manualshive.com logo in svg

Cisco 5510 - ASA SSL / IPsec VPN Edition, Getting Started Manual, Page: 158 / 208

Share
Download
Cisco 5510 - ASA SSL / IPsec VPN Edition Getting Started Manual Download Page 158

Chapter 12      Scenario: Site-to-Site VPN Configuration

  Implementing the Site-to-Site Scenario

12-6

Cisco ASA 5500 Series Getting Started Guide

78-19186-01

Step 3

Click 

Next

 to continue.

Configuring the IKE Policy

IKE is a negotiation protocol that includes an encryption method to protect data 
and ensure privacy; it also provides authentication to ensure the identity of the 
peers. In most cases, the ASDM default values are sufficient to establish secure 
VPN tunnels between two peers.

In Step 3 of the VPN Wizard, perform the following steps:

Step 1

Click the Encryption (DES/3DES/AES), authentication algorithms (MD5/SHA), 
and the Diffie-Hellman group (1/2/5) used by the adaptive security appliance 
during an IKE security association. 

Summary of Contents for 5510 - ASA SSL / IPsec VPN Edition

Page 1: ...A 95134 1706 USA http www cisco com Tel 408 526 4000 800 553 NETS 6387 Fax 408 527 0883 Cisco ASA 5500 Series Getting Started Guide For the Cisco ASA 5510 ASA 5520 ASA 5540 and ASA 5550 Software Version 8 3 Customer Order Number DOC 78 19186 01 Text Part Number 78 19186 01 ...

Page 2: ...E BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES CCDE CCENT CCSI Cisco Eos Cisco Explorer Cisco HealthPresence Cisco IronPort the Cisco logo Cisco Nurse Connect Cisco Pulse Cisco SensorBase Cisco StackPower Cisco StadiumVision Cisco TelePresence Cisco TrustSec Cisco Unified Computing System Cisco WebEx DCE Flip Channels Flip for Good Flip Mino Flipshare Design Flip Ultra Flip Video Flip Video Des...

Page 3: ... 5550 1 5 Related Documents 1 5 C H A P T E R 2 Maximizing Throughput on the ASA 5550 2 1 Embedded Network Interfaces 2 1 Balancing Traffic to Maximize Throughput 2 2 What to Do Next 2 5 C H A P T E R 3 Installing the ASA 5550 3 1 Verifying the Package Contents 3 2 Installing the Chassis 3 3 Rack Mounting the Chassis 3 4 Installing SFP Modules 3 6 SFP Module 3 6 Installing an SFP Module 3 8 Ports ...

Page 4: ...e Chassis 4 3 Rack Mounting the Chassis 4 4 Ports and LEDs 4 7 What to Do Next 4 10 C H A P T E R 5 Installing Optional SSMs 5 1 Cisco 4GE SSM 5 1 4GE SSM Components 5 2 Installing the Cisco 4GE SSM 5 3 Installing the SFP Modules 5 4 SFP Module 5 5 Installing the SFP Module 5 6 Cisco AIP SSM and CSC SSM 5 8 Installing an SSM 5 9 What to Do Next 5 10 C H A P T E R 6 Connecting Interface Cables on t...

Page 5: ...P T E R 8 Scenario DMZ Configuration 8 1 Example DMZ Network Topology 8 1 An Inside User Visits a Web Server on the Internet 8 3 An Internet User Visits the DMZ Web Server 8 4 An Inside User Visits the DMZ Web Server 8 6 Configuring the Adaptive Security Appliance for a DMZ Deployment 8 8 Configuration Requirements 8 9 Information to Have Available 8 10 Enabling Inside Clients to Communicate with ...

Page 6: ...onfiguring User Accounts 9 9 Configuring Address Pools 9 10 Configuring Client Attributes 9 11 Configuring the IKE Policy 9 12 Specifying Address Translation Exception and Split Tunneling 9 14 Verifying the Remote Access VPN Configuration 9 16 What to Do Next 9 17 C H A P T E R 10 Scenario Configuring Connections for a Cisco AnyConnect VPN Client 10 1 About SSL VPN Client Connections 10 1 Obtainin...

Page 7: ...ng the Adaptive Security Appliance for Browser Based SSL VPN Connections 11 6 Specifying the SSL VPN Interface 11 7 Specifying a User Authentication Method 11 8 Specifying a Group Policy 11 10 Creating a Bookmark List for Remote Users 11 11 Verifying the Configuration 11 15 What to Do Next 11 16 C H A P T E R 12 Scenario Site to Site VPN Configuration 12 1 Example Site to Site VPN Network Topology...

Page 8: ...ocedure Overview 13 6 Sessioning to the AIP SSM 13 6 Configuring the Security Policy on the AIP SSM 13 8 Assigning Virtual Sensors to Security Contexts 13 9 Diverting Traffic to the AIP SSM 13 11 What to Do Next 13 14 C H A P T E R 14 Configuring the CSC SSM 14 1 About the CSC SSM 14 1 About Deploying the Adaptive Security Appliance with the CSC SSM 14 2 Scenario Security Appliance with CSC SSM De...

Page 9: ... 78 19186 01 Contents C H A P T E R 15 Configuring the 4GE SSM for Fiber 15 1 Cabling 4GE SSM Interfaces 15 2 Setting the 4GE SSM Media Type for Fiber Interfaces Optional 15 3 What to Do Next 15 5 A P P E N D I X A Obtaining a 3DES AES License A 1 ...

Page 10: ...Contents x Cisco ASA 5500 Series Getting Started Guide 78 19186 01 ...

Page 11: ...of the Cisco ASA 5500 series adaptive security appliance The adaptive security appliance implementations included in this document are as follows ASA 5500 page 1 1 ASA 5500 with AIP SSM page 1 2 ASA 5500 with CSC SSM page 1 3 ASA 5500 with 4GE SSM page 1 4 ASA 5550 page 1 5 Related Documents page 1 5 ASA 5500 To Do This See Install the chassis Chapter 4 Installing the ASA 5500 ASA 5510 ASA 5520 an...

Page 12: ... 8 Scenario DMZ Configuration Chapter 9 Scenario IPsec Remote Access VPN Configuration Chapter 10 Scenario Configuring Connections for a Cisco AnyConnect VPN Client Chapter 11 Scenario SSL VPN Clientless Connections Chapter 12 Scenario Site to Site VPN Configuration Configure optional and advanced features Cisco ASA 5500 Series Configuration Guide using the CLI Operate the system on a daily basis ...

Page 13: ...ntrusion prevention Configuring the Cisco Intrusion Prevention System Sensor Using the Command Line Interface Refine configuration and configure optional and advanced features Cisco ASA 5500 Series Configuration Guide using the CLI Cisco ASA 5500 Series Command Reference Cisco ASA 5500 Series System Log Messages To Do This See Install the chassis Chapter 4 Installing the ASA 5500 ASA 5510 ASA 5520...

Page 14: ...onal and advanced features Cisco ASA 5500 Series Configuration Guide using the CLI Cisco ASA 5500 Series Command Reference Cisco ASA 5500 Series System Log Messages To Do This See Install the chassis Chapter 4 Installing the ASA 5500 ASA 5510 ASA 5520 and ASA 5540 Install the 4GE SSM Chapter 5 Installing Optional SSMs Connect interface cables Chapter 6 Connecting Interface Cables on the ASA 5500 A...

Page 15: ...nd advanced features Cisco ASA 5500 Series Configuration Guide using the CLI Cisco ASA 5500 Series Command Reference Cisco ASA 5500 Series System Log Messages To Do This See Install the chassis Install the fiber optic module if any Connect interface cables Chapter 3 Installing the ASA 5550 Perform initial setup of the adaptive security appliance Chapter 7 Configuring the Adaptive Security Applianc...

Page 16: ...Command Reference Cisco ASA 5500 Series Configuration Guide using the CLI Cisco ASA 5500 Series System Log Messages Migrating to ASA for VPN 3000 Series Concentrator Administrators Cisco Secure Desktop Configuration Guide for Cisco ASA 5500 Series Administrators Open Source Software Licenses for ASA and PIX Security Appliances ...

Page 17: ...apter includes the following sections Embedded Network Interfaces page 2 1 Balancing Traffic to Maximize Throughput page 2 2 What to Do Next page 2 5 Embedded Network Interfaces The adaptive security appliance has two internal buses providing copper Gigabit Ethernet and fiber Gigabit Ethernet connectivity Slot 0 corresponding to Bus 0 has four embedded copper Gigabit Ethernet ports Slot 1 correspo...

Page 18: ... Ethernet ports you can use only four Slot 1 ports at a time For example you could use two Slot 1 copper ports and two fiber ports but you cannot use fiber ports if you are already using all four Slot 1 copper ports Balancing Traffic to Maximize Throughput To maximize traffic throughput configure the adaptive security appliance so that traffic is distributed equally between the two buses in the de...

Page 19: ...per to Copper Figure 2 3 Traffic Evenly Distributed for Maximum Throughput Copper to Fiber 153104 LINK SPD 2 LINK SPD 1 LINK SPD 0 LINK SPD 3 MGMT USB2 USB1 FLASH CONSOLE AUX P O W E R S T A T U S F L A S H V P N A C T I V E PW R ST AT US LNK SPD 0 1 2 3 Slot 1 Slot 0 Incoming and outgoing traffic Incoming and outgoing traffic Maximum throughput 153305 LINK SPD 2 LINK SPD 1 LINK SPD 0 LINK SPD 3 M...

Page 20: ...S H V P N A C T I V E PW R ST AT US LNK SPD 0 1 2 3 LINK SPD 2 LINK SPD 1 LINK SPD 0 LINK SPD 3 MGMT USB2 USB1 FLASH CONSOLE AUX P O W E R S T A T U S F L A S H V P N A C T I V E PW R ST AT US LNK SPD 0 1 2 3 LINK SPD 2 LINK SPD 1 LINK SPD 0 LINK SPD 3 MGMT USB2 USB1 FLASH CONSOLE AUX P O W E R S T A T U S F L A S H V P N A C T I V E PW R ST AT US LNK SPD 0 1 2 3 LINK SPD 2 LINK SPD 1 LINK SPD 0 L...

Page 21: ...hroughput on the ASA 5550 What to Do Next Note You can use the show traffic command to see the traffic throughput over each bus For more information about using the command see the Cisco ASA 5500 Series Command Reference What to Do Next Continue with Chapter 3 Installing the ASA 5550 ...

Page 22: ...Chapter 2 Maximizing Throughput on the ASA 5550 What to Do Next 2 6 Cisco ASA 5500 Series Getting Started Guide 78 19186 01 ...

Page 23: ...ning Only trained and qualified personnel should install replace or service this equipment Statement 49 This chapter describes the ASA 5550 adaptive security appliance and rack mount and installation procedures for the adaptive security appliance This chapter includes the following sections Verifying the Package Contents page 3 2 Installing the Chassis page 3 3 Installing SFP Modules page 3 6 Port...

Page 24: ...le 72 1482 01 Mounting brackets 700 18797 01 AO right 700 18798 01 AO left 4 flathead screws 48 0451 01 AO 2 long cap screws 48 0654 01 AO 4 cap screws 48 0523 01 AO Safety and Compliance Guide Cisco ASA 5550 adaptive security appliance Documentation C i s c o A S A 5 5 5 0 A d a p t i v e S e c u r i t y A p p l i a n c e P r o d u c t C D 4 rubber feet Cable holder 153215 Blue console cable PC t...

Page 25: ...te ventilation An enclosed rack should never be overcrowded Make sure that the rack is not congested because each unit generates heat When mounting a device in an open rack make sure that the rack frame does not block the intake or exhaust ports If the rack contains only one unit mount the unit at the bottom of the rack If the rack is partially filled load the rack from the bottom to the top with ...

Page 26: ... the front or the back of the rack with the front panel or the rear panel of the chassis facing outward Step 1 Attach the rack mount brackets to the chassis using the supplied screws Attach the brackets to the holes as shown in Figure 3 2 After the brackets are secured to the chassis you can rack mount it Figure 3 2 Installing the Right and Left Brackets Step 2 Attach the chassis to the rack using...

Page 27: ... so that you can have the front panel or the rear panel of the chassis facing outward Figure 3 2 shows the brackets attached to the rear so you can see how that configuration appears while Figure 3 3 shows the brackets attached to the front so that you can see how that configuration appears In Step 1 and Step 2 you will choose to have either the brackets rear mounted or front mounted but not both ...

Page 28: ...evice that plugs into the fiber ports Note If you install an SFP module after the switch has powered on you must reload the adaptive security appliance to enable the SFP module Table 3 1 lists the SFP modules that are supported by the adaptive security appliance The 1000BASE LX LH and 1000BASE SX SFP modules are used to establish fiber connections Use fiber cables with LC connectors to connect to ...

Page 29: ...plugs into the SFPs after the cables are extracted from them Be sure to clean the optic surfaces of the fiber cables before you plug them back into the optical bores of another SFP module Avoid getting dust and other contaminants into the optical bores of your SFP modules The optics do not work correctly when obstructed with dust Warning Because invisible laser radiation may be emitted from the ap...

Page 30: ...module into the port slot until it locks into position as shown in Figure 3 4 Figure 3 4 Installing an SFP Module Caution Do not remove the port plugs from the SFP module until you are ready to connect the cables Step 2 Remove the port plug then connect the network cable to the SFP module Step 3 Connect the other end of the cable to your network For more information on connecting the cables see Ch...

Page 31: ...escribes the front and rear panels Figure 3 5 shows the front panel LEDs This section includes the following topics Front Panel LEDs page 3 9 Rear Panel LEDs and Ports in Slot 0 page 3 10 Ports and LEDs in Slot 1 page 3 12 Front Panel LEDs Figure 3 5 shows the LEDs on the front panel of the adaptive security appliance Figure 3 5 Front Panel LEDs LED Color State Description 1 Power Green On The sys...

Page 32: ... 4 VPN Green Solid VPN tunnel is established 5 Flash Green Solid The CompactFlash is being accessed LED Color State Description 1 Management Port1 1 The management 0 0 interface is a Fast Ethernet interface designed for management traffic only 6 USB 2 0 interfaces2 2 Reserved for future use 11 VPN LED 2 External CompactFlash slot 7 Network interfaces3 12 Flash LED 3 Serial Console port 8 Power ind...

Page 33: ...el Link and Speed Indicator LEDs Table 3 3 lists the rear MGMT and Network interface LEDs 3 GigabiteEthernet interfaces from right to left GigabitEthernet 0 0 GigabitEthernet 0 1 GigabitEthernet 0 2 and GigabitEthernet 0 3 1 MGMT indicator LEDs 2 Network interface LEDs 126917 USB2 USB1 LNK SPD 3 LNK SPD 2 LNK SPD 1 LNK SPD 0 MGMT 2 1 Table 3 3 Link and Speed LEDs Indicator Color Description Left s...

Page 34: ...if you want to establish fiber Ethernet connectivity For more information on fiber ports and SFP modules see the Installing SFP Modules section on page 3 6 Table 3 4 describes the LEDs in Slot 1 1 Copper Ethernet ports 5 Status LED 2 RJ 45 Link LED 6 Fiber Ethernet ports 3 RJ 45 Speed LED 7 SFP Link LED 4 Power LED 8 SFP Speed LED 153212 P W R S T A T U S LNK SPD 0 1 2 3 Cisco SSM 4GE 4 1 6 5 7 8 ...

Page 35: ...s a Fast Ethernet interface This port is similar to the Console port but the Management0 0 port only accepts incoming traffic to the adaptive security appliance Note You can configure any interface to be a management only interface using the management only command You can also disable management only mode on the management interface For more information about this command see the management only ...

Page 36: ... to the Console port a Before connecting a computer or terminal to any ports check to determine the baud rate of the serial port The baud rate of the computer or terminal must match the default baud rate 9600 baud of the Console port of the adaptive security appliance Set up the terminal as follows 9600 baud default 8 data bits no parity 1 stop bits and Flow Control FC Hardware b Locate the serial...

Page 37: ...Connect to the Auxiliary port labeled AUX a Locate the serial console cable which has an RJ 45 connector on one end and a DB 9 connector on the other end for the serial port on your computer b Connect the RJ 45 connector of the cable to the Auxiliary port labeled AUX on the adaptive security appliance as shown in Figure 3 11 c Connect the other end of the cable the DB 9 connector to the serial por...

Page 38: ...network connections Copper Ethernet ports are available both in Slot 0 and Slot 1 Note You must use a port in Slot 0 for the inside interface and a port in Slot 1 for the outside interface a Connect one end of an Ethernet cable to a copper Ethernet port as shown in Figure 3 12 and Figure 3 13 1 RJ 45 AUX port 2 RJ 45 to DB 9 console cable 92686 FLASH CONSOLE AUX P O W E R S T A T U S F L A S H V P...

Page 39: ...ng to a Copper Ethernet Interface in Slot 0 Figure 3 13 Connecting to a Copper Ethernet Interfaces in Slot 1 1 Copper Ethernet ports 2 RJ 45 connector USB2 USB1 LNK SPD 3 LNK SPD 2 LNK SPD 1 LNK SPD 0 MGMT 92685 2 1 1 Copper Ethernet ports 2 RJ 45 connector 153213 MGMT USB2 Cisco SSM 4GE LNK SPD 0 1 2 3 P O W E R S TA T U S 2 MGMT USB2 USB1 1 ...

Page 40: ...ts but you can only have a total of four Slot 1 ports in use at a time For example you could use two copper Ethernet ports and two fiber Ethernet ports For each fiber port you want to use perform the following steps a Install the SFP module Insert and slide the SFP module into the fiber port until you hear a click The click indicates that the SFP module is locked into the port Remove the port plug...

Page 41: ...e to a network device such as a router switch or hub Step 7 Connect the power cord to the adaptive security appliance and plug the other end to the power source Step 8 Power on the chassis What to Do Next Continue with Chapter 7 Configuring the Adaptive Security Appliance 1 LC connector 2 SFP module MGMT USB2 Cisco SSM 4GE LNK SPD 0 1 2 3 MGMT USB2 USB1 P O W E R S TA T U S 1 153214 2 ...

Page 42: ...Chapter 3 Installing the ASA 5550 What to Do Next 3 20 Cisco ASA 5500 Series Getting Started Guide 78 19186 01 ...

Page 43: ...on Read the safety warnings in the Regulatory Compliance and Safety Information for the Cisco ASA 5500 Series and follow proper safety procedures when performing these steps This chapter provides a product overview and describes the memory requirements rack mount and installation procedures for the adaptive security appliance This chapter includes the following sections Verifying the Package Conte...

Page 44: ...w the Cisco ASA 5540 adaptive security appliance The Cisco ASA 5510 adaptive security appliance and Cisco ASA 5520 adaptive security appliance are identical containing the same back panel features and indicators Verifying the Package Contents Verify the contents of the packing box to ensure that you have received all items necessary to install your Cisco ASA 5500 series adaptive security appliance...

Page 45: ...in a 19 inch rack with a 17 5 or 17 75 inch opening Yellow Ethernet cable 72 1482 01 Mounting brackets 700 18797 01 AO right 700 18798 01 AO left 4 flathead screws 48 0451 01 AO 2 long cap screws 48 0654 01 AO 4 cap screws 48 0523 01 AO Safety and Compliance Guide Cisco ASA 5500 adaptive security appliance Documentation Cisco ASA 5500 Adaptive Security Appliance Product CD 4 rubber feet Cable hold...

Page 46: ...does not block the intake or exhaust ports If the rack contains only one unit mount the unit at the bottom of the rack If the rack is partially filled load the rack from the bottom to the top with the heaviest component at the bottom of the rack If the rack contains stabilizing devices install the stabilizers prior to mounting or servicing the unit in the rack Warning Before performing any of the ...

Page 47: ...g the supplied screws Attach the brackets to the holes as shown in Figure 4 2 and Figure 4 3 After the brackets are secured to the chassis you can rack mount it Figure 4 2 Installing the Left Bracket on the Rear Panel of the Chassis Figure 4 3 Installing the Right Bracket on the Rear Panel of the Chassis Step 2 Attach the chassis to the rack using the supplied screws as shown in Figure 4 4 191311 ...

Page 48: ... of the chassis so that you can have the front panel or the rear panel of the chassis facing outward Figure 4 2 and Figure 4 3 show the brackets attached to the rear so you can see how that configuration appears while Figure 4 4 shows the brackets attached to the front so that you can see how that configuration appears In Step 1 and Step 2 you will choose to have either the brackets rear mounted o...

Page 49: ...en On The system has power 2 Status Green Flashing The power up diagnostics are running or the system is booting Solid The system has passed power up diagnostics Amber Solid The power up diagnostics have failed 3 Active Green Solid This is the active failover device Amber Solid This is the standby failover device 4 VPN Green Solid VPN tunnel is established 5 Flash Green Solid The CompactFlash is b...

Page 50: ...terface is a Fast Ethernet interface designed for management traffic only 6 USB 2 0 interfaces2 2 Not supported at this time 11 VPN LED 2 External CompactFlash slot 7 Network interfaces3 3 GigabiteEthernet interfaces from right to left GigabitEthernet 0 0 GigabitEthernet 0 1 GigabitEthernet 0 2 and GigabitEthernet 0 3 12 Flash LED 3 Serial Console port 8 Power indicator LED 13 AUX port 4 Power swi...

Page 51: ...twork interface LEDs Note The ASA 5510 adaptive security appliance only supports 10 100BaseTX The ASA 5520 adaptive security appliance and the ASA 5540 adaptive security appliance support 1000BaseT 1 MGMT indicator LEDs 2 Network interface LEDs 126917 USB2 USB1 LNK SPD 3 LNK SPD 2 LNK SPD 1 LNK SPD 0 MGMT 2 1 Table 4 1 Link and Speed LEDs Indicator Color Description Left side Solid green Green fla...

Page 52: ...uide 78 19186 01 What to Do Next Continue with one of the following chapters To Do This See Install SSMs you purchased but that have not yet been installed Chapter 5 Installing Optional SSMs Continue with connecting interface cables Chapter 6 Connecting Interface Cables on the ASA 5500 ASA 5510 ASA 5520 and ASA 5540 Platforms ...

Page 53: ...alled This chapter includes the following sections Cisco 4GE SSM page 5 1 Cisco AIP SSM and CSC SSM page 5 8 What to Do Next page 5 10 Cisco 4GE SSM The 4GE Security Services Module SSM has eight Ethernet ports four 10 100 1000 Mbps copper RJ 45 ports or four optional 1000 Mbps Small Form Factor Pluggable SFP fiber ports This section describes how to install and replace the Cisco 4GE SSM in the ad...

Page 54: ...all the SFP modules if you want to use this feature For more information on SFP ports and modules see the Installing the SFP Modules section on page 5 4 Table 5 1 describes the Cisco 4GE SSM LEDs 1 RJ 45 ports 5 Status LED 2 RJ 45 Link LED 6 SFP ports 3 RJ 45 Speed LED 7 SFP Link LED 4 Power LED 8 SFP Speed LED 132983 4 1 6 5 7 8 LNK SPD 0 1 2 3 2 3 Cisco SSM 4GE Table 5 1 Cisco 4GE SSM LEDs LED C...

Page 55: ...two screws as shown in Figure 5 2 at the left rear end of the chassis and remove the slot cover Figure 5 2 Removing the Screws from the Slot Cover 3 8 SPEED Off Green Amber 10 MB There is no network activity 100 MB There is network activity at 100 Mbps 1000 MB GigE There is network activity at 1000 Mbps 4 POWER Green On The system has power 5 STATUS Green Green Amber Flashing The system is booting...

Page 56: ... For more information see Chapter 6 Connecting Interface Cables on the ASA 5500 ASA 5510 ASA 5520 and ASA 5540 Platforms Installing the SFP Modules The SFP Small Form Factor Pluggable is a hot swappable input output device that plugs into the SFP ports The following SFP module types are supported Long wavelength long haul 1000BASE LX LH GLC LH SM Short wavelength 1000BASE SX GLC SX MM This section...

Page 57: ...tic cables with LC connectors to connect to an SFP module The SFP modules support 850 to 1550 nm nominal wavelengths The cables must not exceed the required cable length for reliable communications Table 5 3 lists the cable length requirements Table 5 3 Cabling Requirements for Fiber Optic SFP Modules Table 5 2 Supported SFP Modules SFP Module Type of Connection Cisco Part Number 1000BASE LX LH Fi...

Page 58: ...s into the SFPs after the cables are extracted from them Be sure to clean the optic surfaces of the fiber cables before you plug them back in the optical bores of another SFP module Avoid getting dust and other contaminants into the optical bores of your SFP modules The optics do not work correctly when obstructed with dust Warning Because invisible laser radiation may be emitted from the aperture...

Page 59: ...t plug then connect the network cable to the SFP module Step 3 Connect the other end of the cable to your network For more information on connecting the cables see Chapter 6 Connecting Interface Cables on the ASA 5500 ASA 5510 ASA 5520 and ASA 5540 Platforms Caution The latching mechanism used on many SFPs locks them into place when cables are connected Do not pull on the cabling in an attempt to ...

Page 60: ...cessor and more memory than the AIP SSM 10 Only one module the AIP SSM 10 or the AIP SSM 20 can populate the slot at a time Table 5 4 lists the memory specifications for the AIP SSM 10 and the AIP SSM 20 For more information on the AIP SSM see the Cisco ASA 5500 Series Configuration Guide using the CLI The CSC SSM runs Content Security and Control software The CSC SSM provides protection against v...

Page 61: ... contacts your bare skin Attach the other end to the chassis Step 3 Remove the two screws as shown in Figure 5 6 at the left rear end of the chassis and remove the slot cover 119644 P W R S T A T U S S P E E D L I N K A C T 1 2 3 4 Table 5 5 SSM LEDs LED Color State Description 1 PWR Green On The system has power 2 STATUS Green Flashing The system is booting Solid The system has passed power up di...

Page 62: ...ance Check the LEDs If the SSM is installed properly the POWER LED is solid green and the STATUS LED flashes green Step 7 Connect one end of the RJ 45 cable to the port and the other end of the cable to your network devices What to Do Next Continue with Chapter 6 Connecting Interface Cables on the ASA 5500 ASA 5510 ASA 5520 and ASA 5540 Platforms 119642 LINK SPD 3 LINK SPD 2 LINK SPD 1 LINK SPD 0 ...

Page 63: ...rs to an intelligent SSM the AIP SSM or CSC SSM Note The 4GE SSM AIP SSM and CSC SSM are optional security services modules If your adaptive security appliance does not include these modules continue with Chapter 7 Configuring the Adaptive Security Appliance Warning Only trained and qualified personnel should install replace or service this equipment Statement 49 Caution Read the safety warnings i...

Page 64: ...nnot connect to this port to run the adaptive security appliance CLI To connect cables to the network interfaces perform the following steps Step 1 Place the chassis on a flat stable surface or in a rack if you are rack mounting it Step 2 Connect to the Management port The adaptive security appliance has a dedicated interface for device management that is referred to as the Management0 0 port The ...

Page 65: ...adaptive security appliance use a crossover Ethernet cable When connecting a computer to the adaptive security appliance through a hub or switch use a straight through Ethernet cable to connect the hub or switch to the management port Figure 6 1 Connecting to the Management Port Step 3 Connect to the Console port a Before connecting a computer or terminal to any ports check to determine the baud r...

Page 66: ... end and a DB 9 connector on the other end for the serial port on your computer c Connect the RJ 45 connector to the Console port of the adaptive security appliance as shown in Figure 6 2 d Connect the DB 9 connector to the console port on your computer Figure 6 2 Connecting the Console Cable Connecting to SSMs SSMs are optional this procedure is necessary only if you have installed an SSM on the ...

Page 67: ... steps Step 1 Connect one RJ 45 connector to the management port on the SSM as shown in Figure 6 3 Step 2 Connect the other end of the RJ 45 cable to your network devices Figure 6 3 Connecting to the SSM Management Port Step 3 Connect to Ethernet ports to be used for network connections a Connect the RJ 45 connector to the Ethernet port b Connect the other end of the Ethernet cable to your network...

Page 68: ...ing a dedicated switch with no hosts or routers on the link or by using a crossover Ethernet cable to link the units directly For more information see the Configuring Failover chapter in the Cisco ASA 5500 Series Configuration Guide using the CLI See also Chapter 4 Ports and LEDs for information about the Ethernet interfaces Figure 6 4 Connecting Cables to Network Interfaces Connecting to a 4GE SS...

Page 69: ...nd ASA 5540 Platforms Connecting to a 4GE SSM To connect to a 4GE SSM perform the following steps Step 1 Connect to copper Ethernet ports to be used for network connections a Connect one end of an Ethernet cable to a copper Ethernet port b Connect the other end of the Ethernet cable to a network device such as a router switch or hub ...

Page 70: ...ps a Install the SFP module Insert and slide the SFP module into the fiber port until you hear a click The click indicates that the SFP module is locked into the port Remove the port plug from the installed SFP as shown in Figure 6 5 Figure 6 5 Removing the Fiber Port Plug Connect the LC connector to the SFP module as shown in Figure 6 6 Figure 6 6 Connecting the LC Connector 1 Port plug 2 SFP mod...

Page 71: ...he other end of the cable to a network device such as a router switch or hub Powering On the Adaptive Security Appliance To power on the adaptive security appliance perform the following steps Step 1 Connect the power cord to the adaptive security appliance and plug the other end to the power source Step 2 Power on the chassis What to Do Next Continue with Chapter 7 Configuring the Adaptive Securi...

Page 72: ...Chapter 6 Connecting Interface Cables on the ASA 5500 ASA 5510 ASA 5520 and ASA 5540 Platforms What to Do Next 6 10 Cisco ASA 5500 Series Getting Started Guide 78 19186 01 ...

Page 73: ...igure the adaptive security appliance using ASDM This chapter includes the following sections About the Factory Default Configuration page 7 1 Using the CLI for Configuration page 7 2 Using the Adaptive Security Device Manager for Configuration page 7 3 Running the ASDM Startup Wizard page 7 8 What to Do Next page 7 9 About the Factory Default Configuration Cisco adaptive security appliances are s...

Page 74: ...s configuration enables a client on the inside network to obtain a DHCP address from the adaptive security appliance to connect to the appliance Administrators can then configure and manage the adaptive security appliance using ASDM Using the CLI for Configuration In addition to the ASDM web configuration tool you can configure the adaptive security appliance by using the command line interface Yo...

Page 75: ...e security appliance The web based design provides secure access so that you can connect to and manage the adaptive security appliance from any location by using a web browser In addition to complete configuration and management capability ASDM features intelligent wizards to simplify and accelerate the deployment of the adaptive security appliance This section includes the following topics Prepar...

Page 76: ...ent tasks Alternatively you can assign a static IP address to your PC by selecting an address in the 192 168 1 0 subnet Valid addresses are 192 168 1 2 through 192 168 1 254 with a mask of 255 255 255 0 and default route of 192 168 1 1 When you connect other devices to any of the inside ports make sure that they do not have the same IP address Note The MGMT interface of the adaptive security appli...

Page 77: ...on information whether traffic is permitted between interfaces at the same security level and whether traffic is permitted between hosts on the same interface If you are configuring an Easy VPN hardware client the IP addresses of primary and secondary Easy VPN servers whether the client is to run in client or network extension mode and user and group login credentials to match those configured on ...

Page 78: ...tall ASDM Launcher and Run ASDM c In the dialog box that requires a username and password leave both fields empty Click OK d Click Yes to accept the certificates Click Yes for all subsequent authentication and certificate dialog boxes e When the File Download dialog box opens click Open to run the installation program directly It is not necessary to save the installation software to your hard driv...

Page 79: ...host name of your adaptive security appliance Step 5 Leave the Username and Password fields blank Note By default there is no Username and Password set for the Cisco ASDM Launcher Step 6 Click OK Step 7 If you receive a security warning containing a request to accept a certificate click Yes The ASA checks to see if there is updated software and if so downloads it automatically The main ASDM window...

Page 80: ...ears Running the ASDM Startup Wizard ASDM includes a Startup Wizard to simplify the initial configuration of your adaptive security appliance With a few steps the Startup Wizard enables you to configure the adaptive security appliance so that it allows packets to flow securely between the inside network and the outside network To use the Startup Wizard to set up a basic configuration for the adapt...

Page 81: ...address to 0 0 0 0 the netmask to 0 0 0 0 and Action to deny What to Do Next Configure the adaptive security appliance for your deployment using one or more of the following chapters To Do This See Configure the adaptive security appliance to protect a DMZ web server Chapter 8 Scenario DMZ Configuration Configure the adaptive security appliance for remote access VPN Chapter 9 Scenario IPsec Remote...

Page 82: ...Chapter 7 Configuring the Adaptive Security Appliance What to Do Next 7 10 Cisco ASA 5500 Series Getting Started Guide 78 19186 01 ...

Page 83: ... includes the following sections Example DMZ Network Topology page 8 1 Configuring the Adaptive Security Appliance for a DMZ Deployment page 8 8 What to Do Next page 8 23 Example DMZ Network Topology The chapter describes how to configure a DMZ deployment of the adaptive security appliance as shown in Figure 8 1 In this example the web server is on the DMZ interface and HTTP clients from both the ...

Page 84: ... devices on the Internet Clients on the Internet are permitted HTTP access to the DMZ web server all other traffic coming from the Internet is denied The network has one IP address that is publicly available the outside interface of the adaptive security appliance 209 165 200 225 This public address is shared by the adaptive security appliance and the DMZ web server User 192 168 1 2 Inside DMZ 191...

Page 85: ...User Visits a Web Server on the Internet Figure 8 2 shows the traffic flow through the adaptive security appliance when an inside user requests an HTTP page from a web server on the Internet Figure 8 2 An Inside User Visits an Internet Web Server User 192 168 1 2 Inside DMZ 191799 www example com Internet Public IP Address 209 165 200 225 outside interface Inside interface 192 168 1 1 DMZ interfac...

Page 86: ...local source address 192 168 1 2 to the public address of the outside interface 209 165 200 225 4 The adaptive security appliance records that a session is established and forwards the packet from the outside interface 5 When www example com responds to the request the packet goes through the adaptive security appliance using the established session 6 The adaptive security appliance uses NAT to tr...

Page 87: ...ge from the DMZ web server using the public IP address of the adaptive security appliance 209 165 200 225 the IP address of the outside interface 2 The adaptive security appliance receives the packet and because it is a new session verifies that the packet is allowed User 192 168 1 2 Inside DMZ 191800 www example com Internet Public IP Address 209 165 200 225 outside interface Inside interface 192...

Page 88: ...0 30 30 30 and forwards the packet through the DMZ interface 4 When the DMZ web server responds to the request the adaptive security appliance translates the local address of the DMZ web server 10 30 30 30 to the public address of the DMZ web server 209 165 200 225 5 The adaptive security appliance forwards the packet to the outside user An Inside User Visits the DMZ Web Server Figure 8 4 shows an...

Page 89: ...web server Because the internal network does not include a DNS server internal client requests for the DMZ web server are handled as follows 1 A lookup request is sent to the DNS server of the ISP The public IP address of the DMZ web server is returned to the client User 192 168 1 2 Inside DMZ 191801 www example com Internet Public IP Address 209 165 200 225 outside interface Inside interface 192 ...

Page 90: ...in the remainder of this chapter Configuring the Adaptive Security Appliance for a DMZ Deployment This section describes how to use ASDM to configure the adaptive security appliance for the configuration scenario shown in Figure 8 1 The procedure uses sample parameters based on the scenario This configuration procedure assumes that the adaptive security appliance already has interfaces configured ...

Page 91: ...efault configuration that permits inside clients access to devices on the Internet No additional configuration is required Internal clients can request information from the DMZ web server A NAT rule between the DMZ and inside interfaces that translates the real IP address of the DMZ web server to its public IP address 10 30 30 30 to 209 165 200 225 A NAT rule between the inside and DMZ interfaces ...

Page 92: ...dress is not exposed Enabling Inside Clients to Communicate with Devices on the Internet To permit internal clients to request content from devices on the Internet the adaptive security appliance translates the real IP addresses of internal clients to the external address of the outside interface that is the public IP address of the adaptive security appliance Outgoing traffic appears to come from...

Page 93: ...rface perform the following steps Step 1 In the Configuration Firewall NAT Rules pane click the green plus icon and choose and choose Add Network Object NAT Rule The Add Network Object dialog box appears Step 2 Fill in the following values In the Name field enter the object name Use characters a to z A to Z 0 to 9 a period a dash a comma or an underscore The name must be 64 characters or less From...

Page 94: ...ork or click and choose an the address from the Browse Translated Addr dialog box In the IP Address field enter In this scenario the IP address of the network is 192 168 1 0 Step 6 Click Advanced and configure the following options in the Advanced NAT Settings dialog box In the Source Interface drop down list choose the Inside interface In the Destination Interface drop down list choose the DMZ in...

Page 95: ...oyment Step 7 Click OK You return to the Add Network Object dialog box Step 8 Click OK to add the rule and return to the list of Address Translation Rules Confirm that the rule was created the way you expected The displayed configuration should be similar to the following Step 9 Click Apply to complete the adaptive security appliance configuration changes ...

Page 96: ...nter the object name Use characters a to z A to Z 0 to 9 a period a dash a comma or an underscore The name must be 64 characters or less From the Type drop down list choose Host In the IP Address field enter the real private address of the DMZ web server In this scenario the IP address is 10 30 30 30 Optional In the Description field enter a description of the network object up to 200 characters i...

Page 97: ...r a DMZ Deployment Step 6 Click Advanced and configure the following options in the Advanced NAT Settings dialog box In the Source Interface drop down list choose the DMZ interface In the Destination Interface drop down list choose the Inside interface These two settings specify the real and or mapped interfaces where this NAT rule should apply ...

Page 98: ...ASA 5500 Series Getting Started Guide 78 19186 01 Step 7 Click OK You return to the Add Network Object dialog box Step 8 Click OK to add the rule and return to the list of Address Translation Rules Confirm that the rule was created the way you expected The displayed configuration should be similar to the following ...

Page 99: ...209 165 200 225 To map the real web server IP address 10 30 30 30 statically to a public IP address 209 165 200 225 perform the following steps Step 1 In the Configuration Firewall NAT Rules pane click the green plus icon and choose and choose Add Network Object NAT Rule The Add Network Object dialog box appears Step 2 Fill in the following values In the Name field enter the object name Use charac...

Page 100: ...e an the address from the Browse Translated Addr dialog box Step 6 Click Advanced and configure the following options in the Advanced NAT Settings dialog box In the Source Interface drop down list choose the DMZ interface In the Destination Interface drop down list choose the Outside interface These two settings specify the real and or mapped interfaces where this NAT rule should apply To configur...

Page 101: ...rt Address Translation to translate the IP address of the DMZ web server to the public IP address IP address of the Outside interface of the adaptive security appliance Step 7 Click OK You return to the Add Network Object dialog box Step 8 Click OK to add the rule and return to the list of Address Translation Rules Confirm that the rule was created the way you expected The displayed configuration ...

Page 102: ...o access the DMZ web server you must configure an access control rule permitting incoming HTTP traffic destined for the DMZ web server This access control rule specifies the interface of the adaptive security appliance that processes the traffic that the traffic is incoming the origin and destination of the traffic and the type of traffic protocol and service to be permitted In this section you cr...

Page 103: ...ll pane click Access Rules c Click the green plus icon then choose Add Access Rule The Add Access Rule dialog box appears Step 2 In the Add Access Rule dialog box do the following a From the Interface drop down list choose Outside b Click the Permit Action radio button c In the Source field enter Any d In the Destination field enter the public IP address of the web server 209 165 200 225 e In the ...

Page 104: ...he configuration that the adaptive security appliance is currently running Clients on the public network can now resolve HTTP requests for content from the DMZ web server while keeping the private network secure Step 3 If you want the configuration changes to be saved to the startup configuration so that they are applied the next time the device starts from the File menu click Save Alternatively A...

Page 105: ...pplications of the adaptive security appliance To Do This See Refine configuration and configure optional and advanced features Cisco ASA 5500 Series Configuration Guide using the CLI Learn about daily operations Cisco ASA 5500 Series Command Reference Cisco ASA 5500 Series System Log Messages To Do This See Configure a remote access VPN Chapter 9 Scenario IPsec Remote Access VPN Configuration Con...

Page 106: ...Chapter 8 Scenario DMZ Configuration What to Do Next 8 24 Cisco ASA 5500 Series Getting Started Guide 78 19186 01 ...

Page 107: ...Cisco VPN client to connect to the adaptive security appliance If you are implementing an Easy VPN solution this chapter describes how to configure the Easy VPN server sometimes called a headend device This chapter includes the following sections Example IPsec Remote Access VPN Network Topology page 9 1 Implementing the IPsec Remote Access VPN Scenario page 9 2 What to Do Next page 9 17 Example IP...

Page 108: ...ction describes how to configure an Easy VPN server also known as a headend device Values for example configuration settings are taken from the remote access scenario illustrated in Figure 9 1 This section includes the following topics Information to Have Available page 9 3 Configuring an IPsec Remote Access VPN page 9 3 Selecting VPN Client Types page 9 5 Specifying the VPN Tunnel Group Name and ...

Page 109: ...ou have the following information available Range of IP addresses to be used in an IP pool These addresses are assigned to remote VPN clients as they are successfully connected List of users to be used in creating a local authentication database unless you are using a AAA server for authentication Networking information to be used by remote clients when connecting to the VPN including the followin...

Page 110: ... VPN Scenario 9 4 Cisco ASA 5500 Series Getting Started Guide 78 19186 01 Step 2 In Step 1 of the VPN Wizard perform the following steps a Click the Remote Access radio button b From the drop down list choose Outside as the enabled interface for the incoming VPN tunnels c Click Next to continue ...

Page 111: ...VPN Scenario Selecting VPN Client Types In Step 2 of the VPN Wizard perform the following steps Step 1 Specify the type of VPN client that will enable remote users to connect to this adaptive security appliance For this scenario click the Cisco VPN Client radio button You can also use any other Cisco Easy VPN remote product Step 2 Click Next to continue ...

Page 112: ...button and enter a preshared key for example Cisco This key is used for IPsec negotiations To use digital certificates for authentication click the Certificate radio button choose the Certificate Signing Algorithm from the drop down list and then choose a preconfigured trustpoint name from the drop down list If you want to use digital certificates for authentication but have not yet configured a t...

Page 113: ...me such as Cisco for the set of users that use common connection parameters and client attributes to connect to this adaptive security appliance Step 3 Click Next to continue Specifying a User Authentication Method Users can be authenticated either by a local authentication database or by using external authentication authorization and accounting AAA servers RADIUS TACACS SDI NT Kerberos and LDAP ...

Page 114: ...ticate users by creating a user database on the adaptive security appliance click the Authenticate Using the Local User Database radio button Step 2 If you want to authenticate users with an external AAA server group a Click the Authenticate Using an AAA Server Group radio button b Choose a preconfigured server group from the Authenticate using a AAA server group drop down list or click New to add...

Page 115: ...User Accounts If you have chosen to authenticate users with the local user database you can create new user accounts here You can also add users later using the ASDM configuration interface In Step 5 of the VPN Wizard perform the following steps Step 1 To add a new user enter a username and password and then click Add Step 2 When you have finished adding new users click Next to continue ...

Page 116: ...ust configure a pool of IP addresses that can be assigned to remote VPN clients as they are successfully connected In this scenario the pool is configured to use the range of IP addresses 209 165 201 1 209 165 201 20 In Step 6 of the VPN Wizard perform the following steps Step 1 Enter a pool name or choose a preconfigured pool from the Pool Name drop down list Alternatively click New to create a n...

Page 117: ...g Client Attributes To access your network each remote access client needs basic network configuration information such as which DNS and WINS servers to use and the default domain name Instead of configuring each remote client individually you can provide the client information to ASDM The adaptive security appliance pushes this information to the remote client or Easy VPN hardware client when a c...

Page 118: ...g Started Guide 78 19186 01 Step 2 Click Next to continue Configuring the IKE Policy IKE is a negotiation protocol that includes an encryption method to protect data and ensure privacy it is also an authentication method to ensure the identity of the peers In most cases the ASDM default values are sufficient to establish secure VPN tunnels ...

Page 119: ...e IPsec Remote Access VPN Scenario To specify the IKE policy in Step 8 of the VPN Wizard perform the following steps Step 1 Choose the Encryption DES 3DES AES authentication algorithms MD5 SHA and the Diffie Hellman group 1 2 5 7 used by the adaptive security appliance during an IKE security association Step 2 Click Next to continue ...

Page 120: ...daptive security appliance uses Network Address Translation NAT to prevent internal IP addresses from being exposed externally You can make exceptions to this network protection by identifying local hosts and networks that should be made accessible to authenticated remote users In Step 9 of the VPN Wizard perform the following steps Step 1 Specify hosts groups and networks that should be in the li...

Page 121: ...pt where each new key is unrelated to any previous key In IPsec negotiations Phase 2 keys are based on Phase 1 keys unless PFS is enabled PFS uses Diffie Hellman techniques to generate the keys PFS ensures that a session key derived from a set of long term public and private keys is not compromised if one of the private keys is compromised in the future Note PFS must be enabled on both sides of th...

Page 122: ...tion should be similar to the following If you are satisfied with the configuration click Finish to apply the changes to the adaptive security appliance If you want the configuration changes to be saved to the startup configuration so that they are applied the next time the device starts from the File menu click Save Alternatively ASDM prompts you to save the configuration changes permanently when...

Page 123: ...of the following steps You can configure the adaptive security appliance for more than one application The following sections provide configuration procedures for other common applications of the adaptive security appliance To Do This See Refine configuration and configure optional and advanced features Cisco ASA 5500 Series Configuration Guide using the CLI Learn about daily operations Cisco ASA ...

Page 124: ...Chapter 9 Scenario IPsec Remote Access VPN Configuration What to Do Next 9 18 Cisco ASA 5500 Series Getting Started Guide 78 19186 01 ...

Page 125: ...g the Cisco AnyConnect VPN Client Software page 10 2 Example Topology Using AnyConnect SSL VPN Clients page 10 3 Implementing the Cisco SSL VPN Scenario page 10 3 What to Do Next page 10 12 About SSL VPN Client Connections To begin the process of using the SSL VPN Client AnyConnect remote users enter in their browser the IP address or FQDN of the SSL VPN interface of the adaptive security applianc...

Page 126: ...m the Cisco website This chapter provides instructions for configuring the SSL VPN using a configuration Wizard You can download the Cisco SSL VPN software during the configuration process Users can download the AnyConnect VPN client from the adaptive security appliance or it can be installed manually on the remote PC by the system administrator For more information about installing the client sof...

Page 127: ... software and browser based clients Figure 10 1 Network Layout for SSL VPN Scenario Implementing the Cisco SSL VPN Scenario This section describes how to configure the adaptive security appliance to accept Cisco AnyConnect SSL VPN connections Values for example configuration settings are taken from the SSL VPN scenario illustrated in Figure 10 1 This section includes the following topics Informati...

Page 128: ... security appliance to which remote users will connect Digital certificate The adaptive security appliance generates a self signed certificate by default However for enhanced security you may want to purchase a publicly trusted SSL VPN certificate before putting the system in a production environment Range of IP addresses to be used in an IP pool These addresses are assigned to SSL AnyConnect VPN ...

Page 129: ... the Adaptive Security Appliance for the Cisco AnyConnect VPN Client To begin the configuration process perform the following steps Step 1 In the main ASDM window choose SSL VPN Wizard from the Wizards drop down menu The SSL VPN Wizard Step 1 screen appears Step 2 In Step 1 of the SSL VPN Wizard perform the following steps a Check the Cisco SSL VPN Client check box b Click Next to continue ...

Page 130: ...wing steps Step 1 Specify a Connection Name to which remote users connect Step 2 From the SSL VPN Interface drop down list choose the interface to which remote users connect When users establish a connection to this interface the SSL VPN portal page is displayed Step 3 From the Certificate drop down list choose the certificate the adaptive security appliance sends to the remote user to authenticat...

Page 131: ...rform the following steps Step 1 If you are using a AAA server or server group for authentication perform the following steps a Click the Authenticate using a AAA server group radio button b Specify a AAA Server Group Name c You can either choose an existing AAA server group name from the drop down list or you can create a new server group by clicking New To create a new AAA Server Group click New...

Page 132: ...e AAA server d Click OK Step 2 If you have chosen to authenticate users with the local user database you can create new user accounts here You can also add users later using the ASDM configuration interface To add a new user enter a username and password and then click Add Step 3 When you have finished adding new users click Next to continue Specifying a Group Policy In Step 4 of the SSL VPN Wizar...

Page 133: ...ons so click Next again Configuring the Cisco AnyConnect VPN Client For remote clients to gain access to your network with a Cisco AnyConnect VPN client you must configure a pool of IP addresses that can be assigned to remote VPN clients as they are successfully connected In this scenario the pool is configured to use the range of IP addresses 209 165 200 225 209 165 200 254 You must also specify ...

Page 134: ...a preconfigured address pool choose the name of the pool from the IPv4 Address Pool drop down list or the IPv6 Address Pool drop down list Step 2 Alternatively click New to create a new address pool Step 3 Specify the location of the AnyConnect VPN client software image To obtain the most current version of the software click Download Latest AnyConnect VPN Client from cisco com This downloads the ...

Page 135: ...d configuration should be similar to the following If you are satisfied with the configuration click Finish to apply the changes to the adaptive security appliance If you want the configuration changes to be saved to the startup configuration so that they are applied the next time the device starts from the File menu click Save Alternatively ASDM prompts you to save the configuration changes perma...

Page 136: ...pplication The following sections provide configuration procedures for other common applications of the adaptive security appliance To Do This See Refine configuration and configure optional and advanced features Cisco ASA 5500 Series Configuration Guide using the CLI Learn about daily operations Cisco ASA 5500 Series Command Reference Cisco ASA 5500 Series System Log Messages To Do This See Confi...

Page 137: ...sers without a software client or hardware client This chapter includes the following sections About Clientless SSL VPN page 11 1 Example Network with Browser Based SSL VPN Access page 11 3 Implementing the Clientless SSL VPN Scenario page 11 4 What to Do Next page 11 16 About Clientless SSL VPN Clientless SSL VPN connections enable secure and easy access to a broad range of web resources and web ...

Page 138: ...ntless SSL VPN Connections Clientless SSL VPN connections on the adaptive security appliance differ from remote access IPsec connections particularly with respect to how they interact with SSL enabled servers and the validation of certificates In a Clientless SSL VPN connection the adaptive security appliance acts as a proxy between the end user web browser and target web servers When a user conne...

Page 139: ...inks to specific targets on the internal network that you want users of Clientless SSL VPN to be able to access 3 Educate users If an SSL enabled site is not inside the private network users should not visit this site over a Clientless SSL VPN connection They should open a separate browser window to visit such sites and use that browser to view the presented certificate The adaptive security appli...

Page 140: ...cess scenario illustrated in Figure 11 1 This section includes the following topics Information to Have Available page 11 5 Configuring the Adaptive Security Appliance for Browser Based SSL VPN Connections page 11 6 Specifying the SSL VPN Interface page 11 7 Specifying a User Authentication Method page 11 8 Specifying a Group Policy page 11 10 Creating a Bookmark List for Remote Users page 11 11 V...

Page 141: ...s you may want to purchase a publicly trusted SSL VPN certificate before putting the system in a production environment List of users to be used in creating a local authentication database unless you are using a AAA server for authentication If you are using a AAA server for authentication the AAA Server Group Name The following information about group policies on the AAA server Server group name ...

Page 142: ...ce for Browser Based SSL VPN Connections To begin the process for configuring a browser based SSL VPN perform the following steps Step 1 In the main ASDM window choose SSL VPN Wizard from the Wizards drop down menu The SSL VPN Feature Step 1 screen appears Step 2 In Step 1 of the SSL VPN Wizard perform the following steps a Check the Browser based SSL VPN Web VPN check box b Click Next to continue...

Page 143: ...ollowing steps Step 1 Specify a Connection Name to which remote users connect Step 2 From the SSL VPN Interface drop down list choose the interface to which remote users connect When users establish a connection to this interface the SSL VPN portal page is displayed Step 3 From the Certificate drop down list choose the certificate the adaptive security appliance sends to the remote user to authent...

Page 144: ... trusted SSL VPN certificate before putting the system in a production environment Specifying a User Authentication Method Users can be authenticated either by a local authentication database or by using external authentication authorization and accounting AAA servers RADIUS TACACS SDI NT Kerberos and LDAP In Step 3 of the SSL VPN Wizard perform the following steps Step 1 If you are using a AAA se...

Page 145: ...er group drop down list or click New to add a new AAA server group To create a new AAA Server Group click New The New Authentication Server Group dialog box appears In this dialog box specify the following A server group name The Authentication Protocol to be used TACACS SDI NT Kerberos LDAP IP address of the AAA server Interface of the adaptive security appliance Secret key to be used when commun...

Page 146: ... add users later using the ASDM configuration interface To add a new user enter a username and password and then click Add Step 3 When you have finished adding new users click Next to continue Specifying a Group Policy In Step 4 of the SSL VPN Wizard specify a group policy by performing the following steps Step 1 Click the Create new group policy radio button and specify a group name OR Click the ...

Page 147: ...can create a portal page a special web page that comes up when browser based clients establish VPN connections to the adaptive security appliance by specifying a list of URLs to which users should have easy access In Step 5 of the SSL VPN Wizard specify URLs to appear on the VPN portal page by performing the following steps Step 1 To specify an existing bookmark list choose the Bookmark List name ...

Page 148: ...ess Connections Implementing the Clientless SSL VPN Scenario 11 12 Cisco ASA 5500 Series Getting Started Guide 78 19186 01 To add a new list or edit an existing list click Manage The Configure GUI Customization Objects dialog box appears ...

Page 149: ...the Clientless SSL VPN Scenario Step 2 To create a new bookmark list click Add To edit an existing bookmark list choose the list and click Edit The Add Bookmark List dialog box appears Step 3 In the URL List Name field specify a name for the list of bookmarks you are creating This is used as the title for your VPN portal page ...

Page 150: ... choose the type of URL you are specifying For example choose http https ftp and so on Then specify the complete URL for the page Step 7 Click OK to return to the Add Bookmark List dialog box Step 8 If you are finished adding bookmark lists click OK to return to the Configure GUI Customization Objects dialog box Step 9 When you are finished adding and editing bookmark lists click OK to return to S...

Page 151: ...ld be similar to the following If you are satisfied with the configuration click Finish to apply the changes to the adaptive security appliance If you want the configuration changes to be saved to the startup configuration so that they are applied the next time the device starts from the File menu click Save Alternatively ASDM prompts you to save the configuration changes permanently when you exit...

Page 152: ...her common applications of the adaptive security appliance To Do This See Refine configuration and configure optional and advanced features Cisco ASA 5500 Series Configuration Guide using the CLI Learn about daily operations Cisco ASA 5500 Series Command Reference Cisco ASA 5500 Series System Log Messages To Do This See Configure the adaptive security appliance to protect a web server in a DMZ Cha...

Page 153: ...le maintaining their network security A VPN connection enables you to send data from one location to another over a secure connection or tunnel first by authenticating both ends of the connection and then by automatically encrypting all data sent between the two sites This chapter includes the following sections Example Site to Site VPN Network Topology page 12 1 Implementing the Site to Site Scen...

Page 154: ...te VPN deployment using example parameters from the remote access scenario shown in Figure 12 1 This section includes the following topics Information to Have Available page 12 3 Configuring the Site to Site VPN page 12 3 Internet 190929 Cisc o ASA SSC 05 Statu s Secu rity Serv ices Card Slot 1 2 cons ole RES ET POW ER 48VDC 7 POWE R over ETHE RNET 6 5 4 3 2 1 0 ISP Router Site A Adaptive Security...

Page 155: ...to Site VPN This section describes how to use the ASDM VPN Wizard to configure the adaptive security appliance for a site to site VPN This section includes the following topics Configuring the Security Appliance at the Local Site page 12 3 Providing Information About the Remote VPN Peer page 12 5 Configuring the IKE Policy page 12 6 Configuring IPsec Encryption and Authentication Parameters page 1...

Page 156: ...rds drop down menu ASDM opens the first VPN Wizard screen In Step 1 of the VPN Wizard perform the following steps a In the VPN Tunnel Type area click the Site to Site radio button Note The Site to Site VPN option connects two IPsec security gateways which can include adaptive security appliances VPN concentrators or other devices that support site to site IPsec connectivity b From the VPN tunnel I...

Page 157: ...ods To use a static preshared key for authentication click the Pre Shared Key radio button and enter a preshared key for example Cisco This key is used for IPsec negotiations between the adaptive security appliances Note When using preshared key authentication the Tunnel Group Name must be the IP address of the peer To use digital certificates for authentication click the Certificate radio button ...

Page 158: ...yption method to protect data and ensure privacy it also provides authentication to ensure the identity of the peers In most cases the ASDM default values are sufficient to establish secure VPN tunnels between two peers In Step 3 of the VPN Wizard perform the following steps Step 1 Click the Encryption DES 3DES AES authentication algorithms MD5 SHA and the Diffie Hellman group 1 2 5 used by the ad...

Page 159: ...figuration Implementing the Site to Site Scenario Note When configuring Security Appliance 2 enter the exact values for each of the options that you chose for Security Appliance 1 Encryption mismatches are a common cause of VPN tunnel failures and can slow down the process Step 2 Click Next to continue ...

Page 160: ... down list and the authentication algorithm MD5 SHA from the Authentication drop down list Step 2 Check the Enable Perfect Forwarding Secrecy PFS check box to specify whether to use perfect forwarding secrecy and the size of the numbers to use from the Diffie Hellman Group drop down list in generating Phase 2 IPsec keys PFS is a cryptographic concept where each new key is unrelated to any previous...

Page 161: ...ransmitted through the VPN tunnel In addition identify hosts and networks at the remote site to be allowed to use this IPsec tunnel to access local hosts and networks Add or remove hosts and networks dynamically by clicking Add or Delete respectively In this scenario for Security Appliance 1 the remote network is Network B 10 20 20 0 so traffic encrypted from this network is permitted through the ...

Page 162: ...86 01 Step 3 If you are not using NAT or PAT check the Exempt ASA side host network from address translation check box and choose the inside interface from the drop down list Step 4 Click Next to continue Viewing VPN Attributes and Completing the Wizard In Step 6 of the VPN Wizard review the configuration list for the VPN tunnel you just created ...

Page 163: ...ity appliance If you want the configuration changes to be saved to the startup configuration so that they are applied the next time the device starts from the File menu click Save Alternatively ASDM prompts you to save the configuration changes permanently when you exit ASDM If you do not save the configuration changes the old configuration takes effect the next time the device starts This conclud...

Page 164: ...or Security Appliance 1 with the exception of local hosts and networks Mismatches are a common cause of VPN configuration failures For information about verifying or troubleshooting the configuration for the Site to Site VPN see the section Troubleshooting the Security Appliance in the Cisco ASA 5500 Series Configuration Guide using the CLI For specific troubleshooting issues see the Troubleshooti...

Page 165: ...rity appliance for more than one application The following sections provide configuration procedures for other common applications of the adaptive security appliance To Do This See Refine configuration and configure optional and advanced features Cisco ASA 5500 Series Configuration Guide using the CLI Learn about daily operations Cisco ASA 5500 Series Command Reference Cisco ASA 5500 Series System...

Page 166: ...Chapter 12 Scenario Site to Site VPN Configuration What to Do Next 12 14 Cisco ASA 5500 Series Getting Started Guide 78 19186 01 ...

Page 167: ...hased an AIP SSM use the procedures in this chapter to Configure the adaptive security appliance to identify traffic to be diverted to the AIP SSM Session in to the AIP SSM and run setup Note The AIP SSM is supported in the Cisco ASA 5500 series software versions 7 0 1 and later You can install the AIP SSM into an ASA 5500 series adaptive security appliance The AIP SSM runs advanced IPS software t...

Page 168: ...ough the adaptive security appliance and the AIP SSM in the following way 1 Traffic enters the adaptive security appliance 2 Firewall policies are applied 3 Traffic is sent to the AIP SSM over the backplane See the Operating Modes section on page 13 3 for information about only sending a copy of the traffic to the AIP SSM 4 The AIP SSM applies its security policy to the traffic and takes appropria...

Page 169: ...licy on a packet by packet basis This mode however can affect throughput Promiscuous mode This mode sends a duplicate stream of traffic to the AIP SSM This mode is less secure but has little impact on traffic throughput Unlike the inline mode in promiscuous mode the AIP SSM can only block traffic by instructing the adaptive adaptive security appliance to shun the traffic or by resetting a connecti...

Page 170: ...IP SSM You can assign each context or single mode adaptive security appliance to one or more virtual sensors or you can assign multiple security contexts to the same virtual sensor See the IPS documentation for more information about virtual sensors including the maximum number of sensors supported Figure 13 3 shows one security context paired with one virtual sensor in inline mode while two secur...

Page 171: ...e adaptive security appliance paired with multiple virtual sensors in inline mode each defined traffic flow goes to a different sensor Figure 13 4 Single Mode Security Appliance with Multiple Virtual Sensors Security Appliance Main System AIP SSM Sensor 1 Context 1 Context 2 Context 3 Sensor 2 191316 Sensor 1 Sensor 2 Sensor 3 Security Appliance Main System AIP SSM Traffic 1 Traffic 2 Traffic 3 19...

Page 172: ...spection and protection policy which determines how to inspect traffic and what to do when an intrusion is detected Configure the inspection and protection policy for each virtual sensor if you want to run the AIP SSM in multiple sensor mode See the Configuring the Security Policy on the AIP SSM section on page 13 8 3 On the ASA 5500 series adaptive security appliance in multiple context mode spec...

Page 173: ...not a word in the dictionary login cisco Password Last login Fri Sep 2 06 21 20 from xxx xxx xxx xxx NOTICE This product contains cryptographic features and is subject to United States and local country laws governing import export transfer and use Delivery of Cisco cryptographic products does not imply third party authority to import export distribute or use encryption Importers exporters distrib...

Page 174: ... to inspect traffic and what to do when an intrusion is detected perform the following steps To session from the adaptive security appliance to the AIP SSM see the Sessioning to the AIP SSM section on page 13 6 To configure the security policy on the AIP SSM perform the following steps Step 1 To run the setup utility for initial configuration of the AIP SSM enter the following command sensor setup...

Page 175: ...s used You can assign the same sensor to multiple contexts Note You do not need to be in multiple context mode to use virtual sensors you can be in single mode and use different sensors for different traffic flows To assign one or more sensors to a security context perform the following steps Step 1 To enter context configuration mode enter the following command in the system execution space hostn...

Page 176: ...y a sensor name the context uses this default sensor You can only configure one default sensor per context If you want to change the default sensor enter the no allocate ips sensor_name command to remove the current default sensor before you allocate a new default sensor If you do not specify a sensor as the default and the context configuration does not include a sensor name then traffic uses the...

Page 177: ...cate ips sensor1 ips1 hostname config ctx allocate ips sensor3 ips2 hostname config ctx config url ftp user1 passw0rd 10 1 1 1 configlets sample cfg hostname config ctx member silver hostname config ctx changeto context A Diverting Traffic to the AIP SSM To identify traffic to divert from the adaptive adaptive security appliance to the AIP SSM perform the following steps In multiple context mode p...

Page 178: ...ugh uninspected if the AIP SSM is unavailable If you use virtual sensors on the AIP SSM you can specify a sensor name using the sensor sensor_name argument To see available sensor names enter the ips sensor command Available sensors are listed You can also use the show ips command If you use multiple context mode on the adaptive security appliance you can only specify sensors that you assigned to ...

Page 179: ... policy map to traffic on a specific interface use the interface interface_ID option where interface_ID is the name assigned to the interface with the nameif command Only one global policy is allowed You can override the global policy on an interface by applying a service policy to that interface You can only apply one policy map to each interface The following example diverts all IP traffic to th...

Page 180: ...ne fail open sensor sensor1 hostname config pmap class my ips class2 hostname config pmap c ips inline fail open sensor sensor2 hostname config pmap c service policy my ips policy interface outside What to Do Next You are now ready to configure the adaptive security appliance for intrusion prevention Use the following documents to continue configuring the adaptive security appliance for your imple...

Page 181: ...nfiguration Guide using the CLI Learn about daily operations Cisco ASA 5500 Series Command Reference Cisco ASA 5500 Series System Log Messages Review hardware maintenance and troubleshooting information Cisco ASA 5500 Series Hardware Installation Guide To Do This See Configure protection of a DMZ web server Chapter 8 Scenario DMZ Configuration Configure a remote access VPN Chapter 9 Scenario IPsec...

Page 182: ...Chapter 13 Configuring the AIP SSM What to Do Next 13 16 Cisco ASA 5500 Series Getting Started Guide 78 19186 01 ...

Page 183: ...s to it Note The CSC SSM requires the Cisco ASA 5500 series software Version 7 1 1 or later This chapter includes the following sections About the CSC SSM page 14 1 About Deploying the Adaptive Security Appliance with the CSC SSM page 14 2 Scenario Security Appliance with CSC SSM Deployed for Content Security page 14 4 What to Do Next page 14 17 About the CSC SSM The CSC SSM maintains a file conta...

Page 184: ... security policies in the CSC SSM software you access the web based GUI for the CSC SSM by clicking links within ASDM This chapter describes how to configure the adaptive security appliance for the deployment Use of the CSC SSM GUI is explained in the Cisco Content Security and Control SSM Administrator Guide About Deploying the Adaptive Security Appliance with the CSC SSM In a network in which th...

Page 185: ...eved the adaptive security appliance determines whether its service policies define this content type as one that should be diverted to the CSC SSM for scanning and does so if appropriate 4 The CSC SSM receives the content from the adaptive security appliance scans it and compares it to its latest update of the Trend Micro content filters 5 If the content is suspicious the CSC SSM blocks the conte...

Page 186: ...routing Rather the CSC SSM forwards the SMTP traffic directly to the SMTP servers protected by the adaptive security appliance Scenario Security Appliance with CSC SSM Deployed for Content Security Figure 14 2 is an illustration of a typical deployment of the adaptive security appliance with CSC SSM Figure 14 2 CSC SSM Deployment Scenario 148387 192 168 100 1 192 168 50 1 Notifications SMTP Server...

Page 187: ...nd the dedicated management network This enables the CSC SSM to retrieve updated content security filters from the Trend Micro update server The management network includes an SMTP server so that administrators can be notified of CSC SSM events The management network also includes a syslog server to store logs generated by the CSC SSM This section includes the following topics Configuration Requir...

Page 188: ...sing the Startup Wizard Your next steps are to configure the adaptive security appliance for a content security deployment The basic steps are as follows 1 Obtain software activation key from Cisco com 2 Gather the information you need to configure the CSC SSM 3 Using ASDM verify time settings 4 In ASDM run the CSC setup wizard to configure the CSC SSM 5 Using ASDM configure the adaptive security ...

Page 189: ... Appendix A Obtaining a 3DES AES License Note The SSM management port IP address must be accessible by the hosts used to run ASDM The IP addresses for the SSM management port and the adaptive security appliance management interface can be in different subnets Hostname and domain name to be used for the CSC SSM DNS Server IP address HTTP proxy server IP address if your network uses a proxy for HTTP...

Page 190: ...ntrol time settings verify the NTP configuration In ASDM choose Configuration Device Setup System Time NTP Run the CSC Setup Wizard To run the CSC Setup Wizard perform the following steps Step 1 In the ASDM main application window choose Configuration Trend Micro Content Security Wizard Setup Launch Wizard Setup The CSC Setup Wizard screen appears Step 2 In Step 1 of the CSC Setup Wizard enter the...

Page 191: ... CSC SSM Scenario Security Appliance with CSC SSM Deployed for Content Security Step 3 Click Next Step 4 In Step 2 of the CSC Setup Wizard enter the following information IP address network mask and gateway IP address for the CSC management interface IP address for the Primary DNS server ...

Page 192: ...ith CSC SSM Deployed for Content Security 14 10 Cisco ASA 5500 Series Getting Started Guide 78 19186 01 Optional IP address and proxy port of the HTTP proxy server only if your network uses an HTTP proxy server to send HTTP requests to the Internet Step 5 Click Next ...

Page 193: ... Step 6 In Step 3 of the CSC Setup Wizard enter the following information Hostname and domain name of the CSC SSM Domain name used by the local mail server as the incoming domain Note Anti spam policies are applied only to e mail traffic entering this domain Administrator e mail address e mail server IP address and port to be used for notifications Step 7 Click Next ...

Page 194: ... network mask for each subnet and host that should have management access to the CSC SSM By default all networks have management access to the CSC SSM Note For security purposes we recommend that you restrict access to specific subnets or management hosts To enter a new host and network combination of settings click Add To remove an existing host and network combination choose one from the Selecte...

Page 195: ...CSC SSM Scenario Security Appliance with CSC SSM Deployed for Content Security Step 10 In Step 5 of the CSC Setup Wizard enter the following information The default factory configuration password cisco A new password for management access Confirmation of the new password Step 11 Click Next ...

Page 196: ...liance with CSC SSM Deployed for Content Security 14 14 Cisco ASA 5500 Series Getting Started Guide 78 19186 01 Step 12 In Step 6 of the CSC Setup Wizard define traffic selections for CSC scanning Click Add The Specify Traffic for CSC Scan dialog box appears ...

Page 197: ...cts list and click OK Step 17 To specify the type of service for the CSC to scan click the ellipses to display the Browse Service dialog box Step 18 Choose the service s from the list and click OK Step 19 Enter a description for the network traffic that you want the CSC to scan in the field provided Step 20 To specify whether or not to allow the CSC to scan network traffic if it fails do the follo...

Page 198: ...p 21 Click Next Step 22 In Step 7 of the CSC Setup Wizard review the configuration settings that you have entered for the CSC SSM in the Summary screen Step 23 If you are satisfied with these settings click Finish To make changes click Back until you reach the screen whose settings you want to modify An informational message appears indicating that the CSC SSM is active ...

Page 199: ...l as e mail and FTP parameters For more information see the Cisco Content Security and Control SSM Administrator Guide What to Do Next You are now ready to configure the Trend Micro Interscan for Cisco CSC SSM software Use the following documents to continue configuring the adaptive security appliance for your implementation To Perform This Task See Configure CSC SSM software such as advanced secu...

Page 200: ...ion Guide using the CLI Learn about daily operations Cisco ASA 5500 Series Command Reference Cisco ASA 5500 Series System Log Messages Review hardware maintenance and troubleshooting information Cisco ASA 5500 Series Hardware Installation Guide To Perform This Task See Configure protection of a DMZ web server Chapter 8 Scenario DMZ Configuration Configure a remote access VPN Chapter 9 Scenario IPs...

Page 201: ...can mix the copper and fiber ports using the same 4GE SSM card Note The 4GE SSM requires the Cisco ASA 5500 series software Version 7 1 1 or later This chapter includes the following sections Cabling 4GE SSM Interfaces page 15 2 Setting the 4GE SSM Media Type for Fiber Interfaces Optional page 15 3 What to Do Next page 15 5 Note Because the default media type setting is Ethernet you do not need to...

Page 202: ...t on the 4GE SSM as shown in Figure 15 1 Figure 15 1 Connecting the Ethernet port c Connect the other end of the cable to your network device Step 2 Optional If you want to use an SFP fiber optic port install and cable the SFP modules as shown in Figure 15 2 a Insert and slide the SFP module into the SFP port until you hear a click The click indicates that the SFP module is locked into the port b ...

Page 203: ...or each SFP interface Continue with the following procedure Setting the 4GE SSM Media Type for Fiber Interfaces Optional Setting the 4GE SSM Media Type for Fiber Interfaces Optional If you are using fiber interfaces for each SFP interface you must change the media type setting from the default setting Ethernet to Fiber Connector Note Because the default media type setting is Ethernet you do not ne...

Page 204: ... tab Step 3 Click the 4GE SSM interface and click Edit The Edit Interface dialog box appears Step 4 Click Configure Hardware Properties The Hardware Properties dialog box appears Step 5 From the Media Type drop down list choose Fiber Connector Step 6 Click OK to return to the Edit Interfaces dialog box then click OK to return to the interfaces configuration dialog box Step 7 Repeat this procedure ...

Page 205: ... performing some of the following additional steps To Do This See Refine configuration and configure optional and advanced features Cisco ASA 5500 Series Configuration Guide using the CLI Learn about daily operations Cisco ASA 5500 Series Command Reference Cisco ASA 5500 Series System Log Messages Review hardware maintenance and troubleshooting information Cisco ASA 5500 Series Hardware Installati...

Page 206: ...Chapter 15 Configuring the 4GE SSM for Fiber What to Do Next 15 6 Cisco ASA 5500 Series Getting Started Guide 78 19186 01 ...

Page 207: ...stered user of Cisco com and would like to obtain a 3DES AES encryption license go to the following website http www cisco com go license If you are not a registered user of Cisco com go to the following website https tools cisco com SWIFT Licensing RegistrationServlet Provide your name e mail address and the serial number for the adaptive security appliance as it appears in the show version comma...

Page 208: ...tuple key Updates the encryption activation key by replacing the activation 4 tuple key variable with the activation key obtained with your new license The activation 5 tuple key variable is a five element hexadecimal string with one space between each element An example is 0xe02888da 0x4ba7bed6 0xf1c123ae 0xffd8624e The 0x is optional all values are assumed to be hexadecimal Step 4 hostname confi...

Reviews:

No comments