Cisco Security Cloud Control: Secure Firewall ASA Management

PDF

Cisco Security Cloud Control: Secure Firewall ASA Management

ASA system settings policy in Security Cloud Control Firewall Management

Updated: July 17, 2026

Want to summarize with AI?

Log in

An overview of ASA system settings policy, including DNS, HTTP, SSH, NTP, logging, sysopt, and device association settings.

Introduction to ASA system settings policy

Manage your ASA device's operations and functionalities using a System Settings policy. This policy includes essential configurations like domain name services, enabling the secure copy server, message logging, and permitting VPN traffic without checking ACLs. By setting up a policy, you can ensure that your device is properly configured to maintain a secure network environment.

When configuring an ASA device, it's important to note that you have the option to manage multiple devices' settings with a shared system settings policy, or you can individually edit the settings for any single device.

Shared system settings policy

A shared system settings policy applies to multiple ASA devices in your network. It makes it possible to configure multiple managed devices at once, which provides consistency in your deployment and streamlines your management efforts. Any changes made to a parameter of a shared policy affect the other ASA devices that use the policy.

Choose Policies > ASA > System Settings. See Create an ASA Shared System Settings Policy.

You can also modify the device-specific system settings specific to a single ASA device to override the shared system settings policy values. Choose Security Devices > ASA device > Management > Settings. See Configure or Modify Device Specific System Settings.

Create an ASA Shared System Settings Policy

Use this section to create a new shared system settings policy for ASA devices.

Procedure

1.

From the Security Cloud Control Home page, click Firewall.
2.

In the left pane, click Policies > ASA > System Settings.
3.

Click .
4.

In the Name field, enter a name for the policy and click Save.
5.

In the edit ASA shared system settings page, configure the parameters you want:

Note

  • An orange dot () on the corresponding parameter highlights unsaved changes.

  • The denied symbol () highlights parameters that use existing local values from the device.

Configure Basic DNS Settings

You need to configure a DNS server so that the ASA can resolve host names to IP addresses. You also must configure a DNS server to use fully qualified domain names (FQDN) network objects in access rules.

Procedure

1.

In the edit ASA system settings page, click DNS in the left pane.
2.

Uncheck the Retain existing values checkbox to configure the values for the shared ASA system settings policy.

If the Retain existing values check box is selected, you can't configure the values as the fields are hidden. Security Cloud Control uses the existing local values of the ASA device for this setting and doesn't inherit from the shared policy.
3.

In the DNS section, click to configure servers.

  • IP Version: Select the IP address version you want to use.

  • IP Address: Specify DNS server's IP address.

  • Interface Name: Specify the interface where the DNS lookup should be enabled.

Note

Ensure the interface name specified here is the same on the ASA devices associated with this shared system settings policy.
4.

Click Save.
5.

In the Domain name field, specify the domain name for the ASA.

The ASA appends the domain name as a suffix to unqualified names. For example, if you set the domain name to “example.com” and specify a syslog server by the unqualified name of “jupiter,” then the ASA qualifies the name to “jupiter.example.com.”
6.

In the DNS Lookup section, click and specify the interface name.

If you do not enable DNS lookup on an interface, then the ASA will not communicate with the DNS server on that interface. Make sure to enable DNS lookup on all interfaces that will be used to access DNS servers.

Note

To remove a configured interface, you can click the delete icon under Actions.

7.

Click Save.

Configure HTTP Settings

To access the ASA interface for management access, you must specify the addresses of all hosts/networks which are allowed to access the ASA using HTTP. If you configure HTTP redirect to redirect HTTP connections to HTTPS automatically, you must enable an access rule to allow HTTP; otherwise, the interface cannot listen to the HTTP port.

Procedure

1.

In the edit ASA system settings page, click HTTP in the left pane.

2.

Uncheck the Retain existing values checkbox to configure the values for the shared ASA system settings policy.

If the Retain existing values check box is selected, you can't configure the values as the fields are hidden. Security Cloud Control uses the existing local values of the ASA device for this setting and doesn't inherit from the shared policy.
3.

Check the Enable HTTP Server check box to enable the HTTP server.
4.

In the Port Number field, set the port number. The port identifies the port from which the interface redirects HTTP connections.

Warning

If you change the HTTP port on your device, it may cause some problems with its connection to Security Cloud Control. It's important to remember this if you plan to alter any settings related to your device's network connection.

5.

Click to add HTTP information.

  • Interface: Ensure the interface name specified here is the same on the ASA devices associated with this shared system settings policy.

  • IP Version: Select the IP address version you want to use.

  • IP Address: Specify the addresses of all hosts/networks that can access the ASA using HTTP.

  • Netmask: Specify the subnet mask for the network.

Note

To remove a host, you can click the delete icon under Actions.

6.

Click Save.

Set the Date and Time Using an NTP Server

NTP is used to implement a hierarchical system of servers that provide a precisely synchronized time among network systems. This kind of accuracy is required for time-sensitive operations, such as validating CRLs, which include a precise time stamp. You can configure multiple NTP servers. The ASA chooses the server with the lowest stratum—a measure of how reliable the data is.

Time derived from an NTP server overrides any time set manually.

The ASA supports NTPv4.

Procedure

1.

In the edit ASA system settings page, click NTP in the left pane.
2.

Uncheck the Retain existing values checkbox to configure the values for the shared ASA system settings policy.

If the Retain existing values check box is selected, you can't configure the values as the fields are hidden. Security Cloud Control uses the existing local values of the ASA device for this setting and doesn't inherit from the shared policy.
3.

Click to add NTP server details.

  • IP Version: Select the IP address version you want to use.

  • IP Address: Specify the NTP server's IP address.

    You cannot enter a hostname for the server; the ASA does not support DNS lookup for the NTP server.

  • Key Id: Enter a number between 1 and 4294967295.

    This setting specifies the key ID for this authentication key, which enables you to use authentication to communicate with the NTP server. The NTP server packets must also use this key ID.

  • Interface Name: Specify the interface name. Ensure the interface name specified here is the same on the ASA devices associated with this shared system settings policy.

    NTP uses an algorithm to determine which server is the most accurate and synchronizes to it. If servers are of similar accuracy, then the preferred server is used. However, if a server is significantly more accurate than the preferred one, the ASA uses the more accurate one.

  • Prefer: (optional) Check the Preferred check box to set this server as a preferred server.

Note

To remove an NTP server, you can click the delete icon under Actions.

4.

Click Save.

Configure SSH Access

You can enable the secure copy (SCP) server on the ASA. Only clients that are allowed to access the ASA using SSH can establish a secure copy connection.

Procedure

1.

In the edit ASA settings policy page, click SSH in the left pane.

2.

Uncheck the Retain existing values checkbox to configure the values for the shared ASA system settings policy.

If the Retain existing values check box is selected, you can't configure the values as the fields are hidden. Security Cloud Control uses the existing local values of the ASA device for this setting and doesn't inherit from the shared policy.
3.

Enable Enable Scopy SSH (secure copy SSH).

4.

In the Timeout in Minutes field, set the timeout from 1 to 60 minutes. The default is 5 minutes. The default duration is too short in most cases, and should be increased until all pre-production testing and troubleshooting have been completed.
5.

Click and configure the following:

  • Interface: Specify the interface name. Ensure the interface name specified here is the same on the ASA devices associated with this shared system settings policy.

  • IP Version: Select the IP address version you want to use.

  • IP Address: Specify the addresses of all hosts/networks that can access the ASA using SSH.

  • Netmask: Specify the subnet mask for the network.

Note

To remove SSH details, you can click the delete icon under Actions.

6.

Click Save.

Configure System Logging

System logging is a method of collecting messages from devices to a server running a syslog daemon. Logging to a central syslog server helps in aggregation of logs and alerts. Cisco devices can send their log messages to a UNIX-style syslog service. A syslog service accepts messages and stores them in files, or prints them according to a simple configuration file. This form of logging provides protected long-term storage for logs. Logs are useful both in routine troubleshooting and in incident handling.

Security Levels

The following table lists the syslog message severity levels.

Table 1. Syslog Message Severity Levels

Level Number

Security Level

Description

0

emergencies

System is unusable

1

alert

Immediate action is needed.

2

critical

Critical conditions.

3

error

Error conditions.

4

warning

Warning conditions.

5

notification

Normal but significant conditions.

6

informational

Informational messages only.

7

debugging

Debugging messages only.

Log at this level only temporarily, when debugging issues. This log level can potentially generate so many messages that system performance can be affected.
Note

ASA does not generate syslog messages with a severity level of zero (emergencies).

Procedure

1.

In the edit ASA system settings page, click Syslog in the left pane.
2.

Uncheck the Retain existing values checkbox to configure the values for the shared ASA system settings policy.

If the Retain existing values check box is selected, you can't configure the values as the fields are hidden. Security Cloud Control uses the existing local values of the ASA device for this setting and doesn't inherit from the shared policy.
3.

Configure the following:

  • Logging Enabled: Enable secure logging.

  • Timestamp Enabled: Enable to include the date and time in syslog messages.

  • Permit host down: (Optional) Disable the feature to block new connections when a TCP-connected syslog server is down.

  • Buffer Size: Specify the size of the internal log buffer. The allowed range is 4096 to 1048576 bytes.

  • Buffered Logging Level: Specify which syslog messages should be sent to the internal log buffer, which serves as a temporary storage location.

  • Console Logging Level: Specify which syslog messages should be sent to the console port.

  • Trap Logging Level: Specify which syslog messages should be sent to the syslog server.
4.

Click to add Syslog server details.

  • Interface Name: Specify the interface name on which the syslog server resides. Ensure the interface name specified here is the same on the ASA devices associated with this shared system settings policy.

  • IP Version: Select the IP address version you want to use.

  • IP Address: Specify the IP address of the syslog server.

  • Protocol: Choose the protocol (TCP or UDP) the ASA should use to send syslog messages to the syslog server.

    • Port: Specify the port that the syslog server listens to for syslog messages. The allowed TCP port range is 1 to 65535, and the UDP port range is 1025 to 65535.

    • Log messages in Cisco EMBLEM format (UDP only): Enables EMBLEM format logging for the syslog server with UDP only.

    • Enable secure syslog using SSL?: Specifies that the connection to the remote logging host should use SSL/TLS for TCP only.

  • Reference Identity: Specify the reference identity type to enable RFC 6125 reference identity checks on the certificate based on the previously configured reference identity object. See Configure Reference Identities for details on the reference identity object.

Note

To remove a Syslog server, you can click the delete icon under Actions.

5.

Click Save.

Enable Sysopt Settings

The crypto map ACL bound to the outgoing interface either permits or denies IPsec packets through the VPN tunnel. IPsec authenticates and deciphers packets that arrive from an IPsec tunnel, and subjects them to evaluation against the ACL associated with the tunnel.

ACLs define which IP traffic to protect. For example, you can create ACLs to protect all IP traffic between two subnets or two hosts.

Procedure

1.

In the edit ASA system settings page, click Sysopt in the left pane.
2.

Uncheck the Retain existing values checkbox to configure the values for the shared ASA system settings policy.

If the Retain existing values check box is selected, you can't configure the values as the fields are hidden. Security Cloud Control uses the existing local values of the ASA device for this setting and doesn't inherit from the shared policy.
3.

Enable Allow VPN traffic to bypass interface access lists bypasses the ACL inspection.
4.

Click Save.

Assign a Policy from the Shared System Settings Page

After configuring a shared system settings policy, assign onboarded ASA devices and deploy the settings to the devices for the changes to take effect. Any change made to the policy affects the devices that are associated with the policy.

You can also assign a policy from the device-specific settings page.

Note

You can associate an ASA device to only one shared system settings policy.

Procedure

1.

From the Security Cloud Control Home page, click Firewall.
2.

In the left pane, click Policies > ASA > System Settings.

3.

Select a shared policy and click Edit.
4.

Click the filter appearing beside the policy name to assign devices.
5.

Select the ASA devices you want to associate with the selected policy and click OK.

Note

The checkboxes are ticked for devices that are already associated with the selected policy.

If you see a red icon , it means that an error has occurred while applying the shared system settings policy to your devices. To troubleshoot the issue, click the policy on the ASA System Settings page and in the Error Detected pane, click the Device Workflows to get more information.
6.

Review and deploy the changes you have made.

Configure or Modify Device Specific System Settings

A device-specific system settings are existing values specific to an ASA device that can be modified using Security Cloud Control. You can override the shared system settings policy values with existing device-specific values for parameters you want.

This topic describes configuring an onboarded ASA device's system settings.

Procedure

1.

In the left pane, click Security Devices.
2.

Click the ASA tab.
3.

Select the ASA device you want and in the Management pane on the right, click Settings.

You will see the device-specific system settings of the selected ASA device.

Note

If the selected device is assigned with a shared system settings policy, the Parent Policy provides a link to open the policy. You can also assign a policy from the device-specific settings page. Select the ASA devices you want to associate with the selected policy and click OK
4.

Configure or modify the values of the system settings you want and click Save.

Note

The field descriptions for a shared and device-specific system settings remain the same. You can click the corresponding link below for more information.

You can click Return to Security Devices to navigate to the Security Devices page.
5.

Click Save after making the changes.

Note

An orange dot () on the corresponding parameter highlights unsaved changes.

Assign a Policy from Device-Specific Settings Page

You can also assign a policy from the device-specific settings page of an onboarded ASA device.

Procedure

1.

In the left pane, click Security Devices.
2.

Click the ASA tab.
3.

Select the ASA device you want and in the Management pane on the right, click Settings.

You will see the device-specific settings of the selected ASA device.

Note

If the selected device is assigned with a shared system settings policy, the Parent Policy provides a link to open the policy. Select the ASA devices you want to associate with the selected policy and click OK
4.

Click the Parent Policy button to assign a shared system settings policy.

5.

Select a policy and click Apply.

6.

Review and deploy the changes you have made.

Auto Assignment of ASA Devices to a Shared System Settings Policy

When onboarding a new ASA device, or checking for changes or handing out-of-band changes for existing devices, Security Cloud Control verifies whether:

  • The device-specific settings match a pre-existing shared system settings policy. If there is a match, the device gets assigned to the shared system settings policy.

  • The device-specific settings of the onboarded devices match each other. If they do, a new shared system settings policy gets created automatically, and devices with the same local settings are assigned to this shared policy.

Note

You can rename the Shared Settings policy whether it was created by the user or the system.

Filter ASA Shared System Settings Policy

If you're searching for specific shared system settings policies on the ASA System Setting page, you can use filters based on issues and usage to narrow down your search and find what you're looking for more easily.

Click Policies > ASA > System Settings > .

  • Issues:

    • Issue Detected: Displays only the policies that have issues when applying devices to them.

    • No issue: Displays only the policies that are successfully applied to devices.

  • Usage:

    • In Use: Displays policies that have are assigned to devices.

    • Unused: Displays policies that have not been assigned to any devices yet.

Disassociate Devices from Shared System Settings Policy

If an ASA device is no longer needed in the shared system settings policy, you can easily dissociate it. The device detaches from the policy when:

  • Changes are made to the device-specific settings, where the corresponding setting on the shared policy is not configured to retain existing values from the device.

  • Devices are detached manually from the shared system settings policy.

  • Shared system settings policy is deleted from Security Cloud Control. However, this doesn’t delete the device. See Delete Shared Settings Policy.

Procedure

1.

From the Security Cloud Control Home page, click Firewall.
2.

In the left pane, click Policies > ASA > System Settings.
3.

Select a shared policy and click Edit.
4.

Click the filter appearing beside the policy name to detach devices.
5.

Uncheck the devices you want to detach from the selected shared system settings policy and click OK.

Note

The changes are saved automatically and don't require any manual deployment.

Delete Shared Settings Policy

If you want to remove some shared settings policies, you have the option to select one or more of them and delete them. However, it's important to note that you can only delete them if they haven't been applied or committed to any devices yet.

Before you begin

Ensure the devices are dissociated from the shared settings policy you wish to delete. See Disassociate Devices from Shared System Settings Policy for more information.

Procedure

1.

From the Security Cloud Control Home page, click Firewall.
2.

In the left pane, click Policies > ASA > System Settings.
3.

Select a shared policy and click Delete.
4.

Click OK to confirm your action.

Note

If you delete an ASA from Security Cloud Control, the device-specific settings and configurations will also be deleted, and the device references will be removed from the shared settings policy.