Cisco ASA 5500 Series Configuration Guide using the CLI, 8.4 and 8.6

Detailed Steps

Step 1 Connect a PC to the console port using the provided console cable, and connect to the console using a terminal emulator set for 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control.

See the hardware guide for your ASA for more information about the console cable.

Step 2 Press the Enter key to see the following prompt:

hostname>

This prompt indicates that you are in user EXEC mode. Only basic commands are available from user EXEC mode.

Step 3 To access privileged EXEC mode, enter the following command:

The following prompt appears:

All non-configuration commands are available in privileged EXEC mode. You can also enter configuration mode from privileged EXEC mode.

Step 4 Enter the enable password at the prompt.

By default, the password is blank, and you can press the Enter key to continue. See the “Configuring the Hostname, Domain Name, and Passwords” section to change the enable password.

The prompt changes to the following:

To exit privileged mode, enter the disable, exit, or quit command.

Step 5 To access global configuration mode, enter the following command:

The prompt changes to the following:

You can begin to configure the ASA from global configuration mode. To exit global configuration mode, enter the exit, quit, or end command.

Accessing ASDM Using the Factory Default Configuration

With a factory default configuration (see the “Factory Default Configurations” section), ASDM connectivity is preconfigured with default network settings. Connect to ASDM using the following interface and network settings:

• The management interface depends on your model:

– ASA 5505—The switch port to which you connect to ASDM can be any port, except for Ethernet 0/0.

– ASA 5510 and higher—The interface to which you connect to ASDM is Management 0/0.

• The default management address is 192.168.1.1.
• The clients allowed to access ASDM must be on the 192.168.1.0/24 network. The default configuration enables DHCP so your management station can be assigned an IP address in this range. To allow other client IP addresses to access ASDM, see the “Configuring ASA Access for ASDM, Telnet, or SSH” section.

To launch ASDM, see the “Starting ASDM” section.

Note To change to multiple context mode, see the “Enabling or Disabling Multiple Context Mode” section. After changing to multiple context mode, you can access ASDM from the admin context using the network settings above.

Accessing ASDM Using a Non-Default Configuration (ASA 5505)

If you do not have a factory default configuration, or want to change to transparent firewall mode, perform the following steps. See also the sample configurations in the “ASA 5505 Default Configuration” section.

Prerequisites

Access the CLI according to the “Accessing the Appliance Command-Line Interface” section.

Detailed Steps

Examples

The following configuration converts the firewall mode to transparent mode, configures the VLAN 1 interface and assigns it to BVI 1, enables a switchport, and enables ASDM for a management host:

firewall transparent

interface bvi 1

interface ethernet 0/1

dhcpd address 192.168.1.5-192.168.1.254 inside

dhcpd enable inside

http server enable

http 192.168.1.0 255.255.255.0 inside

Accessing ASDM Using a Non-Default Configuration (ASA 5510 and Higher)

If you do not have a factory default configuration, or want to change the firewall or context mode, perform the following steps.

Prerequisites

Access the CLI according to the “Accessing the Appliance Command-Line Interface” section.

Detailed Steps

Examples

The following configuration converts the firewall mode to transparent mode, configures the Management 0/0 interface, and enables ASDM for a management host:

firewall transparent

interface management 0/0

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

http server enable

http 192.168.1.0 255.255.255.0 management

Connecting to ASDM for the First Time

To connect to ASDM for the first time to download the ASDM-IDM Launcher or Java Web Start application, perform the following steps:

Step 1 From a supported web browser on the ASA network, enter the following URL:

Where interface_ip_address is the management IP address of the ASA. See the “Configuring ASDM Access for Appliances” section for more information about management access.

See the ASDM release notes for your release for the requirements to run ASDM.

The ASDM launch page appears with the following buttons:

• Install ASDM Launcher and Run ASDM (Windows only)
• Run ASDM
• Run Startup Wizard

Step 2 To download the Launcher:

a. Click Install ASDM Launcher and Run ASDM.

b. Enter the username and password, and click OK. For a factory default configuration, leave these fields empty. With no HTTPS authentication configured, you can gain access to ASDM with no username and the enable password, which is blank by default. With HTTPS authentication enabled, enter your username and associated password.

c. Save the installer to your PC, and then start the installer. The ASDM-IDM Launcher opens automatically after installation is complete.

d. See the “Starting ASDM from the ASDM-IDM Launcher” section to use the Launcher to connect to ASDM.

Step 3 To use the Java Web Start application:

a. Click Run ASDM or Run Startup Wizard.

b. Save the application to your PC when prompted. You can optionally open it instead of saving it.

c. See the “Starting ASDM from the Java Web Start Application” section to use the Java Web Start application to connect to ASDM.

Starting ASDM from the ASDM-IDM Launcher

To start ASDM from the ASDM-IDM Launcher, perform the following steps.

Prerequisites

Download the ASDM-IDM Launcher according to the “Connecting to ASDM for the First Time” section.

Detailed Steps

Step 1 Start the ASDM-IDM Launcher application.

Step 2 Enter or choose the ASA IP address or hostname to which you want to connect. To clear the list of IP addresses, click the trash can icon next to the Device/IP Address/Name field.

Step 3 Enter your username and your password, and then click OK.

For a factory default configuration, leave these fields empty. With no HTTPS authentication configured, you can gain access to ASDM with no username and the enable password, which is blank by default. With HTTPS authentication enabled, enter your username and associated password.

If there is a new version of ASDM on the ASA, the ASDM Launcher automatically downloads the new version and requests that you update the current version before starting ASDM.

The main ASDM window appears.

Starting ASDM from the Java Web Start Application

To start ASDM from the Java Web Start application, perform the following steps.

Prerequisites

Download the Java Web Start application according to the “Connecting to ASDM for the First Time” section.

Detailed Steps

Step 1 Start the Java Web Start application.

Step 2 Accept any certificates according to the dialog boxes that appear. The Cisco ASDM-IDM Launcher appears.

Step 3 Enter the username and password, and click OK. For a factory default configuration, leave these fields empty. With no HTTPS authentication configured, you can gain access to ASDM with no username and the enable password, which is blank by default. With HTTPS authentication enabled, enter your username and associated password.

The main ASDM window appears.

Using ASDM in Demo Mode

The ASDM Demo Mode, a separately installed application, lets you run ASDM without having a live device available. In this mode, you can do the following:

• Perform configuration and selected monitoring tasks via ASDM as though you were interacting with a real device.
• Demonstrate ASDM or ASA features using the ASDM interface.
• Perform configuration and monitoring tasks with the CSC SSM.
• Obtain simulated monitoring and logging data, including real-time syslog messages. The data shown is randomly generated; however, the experience is identical to what you would see when you are connected to a real device.

This mode has been updated to support the following features:

• For global policies, an ASA in single, routed mode and intrusion prevention
• For object NAT, an ASA in single, routed mode and a firewall DMZ.
• For the Botnet Traffic Filter, an ASA in single, routed mode and security contexts.
• Site-to-Site VPN with IPv6 (Clientless SSL VPN and IPsec VPN)
• Promiscuous IDS (intrusion prevention)
• Unified Communication Wizard

This mode does not support the following:

• Saving changes made to the configuration that appear in the GUI.
• File or disk operations.
• Historical monitoring data.
• Non-administrative users.
• These features:

– File menu:

Save Running Configuration to Flash

Save Running Configuration to TFTP Server

Save Running Configuration to Standby Unit

Save Internal Log Buffer to Flash

Clear Internal Log Buffer

– Tools menu:

Command Line Interface

Ping

File Management

Update Software

File Transfer

Upload Image from Local PC

System Reload

– Toolbar/Status bar > Save

– Configuration > Interface > Edit Interface > Renew DHCP Lease

– Configuring a standby device after failover

• Operations that cause a rereading of the configuration, in which the GUI reverts to the original configuration:

– Switching contexts

– Making changes in the Interface pane

– NAT pane changes

– Clock pane changes

To run ASDM in Demo Mode, perform the following steps:

Step 1 Download the ASDM Demo Mode installer, asdm-demo- version.msi, from the following location: http://www.cisco.com/cisco/web/download/index.html.

Step 2 Double-click the installer to install the software.

Step 3 Double-click the Cisco ASDM Launcher shortcut on your desktop, or open it from the Start menu.

Step 4 Check the Run in Demo Mode check box.

The Demo Mode window appears.

Restoring the Factory Default Configuration

This section describes how to restore the factory default configuration.

Limitations

This feature is available only in routed firewall mode; transparent mode does not support IP addresses for interfaces. In addition, this feature is available only in single context mode; an ASA with a cleared configuration does not have any defined contexts to configure automatically using this feature.

Detailed Steps

Using the CLI:

What to Do Next

See the “Working with the Configuration” section to start configuring the ASA.

ASA 5505 Default Configuration

The default configuration is available for routed mode only. This section describes the default configuration and also provides a sample transparent mode configuration that you can copy and paste as a starting point. This section includes the following topics:

• ASA 5505 Routed Mode Default Configuration
• ASA 5505 Transparent Mode Sample Configuration

ASA 5505 Routed Mode Default Configuration

The default factory configuration for the ASA 5505 configures the following:

• Interfaces—Inside (VLAN 1) and outside (VLAN 2).
• Switchports enabled and assigned—Ethernet 0/1 through 0/7 switch ports assigned to inside. Ethernet 0/0 assigned to outside.
• IP addresses— Outside address from DHCP; inside address set manually to 192.168.1.1/24.
• Network Address Translation (NAT)—All inside IP addresses are translated when accessing the outside using interface PAT.
• Traffic flow—IPv4 and IPv6 traffic allowed from inside to outside (this behavior is implicit on the ASA). Outside users are prevented from accessing the inside.
• DHCP server—Enabled for inside hosts, so a PC connecting to the inside interface receives an address between 192.168.1.5 and 192.168.1.254. DNS, WINS, and domain information obtained from the DHCP client on the outside interface is passed to the DHCP clients on the inside interface.
• Default route—Derived from DHCP.
• ASDM access—Inside hosts allowed.

Figure 3-1 shows the traffic flow for an ASA 5505 in routed mode.

Figure 3-1 ASA 5505 Routed Mode

The configuration consists of the following commands:

Note For testing purposes, you can allow ping from inside to outside by enabling ICMP inspection. Add the following commands to the default configuration:

ASA 5505 Transparent Mode Sample Configuration

When you change the mode to transparent mode, the configuration is erased. You can copy and paste the following sample configuration at the CLI to get started. This configuration uses the default configuration as a starting point. Note the following areas you may need to modify:

• IP addresses—The IP addresses configured should be changed to match the network to which you are connecting.
• Static routes—For some kinds of traffic, static routes are required. See the “MAC Address vs. Route Lookups” section.
• Figure 3-2 shows the traffic flow for an ASA 5505 in transparent mode.

Figure 3-2 ASA 5505 Transparent Mode

Note For testing purposes, you can allow ping from inside to outside by enabling ICMP inspection. Add the following commands to the sample configuration:

ASA 5510 and Higher Default Configuration

The default factory configuration for the ASA 5510 and higher configures the following:

• Management interface—Management 0/0 (management).
• IP address—The management address is 192.168.1.1/24.
• DHCP server—Enabled for management hosts, so a PC connecting to the management interface receives an address between 192.168.1.2 and 192.168.1.254.
• ASDM access—Management hosts allowed.

The configuration consists of the following commands:

Saving Configuration Changes

This section describes how to save your configuration and includes the following topics:

• Saving Configuration Changes in Single Context Mode
• Saving Configuration Changes in Multiple Context Mode

Saving Configuration Changes in Single Context Mode

To save the running configuration to the startup configuration, enter the following command:

Saving Configuration Changes in Multiple Context Mode

You can save each context (and system) configuration separately, or you can save all context configurations at the same time. This section includes the following topics:

• Saving Each Context and System Separately
• Saving All Context Configurations at the Same Time

Saving Each Context and System Separately

To save the system or context configuration, enter the following command within the system or context:

Saving All Context Configurations at the Same Time

To save all context configurations at the same time, as well as the system configuration, enter the following command in the system execution space:

After the ASA saves each context, the following message appears:

Sometimes, a context is not saved because of an error. See the following information for errors:

• For contexts that are not saved because of low memory, the following message appears:

• For contexts that are not saved because the remote destination is unreachable, the following message appears:

• For contexts that are not saved because the context is locked, the following message appears:

A context is only locked if another user is already saving the configuration or in the process of deleting the context.

• For contexts that are not saved because the startup configuration is read-only (for example, on an HTTP server), the following message report is printed at the end of all other messages:

• For contexts that are not saved because of bad sectors in the flash memory, the following message appears:

Copying the Startup Configuration to the Running Configuration

Copy a new startup configuration to the running configuration using one of the following options.

Viewing the Configuration

The following commands let you view the running and startup configurations.

Clearing and Removing Configuration Settings

To erase settings, enter one of the following commands.

Creating Text Configuration Files Offline

This guide describes how to use the CLI to configure the ASA; when you save commands, the changes are written to a text file. Instead of using the CLI, however, you can edit a text file directly on your PC and paste a configuration at the configuration mode command-line prompt in its entirety, or line by line. Alternatively, you can download a text file to the ASA internal flash memory. See “Managing Software and Configurations,” for information on downloading the configuration file to the ASA.

In most cases, commands described in this guide are preceded by a CLI prompt. The prompt in the following example is “hostname(config)#”:

In the text configuration file you are not prompted to enter commands, so the prompt is omitted as follows:

For additional information about formatting the file, see Appendix A, “Using the Command-Line Interface.”

Detailed Steps