Contents
Software Version
Cisco ASA Series Firewall CLI Configuration Guide
Cisco ASA Series Firewall CLI Configuration Guide
Iii
N T E N T S
Guidelines and Limitations Default Inspection Policy Maps
NAT for VPN
Guidelines and Limitations
Vii
Rules
Viii
Getting Started with Application Layer Protocol Inspection
IPv6 Inspection
Verifying and Monitoring Sun RPC Inspection
Configuring Unified Communications
Xii
Installing a Certificate
Xiii
Enabling the Phone Proxy with SIP and Skinny Inspection
Xiv
CTL Client Overview
Architecture
Xvi
Configuring Connection Settings and QoS
Xvii
Configuring the Standard Priority Queue for an Interface
Xviii
Bypassing Scanning with Whitelists
Xix
Information About the Static Database
Configuring Java Applet Filtering
Xxi
Filtering URLs and FTP Requests with an External Server
30-15
Xxii
Xxiii
ASA 5505 Configuring Basic Network Settings
Xxiv
Convention Indication
Document Objectives
Related Documentation
Conventions
Xxvi
Obtaining Documentation and Submitting a Service Request
R T
Page
Information About Service Policies
For Through
Supported Features
Feature Directionality
Feature Traffic? See
Feature
Feature Matching Within a Service Policy
Global Direction
ASA IPS ASA CX
Order in Which Multiple Feature Actions are Applied
Incompatibility of Certain Feature Actions
Feature Matching for Multiple Service Policies
Licensing Requirements for Service Policies
Guidelines and Limitations
Class Map Guidelines
Service Policy Guidelines
Policy Map Guidelines
Default Configuration
Default Settings
Default Configuration, Default Class Maps,
This section includes the following topics
Task Flows for Configuring Service Policies
Default Class Maps
Task Flow for Using the Modular Policy Framework
See the Identifying Traffic Layer 3/4 Class Maps section on
Layer 3/4 Policy Map
Example
Command Purpose
Identifying Traffic Layer 3/4 Class Maps
Creating a Layer 3/4 Class Map for Through Traffic
Ports are included in the match default-inspection-traffic
See the Default Settings and NAT Limitations section on
Match default-inspection-traffic command to narrow
Match flow ip destination-address command to match flows
Except for the match any , match access-list , or match
Creating a Layer 3/4 Class Map for Management Traffic
Defining Actions Layer 3/4 Policy Map
Creates a management class map, where classmapname is a
QoS Traffic Shaping section on page 1-11 for more
Task Flow for Configuring Hierarchical Policy Maps for
See the Supported Features section on
Identifying Traffic Layer 3/4 Class Maps section on
Applying Actions to an Interface Service Policy
IPv6, see the IPv6 Guidelines section on
Configuration Examples for Modular Policy Framework
Displays the service policy statistics
Monitoring Modular Policy Framework
Applying Inspection to Http Traffic Globally
See the following commands for this example
Ciscoasaconfig# class-map httptraffic
Applying Inspection and QoS Policing to Http Traffic
Ciscoasaconfig# service-policy httptrafficpolicy global
Ciscoasaconfig# policy-map httptrafficpolicy
Host
Ciscoasaconfig# service-policy httpclient interface inside
Applying Inspection to Http Traffic with NAT
Obj-192.168.1.1
Radius-accounting
Feature History for Service Policies
Feature Name Releases Feature Information
Introduced class-map type management, and inspect
Information About Inspection Policy Maps
Guidelines and Limitations
Default Inspection Policy Maps
Identifying Traffic in an Inspection Class Map section on
Defining Actions in an Inspection Policy Map
Identifying Traffic in an Inspection Class Map
Getting Started with Application Layer Protocol Inspection
Feature History for Inspection Policy Maps
Where to Go Next
1lists the release history for this feature
Page
Configuring Network Address Translation
Page
Information About NAT
Why Use NAT?
NAT Terminology
Information About Static NAT
NAT Types
NAT Types Overview
Static NAT
Information About Static NAT with Port Address Translation
Information About Static NAT with Port Translation
Static NAT with Identity Port Translation
Information About One-to-Many Static NAT
4shows a typical few-to-many static NAT scenario
Information About Other Mapping Scenarios Not Recommended
Information About Dynamic NAT
Dynamic NAT
Dynamic NAT Disadvantages and Advantages
Dynamic PAT
Information About Dynamic PAT
Dynamic PAT Disadvantages and Advantages
Per-Session PAT vs. Multi-Session PAT
Identity NAT
NAT in Routed and Transparent Mode
NAT in Routed Mode, NAT in Transparent Mode,
NAT in Transparent Mode
NAT in Routed Mode
10 NAT Example Transparent Mode
How NAT is Implemented
NAT and IPv6
Main Differences Between Network Object NAT and Twice NAT
Information About Twice NAT
Information About Network Object NAT
11 Twice NAT with Different Destination Addresses
12 Twice NAT with Different Destination Ports
13 Twice Static NAT with Destination Address Translation
Rule Type Order of Rules within the Section
NAT Rule Order
Routing NAT Packets
NAT Interfaces
Mapped Addresses and Routing
Too late
Transparent Mode Routing Requirements for Remote Networks
NAT for VPN
203.0.113.16075
NAT and Remote Access VPN
Same-security-traffic permit intra-interface
NAT and Site-to-Site VPN
19 Interface PAT and Identity NAT for Site-to-Site VPN
See the following sample NAT configuration for ASA1 Boulder
Object network vpnlocal Subnet 10.3.3.0
NAT and VPN Management Access
Subnet 10.2.2.0
Object network boulderinside Subnet 10.1.1.0
Subnet 10.1.1.0 Nat inside,outside dynamic interface
Management-access inside
Enter show nat detail and show conn all
Troubleshooting NAT and VPN
Add the identity NAT configuration
DNS and NAT
22 DNS Reply Modification, DNS Server on Outside
192.168.1.10
24 DNS Reply Modification, DNS Server on Host Network
2001DB8D1A5C8E1
26 PTR Modification, DNS Server on Host Network
Page
Information About Network Object NAT
Configuring Network Object NAT
Prerequisites for Network Object NAT
Licensing Requirements for Network Object NAT
Supports IPv6. See also the NAT and IPv6 section on
Additional Guidelines
Adding Network Objects for Mapped Addresses
Configuring Network Object NAT
Object
Configuring Dynamic NAT
Object network objname
DNS and NAT section on page 3-28 for more information
Additional Guidelines section on
Nat inside,outside dynamic nat-pat-grp interface
Configuring Dynamic PAT Hide
Mapped addresses
Configures a network object for which you want to configure
Optional Create a network object or group for
See the Adding Network Objects for Mapped Addresses section
When you want to use the interface IP address you
Configures dynamic PAT for the object IP addresses. You can
Interface-Routed mode only The IP address
Used. For this option, you must configure a specific
Ciscoasaconfig-network-object#nat inside,outside dynamic
Ciscoasaconfig# object network IPv4POOL
Configuring Static NAT or Static NAT-with-Port-Translation
Ciscoasaconfig# object network IPv6INSIDE
Addresses IPv4 or IPv6 that you want to translate
See the DNS and NAT section on page 3-28. This option is
Static NAT section on
See the Mapped Addresses and Routing section on
Translate. See the Adding Network Objects for Mapped
Configuring Identity NAT
Addresses section on
Section on page 3-22 for more information
NAT command. See the Determining the Egress Interface
See the Additional Guidelines section on
Mapped Addresses and Routing section on
By default, the following rules are installed
Configuring Per-Session PAT Rules
Shows NAT statistics, including hits for each NAT rule
Monitoring Network Object NAT
How many times they were allocated
Configuration Examples for Network Object NAT
Create a network object for the internal web server
Providing Access to an Inside Web Server Static NAT
Configure static NAT for the object
Ciscoasaconfig# object network myWebServ
Create a network object for the outside web server
Configure static NAT for the web server
Ciscoasaconfig-network-object#nat outside,inside static
Create a network object for the inside network
Create a network object for the load balancer
Configure static NAT for the load balancer
Ciscoasaconfig# object network myPublicIPs
Ciscoasaconfig# object network myLBHost
Create a network object for the Http server address
Ciscoasaconfig# object network Ftpserver
Ciscoasaconfig# object network Httpserver
Create a network object for the FTP server address
Create a network object for the Smtp server address
Ciscoasaconfig# object network Smtpserver
DNS Reply Modification
DNS Reply Modification Using Outside NAT
2001DB8D1A5C8E1
Ciscoasaconfig# object network Dnsserver
Platform Feature Name Releases Feature Information
Feature History for Network Object NAT
Pat-pool mappedobject extended
Pat-pool mappedobject flat include-reserve
Configuration mode, show nat, show nat pool, show xlate
General-attributes configuration mode
Nat-assigned-to-public-ip interface tunnel-group
Show nat pool
Page
Information About Twice NAT
Configuring Twice NAT
Prerequisites for Twice NAT
Licensing Requirements for Twice NAT
Supports IPv6
Configuring Twice NAT Guidelines and Limitations
Adding Network Objects for Real and Mapped Addresses
Configuring Twice NAT
Configuring Twice NAT
Configure service objects for
Optional Adding Service Objects for Real and Mapped Ports
Command Purpose
See the Adding Network Objects for Real and Mapped
See the Optional Adding Service Objects for Real and Mapped
Ports section on
You can optionally configure the following fallback
Configure dynamic NAT. See the following guidelines
Section and Line-Optional By default, the NAT rule is
Anywhere in the applicable section using the line argument
Command Purpose
Subnet 203.0.113.0
For a PAT pool
Subnet 2001DB8AAAA/96
Configuring Twice NAT
Detailed Steps
Interface keyword enables interface PAT fallback. After
Configures dynamic PAT hide. See the following guidelines
Mapped-Configure one of the following
Interface-Routed mode only Specify the interface
Command Purpose
Command Purpose
Subnet 192.168.1.0
Service tcp destination eq
Host 2001DB823
Source or Destination mapped ports
Source or Destination real ports
See the Static Interface NAT with Port Translation
Rule Order section on page 3-18for more information about
Examples
OUTSIDEIPv6NW
Object
MAPPEDIPv6NW
Subnet 2001DB8BBBB/96
Source real addresses you will typically use
Static Interface NAT with Port Translation section on
How many times they were allocated
To monitor twice NAT, enter one of the following commands
Monitoring Twice NAT
Shows NAT statistics, including hits for each NAT rule
Add a network object for the DMZ network
Configuration Examples for Twice NAT
Ciscoasaconfig# object network PATaddress1
Add a network object for the inside network
Configure the second twice NAT rule
Configure the first twice NAT rule
Ciscoasaconfig# object network TelnetWebServer
Add a network object for the PAT address when using Telnet
Add a service object for Telnet
Ciscoasaconfig# object network myInsideNetwork
Add a service object for Http
Existing functionality. The unidirectional keyword is
Feature History for Twice NAT
We modified the following command nat source static
Show nat, show xlate, show nat pool
Pat-pool mappedobject flat include-reserve
Nat-assigned-to-public-ip interface tunnel-group
Show nat pool
Configuring Access Control
Page
Information About Access Rules
Configuring Access Rules
Implicit Permits
General Information About Rules
Information About EtherType Rules,
Inbound and Outbound Rules
Implicit Deny
Outbound ACL
Transactional-Commit Model
Access Rules for Returning Traffic
Information About Extended Access Rules
Additional Guidelines and Limitations
Traffic Type Protocol or Port
Management Access Rules
Information About EtherType Rules
Supported EtherTypes and Other Traffic
Supported in routed and transparent firewall modes
Licensing Requirements for Access Rules
Prerequisites
Allowing Mpls
Per-User ACL Guidelines
Default Settings
Configuring Access Rules
To apply an access rule, perform the following steps
See Per-User ACL Guidelines,
Per-user-override option
Hostname config# object-group service myaclog
Monitoring Access Rules
To monitor network access, enter the following command
Show running-config access-group
Extended
Feature History for Access Rules
Permit deny is-is
Transactional-commit,show running-config asp
Extended, access-list webtype
Ipv6 access-list webtype, ipv6-vpn-filter
Access-list extended, service-object, service
Licensing Requirements for AAA Rules
AAA Performance
Information About Authentication
Configuring Authentication for Network Access
ASA Authentication Prompts
One-Time Authentication
AAA Prompts and Identity Firewall
Name name1@name2 Password password1@password2
Static PAT and Http
AAA Rules as a Backup Authentication Method
Nat inside,outside static 10.48.66.155 service tcp 111
Authentication include command which
Configuring Network Access Authentication
User-group any and user-group none can be
Lockout command
Protocol ldap
Ldap-login-password
Ldap-over-ssl enable
Aaa authentication match Auth inside Ldap
Enabling Secure Authentication of Web Clients
Authenticating Https Connections with a Virtual Server
Authenticating Directly with the ASA
Authenticating Telnet Connections with a Virtual Server
Authentication include command
Configuring TACACS+ Authorization
Configuring Authorization for Network Access
FTP in the ACL, because the user must authenticate
Authenticate. For details, see the general operations
Authentication, while deny entries exclude matching
Traffic from authentication. Be sure to include
Authorization include command which
Authentication match command
About the Downloadable ACL Feature and Cisco Secure ACS
Configuring Radius Authorization
ACSCiscoSecure-Defined-ACL=acl-set-name
Access-list aclname extended
Configuring Cisco Secure ACS for Downloadable ACLs
With the following text
Downloaded ACL on the ASA consists of the following lines
Ipinacl#nnn=
Filter-id=aclname
Configuring Accounting for Network Access
Accounting include command which
Information, see the Configuring Network Access
Authentication section on page 7-7. If you want
Access-list command
Configuring AAA Rules for Network Access
Mac-exempt match command
Feature History for AAA Rules
Page
Configuring Application Inspection
Page
How Inspection Engines Work
Getting Started with Application Layer Protocol Inspection
How Inspection Engines Work
When to Use Application Protocol Inspection
Supports IPv6 for the following inspections
Failover Guidelines
323 H.225
Default Settings and NAT Limitations
IP Options
NetBIOS Name
Server over IP
SQL*Net
Smtp
Sun RPC over
Configuring Application Layer Protocol Inspection
View the entire class map using the following command
Ciscoasaconfig# policy-mapname ciscoasaconfig-pmap#
Keywords
Ipsec-pass-thru mapname
Icmp Icmp error Ils
Netbios mapname
Ip-options mapname
Sqlnet Sunrpc
Scansafe mapname
Tftp Waas Xdmcp
10-1
DNS Inspection
DNS Inspection Actions
Default Settings for DNS Inspection
Information About DNS Inspection
General Information About DNS
10-3
Do one of the following
Class-map type inspect dns match-all
10-4
Defining Actions in an Inspection Policy Map section on
Section
Keyword specifies the question portion of a DNS message.
Section the authority keyword specifies the Authority RR
Section the additional keyword specifies the Additional RR
10-6
Matches a DNS message domain name list. The regexname
Match not domain-name regex regexid
10-7
Id-mismatch count number duration seconds action
Message-length maximum length client length auto
Tsig enforced action drop log-Requires a Tsig
Layer 3/4 Class Maps section on page 1-12 for more
Configuring DNS Inspection
10-8
Dynamic-filter-snoop keyword, see the Enabling DNS
Monitoring DNS Inspection
10-9
10-10
Ciscoasa# show service-policy
FTP Inspection
FTP Inspection Overview
10-11
Using the strict Option
10-12
10-13
10-14
Ciscoasaconfig# policy-map type inspect ftp mymap
Http Inspection Overview
Ciscoasaconfig# service-policy ftp-policy interface inside
Http Inspection
Verifying and Monitoring FTP Inspection
10-16
10-17
Ciscoasaconfig-cmap#match not req-resp content-type mismatch
10-18
Ciscoasaconfig# policy-map type inspect http policymapname
10-19
IM Inspection Overview
Icmp Error Inspection
Icmp Inspection
Instant Messaging Inspection
10-21
Ciscoasaconfig-cmap#match not protocol im-yahoo im-msn
Conference games
10-22
Ciscoasaconfig# policy-map type inspect im policymapname
10-23
IP Options Inspection
10-24
IP Options Inspection Overview
IPsec Pass Through Inspection
Ciscoasaconfig-pmap-p#router-alert action allow clear
10-25
10-26
IPv6 Inspection
IPsec Pass Through Inspection Overview
Example for Defining an IPsec Pass Through Parameter Map
10-27
Default Settings for IPv6 Inspection
Optional Configuring an IPv6 Inspection Policy Map
Information about IPv6 Inspection
10-28
Routing-address count gt number -Sets the maximum
To enable IPv6 inspection, perform the following steps
Configuring IPv6 Inspection
10-29
NetBIOS Inspection Overview
NetBIOS Inspection
10-30
10-31
10-32
Pptp Inspection
Smtp and Extended Smtp Inspection
Smtp and Esmtp Inspection Overview
10-33
10-34
Ciscoasaconfig# policy-map type inspect esmtp policymapname
10-35
Tftp Inspection
10-36
Ctiqbe Inspection Overview
Ctiqbe Inspection
11-1
Verifying and Monitoring Ctiqbe Inspection
Limitations and Restrictions
11-2
11-3
Inspection
How H.323 Works
Inspection Overview
11-4
11-5
Support in H.245 Messages
11-6
Ciscoasaconfig# policy-map type inspect h323 policymapname
Ciscoasaconfig-cmap#match not media-type audio data video
11-7
11-8
Ciscoasaconfig# ras-rcf-pinholes enable
Ciscoasaconfig-pmap-p#rtp-conformance enforce-payloadtype
Ciscoasaconfig-pmap-p#state-checking h225 ras
11-9
Configuring H.323 and H.225 Timeout Values
Verifying and Monitoring H.323 Inspection
Monitoring H.225 Sessions
Ciscoasa# show h323-ras
Monitoring H.245 Sessions
Monitoring H.323 RAS Sessions
11-10
Mgcp Inspection Overview
Mgcp Inspection
11-11
11-12
Ciscoasaconfig# policy-map type inspect mgcp mapname
Following example shows how to define an Mgcp map
Configuring Mgcp Timeout Values
11-13
Verifying and Monitoring Mgcp Inspection
Rtsp Inspection
11-14
11-15
Using RealPlayer
Rtsp Inspection Overview
Restrictions and Limitations
11-16
Ciscoasaconfig-cmap#match not request-method method
11-17
Ciscoasaconfig# policy-map type inspect rtsp policymapname
SIP Inspection Overview
SIP Inspection
11-18
11-19
SIP Instant Messaging
11-20
11-21
Ciscoasaconfig-cmap#match not content length gt length
Ciscoasaconfig# policy-map type inspect sip policymapname
Ciscoasaconfig-cmap#match not uri sip tel length gt length
11-22
Ciscoasaconfig-pmap-p#uri-non-sip action mask log log
Ciscoasaconfig-pmap-p#software-version action mask log log
11-23
11-24
Configuring SIP Timeout Values
Skinny Sccp Inspection
Verifying and Monitoring SIP Inspection
Supporting Cisco IP Phones
Sccp Inspection Overview
11-25
11-26
Ciscoasaconfig# policy-map type inspect skinny policymapname
11-27
Ciscoasaconfig-pmap-p#sccp-prefix-len max min valuelength
11-28
Verifying and Monitoring Sccp Inspection
ILS Inspection, SQL*Net Inspection, Sun RPC Inspection,
ILS Inspection
12-1
12-2
SQL*Net Inspection
Sun RPC Inspection Overview
Sun RPC Inspection
12-3
Verifying and Monitoring Sun RPC Inspection
Managing Sun RPC Services
12-4
Ciscoasa# show sunrpc-server active
12-5
12-6
Dcerpc Overview
Dcerpc Inspection
13-1
13-2
Ciscoasaconfig# policy-map type inspect dcerpc policymapname
GTP Inspection Overview
GTP Inspection
13-3
13-4
Ciscoasaconfig# policy-map type inspect gtp policymapname
Ciscoasaconfig-network#network-object host
Ciscoasaconfig# object-group network GSN-pool-name
13-5
Ciscoasaconfig# object-group network sgsn32
Ciscoasaconfig# object-group network SGSN-name
13-6
13-7
Ciscoasaconfig# service-policy globalpolicy global
Ciscoasa# show service-policy inspect gtp statistics
Verifying and Monitoring GTP Inspection
Radius Accounting Inspection
Ciscoasa# show service-policy gtp statistics grep gsn
13-8
Inspect radius-accounting radiusaccountingmap
Configure the service policy
Radius Accounting Inspection Overview
13-9
13-10
RSH Inspection
Snmp Inspection
Snmp Inspection Overview
13-11
Xdmcp Inspection
13-12
Configuring Unified Communications
Page
14-1
14-2
Application
Might not need
Certificate for
Phone proxy
14-4
Model License Requirement1
ASA Base License and Security Plus License 2 sessions
ASA Base License 2 sessions
ASA 5585-X with Base License 2 sessions SSP-20, -40, or
ASA 5585-X with Base License 2 sessions SSP-10
14-5
14-6
IME
15-1
Cisco Mobility Advantage Proxy
Cisco Presence Federation Proxy
Cisco Intercompany Media Engine Proxy
15-2
15-3
Licensing Requirements for the Unified Communication Wizard
15-4
Supports IPv6 addresses
15-5
Configuring the Private Network for the Phone Proxy
Click the Generate and Export LDC Certificate button
Configuring Servers for the Phone Proxy
15-6
15-7
Address Default Port Description
15-8
15-9
Configuring the Public IP Phone Network
15-10
15-11
15-12
15-13
15-14
Certificate,
Dialog box. See Installing a Certificate,
15-15
15-16
15-17
Off-path Deployment
Basic Deployment
15-18
15-19
15-20
Other, respectively, during TLS handshakes
Wizard supports using self-signed certificates only
Cisco UCMs need to be installed on the security appliance
Supports installing self-signed certificates
15-22
Exporting an Identity Certificate
Installing a Certificate
15-23
15-24
Click Install Certificate
15-25
Saving the Identity Certificate Request
15-26
15-27
15-28
Phone Proxy Functionality
Information About the Cisco Phone Proxy
16-1
TCP/RTP TLS/SRTP
16-2
16-3
Supported Cisco UCM and IP Phones for the Phone Proxy
Cisco Unified Communications Manager
Cisco Unified IP Phones
16-4
Licensing Requirements for the Phone Proxy
16-5
16-6
Prerequisites for the Phone Proxy
Media Termination Instance Prerequisites
This section contains the following topics
ACL Rules
Certificates from the Cisco UCM
DNS Lookup Prerequisites
Cisco Unified Communications Manager Prerequisites
PAT Prerequisites
NAT and PAT Prerequisites
Address Port Protocol Description
NAT Prerequisites
16-9
Prerequisites for IP Phones on Multiple Interfaces
7940 IP Phones Support
There must be two CTL file record entries for the Cisco UCM
Cisco IP Communicator Prerequisites
Cipc security-mode authenticated
16-10
16-11
Rate Limiting Configuration Example
Prerequisites for Rate Limiting Tftp Requests
Icmp deny any outside
16-12
Phone Proxy Guidelines and Limitations
End-User Phone Provisioning
Ways to Deploy IP Phones to End Users
16-13
General Guidelines and Limitations
Media Termination Address Guidelines and Limitations
Configuring the Phone Proxy
16-14
Choose Security Certificate Management
Importing Certificates from the Cisco UCM
16-15
Certificate Name Required for
Authenticating IP phones with an LSC
Hostnameconfig# crypto ca trustpoint trustpointname
Hostnameconfig# crypto ca authenticate trustpoint
16-17
Creating Trustpoints and Generating Certificates
16-18
Creating the CTL File
Prerequisites
What to Do Next
16-19
16-20
Using an Existing CTL File
16-21
Creating the TLS Proxy for a Mixed-mode Cisco UCM Cluster
16-22
16-23
Creating the Media Termination Instance
Cucm/cucos/504/iptpch6.html#wp1040848
Cucm/cucos/504/iptpch6.html#wp1040354
See Media Termination Instance Prerequisites
Creating the Phone Proxy Instance
16-24
16-25
See Creating the Media Termination Instance
See Cisco IP Communicator Prerequisites
Enabling the Phone Proxy with SIP and Skinny Inspection
16-26
16-27
16-28
Troubleshooting the Phone Proxy
Configuring Your Router
Debugging Information from the Security Appliance
16-29
Use the Command
16-30
Show conn all
Show asp drop
Debugging Information from IP Phones
Show asp table classify domain
16-32
Debugging Information from IP Phones
16-33
Tftp Auth Error Displays on IP Phone Console
Problem The IP phone displays the following Status message
IP Phone Registration Failure
16-34
Configuration File Parsing Error
Configuration File Parsing Error Unable to Get DNS Response
Ciscoasa# show running-config all ctl-file ctlname
Hostname# debug phone-proxy tftp
Non-configuration File Parsing Error
Phone-proxy tftp
16-35
Hostname# capture out interface outside
16-36
16-37
IP Phone Requesting Unsigned File Error
Hostnameconfig# show running-config all phone-proxy
IP Phone Unable to Download CTL File
16-38
IP Phone Registration Failure from Signaling Connections
Hostname# show run all ssl
To add the required ciphers, enter the following command
Debug sip Debug skinny
16-39
16-40
SSL Handshake Failure
Certificate Validation Errors
Media Termination Address Errors
16-41
Saving Sast Keys
Audio Problems with IP Phones
16-42
16-43
Record-entry capf trustpoint trustpoint address address
Configuration Examples for the Phone Proxy
16-44
Record-entry cucm trustpoint trustpoint address address
Corporate Network
16-45
Fqdn my-ldc-ca.exmaple.com
16-46
Phone a 10.10.0.24
16-47
16-48
ASA Outside Interface Phone a 10.10.0.24
16-49
16-50
16-51
Enroll terminal crypto ca authenticate capf ctl-file myctl
16-52
Example 6 Vlan Transversal
ASA Inside Interface 10.130.50.24
16-53
16-54
Feature History for the Phone Proxy
17-1
17-2
Supported Cisco UCM and IP Phones for the TLS Proxy
17-3
CTL Client Overview
17-4
CTL Client TLS Proxy Features ASA IP Address or Domain Name
17-5
Licensing for the TLS Proxy
17-6
17-7
Configuring the TLS Proxy for Encrypted Voice Inspection
Ciscoasaconfig# show crypto ca server certificate
Ciscoasaconfig# tls-proxy maximum-sessions
17-8
17-9
17-10
Creating an Internal CA
17-11
Creating a CTL Provider Instance
17-12
Creating the TLS Proxy Instance
17-13
Crypto ca trustpoint command
17-14
17-15
Monitoring the TLS Proxy
AES128-SHA
17-16
TLS Proxy TLS proxy feature was introduced
2lists the release history for this feature
17-17
17-18
18-1
Cisco Mobility Advantage Proxy Functionality
Mobility Advantage Proxy Deployment Scenarios
Hostnameconfig-tlsp#no server authenticate-client
18-2
TLS
18-3
Versus
Mobility Advantage Proxy Using NAT/PAT
18-4
18-5
Trust Relationships for Cisco UMA Deployments
Longer requires a Unified Communications Proxy license
Configuring Cisco Mobility Advantage
18-6
18-7
Task Flow for Configuring Cisco Mobility Advantage
Installing the Cisco UMA Server Certificate
Enabling the TLS Proxy for MMP Inspection,
18-8
18-9
Enabling the TLS Proxy for MMP Inspection
18-10
Exits from the Policy Map configuration mode
Enables the service policy on all interfaces
Monitoring for Cisco Mobility Advantage
18-11
Configuration Examples for Cisco Mobility Advantage
18-12
18-13
18-14
Feature History for Cisco Mobility Advantage
19-1
Information About Cisco Unified Presence
19-2
Ciscoasaconfig# object network obj-10.0.0.2-01
19-3
19-4
Trust Relationship in the Presence Federation
19-5
Xmpp Federation Deployments
19-6
Configuration Requirements for Xmpp Federation
Configure the following NAT commands
Allow traffic from any address to any single node on port
19-7
Licensing for Cisco Unified Presence
19-8
Configuring Cisco Unified Presence Proxy for SIP Federation
19-9
Install the certificates. See Installing Certificates,
Trustpoint for the remote entity
Installing Certificates
19-10
19-11
19-12
Enabling the TLS Proxy for SIP Inspection
Trust-pointcommand is the remote entity proxy
19-13
19-14
Configuration Example for Cisco Unified Presence
Example Configuration for SIP Federation Deployments,
Monitoring Cisco Unified Presence
19-15
Example Configuration for SIP Federation Deployments
19-16
19-17
Example ACL Configuration for Xmpp Federation
19-18
Example NAT Configuration for Xmpp Federation
19-19
19-20
Feature History for Cisco Unified Presence
20-1
Features of Cisco Intercompany Media Engine Proxy
20-2
How the UC-IME Works with the Pstn and the Internet
20-3
Tickets and Passwords
20-4
Call Fallback to the Pstn
Architecture, Basic Deployment, Off Path Deployment,
Architecture
20-5
20-6
Basic Deployment
Off Path Deployment
Licensing for Cisco Intercompany Media Engine
20-7
20-8
Supported in single context mode only
Supported in routed firewall mode only
Does not support IPv6 addresses
20-9
Task Flow for Configuring Cisco Intercompany Media Engine
Configuring Cisco Intercompany Media Engine Proxy
20-10
Create the TLS proxy. See Creating the TLS Proxy,
Configuring NAT for Cisco Intercompany Media Engine Proxy
20-11
20-12
Cisco UCM that you want to translate
20-13
Configuring PAT for the Cisco UCM Server
20-14
20-15
Creating ACLs for Cisco Intercompany Media Engine Proxy
Guidelines
Procedure
20-16
See Creating the Cisco Intercompany Media Engine
Creating the Cisco Intercompany Media Engine Proxy
20-17
20-18
20-19
Show running-config uc-ime command
20-20
20-21
Prerequisites for Installing Certificates
20-22
20-23
Creating the TLS Proxy
Creating Trustpoints and Generating
Certificates section on
20-24
ACLs for Cisco Intercompany Media Engine Proxy
Created in , page 20-15of the task Creating
20-25
20-26
Optional Configuring TLS within the Local Enterprise
Where policymapname is the name of the policy
Map you created in of this task
20-27
Commands Purpose
Where proxytrustpoint for the client trust-point
Where proxytrustpoint for the server trust-point
20-28
20-29
Optional Configuring Off Path Signaling
20-30
Intercompany Media Engine Proxy,
Creating the Cisco Intercompany Media
Engine Proxy,
20-31
20-32
20-33
Show uc-ime signaling-sessions
Show uc-ime media-sessions detail
Show uc-ime signaling-sessions statistics
20-34
20-35
Show uc-ime mapping-service-sessions
Show uc-ime mapping-service-sessions statistics
Show uc-ime fallback-notification statistics
20-36
Configuring Connection Settings and QoS
Page
22-1
Information About Connection Settings
Dead Connection Detection DCD
TCP Intercept and Limiting Embryonic Connections
22-2
22-3
TCP Sequence Randomization
TCP Normalization
TCP State Bypass
22-4
Licensing Requirements for Connection Settings
TCP Normalizer
TCP State Bypass Unsupported Features
Maximum Concurrent and Embryonic Connection Guidelines
TCP State Bypass
Customizing the TCP Normalizer with a TCP Map
Configuring Connection Settings
Task Flow For Configuring Connection Settings
For each TCP map, you can customize one or more settings
22-7
22-8
Command
22-9
Command
22-10
22-11
Configuring Connection Settings
Urgent-flag allow clear
Window-variation allow drop
22-12
22-13
Random-sequence-number enable disable keyword
TCP Sequence Randomization section on page 22-3 section for
Embryonic-conn-max keywords
To 0, which means the connection never times out
Command in the command reference
Embryonic hh mm ss keyword sets the timeout period until a
Idle hh mm ss keyword sets the idle timeout period after
22-15
Monitoring Connection Settings
Configuration Examples for Connection Settings
Configuration Examples for Connection Limits and Timeouts
22-16
Configuration Examples for TCP State Bypass
Configuration Examples for TCP Normalization
Following is a sample configuration for TCP state bypass
22-17
Feature History for Connection Settings
Per-client-max
Timeout half-closed,timeout half-closed
Conn-max,set connection embryonic-conn-max,set
Connection per-client-embryonic-max,set connection
23-1
Information About QoS
What is a Token Bucket?
Supported QoS Features
23-2
Information About Priority Queuing
Information About Policing
23-3
Information About Traffic Shaping
How QoS Features Interact
23-4
Model Guidelines
Licensing Requirements for QoS
Dscp and DiffServ Preservation
Does not support IPv6
23-6
Configuring QoS
23-7
Mbps
125
Kbps
23-8
Configuring the Standard Priority Queue for an Interface
Priority queue, or for the ASA 5505 or ASASM, the Vlan
Interface name
23-9
23-10
23-11
Step
23-12
23-13
23-14
Configuring the Service Rule
Priority Queuing Policy section on
Multiple of 8000. See the Information About Traffic Shaping
23-15
23-16
Ciscoasa# show service-policy police
Monitoring QoS
Viewing QoS Police Statistics
Viewing QoS Shaping Statistics
Viewing QoS Standard Priority Statistics
23-17
23-18
Viewing QoS Standard Priority Queue Statistics
Ciscoasa# show priority-queue statistics test
23-19
Feature History for QoS
23-20
Testing Your Configuration
Troubleshooting Connections and Resources
24-1
24-2
Enabling Icmp Debugging Messages and Syslog Messages
24-3
Pinging ASA Interfaces
24-4
ASA
24-5
Passing Traffic Through the ASA
24-6
Disabling the Test Configuration
24-7
Monitoring Per-Process CPU Usage
Determining Packet Routing with Traceroute
Tracing Packets with Packet Tracer
24-8
Configuring Advanced Network Protection
Page
25-1
Configuring the ASA for Cisco Cloud Web Security
25-2
User Authentication and Cloud Web Security
Information About Cisco Cloud Web Security
Redirection of Web Traffic to Cloud Web Security
25-3
Authentication Keys
Company Authentication Key Group Authentication Key
Company Authentication Key, Group Authentication Key,
25-4
ScanCenter Policy
Directory Groups
Custom Groups
Cloud Web Security Actions
How Groups and the Authentication Key Interoperate
25-5
IPv4 and IPv6 Support
Failover from Primary to Backup Proxy Server
Licensing Requirements for Cisco Cloud Web Security
Bypassing Scanning with Whitelists
25-7
Optional User Authentication Prerequisites
Prerequisites for Cloud Web Security
Optional Fully Qualified Domain Name Prerequisites
By default, Cisco Cloud Web Security is not enabled
Configuring Cisco Cloud Web Security
25-8
25-9
See the Authentication Keys section on
25-10
Config-url disk0/onectx.cfg Context two
25-11
Optional Configuring Whitelisted Traffic section on
25-12
Adding an Extended Access Control List,
25-13
Policy section on page 1-17for more information
25-14
25-15
Optional Configuring Whitelisted Traffic
25-16
Optional Configuring the User Identity Monitor
Configuring the Cloud Web Security Policy
Object-group-user-Specifies an object-group user name
Http//Whoami.scansafe.net
Monitoring Cloud Web Security
25-17
Single Mode Example
Configuration Examples for Cisco Cloud Web Security
25-18
25-19
Multiple Mode Example
Whitelist Example
To attach class-maps to the Cloud Web Security Policy map
Directory Integration Examples
Configuring the Active Directory Server Using Ldap
25-20
Creating the ASA as a Client on the AD Agent Server
Configuring the Active Directory Agent Using Radius
Testing the AD Agent
Configuring the Identity Options on the ASA
Showing a List of Active Users
Cloud Web Security with Identity Firewall Example
Monitoring the Active Directory Groups
Downloading the Database from the AD Agent
25-23
Aaa-server AD inside host 192.168.116.220 server-port
25-24
No call-home reporting anonymous call-home
25-25
25-26
Feature History for Cisco Cloud Web Security
Related Documents
Related Documents
Botnet Traffic Filter Address Types,
Information About the Botnet Traffic Filter
26-1
Information About the Dynamic Database
Botnet Traffic Filter Address Types
Botnet Traffic Filter Actions for Known Addresses
Botnet Traffic Filter Databases
26-3
Information About the Static Database
26-4
26-5
How the Botnet Traffic Filter Works
Prerequisites for the Botnet Traffic Filter
Licensing Requirements for the Botnet Traffic Filter
26-6
Task Flow for Configuring the Botnet Traffic Filter
Configuring the Botnet Traffic Filter
26-7
26-8
Configuring the Dynamic Database
See the Adding Entries to the Static Database section on
Adding Entries to the Static Database
26-9
26-10
Enabling DNS Snooping
See the Enabling DNS Snooping section on
TCP DNS traffic is not supported
26-11
26-12
Inspection section on page 10-1 for more information about
26-13
Recommended Configuration
Very-low Low Moderate High Very-high
Subset of the dynamic-filter enable ACL
See the Blocking Botnet Traffic Manually section on
Threat-level range moderate very-high
26-15
For dropping purposes. If you do not enable this command
Blocking Botnet Traffic Manually
About the greylist
26-16
Searching the Dynamic Database
26-17
Botnet Traffic Filter Commands
Monitoring the Botnet Traffic Filter
Botnet Traffic Filter Syslog Messaging
Dns-snoop command
Infected-hosts command
26-18
Ciscoasa# show dynamic-filter reports top malware-ports
Configuration Examples for the Botnet Traffic Filter
Recommended Configuration Example
26-19
26-20
Other Configuration Examples
Outside
26-21
26-22
Feature History for the Botnet Traffic Filter
27-1
Configuring Threat Detection
Information About Threat Detection
Licensing Requirements for Threat Detection
Information About Basic Threat Detection Statistics
Configuring Basic Threat Detection Statistics
27-2
Types of Traffic Monitored
Trigger Settings Packet Drop Reason Average Rate Burst Rate
Guidelines and Limitations
Security Context Guidelines
27-4
Configuring Basic Threat Detection Statistics
Threat Detection Statistics section on
Monitoring Basic Threat Detection Statistics
27-5
27-6
Configuring Advanced Threat Detection Statistics
Feature History for Basic Threat Detection Statistics
Information About Advanced Threat Detection Statistics
27-7
Configuring Advanced Threat Detection Statistics
27-8
27-9
Monitoring Advanced Threat Detection Statistics
27-10
27-11
Using the show threat-detection rate acl-drop command
27-12
Protocolnumber argument is an integer between 0
Statistics
Field
27-13
Field Description
27-14
Feature History for Advanced Threat Detection Statistics
Information About Scanning Threat Detection
Configuring Scanning Threat Detection
27-15
27-16
Average Rate Burst Rate
Displays the hosts that are currently shunned
Configuring Scanning Threat Detection
Configuration see the Configuring Basic Threat Detection
Monitoring Shunned Hosts, Attackers, and Targets
27-18
Feature History for Scanning Threat Detection
27-19
Configuration Examples for Threat Detection
27-20
28-1
Preventing IP Spoofing
Blocking Unwanted Connections
Configuring the Fragment Size
28-2
28-3
Configuring IP Audit for Basic IPS Support
Configuring IP Audit
Configuring IP Audit, IP Audit Signature List,
28-4
IP Audit Signature List
1lists supported signatures and system message numbers
Signature Message Number Signature Title
28-5
28-6
28-7
28-8
29-1
Information About Web Traffic Filtering
29-2
Configuring ActiveX Filtering
Licensing Requirements for ActiveX Filtering
Information About ActiveX Filtering
29-3
Configuring ActiveX Filtering
Configuration Examples for ActiveX Filtering
Guidelines and Limitations for ActiveX Filtering
Licensing Requirements for Java Applet Filtering
Configuring Java Applet Filtering
Feature History for ActiveX Filtering
Information About Java Applet Filtering
29-5
Configuring Java Applet Filtering
Configuration Examples for Java Applet Filtering
Guidelines and Limitations for Java Applet Filtering
29-6
Feature History for Java Applet Filtering
Filtering URLs and FTP Requests with an External Server
Information About URL Filtering
Guidelines and Limitations for URL Filtering
Licensing Requirements for URL Filtering
29-7
Choose from the following options
Identifying the Filtering Server
29-8
29-9
Maximum memory allocation of 2 KB to 10 MB
Configuring Additional URL Filtering Settings
Buffering the Content Server Response
Replaces block-buffer with the maximum number of Http
Websense server
Caching Server Addresses
Filtering Http URLs
On the Websense server
29-12
29-13
Filtering Https URLs
Might enter cd ./files instead of cd /public/files
Filtering FTP Requests
29-14
Ciscoasa# show url-server
Following is sample output from the show url-servercommand
Monitoring Filtering Statistics
29-15
29-16
Following is sample output from the show url-blockcommand
Following is sample output from the show perfmon command
Following is sample output from the show filter command
29-17
Feature History for URL Filtering
29-18
Configuring Modules
Page
30-1
Information About the ASA CX Module
30-2
How the ASA CX Module Works with the ASA
30-3
Monitor-Only Mode
Service Policy in Monitor-Only Mode
Traffic-Forwarding Interface in Monitor-Only Mode
30-4
Initial Configuration
Initial Configuration, Policy Configuration and Management,
Information About ASA CX Management
Information About VPN and the ASA CX Module
Information About Authentication Proxy
Compatibility with ASA Features
Policy Configuration and Management
30-6
Licensing Requirements for the ASA CX Module
30-7
Monitor-Only Mode Guidelines
ASA Clustering Guidelines
Does not support clustering
Task Flow for the ASA CX Module
Configuring the ASA CX Module
See the Compatibility with ASA Features section on
Parameters Default
ASA 5585-X Hardware Module
Connecting the ASA CX Management Interface
30-9
If you do not have an inside router
If you have an inside router
30-10
30-11
ASA 5512-X through ASA 5555-X Software Module
30-12
Partition the SSD
Example
30-13
30-14
Session 1 do setup host ip
ASA 5585-X Changing the ASA CX Management IP Address
Sets the ASA CX management IP address, mask, and gateway
Enter an IPv6 address 2001DB80CD301234/64
Configuring Basic ASA CX Settings at the ASA CX CLI
30-15
Ciscoasa# session cxsc console
Asacx config passwd
Change the admin password by entering the following command
30-16
30-17
Optional Configuring the Authentication Proxy Port
Redirecting Traffic to the ASA CX Module
Creating the ASA CX Service Policy
30-18
30-19
See the Monitor-Only Mode section on page 30-3 for more
See the Feature Matching Within a Service Policy section on
Configuring Traffic-Forwarding Interfaces Monitor-Only Mode
30-20
30-21
Managing the ASA CX Module
30-22
Resetting the Password
Reloading or Resetting the Module
For a software module ASA 5512-X through ASA
30-23
Shutting Down the Module
Reload
Sw-module module cxsc uninstall
New module type
30-24
30-25
Admin123
Monitoring the ASA CX Module
Showing Module Status
30-26
Showing Module Statistics
30-27
Monitoring Module Connections
Show asp event dp-cp cxsc-msg
Dp-cp
‘X’ flag
30-28
Ciscoasa# show asp drop
30-29
Ciscoasa# show asp event dp-cp cxsc-msg
30-30
Troubleshooting the ASA CX Module
Capturing Module Traffic
Debugging the Module
30-31
Problems with the Authentication Proxy
30-32
Configuration Examples for the ASA CX Module
Check the authentication proxy port
Check the authentication proxy rules
30-33
Feature History for the ASA CX Module
30-34
We modified or introduced the following commands cxsc
Fail-close fail-openmonitor-only,traffic-forward
Cxsc monitor-only
Asadataplane
Capture interface asadataplane command
30-35
30-36
31-1
Information About the ASA IPS Module
31-2
How the ASA IPS Module Works with the ASA
Operating Modes
Using Virtual Sensors ASA 5510 and Higher
31-3
31-4
Information About Management Access
31-5
Licensing Requirements for the ASA IPS module
Management Vlan ASA 5505 only
1lists the default settings for the ASA IPS module
31-6
Task Flow for the ASA IPS Module
Configuring the ASA IPS module
31-7
31-8
Connecting the ASA IPS Management Interface
31-9
31-10
ASA
Sessioning to the Module from the ASA
ASA 5512-X through ASA 5555-X Booting the Software Module
31-11
31-12
Configuring Basic IPS Module Network Settings
For example, using the filename in the example in , enter
Ciscoasa# sw-module module ips recover boot
Sessioning to the Module from the ASA Section on
ASA 5510 and Higher Configuring Basic Network Settings
ASA 5505 Configuring Basic Network Settings
Connecting the ASA IPS Management Interface section on
31-14
Details command
Configuring the Security Policy on the ASA IPS Module
31-15
31-16
31-17
31-18
Diverting Traffic to the ASA IPS module
31-19
31-20
31-21
Installing and Booting an Image on the Module
Managing the ASA IPS module
IPS module
31-22
31-23
Uninstalling a Software Module Image
Sw-module module ips uninstall
For a software module for example, the ASA 5545-X
For a software module for example, the ASA
Sw-module module ips password-reset
31-24
Ips for a software module
Monitoring the ASA IPS module
31-25
31-26
Configuration Examples for the ASA IPS module
Ciscoasa# show module ips
31-27
Feature History for the ASA IPS module
Allow-ssc-mgmt,hw-module module ip, and hw-module
Module allow-ip
Session, show module, sw-module
Inventory, show environment
31-28
32-1
Information About the CSC SSM
32-2
ASA
32-3
Determining What Traffic to Scan
32-4
Common Network Configuration for CSC SSM Scanning
Prerequisites for the CSC SSM
Licensing Requirements for the CSC SSM
32-5
32-6
1lists the default settings for the CSC SSM
Parameter Default
Supported in single and multiple context modes
Before Configuring the CSC SSM
Configuring the CSC SSM
32-7
See the Connecting to the CSC SSM section on
Connecting to the CSC SSM
32-8
32-9
32-10
Diverting Traffic to the CSC SSM
See the Diverting Traffic to the CSC SSM section on
Determining What Traffic to Scan section on
32-11
32-12
Guidelines and Limitations section on
Displays additional status information
Monitoring the CSC SSM
See the Monitoring the CSC SSM section on
Displays the status
Installing an Image on the Module
Troubleshooting the CSC Module
32-14
Recover command
Resetting the Password
32-15
32-16
Reloading or Resetting the Module
Shuts down the module
Configuration Examples for the CSC SSM
Ciscoasaconfig-cmap#policy-map cscinpolicy
Shutting Down the Module
Assistance with the Startup Wizard
Additional References
Related Topic Document Title
Instructions on use of the CSC SSM GUI
32-19
Feature History for the CSC SSM
Feature Name Platform Releases Feature Information
Details recover
32-20
IN-1
IN-2
IN-3
IN-4
IN-5
IN-6
See also policy map
LDP 6-7router-id 6-7TDP Multi-session PAT
RPC not supported with
IN-7
IN-8
IN-9
IN-10