Cisco ASA 5505 User Manual
Cisco Hardware
This manual is related to the following products:
Table of contents
Document Outline
- About This Guide
- Getting Started with the ASA
- Introduction to the Cisco ASA 5500 Series
- Hardware and Software Compatibility
- VPN Specifications
- New Features
- Firewall Functional Overview
- Security Policy Overview
- Permitting or Denying Traffic with Access Lists
- Applying NAT
- Protecting from IP Fragments
- Using AAA for Through Traffic
- Applying HTTP, HTTPS, or FTP Filtering
- Applying Application Inspection
- Sending Traffic to the IPS Module
- Sending Traffic to the Content Security and Control Module
- Applying QoS Policies
- Applying Connection Limits and TCP Normalization
- Enabling Threat Detection
- Enabling the Botnet Traffic Filter
- Configuring Cisco Unified Communications
- Firewall Mode Overview
- Stateful Inspection Overview
- Security Policy Overview
- VPN Functional Overview
- Security Context Overview
- Getting Started
- Accessing the Appliance Command-Line Interface
- Configuring ASDM Access for Appliances
- Starting ASDM
- Factory Default Configurations
- Working with the Configuration
- Applying Configuration Changes to Connections
- Managing Feature Licenses
- Supported Feature Licenses Per Model
- Information About Feature Licenses
- Guidelines and Limitations
- Configuring Licenses
- Monitoring Licenses
- Feature History for Licensing
- Introduction to the Cisco ASA 5500 Series
- Configuring Firewall and Security Context Modes
- Configuring the Transparent or Routed Firewall
- Configuring the Firewall Mode
- Configuring ARP Inspection for the Transparent Firewall
- Customizing the MAC Address Table for the Transparent Firewall
- Firewall Mode Examples
- Configuring Multiple Context Mode
- Information About Security Contexts
- Licensing Requirements for Multiple Context Mode
- Guidelines and Limitations
- Default Settings
- Configuring Multiple Contexts
- Changing Between Contexts and the System Execution Space
- Managing Security Contexts
- Monitoring Security Contexts
- Configuration Examples for Multiple Context Mode
- Feature History for Multiple Context Mode
- Configuring the Transparent or Routed Firewall
- Configuring Interfaces
- Starting Interface Configuration (ASA 5510 and Higher)
- Information About Starting ASA 5510 and Higher Interface Configuration
- Licensing Requirements for ASA 5510 and Higher Interfaces
- Guidelines and Limitations
- Default Settings
- Starting Interface Configuration (ASA 5510 and Higher)
- Task Flow for Starting Interface Configuration
- Converting In-Use Interfaces to a Redundant or EtherChannel Interface
- Enabling the Physical Interface and Configuring Ethernet Parameters
- Configuring a Redundant Interface
- Configuring an EtherChannel
- Configuring VLAN Subinterfaces and 802.1Q Trunking
- Enabling Jumbo Frame Support (Supported Models)
- Monitoring Interfaces
- Configuration Examples for ASA 5510 and Higher Interfaces
- Where to Go Next
- Feature History for ASA 5510 and Higher Interfaces
- Starting Interface Configuration (ASA 5505)
- Completing Interface Configuration (Routed Mode)
- Information About Completing Interface Configuration in Routed Mode
- Licensing Requirements for Completing Interface Configuration in Routed Mode
- Guidelines and Limitations
- Default Settings
- Completing Interface Configuration in Routed Mode
- Monitoring Interfaces
- Configuration Examples for Interfaces in Routed Mode
- Feature History for Interfaces in Routed Mode
- Completing Interface Configuration (Transparent Mode)
- Information About Completing Interface Configuration in Transparent Mode
- Licensing Requirements for Completing Interface Configuration in Transparent Mode
- Guidelines and Limitations
- Default Settings
- Completing Interface Configuration in Transparent Mode
- Monitoring Interfaces
- Configuration Examples for Interfaces in Transparent Mode
- Feature History for Interfaces in Transparent Mode
- Starting Interface Configuration (ASA 5510 and Higher)
- Configuring Basic Settings
- Configuring Basic Settings
- Configuring DHCP
- Configuring Dynamic DNS
- Information About DDNS
- Licensing Requirements for DDNS
- Guidelines and Limitations
- Configuring DDNS
- Configuration Examples for DDNS
- Example 1: Client Updates Both A and PTR RRs for Static IP Addresses
- Example 2: Client Updates Both A and PTR RRs; DHCP Server Honors Client Update Request; FQDN Provided Through Configuration
- Example 3: Client Includes FQDN Option Instructing Server Not to Update Either RR; Server Overrides Client and Updates Both RRs.
- Example 4: Client Asks Server To Perform Both Updates; Server Configured to Update PTR RR Only; Honors Client Request and Updates Both A and PTR RR
- Example 5: Client Updates A RR; Server Updates PTR RR
- DDNS Monitoring Commands
- Feature History for DDNS
- Configuring Objects and Access Lists
- Configuring Objects
- Configuring Objects and Groups
- Configuring Regular Expressions
- Scheduling Extended Access List Activation
- Information About Scheduling Access List Activation
- Licensing Requirements for Scheduling Access List Activation
- Guidelines and Limitations for Scheduling Access List Activation
- Configuring and Applying Time Ranges
- Configuration Examples for Scheduling Access List Activation
- Feature History for Scheduling Access List Activation
- Information About Access Lists
- Adding an Extended Access List
- Adding an EtherType Access List
- Information About EtherType Access Lists
- Licensing Requirements for EtherType Access Lists
- Guidelines and Limitations
- Default Settings
- Configuring EtherType Access Lists
- What to Do Next
- Monitoring EtherType Access Lists
- Configuration Examples for EtherType Access Lists
- Feature History for EtherType Access Lists
- Adding a Standard Access List
- Adding a Webtype Access List
- Adding an IPv6 Access List
- Information About IPv6 Access Lists
- Licensing Requirements for IPv6 Access Lists
- Prerequisites for Adding IPv6 Access Lists
- Guidelines and Limitations
- Default Settings
- Configuring IPv6 Access Lists
- Monitoring IPv6 Access Lists
- Configuration Examples for IPv6 Access Lists
- Where to Go Next
- Feature History for IPv6 Access Lists
- Configuring Logging for Access Lists
- Configuring Objects
- Configuring IP Routing
- Routing Overview
- Configuring Static and Default Routes
- Defining Route Maps
- Configuring OSPF
- Information About OSPF
- Licensing Requirements for OSPF
- Guidelines and Limitations
- Configuring OSPF
- Customizing OSPF
- Redistributing Routes Into OSPF
- Configuring Route Summarization When Redistributing Routes Into OSPF
- Configuring Route Summarization Between OSPF Areas
- Configuring OSPF Interface Parameters
- Configuring OSPF Area Parameters
- Configuring OSPF NSSA
- Defining Static OSPF Neighbors
- Configuring Route Calculation Timers
- Logging Neighbors Going Up or Down
- Restarting the OSPF Process
- Configuration Example for OSPF
- Monitoring OSPF
- Feature History for OSPF
- Configuring RIP
- Configuring Multicast Routing
- Information About Multicast Routing
- Licensing Requirements for Multicast Routing
- Guidelines and Limitations
- Enabling Multicast Routing
- Customizing Multicast Routing
- Configuration Example for Multicast Routing
- Additional References
- Feature History for Multicast Routing
- Configuring EIGRP
- Information About EIGRP
- Licensing Requirements for EIGRP
- Guidelines and Limitations
- Configuring EIGRP
- Customizing EIGRP
- Defining a Network for an EIGRP Routing Process
- Configuring Interfaces for EIGRP
- Configuring the Summary Aggregate Addresses on Interfaces
- Changing the Interface Delay Value
- Enabling EIGRP Authentication on an Interface
- Defining an EIGRP Neighbor
- Redistributing Routes Into EIGRP
- Filtering Networks in EIGRP
- Customizing the EIGRP Hello Interval and Hold Time
- Disabling Automatic Route Summarization
- Configuring Default Information in EIGRP
- Disabling EIGRP Split Horizon
- Restarting the EIGRP Process
- Monitoring EIGRP
- Configuration Example for EIGRP
- Feature History for EIGRP
- Configuring IPv6 Neighbor Discovery
- Information About IPv6 Neighbor Discovery
- Licensing Requirements for IPv6 Neighbor Discovery
- Guidelines and Limitations
- Default Settings for IPv6 Neighbor Discovery
- Configuring the Neighbor Solicitation Message Interval
- Configuring the Neighbor Reachable Time
- Configuring the Router Advertisement Transmission Interval
- Configuring the Router Lifetime Value
- Configuring DAD Settings
- Configuring IPv6 Addresses on an Interface
- Suppressing Router Advertisement Messages
- Configuring the IPv6 Prefix
- Configuring a Static IPv6 Neighbor
- Monitoring IPv6 Neighbor Discovery
- Additional References
- Feature History for IPv6 Neighbor Discovery
- Configuring Network Address Translation
- Information About NAT
- Configuring Network Object NAT
- Information About Network Object NAT
- Licensing Requirements for Network Object NAT
- Prerequisites for Network Object NAT
- Guidelines and Limitations
- Default Settings
- Configuring Network Object NAT
- Monitoring Network Object NAT
- Configuration Examples for Network Object NAT
- Providing Access to an Inside Web Server (Static NAT)
- NAT for Inside Hosts (Dynamic NAT) and NAT for an Outside Web Server (Static NAT)
- Inside Load Balancer with Multiple Mapped Addresses (Static NAT, One-to-Many)
- Single Address for FTP, HTTP, and SMTP (Static NAT-with-Port-Translation)
- DNS Server on Mapped Interface, Web Server on Real Interface (Static NAT with DNS Modification)
- DNS Server and Web Server on Mapped Interface, Web Server is Translated (Static NAT with DNS Modification)
- Feature History for Network Object NAT
- Configuring Twice NAT
- Configuring Service Policies Using the Modular Policy Framework
- Configuring a Service Policy Using the Modular Policy Framework
- Information About Service Policies
- Licensing Requirements for Service Policies
- Guidelines and Limitations
- Default Settings
- Task Flows for Configuring Service Policies
- Identifying Traffic (Layer 3/4 Class Maps)
- Defining Actions (Layer 3/4 Policy Map)
- Applying Actions to an Interface (Service Policy)
- Monitoring Modular Policy Framework
- Configuration Examples for Modular Policy Framework
- Feature History for Service Policies
- Configuring Special Actions for Application Inspections (Inspection Policy Map)
- Configuring a Service Policy Using the Modular Policy Framework
- Configuring Access Control
- Configuring Access Rules
- Information About Access Rules
- Licensing Requirements for Access Rules
- Prerequisites
- Guidelines and Limitations
- Default Settings
- Configuring Access Rules
- Monitoring Access Rules
- Configuration Examples for Permitting or Denying Network Access
- Feature History for Access Rules
- Configuring AAA Servers and the Local Database
- Information About AAA
- Information About Authentication
- Information About Authorization
- Information About Accounting
- Summary of Server Support
- RADIUS Server Support
- TACACS+ Server Support
- RSA/SDI Server Support
- NT Server Support
- Kerberos Server Support
- LDAP Server Support
- HTTP Forms Authentication for Clientless SSL VPN
- Local Database Support, Including as a Falback Method
- How Fallback Works with Multiple Servers in a Group
- Using Certificates and User Login Credentials
- Licensing Requirements for AAA Servers
- Guidelines and Limitations
- Configuring AAA
- Task Flow for Configuring AAA
- Configuring AAA Server Groups
- Configuring Authorization with LDAP for VPN
- Configuring LDAP Attribute Maps
- Adding a User Account to the Local Database
- Managing User Passwords
- .Changing User Passwords
- Authenticating Users with a Public Key for SSH
- Differentiating User Roles Using AAA
- Monitoring AAA Servers
- Additional References
- Feature History for AAA Servers
- Information About AAA
- Configuring the Identity Firewall
- Configuring Management Access
- Configuring ASA Access for ASDM, Telnet, or SSH
- Configuring CLI Parameters
- Configuring ICMP Access
- Configuring Management Access Over a VPN Tunnel
- Configuring AAA for System Administrators
- Information About AAA for System Administrators
- Licensing Requirements for AAA for System Administrators
- Prerequisites
- Guidelines and Limitations
- Default Settings
- Configuring Authentication for CLI and ASDM Access
- Configuring Authentication to Access Privileged EXEC Mode (the enable Command)
- Limiting User CLI and ASDM Access with Management Authorization
- Configuring Command Authorization
- Configuring Management Access Accounting
- Viewing the Currently Logged-In User
- Recovering from a Lockout
- Setting a Management Session Quota
- Feature History for Management Access
- Configuring AAA Rules for Network Access
- AAA Performance
- Licensing Requirements for AAA Rules
- Guidelines and Limitations
- Configuring Authentication for Network Access
- Configuring Authorization for Network Access
- Configuring Accounting for Network Access
- Using MAC Addresses to Exempt Traffic from Authentication and Authorization
- Feature History for AAA Rules
- Configuring Filtering Services
- Information About Web Traffic Filtering
- Configuring ActiveX Filtering
- Licensing Requirements for ActiveX Filtering
- Configuring Java Applet Filtering
- Filtering URLs and FTP Requests with an External Server
- Monitoring Filtering Statistics
- Configuring Web Cache Services Using WCCP
- Configuring Digital Certificates
- Information About Digital Certificates
- Licensing Requirements for Digital Certificates
- Prerequisites for Local Certificates
- Guidelines and Limitations
- Configuring Digital Certificates
- Configuring Key Pairs
- Removing Key Pairs
- Configuring Trustpoints
- Configuring CRLs for a Trustpoint
- Exporting a Trustpoint Configuration
- Importing a Trustpoint Configuration
- Configuring CA Certificate Map Rules
- Obtaining Certificates Manually
- Obtaining Certificates Automatically with SCEP
- Configuring Proxy Support for SCEP Requests
- Enabling the Local CA Server
- Configuring the Local CA Server
- Customizing the Local CA Server
- Debugging the Local CA Server
- Disabling the Local CA Server
- Deleting the Local CA Server
- Configuring Local CA Certificate Characteristics
- Configuring the Issuer Name
- Configuring the CA Certificate Lifetime
- Configuring the User Certificate Lifetime
- Configuring the CRL Lifetime
- Configuring the Server Keysize
- Setting Up External Local CA File Storage
- Downloading CRLs
- Storing CRLs
- Setting Up Enrollment Parameters
- Adding and Enrolling Users
- Renewing Users
- Restoring Users
- Removing Users
- Revoking Certificates
- Maintaining the Local CA Certificate Database
- Rolling Over Local CA Certificates
- Archiving the Local CA Server Certificate and Keypair
- Monitoring Digital Certificates
- Feature History for Certificate Management
- Configuring Access Rules
- Configuring Application Inspection
- Getting Started with Application Layer Protocol Inspection
- Configuring Inspection of Basic Internet Protocols
- DNS Inspection
- FTP Inspection
- HTTP Inspection
- ICMP Inspection
- ICMP Error Inspection
- Instant Messaging Inspection
- IP Options Inspection
- IPsec Pass Through Inspection
- IPv6 Inspection
- NetBIOS Inspection
- PPTP Inspection
- SMTP and Extended SMTP Inspection
- TFTP Inspection
- Configuring Inspection for Voice and Video Protocols
- CTIQBE Inspection
- H.323 Inspection
- MGCP Inspection
- RTSP Inspection
- SIP Inspection
- Skinny (SCCP) Inspection
- Configuring Inspection of Database and Directory Protocols
- Configuring Inspection for Management Application Protocols
- Configuring Unified Communications
- Information About Cisco Unified Communications Proxy Features
- Configuring the Cisco Phone Proxy
- Information About the Cisco Phone Proxy
- Licensing Requirements for the Phone Proxy
- Prerequisites for the Phone Proxy
- Media Termination Instance Prerequisites
- Certificates from the Cisco UCM
- DNS Lookup Prerequisites
- Cisco Unified Communications Manager Prerequisites
- Access List Rules
- NAT and PAT Prerequisites
- Prerequisites for IP Phones on Multiple Interfaces
- 7960 and 7940 IP Phones Support
- Cisco IP Communicator Prerequisites
- Prerequisites for Rate Limiting TFTP Requests
- About ICMP Traffic Destined for the Media Termination Address
- End-User Phone Provisioning
- Phone Proxy Guidelines and Limitations
- Configuring the Phone Proxy
- Task Flow for Configuring the Phone Proxy in a Non-secure Cisco UCM Cluster
- Importing Certificates from the Cisco UCM
- Task Flow for Configuring the Phone Proxy in a Mixed-mode Cisco UCM Cluster
- Creating Trustpoints and Generating Certificates
- Creating the CTL File
- Using an Existing CTL File
- Creating the TLS Proxy Instance for a Non-secure Cisco UCM Cluster
- Creating the TLS Proxy for a Mixed-mode Cisco UCM Cluster
- Creating the Media Termination Instance
- Creating the Phone Proxy Instance
- Enabling the Phone Proxy with SIP and Skinny Inspection
- Configuring Linksys Routers with UDP Port Forwarding for the Phone Proxy
- Troubleshooting the Phone Proxy
- Debugging Information from the Security Appliance
- Debugging Information from IP Phones
- IP Phone Registration Failure
- TFTP Auth Error Displays on IP Phone Console
- Configuration File Parsing Error
- Configuration File Parsing Error: Unable to Get DNS Response
- Non-configuration File Parsing Error
- Cisco UCM Does Not Respond to TFTP Request for Configuration File
- IP Phone Does Not Respond After the Security Appliance Sends TFTP Data
- IP Phone Requesting Unsigned File Error
- IP Phone Unable to Download CTL File
- IP Phone Registration Failure from Signaling Connections
- SSL Handshake Failure
- Certificate Validation Errors
- Media Termination Address Errors
- Audio Problems with IP Phones
- Saving SAST Keys
- Configuration Examples for the Phone Proxy
- Example 1: Nonsecure Cisco UCM cluster, Cisco UCM and TFTP Server on Publisher
- Example 2: Mixed-mode Cisco UCM cluster, Cisco UCM and TFTP Server on Publisher
- Example 3: Mixed-mode Cisco UCM cluster, Cisco UCM and TFTP Server on Different Servers
- Example 4: Mixed-mode Cisco UCM cluster, Primary Cisco UCM, Secondary and TFTP Server on Different Servers
- Example 5: LSC Provisioning in Mixed-mode Cisco UCM cluster; Cisco UCM and TFTP Server on Publisher
- Example 6: VLAN Transversal
- Feature History for the Phone Proxy
- Configuring the TLS Proxy for Encrypted Voice Inspection
- Configuring Cisco Mobility Advantage
- Configuring Cisco Unified Presence
- Configuring Cisco Intercompany Media Engine Proxy
- Information About Cisco Intercompany Media Engine Proxy
- Licensing for Cisco Intercompany Media Engine
- Guidelines and Limitations
- Configuring Cisco Intercompany Media Engine Proxy
- Task Flow for Configuring Cisco Intercompany Media Engine
- Configuring NAT for Cisco Intercompany Media Engine Proxy
- Configuring PAT for the Cisco UCM Server
- Creating Access Lists for Cisco Intercompany Media Engine Proxy
- Creating the Media Termination Instance
- Creating the Cisco Intercompany Media Engine Proxy
- Creating Trustpoints and Generating Certificates
- Creating the TLS Proxy
- Enabling SIP Inspection for the Cisco Intercompany Media Engine Proxy
- (Optional) Configuring TLS within the Local Enterprise
- (Optional) Configuring Off Path Signaling
- Configuring the Cisco UC-IMC Proxy by using the UC-IME Proxy Pane
- Configuring the Cisco UC-IMC Proxy by using the Unified Communications Wizard
- Troubleshooting Cisco Intercompany Media Engine Proxy
- Feature History for Cisco Intercompany Media Engine Proxy
- Configuring Connection Settings and QoS
- Configuring Connection Settings
- Configuring QoS
- Information About QoS
- Licensing Requirements for QoS
- Guidelines and Limitations
- Configuring QoS
- Monitoring QoS
- Feature History for QoS
- Configuring Advanced Network Protection
- Configuring the Botnet Traffic Filter
- Information About the Botnet Traffic Filter
- Licensing Requirements for the Botnet Traffic Filter
- Guidelines and Limitations
- Default Settings
- Configuring the Botnet Traffic Filter
- Monitoring the Botnet Traffic Filter
- Configuration Examples for the Botnet Traffic Filter
- Where to Go Next
- Feature History for the Botnet Traffic Filter
- Configuring Threat Detection
- Using Protection Tools
- Configuring the Botnet Traffic Filter
- Configuring Modules
- Configuring the ASA IPS Module
- Information About the ASA IPS module
- Licensing Requirements for the ASA IPS module
- Guidelines and Limitations
- Default Settings
- Configuring the ASA IPS module
- Task Flow for the ASA IPS Module
- Connecting Management Interface Cables
- Sessioning to the Module from the ASA
- Configuring Basic IPS Module Network Settings
- (ASA 5512-X through ASA 5555-X) Installing the Software Module
- Configuring the Security Policy on the ASA IPS module
- Assigning Virtual Sensors to a Security Context (ASA 5510 and Higher)
- Diverting Traffic to the ASA IPS module
- Monitoring the ASA IPS module
- Troubleshooting the ASA IPS module
- Configuration Examples for the ASA IPS module
- Feature History for the ASA IPS module
- Configuring the ASA CX Module
- Information About the ASA CX Module
- Licensing Requirements for the ASA CX Module
- Guidelines and Limitations
- Default Settings
- Configuring the ASA CX Module
- Task Flow for the ASA CX Module
- Connecting Management Interface Cables
- Configuring the ASA CX Management IP Address
- Configuring Basic ASA CX Settings at the ASA CX CLI
- Configuring the Security Policy on the ASA CX Module Using PRSM
- (Optional) Configuring the Authentication Proxy Port
- Redirecting Traffic to the ASA CX Module
- Monitoring the ASA CX Module
- Troubleshooting the ASA CX Module
- Configuration Examples for the ASA CX Module
- Feature History for the ASA CX Module
- Configuring the ASA CSC Module
- Information About the CSC SSM
- Licensing Requirements for the CSC SSM
- Prerequisites for the CSC SSM
- Guidelines and Limitations
- Default Settings
- Configuring the CSC SSM
- Monitoring the CSC SSM
- Troubleshooting the CSC Module
- Configuration Examples for the CSC SSM
- Where to Go Next
- Additional References
- Feature History for the CSC SSM
- Configuring the ASA IPS Module
- Configuring High Availability
- Information About High Availability
- Introduction to Failover and High Availability
- Failover System Requirements
- Failover and Stateful Failover Links
- Active/Active and Active/Standby Failover
- Stateless (Regular) and Stateful Failover
- Transparent Firewall Mode Requirements
- Auto Update Server Support in Failover Configurations
- Failover Health Monitoring
- Failover Times
- Failover Messages
- Configuring Active/Standby Failover
- Information About Active/Standby Failover
- Licensing Requirements for Active/Standby Failover
- Prerequisites for Active/Standby Failover
- Guidelines and Limitations
- Configuring Active/Standby Failover
- Controlling Failover
- Monitoring Active/Standby Failover
- Feature History for Active/Standby Failover
- Configuring Active/Active Failover
- Information About Active/Active Failover
- Licensing Requirements for Active/Active Failover
- Prerequisites for Active/Active Failover
- Guidelines and Limitations
- Configuring Active/Active Failover
- Remote Command Execution
- Controlling Failover
- Monitoring Active/Active Failover
- Feature History for Active/Active Failover
- Information About High Availability
- Configuring VPN
- Configuring IPsec and ISAKMP
- Information About Tunneling, IPsec, and ISAKMP
- Licensing Requirements for Remote Access IPsec VPNs
- Guidelines and Limitations
- Configuring ISAKMP
- Configuring IKEv1 and IKEv2 Policies
- Enabling IKE on the Outside Interface
- Disabling IKEv1 Aggressive Mode
- Determining an ID Method for IKEv1 and IKEv2 ISAKMP Peers
- Enabling IPsec over NAT-T
- Enabling IPsec with IKEv1 over TCP
- Waiting for Active Sessions to Terminate Before Rebooting
- Alerting Peers Before Disconnecting
- Configuring Certificate Group Matching for IKEv1
- Configuring IPsec
- Understanding IPsec Tunnels
- Understanding IKEv1 Transform Sets and IKEv2 Proposals
- Defining Crypto Maps
- Applying Crypto Maps to Interfaces
- Using Interface Access Lists
- Changing IPsec SA Lifetimes
- Creating a Basic IPsec Configuration
- Using Dynamic Crypto Maps
- Providing Site-to-Site Redundancy
- Viewing an IPsec Configuration
- Clearing Security Associations
- Clearing Crypto Map Configurations
- Supporting the Nokia VPN Client
- Configuring L2TP over IPsec
- Setting General VPN Parameters
- Configuring VPNs in Single, Routed Mode
- Configuring IPsec to Bypass ACLs
- Permitting Intra-Interface Traffic (Hairpinning)
- Setting Maximum Active IPsec or SSL VPN Sessions
- Using Client Update to Ensure Acceptable IPsec Client Revision Levels
- Understanding Load Balancing
- Configuring Load Balancing
- Configuring VPN Session Limits
- Configuring Connection Profiles, Group Policies, and Users
- Overview of Connection Profiles, Group Policies, and Users
- Connection Profiles
- Configuring Connection Profiles
- Maximum Connection Profiles
- Default IPsec Remote Access Connection Profile Configuration
- Configuring IPsec Tunnel-Group General Attributes
- Configuring Remote-Access Connection Profiles
- Configuring LAN-to-LAN Connection Profiles
- Configuring Connection Profiles for Clientless SSL VPN Sessions
- Customizing Login Windows for Users of Clientless SSL VPN sessions
- Configuring Microsoft Active Directory Settings for Password Management
- Using Active Directory to Force the User to Change Password at Next Logon
- Using Active Directory to Specify Maximum Password Age
- Using Active Directory to Override an Account Disabled AAA Indicator
- Using Active Directory to Enforce Minimum Password Length
- Using Active Directory to Enforce Password Complexity
- Configuring the Connection Profile for RADIUS/SDI Message Support for the AnyConnect Client
- Group Policies
- Default Group Policy
- Configuring Group Policies
- Configuring an External Group Policy
- Configuring an Internal Group Policy
- Configuring Group Policy Attributes
- Configuring WINS and DNS Servers
- Configuring VPN-Specific Attributes
- Configuring Security Attributes
- Configuring the Banner Message
- Configuring IPsec-UDP Attributes for IKEv1
- Configuring Split-Tunneling Attributes
- Configuring Domain Attributes for Tunneling
- Configuring Attributes for VPN Hardware Clients
- Configuring Backup Server Attributes
- Configuring Browser Client Parameters
- Configuring Network Admission Control Parameters
- Configuring Address Pools
- Configuring Firewall Policies
- Supporting a Zone Labs Integrity Server
- Configuring User Attributes
- Configuring IP Addresses for VPNs
- Configuring Remote Access IPsec VPNs
- Information About Remote Access IPsec VPNs
- Licensing Requirements for Remote Access IPsec VPNs
- Guidelines and Limitations
- Configuring Remote Access IPsec VPNs
- Configuring Interfaces
- Configuring ISAKMP Policy and Enabling ISAKMP on the Outside Interface
- Configuring an Address Pool
- Adding a User
- Creating an IKEv1 Transform Set or IKEv2 Proposal
- Defining a Tunnel Group
- Creating a Dynamic Crypto Map
- Creating a Crypto Map Entry to Use the Dynamic Crypto Map
- Saving the Security Appliance Configuration
- Configuration Examples for Remote Access IPsec VPNs
- Feature History for Remote Access VPNs
- Configuring Network Admission Control
- Information about Network Admission Control
- Licensing Requirements
- Prerequisites for NAC
- Guidelines and Limitations
- Viewing the NAC Policies on the Security Appliance
- Adding, Accessing, or Removing a NAC Policy
- Configuring a NAC Policy
- Assigning a NAC Policy to a Group Policy
- Changing Global NAC Framework Settings
- Configuring Easy VPN Services on the ASA 5505
- Specifying the Client/Server Role of the Cisco ASA 5505
- Specifying the Primary and Secondary Servers
- Specifying the Mode
- Configuring Automatic Xauth Authentication
- Configuring IPsec Over TCP
- Comparing Tunneling Options
- Specifying the Tunnel Group or Trustpoint
- Configuring Split Tunneling
- Configuring Device Pass-Through
- Configuring Remote Management
- Guidelines for Configuring the Easy VPN Server
- Configuring the PPPoE Client
- Configuring LAN-to-LAN IPsec VPNs
- Configuring Clientless SSL VPN
- Information About Clientless SSL VPN
- Licensing Requirements
- Prerequisites for Clientless SSL VPN
- Guidelines and Limitations
- Observing Clientless SSL VPN Security Precautions
- Using SSL to Access the Central Site
- Configuring Application Helper
- Using Single Sign-on with Clientless SSL VPN
- Encoding
- Creating and Applying Clientless SSL VPN Policies for Accessing Resources
- Using the Security Appliance Authentication Server
- Configuring Connection Profile Attributes for Clientless SSL VPN
- Configuring Group Policy and User Attributes for Clientless SSL VPN
- Configuring Browser Access to Plug-ins
- Why a Microsoft Kerberos Constrained Delegation Solution
- Understanding How KCD Works
- Configuring Application Access
- Logging Off Smart TunnelConfiguring Smart Tunnel Access
- About Smart Tunnels
- Why Smart Tunnels?
- Adding Applications to Be Eligible for Smart Tunnel Access
- Assigning a Smart Tunnel List
- Configuring and Applying Smart Tunnel Policy
- Configuring and Applying a Smart Tunnel Tunnel Policy
- Specifying Servers for Smart Tunnel Auto Sign-on
- Adding or Editing a Smart Tunnel Auto Sign-on Server Entry
- Automating Smart Tunnel Access
- Logging Off Smart Tunnel
- Logging Off Smart TunnelConfiguring Smart Tunnel Access
- Configuring Port Forwarding
- Application Access User Notes
- Configuring File Access
- Ensuring Clock Accuracy for SharePoint Access
- Using Clientless SSL VPN with PDAs
- Using E-Mail over Clientless SSL VPN
- Configuring Portal Access Rules
- Optimizing Clientless SSL VPN Performance
- Clientless SSL VPN End User Setup
- Customizing Clientless SSL VPN Pages
- Configuring Browser Access to Client-Server Plug-ins
- Communicating Security Tips
- Configuring Remote Systems to Use Clientless SSL VPN Features
- Translating the Language of User Messages
- Capturing Data
- Configuring AnyConnect VPN Client Connections
- Information About AnyConnect VPN Client Connections
- Licensing Requirements for AnyConnect Connections
- Guidelines and Limitations
- Configuring AnyConnect Connections
- Configuring the ASA to Web-Deploy the Client
- Enabling Permanent Client Installation
- Configuring DTLS
- Prompting Remote Users
- Enabling AnyConnect Client Profile Downloads
- Enabling Additional AnyConnect Client Features
- Enabling Start Before Logon
- Translating Languages for AnyConnect User Messages
- Configuring Advanced AnyConnect Features
- Updating AnyConnect Client Images
- Enabling IPv6 VPN Access
- Monitoring AnyConnect Connections
- Logging Off AnyConnect VPN Sessions
- Configuration Examples for Enabling AnyConnect Connections
- Feature History for AnyConnect Connections
- Configuring AnyConnect Host Scan
- Configuring IPsec and ISAKMP
- Configuring Logging, SNMP, and Smart Call Home
- Configuring Logging
- Information About Logging
- Licensing Requirements for Logging
- Prerequisites for Logging
- Guidelines and Limitations
- Configuring Logging
- Enabling Logging
- Configuring an Output Destination
- Sending Syslog Messages to an External Syslog Server
- Sending Syslog Messages to the Internal Log Buffer
- Sending Syslog Messages to an E-mail Address
- Sending Syslog Messages to ASDM
- Sending Syslog Messages to the Console Port
- Sending Syslog Messages to an SNMP Server
- Sending Syslog Messages to a Telnet or SSH Session
- Creating a Custom Event List
- Generating Syslog Messages in EMBLEM Format to a Syslog Server
- Generating Syslog Messages in EMBLEM Format to Other Output Destinations
- Changing the Amount of Internal Flash Memory Available for Logs
- Configuring the Logging Queue
- Sending All Syslog Messages in a Class to a Specified Output Destination
- Enabling Secure Logging
- Including the Device ID in Non-EMBLEM Format Syslog Messages
- Including the Date and Time in Syslog Messages
- Disabling a Syslog Message
- Changing the Severity Level of a Syslog Message
- Limiting the Rate of Syslog Message Generation
- Monitoring the Logs
- Configuration Examples for Logging
- Feature History for Logging
- Configuring NetFlow Secure Event Logging (NSEL)
- Information About NSEL
- Licensing Requirements for NSEL
- Prerequisites for NSEL
- Guidelines and Limitations
- Configuring NSEL
- Configuring NSEL Collectors
- Configuring Flow-Export Actions Through Modular Policy Framework
- Configuring Template Timeout Intervals
- Changing the Time Interval for Sending Flow-Update Events to a Collector
- Delaying Flow-Create Events
- Disabling and Reenabling NetFlow-related Syslog Messages
- Clearing Runtime Counters
- Monitoring NSEL
- Configuration Examples for NSEL
- Where to Go Next
- Additional References
- Feature History for NSEL
- Configuring SNMP
- Information About SNMP
- Licensing Requirements for SNMP
- Prerequisites for SNMP
- Guidelines and Limitations
- Configuring SNMP
- Troubleshooting Tips
- Monitoring SNMP
- Configuration Examples for SNMP
- Where to Go Next
- Additional References
- Feature History for SNMP
- Configuring Anonymous Reporting and Smart Call Home
- Information About Anonymous Reporting and Smart Call Home
- Licensing Requirements for Anonymous Reporting and Smart Call Home
- Prerequisites for Smart Call Home and Anonymous Reporting
- Guidelines and Limitations
- Configuring Anonymous Reporting and Smart Call Home
- Monitoring Smart Call Home
- Configuration Example for Smart Call Home
- Feature History for Anonymous Reporting and Smart Call Home
- Configuring Logging
- System Administration
- Managing Software and Configurations
- Managing the Flash File System
- Downloading Software or Configuration Files to Flash Memory
- Configuring the Application Image and ASDM Image to Boot
- Configuring the File to Boot as the Startup Configuration
- Deleting Files from a USB Drive on the ASA 5500-X Series
- Performing Zero Downtime Upgrades for Failover Pairs
- Backing Up Configuration Files or Other Files
- Backing up the Single Mode Configuration or Multiple Mode System Configuration
- Backing Up a Context Configuration or Other File in Flash Memory
- Backing Up a Context Configuration within a Context
- Copying the Configuration from the Terminal Display
- Backing Up Additional Files Using the Export and Import Commands
- Using a Script to Back Up and Restore Files
- Configuring Auto Update Support
- Downgrading Your Software
- Troubleshooting
- Managing Software and Configurations
- Reference
- Using the Command-Line Interface
- Addresses, Protocols, and Ports
- Configuring an External Server for Authorization and Authentication
- Understanding Policy Enforcement of Permissions and Attributes
- Configuring an External LDAP Server
- Configuring an External RADIUS Server
- Configuring an External TACACS+ Server
- Glossary
- Index