To access this feature, select Configuration > Device Settings > Advanced Security > Anti-Spoofing.

This feature provides Unicast RPF (Reverse Path Forwarding) functionality for the firewall device. It is disabled by default. Because of the danger of IP spoofing in the IP protocol, measures must be taken to reduce this risk. Unicast RPF, or reverse route lookups, prevents manipulation under certain circumstances. Unicast RPF is a unidirectional input function that screens inbound packets arriving on an interface. It does not screen outbound packets. For more information on anti-spoofing, see RFC2267.

Caution   Before using this feature, add static routes for every network that can be accessed on the interfaces. Enable this feature only if routing is fully specified. Otherwise, the firewall device will stop traffic on the interface you specify.

Applying Anti-Spoofing

The Anti-Spoofing page appears.

Step 2   Do one of the following:

Step 3   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

Anti-Spoofing Field-Level Elements and Descriptions

Configuring Fragments

The Fragments feature allows you to configure the IP fragment database for each firewall device interface. It provides additional packet-fragmentation management and improves compatibility with a Network File System (NFS) to allow remote file access across a network. To access this feature, select Configuration > Device Settings > Advanced Security > Fragment.

Adding or Editing a Fragment

The Fragment page appears.

Step 2   Do one of the following:

The Create Fragment page appears.

The Create Fragment page appears.

Step 3   Select the interface name. The list displays all interfaces defined at the current scope.

Step 4   Verify the maximum number of packets allowed in the fragment database. Default is 200.

Step 5   Verify the maximum number of elements allowed in the fragment set. Default is 24.

Step 6   Verify the timeout value, which is the maximum number of seconds to assemble a fragment set. Default is 5.

Step 7   Click Next.

The fragment summary page appears.

Step 8   Verify the information is correct, then click Finish.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

Fragment Field-Level Elements and Descriptions

Deleting a Fragment

The Fragment table appears.

Step 2   Select the check box for the row, then click Delete.

You are prompted to confirm the delete request.

Step 3   Click OK.

The row is removed from the table, and the information is removed from the assigned firewall device configuration files when the files are deployed.

Configuring TCP Options

The TCP Options feature allows you to set various parameters for TCP connections. To access this feature, select Configuration > Device Settings > Advanced Security > TCP Options.

Applying TCP Options

The TCP Options page appears.

Step 2   Select the Force maximum segment size check box to enforce a maximum segment size for all TCP sessions through a firewall device, then enter the size of the byte in the corresponding text box. This setting is used primarily to ensure that a TCP session does not fragment.

Step 3   Select the Force TCP connection to linger in TIME_WAIT state at least 15 seconds check box to force a firewall device to retain its TCP connection information/state for at least 15 seconds after a normal TCP close-down sequence is seen. This helps to ensure that both sides of a TCP session receive close-down packets.

Step 4   Select the Reset inbound check box to send TCP resets (instead of dropping the packets) for all TCP sessions that:

If you deselect the check box, the firewall device discards packets of all such sessions.

Step 5   Select the Reset outbound check box to send TCP resets for all TCP sessions that:

If you deselect the check box, the firewall device discards packets of all such sessions.

Step 6   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

TCP Options Field-Level Elements and Descriptions

Configuring Timeouts

The Timeout feature allows you to set the maximum idle time for use with the firewall device. All times are displayed in the format hh:mm:ss. To access this feature, select Configuration > Device Settings > Advanced Security > Timeouts.

Applying Timeouts

The Timeouts page appears.

Step 2   Verify the timeout values for the protocols listed. (See Timeouts Field-Level Elements and Descriptions.) Timeout values are displayed in the format hh:mm:ss.

Step 3   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

Timeouts Field-Level Elements and Descriptions

Note   Timeout values are displayed in the format hh:mm:ss. Element1  Description  Inherit settings check box When selected, the subgroup or device inherits the settings of the enclosing group to current scope. You can override a default setting by deselecting the check box and specifying other values. See What Is Inheritance?. Note A grayed-out check box disallows changes at the current scope. Enforce/Mandate settings for children check box When selected, settings are at a group level and are inherited by the enclosed subgroups and devices. Mandatory settings cannot be changed by a subgroup or device. See What Is Inheritance?. Note A grayed-out check box disallows changes at the current scope. Connection Changes idle time to wait for a connection slot to be freed. Enter 00:00:00 to disable timeout. Duration must be at least 5 minutes. Default is 1 hour. Half-closed Changes idle time to wait for a TCP half-closed connection to close. Enter 00:00:00 to disable timeout. Minimum is 5 minutes. Default is 10 minutes. H.323 Changes idle time to wait for an H.323 service connection to close. Enter 00:00:00 to disable timeout. Duration must be at least 5 minutes. Default is 5 minutes. SIP Changes idle time to wait for an SIP signaling port connection to close. Enter 00:00:00 to disable timeout. Default is 30 minutes. SIP media Changes idle time to wait for an SIP media port connection to close. Enter 00:00:00 to disable timeout. Default is 2 minutes. Authorization absolute Changes length of time until authentication and authorization cache times out and you must reauthenticate a new connection. Length of time must be shorter than Translation Slot value. System waits to reprompt you until you start a new connection, such as clicking link in browser. Enter 00:00:00 to disable caching. Note Do not set this value to zero if passive FTP is used on the connections. Authorization inactivity (0 is inactive) Changes idle time until authentication and authorization cache times out and you have to reauthenticate a new connection. Duration must be shorter than Translation Slot value. Translation slot Changes idle time to wait for a translation slot to be freed. Duration must be at least 1 minute. Default is 3 hours. UDP Changes idle time to wait until UDP connection closes. Duration must be at least 1 minute. Default is 2 minutes. RPC Changes idle time to wait for an RPC slot to be freed. Enter 00:00:00 to disable timeout. Duration must be at least 1 minute. Default is 10 minutes. H.225 Idle time after which H.225 signaling closes. Default is 1 hour. Timeout value of 00:00:00 means never tear down H.225 signaling. Timeout value of 00:00:01 disables timer and closes TCP connection immediately after all calls are cleared. MGCP Sets length of time for Media Gateway Control Protocol (MGCP) inactivity timer. Default is 5 minutes. 1 00:00:00 = hh:mm:ss.

Configuring Basic Fixups

The Fixups feature is an informational list of services, protocols, and port numbers to which a firewall device applies the Adaptive Security Algorithm (ASA). The default ports or those you specify are the ports at which the firewall device listens for each service. To access this feature, select Configuration > Device Settings > Advanced Security > Basic Fixups.

The default configuration of the firewall device includes a set of application inspection entries that associate supported protocols with specific TCP or UDP port numbers and that identify any special handling required. The inspection function does not support NAT or PAT for certain applications because of the constraints imposed by the applications. You can change the port assignments for some applications, but other applications have fixed port assignments that you cannot change.

Applying Basic Fixups

The Basic Fixups page appears.

Step 2   Select the check boxes for the fixup protocols to enable, then enter the ports or port ranges in the corresponding text field where needed. See Basic Fixups Field-Level Elements and Descriptions.

---

Note    Other fixups exist, but the Protocol and Fixup Port Range table displays only those that can be changed.

---

Step 3   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

Basic Fixups Field-Level Elements and Descriptions

Note

• In each Fixup row (unless specified), you can enter a list of ports or port ranges to fix up using comma-separated values or spaces.

Configuring Multimedia Fixups

The Fixups feature is an informational list of services, protocols, and port numbers to which a firewall device applies the Adaptive Security Algorithm (ASA). The default ports or those you specify are the ports at which the firewall device listens for each service. To access this feature, select Configuration > Device Settings > Advanced Security > Multimedia Fixups.

The default configuration of the firewall device includes a set of application inspection entries that associate supported protocols with specific TCP or UDP port numbers and that identify any special handling required. The inspection function does not support NAT or PAT for certain applications because of the constraints imposed by the applications. You can change the port assignments for some applications, while other applications have fixed port assignments that you cannot change.

Applying Multimedia Fixups

The Multimedia Fixups page appears.

Step 2   Select the check boxes for the fixup protocols to enable, then enter the ports or port ranges in the corresponding text field where needed. See Multimedia Fixups Field-Level Elements and Descriptions.

---

Note    Other fixups exist, but only those that can be changed are displayed in the Protocol and Fixup Port Range table.

---

Step 3   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to the firewall devices at deployment.

Multimedia Fixups Field-Level Elements and Descriptions

Note

• For each Fixup row (unless specified), you can enter a list of ports or port ranges to fix up using comma-separated values or spaces.

Configuring Flood Guard

The Flood Guard feature lets you reclaim firewall device resources if the user-authentication subsystem runs out of resources. If an inbound or outbound user-authentication connection is being attacked or overused, the firewall device actively reclaims TCP user resources. To access this feature, select Configuration > Device Settings > Advanced Security > Flood Guard.

Enabling Flood Guard

The Flood Guard page appears.

Step 2   Select the Enable Flood Guard check box to enable flood guard.

Step 3   Click Apply.

Changes are applied to the assigned firewall device configuration files when the files are generated. The configuration files are then downloaded to firewall devices at deployment.

Flood Guard Field-Level Elements and Descriptions