Contents
Software Version
Cisco ASA Series Firewall CLI Configuration Guide
Cisco ASA Series Firewall CLI Configuration Guide
Iii
N T E N T S
Guidelines and Limitations Default Inspection Policy Maps
NAT for VPN
Guidelines and Limitations
Vii
Rules
Viii
Getting Started with Application Layer Protocol Inspection
IPv6 Inspection
Verifying and Monitoring Sun RPC Inspection
Configuring Unified Communications
Xii
Installing a Certificate
Xiii
Enabling the Phone Proxy with SIP and Skinny Inspection
Xiv
CTL Client Overview
Architecture
Xvi
Configuring Connection Settings and QoS
Xvii
Configuring the Standard Priority Queue for an Interface
Xviii
Bypassing Scanning with Whitelists
Xix
Information About the Static Database
Configuring Java Applet Filtering
Xxi
Filtering URLs and FTP Requests with an External Server
30-15
Xxii
Xxiii
ASA 5505 Configuring Basic Network Settings
Xxiv
Convention Indication
Document Objectives
Related Documentation
Conventions
Xxvi
Obtaining Documentation and Submitting a Service Request
R T
Page
Information About Service Policies
For Through
Supported Features
Feature Directionality
Feature Traffic? See
Global Direction
Feature Matching Within a Service Policy
Feature
ASA IPS ASA CX
Order in Which Multiple Feature Actions are Applied
Incompatibility of Certain Feature Actions
Guidelines and Limitations
Licensing Requirements for Service Policies
Feature Matching for Multiple Service Policies
Policy Map Guidelines
Service Policy Guidelines
Class Map Guidelines
Default Configuration, Default Class Maps,
Default Settings
Default Configuration
This section includes the following topics
Task Flows for Configuring Service Policies
Default Class Maps
Task Flow for Using the Modular Policy Framework
See the Identifying Traffic Layer 3/4 Class Maps section on
Layer 3/4 Policy Map
Example
Command Purpose
Identifying Traffic Layer 3/4 Class Maps
Creating a Layer 3/4 Class Map for Through Traffic
Match default-inspection-traffic command to narrow
See the Default Settings and NAT Limitations section on
Ports are included in the match default-inspection-traffic
Creating a Layer 3/4 Class Map for Management Traffic
Except for the match any , match access-list , or match
Match flow ip destination-address command to match flows
Defining Actions Layer 3/4 Policy Map
Creates a management class map, where classmapname is a
QoS Traffic Shaping section on page 1-11 for more
Task Flow for Configuring Hierarchical Policy Maps for
See the Supported Features section on
Identifying Traffic Layer 3/4 Class Maps section on
Applying Actions to an Interface Service Policy
IPv6, see the IPv6 Guidelines section on
Configuration Examples for Modular Policy Framework
Displays the service policy statistics
Monitoring Modular Policy Framework
Applying Inspection to Http Traffic Globally
See the following commands for this example
Ciscoasaconfig# class-map httptraffic
Applying Inspection and QoS Policing to Http Traffic
Ciscoasaconfig# service-policy httptrafficpolicy global
Ciscoasaconfig# policy-map httptrafficpolicy
Host
Ciscoasaconfig# service-policy httpclient interface inside
Applying Inspection to Http Traffic with NAT
Obj-192.168.1.1
Radius-accounting
Feature History for Service Policies
Feature Name Releases Feature Information
Introduced class-map type management, and inspect
Information About Inspection Policy Maps
Guidelines and Limitations
Default Inspection Policy Maps
Identifying Traffic in an Inspection Class Map section on
Defining Actions in an Inspection Policy Map
Identifying Traffic in an Inspection Class Map
Getting Started with Application Layer Protocol Inspection
1lists the release history for this feature
Where to Go Next
Feature History for Inspection Policy Maps
Page
Configuring Network Address Translation
Page
Information About NAT
Why Use NAT?
NAT Terminology
Information About Static NAT
NAT Types
NAT Types Overview
Static NAT
Information About Static NAT with Port Address Translation
Information About Static NAT with Port Translation
Static NAT with Identity Port Translation
Information About One-to-Many Static NAT
4shows a typical few-to-many static NAT scenario
Information About Other Mapping Scenarios Not Recommended
Information About Dynamic NAT
Dynamic NAT
Information About Dynamic PAT
Dynamic PAT
Dynamic NAT Disadvantages and Advantages
Dynamic PAT Disadvantages and Advantages
Per-Session PAT vs. Multi-Session PAT
NAT in Routed Mode, NAT in Transparent Mode,
NAT in Routed and Transparent Mode
Identity NAT
NAT in Transparent Mode
NAT in Routed Mode
10 NAT Example Transparent Mode
Main Differences Between Network Object NAT and Twice NAT
NAT and IPv6
How NAT is Implemented
Information About Twice NAT
Information About Network Object NAT
11 Twice NAT with Different Destination Addresses
12 Twice NAT with Different Destination Ports
13 Twice Static NAT with Destination Address Translation
Rule Type Order of Rules within the Section
NAT Rule Order
Routing NAT Packets
NAT Interfaces
Mapped Addresses and Routing
Too late
Transparent Mode Routing Requirements for Remote Networks
NAT for VPN
203.0.113.16075
NAT and Remote Access VPN
Same-security-traffic permit intra-interface
NAT and Site-to-Site VPN
19 Interface PAT and Identity NAT for Site-to-Site VPN
See the following sample NAT configuration for ASA1 Boulder
Object network vpnlocal Subnet 10.3.3.0
NAT and VPN Management Access
Subnet 10.2.2.0
Object network boulderinside Subnet 10.1.1.0
Subnet 10.1.1.0 Nat inside,outside dynamic interface
Management-access inside
Enter show nat detail and show conn all
Troubleshooting NAT and VPN
Add the identity NAT configuration
DNS and NAT
22 DNS Reply Modification, DNS Server on Outside
192.168.1.10
24 DNS Reply Modification, DNS Server on Host Network
2001DB8D1A5C8E1
26 PTR Modification, DNS Server on Host Network
Page
Information About Network Object NAT
Configuring Network Object NAT
Supports IPv6. See also the NAT and IPv6 section on
Licensing Requirements for Network Object NAT
Prerequisites for Network Object NAT
Additional Guidelines
Adding Network Objects for Mapped Addresses
Configuring Network Object NAT
Object network objname
Configuring Dynamic NAT
Object
DNS and NAT section on page 3-28 for more information
Additional Guidelines section on
Nat inside,outside dynamic nat-pat-grp interface
Configuring Dynamic PAT Hide
Mapped addresses
Configures a network object for which you want to configure
Optional Create a network object or group for
See the Adding Network Objects for Mapped Addresses section
When you want to use the interface IP address you
Configures dynamic PAT for the object IP addresses. You can
Interface-Routed mode only The IP address
Used. For this option, you must configure a specific
Ciscoasaconfig-network-object#nat inside,outside dynamic
Ciscoasaconfig# object network IPv6INSIDE
Configuring Static NAT or Static NAT-with-Port-Translation
Ciscoasaconfig# object network IPv4POOL
Addresses IPv4 or IPv6 that you want to translate
See the Mapped Addresses and Routing section on
Static NAT section on
See the DNS and NAT section on page 3-28. This option is
Addresses section on
Configuring Identity NAT
Translate. See the Adding Network Objects for Mapped
Section on page 3-22 for more information
NAT command. See the Determining the Egress Interface
See the Additional Guidelines section on
Mapped Addresses and Routing section on
By default, the following rules are installed
Configuring Per-Session PAT Rules
How many times they were allocated
Monitoring Network Object NAT
Shows NAT statistics, including hits for each NAT rule
Configuration Examples for Network Object NAT
Create a network object for the internal web server
Providing Access to an Inside Web Server Static NAT
Configure static NAT for the object
Ciscoasaconfig# object network myWebServ
Create a network object for the outside web server
Configure static NAT for the web server
Ciscoasaconfig-network-object#nat outside,inside static
Create a network object for the inside network
Create a network object for the load balancer
Configure static NAT for the load balancer
Ciscoasaconfig# object network myPublicIPs
Ciscoasaconfig# object network myLBHost
Create a network object for the Http server address
Ciscoasaconfig# object network Ftpserver
Ciscoasaconfig# object network Httpserver
Create a network object for the FTP server address
Create a network object for the Smtp server address
Ciscoasaconfig# object network Smtpserver
DNS Reply Modification
DNS Reply Modification Using Outside NAT
2001DB8D1A5C8E1
Ciscoasaconfig# object network Dnsserver
Platform Feature Name Releases Feature Information
Feature History for Network Object NAT
Pat-pool mappedobject extended
Pat-pool mappedobject flat include-reserve
Nat-assigned-to-public-ip interface tunnel-group
General-attributes configuration mode
Configuration mode, show nat, show nat pool, show xlate
Show nat pool
Page
Information About Twice NAT
Configuring Twice NAT
Supports IPv6
Licensing Requirements for Twice NAT
Prerequisites for Twice NAT
Configuring Twice NAT Guidelines and Limitations
Adding Network Objects for Real and Mapped Addresses
Configuring Twice NAT
Configuring Twice NAT
Configure service objects for
Optional Adding Service Objects for Real and Mapped Ports
Command Purpose
Ports section on
See the Optional Adding Service Objects for Real and Mapped
See the Adding Network Objects for Real and Mapped
You can optionally configure the following fallback
Configure dynamic NAT. See the following guidelines
Section and Line-Optional By default, the NAT rule is
Anywhere in the applicable section using the line argument
Command Purpose
Subnet 2001DB8AAAA/96
For a PAT pool
Subnet 203.0.113.0
Configuring Twice NAT
Detailed Steps
Interface keyword enables interface PAT fallback. After
Configures dynamic PAT hide. See the following guidelines
Mapped-Configure one of the following
Interface-Routed mode only Specify the interface
Command Purpose
Command Purpose
Host 2001DB823
Service tcp destination eq
Subnet 192.168.1.0
Source or Destination mapped ports
Source or Destination real ports
See the Static Interface NAT with Port Translation
Rule Order section on page 3-18for more information about
Examples
OUTSIDEIPv6NW
Object
MAPPEDIPv6NW
Subnet 2001DB8BBBB/96
Source real addresses you will typically use
Static Interface NAT with Port Translation section on
How many times they were allocated
To monitor twice NAT, enter one of the following commands
Monitoring Twice NAT
Shows NAT statistics, including hits for each NAT rule
Add a network object for the DMZ network
Configuration Examples for Twice NAT
Ciscoasaconfig# object network PATaddress1
Add a network object for the inside network
Configure the second twice NAT rule
Configure the first twice NAT rule
Ciscoasaconfig# object network TelnetWebServer
Add a network object for the PAT address when using Telnet
Add a service object for Telnet
Ciscoasaconfig# object network myInsideNetwork
Add a service object for Http
Existing functionality. The unidirectional keyword is
Feature History for Twice NAT
We modified the following command nat source static
Show nat, show xlate, show nat pool
Pat-pool mappedobject flat include-reserve
Nat-assigned-to-public-ip interface tunnel-group
Show nat pool
Configuring Access Control
Page
Information About Access Rules
Configuring Access Rules
Information About EtherType Rules,
General Information About Rules
Implicit Permits
Inbound and Outbound Rules
Implicit Deny
Outbound ACL
Transactional-Commit Model
Additional Guidelines and Limitations
Information About Extended Access Rules
Access Rules for Returning Traffic
Traffic Type Protocol or Port
Management Access Rules
Information About EtherType Rules
Supported EtherTypes and Other Traffic
Supported in routed and transparent firewall modes
Licensing Requirements for Access Rules
Prerequisites
Allowing Mpls
Per-User ACL Guidelines
Default Settings
Configuring Access Rules
To apply an access rule, perform the following steps
See Per-User ACL Guidelines,
Per-user-override option
Hostname config# object-group service myaclog
Monitoring Access Rules
To monitor network access, enter the following command
Show running-config access-group
Permit deny is-is
Feature History for Access Rules
Extended
Transactional-commit,show running-config asp
Extended, access-list webtype
Ipv6 access-list webtype, ipv6-vpn-filter
Access-list extended, service-object, service
Licensing Requirements for AAA Rules
AAA Performance
Information About Authentication
Configuring Authentication for Network Access
ASA Authentication Prompts
One-Time Authentication
AAA Prompts and Identity Firewall
Name name1@name2 Password password1@password2
Static PAT and Http
AAA Rules as a Backup Authentication Method
Nat inside,outside static 10.48.66.155 service tcp 111
User-group any and user-group none can be
Configuring Network Access Authentication
Authentication include command which
Lockout command
Protocol ldap
Ldap-login-password
Ldap-over-ssl enable
Aaa authentication match Auth inside Ldap
Enabling Secure Authentication of Web Clients
Authenticating Https Connections with a Virtual Server
Authenticating Directly with the ASA
Authenticating Telnet Connections with a Virtual Server
Authentication include command
Configuring TACACS+ Authorization
Configuring Authorization for Network Access
FTP in the ACL, because the user must authenticate
Authenticate. For details, see the general operations
Authentication, while deny entries exclude matching
Traffic from authentication. Be sure to include
Authorization include command which
Authentication match command
About the Downloadable ACL Feature and Cisco Secure ACS
Configuring Radius Authorization
ACSCiscoSecure-Defined-ACL=acl-set-name
Access-list aclname extended
Configuring Cisco Secure ACS for Downloadable ACLs
Ipinacl#nnn=
Downloaded ACL on the ASA consists of the following lines
With the following text
Filter-id=aclname
Configuring Accounting for Network Access
Accounting include command which
Information, see the Configuring Network Access
Authentication section on page 7-7. If you want
Access-list command
Configuring AAA Rules for Network Access
Mac-exempt match command
Feature History for AAA Rules
Page
Configuring Application Inspection
Page
How Inspection Engines Work
Getting Started with Application Layer Protocol Inspection
How Inspection Engines Work
When to Use Application Protocol Inspection
Supports IPv6 for the following inspections
Failover Guidelines
323 H.225
Default Settings and NAT Limitations
Server over IP
NetBIOS Name
IP Options
Sun RPC over
Smtp
SQL*Net
Configuring Application Layer Protocol Inspection
View the entire class map using the following command
Ciscoasaconfig# policy-mapname ciscoasaconfig-pmap#
Keywords
Ipsec-pass-thru mapname
Icmp Icmp error Ils
Netbios mapname
Ip-options mapname
Tftp Waas Xdmcp
Scansafe mapname
Sqlnet Sunrpc
10-1
DNS Inspection
DNS Inspection Actions
Default Settings for DNS Inspection
Information About DNS Inspection
General Information About DNS
Class-map type inspect dns match-all
Do one of the following
10-3
10-4
Defining Actions in an Inspection Policy Map section on
Section
Keyword specifies the question portion of a DNS message.
Section the authority keyword specifies the Authority RR
Section the additional keyword specifies the Additional RR
Match not domain-name regex regexid
Matches a DNS message domain name list. The regexname
10-6
10-7
Id-mismatch count number duration seconds action
Message-length maximum length client length auto
Tsig enforced action drop log-Requires a Tsig
10-8
Configuring DNS Inspection
Layer 3/4 Class Maps section on page 1-12 for more
10-9
Monitoring DNS Inspection
Dynamic-filter-snoop keyword, see the Enabling DNS
10-10
Ciscoasa# show service-policy
FTP Inspection
FTP Inspection Overview
10-11
Using the strict Option
10-12
10-13
10-14
Ciscoasaconfig# policy-map type inspect ftp mymap
Http Inspection Overview
Ciscoasaconfig# service-policy ftp-policy interface inside
Http Inspection
Verifying and Monitoring FTP Inspection
10-16
10-17
Ciscoasaconfig-cmap#match not req-resp content-type mismatch
10-18
Ciscoasaconfig# policy-map type inspect http policymapname
10-19
IM Inspection Overview
Icmp Error Inspection
Icmp Inspection
Instant Messaging Inspection
Conference games
Ciscoasaconfig-cmap#match not protocol im-yahoo im-msn
10-21
10-22
Ciscoasaconfig# policy-map type inspect im policymapname
10-23
IP Options Inspection
10-24
IP Options Inspection Overview
10-25
Ciscoasaconfig-pmap-p#router-alert action allow clear
IPsec Pass Through Inspection
10-26
IPv6 Inspection
IPsec Pass Through Inspection Overview
Example for Defining an IPsec Pass Through Parameter Map
10-27
Default Settings for IPv6 Inspection
Optional Configuring an IPv6 Inspection Policy Map
Information about IPv6 Inspection
10-28
Routing-address count gt number -Sets the maximum
10-29
Configuring IPv6 Inspection
To enable IPv6 inspection, perform the following steps
10-30
NetBIOS Inspection
NetBIOS Inspection Overview
10-31
10-32
Pptp Inspection
Smtp and Extended Smtp Inspection
Smtp and Esmtp Inspection Overview
10-33
10-34
Ciscoasaconfig# policy-map type inspect esmtp policymapname
10-35
Tftp Inspection
10-36
11-1
Ctiqbe Inspection
Ctiqbe Inspection Overview
11-2
Limitations and Restrictions
Verifying and Monitoring Ctiqbe Inspection
11-3
Inspection
11-4
Inspection Overview
How H.323 Works
11-5
Support in H.245 Messages
11-6
11-7
Ciscoasaconfig-cmap#match not media-type audio data video
Ciscoasaconfig# policy-map type inspect h323 policymapname
11-8
Ciscoasaconfig# ras-rcf-pinholes enable
Ciscoasaconfig-pmap-p#rtp-conformance enforce-payloadtype
Ciscoasaconfig-pmap-p#state-checking h225 ras
11-9
Configuring H.323 and H.225 Timeout Values
Verifying and Monitoring H.323 Inspection
Monitoring H.225 Sessions
Ciscoasa# show h323-ras
Monitoring H.245 Sessions
Monitoring H.323 RAS Sessions
11-10
11-11
Mgcp Inspection
Mgcp Inspection Overview
11-12
Ciscoasaconfig# policy-map type inspect mgcp mapname
11-13
Configuring Mgcp Timeout Values
Following example shows how to define an Mgcp map
11-14
Rtsp Inspection
Verifying and Monitoring Mgcp Inspection
11-15
Using RealPlayer
Rtsp Inspection Overview
Restrictions and Limitations
11-16
Ciscoasaconfig-cmap#match not request-method method
11-17
Ciscoasaconfig# policy-map type inspect rtsp policymapname
11-18
SIP Inspection
SIP Inspection Overview
11-19
SIP Instant Messaging
11-20
11-21
Ciscoasaconfig-cmap#match not content length gt length
11-22
Ciscoasaconfig-cmap#match not uri sip tel length gt length
Ciscoasaconfig# policy-map type inspect sip policymapname
11-23
Ciscoasaconfig-pmap-p#software-version action mask log log
Ciscoasaconfig-pmap-p#uri-non-sip action mask log log
11-24
Configuring SIP Timeout Values
Skinny Sccp Inspection
Verifying and Monitoring SIP Inspection
11-25
Sccp Inspection Overview
Supporting Cisco IP Phones
11-26
Ciscoasaconfig# policy-map type inspect skinny policymapname
11-27
Ciscoasaconfig-pmap-p#sccp-prefix-len max min valuelength
11-28
Verifying and Monitoring Sccp Inspection
12-1
ILS Inspection
ILS Inspection, SQL*Net Inspection, Sun RPC Inspection,
12-2
SQL*Net Inspection
12-3
Sun RPC Inspection
Sun RPC Inspection Overview
12-4
Managing Sun RPC Services
Verifying and Monitoring Sun RPC Inspection
Ciscoasa# show sunrpc-server active
12-5
12-6
13-1
Dcerpc Inspection
Dcerpc Overview
13-2
Ciscoasaconfig# policy-map type inspect dcerpc policymapname
13-3
GTP Inspection
GTP Inspection Overview
13-4
Ciscoasaconfig# policy-map type inspect gtp policymapname
13-5
Ciscoasaconfig# object-group network GSN-pool-name
Ciscoasaconfig-network#network-object host
13-6
Ciscoasaconfig# object-group network SGSN-name
Ciscoasaconfig# object-group network sgsn32
13-7
Ciscoasaconfig# service-policy globalpolicy global
Ciscoasa# show service-policy inspect gtp statistics
Verifying and Monitoring GTP Inspection
13-8
Ciscoasa# show service-policy gtp statistics grep gsn
Radius Accounting Inspection
Inspect radius-accounting radiusaccountingmap
Configure the service policy
Radius Accounting Inspection Overview
13-9
13-10
RSH Inspection
Snmp Inspection
Snmp Inspection Overview
13-11
Xdmcp Inspection
13-12
Configuring Unified Communications
Page
14-1
14-2
Application
Might not need
Certificate for
Phone proxy
14-4
Model License Requirement1
ASA Base License and Security Plus License 2 sessions
ASA Base License 2 sessions
14-5
ASA 5585-X with Base License 2 sessions SSP-10
ASA 5585-X with Base License 2 sessions SSP-20, -40, or
14-6
IME
15-1
Cisco Mobility Advantage Proxy
Cisco Presence Federation Proxy
Cisco Intercompany Media Engine Proxy
15-2
15-3
Licensing Requirements for the Unified Communication Wizard
15-4
Supports IPv6 addresses
15-5
Configuring the Private Network for the Phone Proxy
15-6
Configuring Servers for the Phone Proxy
Click the Generate and Export LDC Certificate button
15-7
Address Default Port Description
15-8
15-9
Configuring the Public IP Phone Network
15-10
15-11
15-12
15-13
15-14
15-15
Dialog box. See Installing a Certificate,
Certificate,
15-16
15-17
15-18
Basic Deployment
Off-path Deployment
15-19
15-20
Other, respectively, during TLS handshakes
Wizard supports using self-signed certificates only
Cisco UCMs need to be installed on the security appliance
Supports installing self-signed certificates
15-22
15-23
Installing a Certificate
Exporting an Identity Certificate
15-24
Click Install Certificate
15-25
Saving the Identity Certificate Request
15-26
15-27
15-28
16-1
Information About the Cisco Phone Proxy
Phone Proxy Functionality
TCP/RTP TLS/SRTP
16-2
16-3
Supported Cisco UCM and IP Phones for the Phone Proxy
Cisco Unified Communications Manager
Cisco Unified IP Phones
16-4
Licensing Requirements for the Phone Proxy
16-5
16-6
Prerequisites for the Phone Proxy
Media Termination Instance Prerequisites
This section contains the following topics
ACL Rules
Certificates from the Cisco UCM
DNS Lookup Prerequisites
Cisco Unified Communications Manager Prerequisites
PAT Prerequisites
NAT and PAT Prerequisites
Address Port Protocol Description
NAT Prerequisites
16-9
Prerequisites for IP Phones on Multiple Interfaces
7940 IP Phones Support
There must be two CTL file record entries for the Cisco UCM
16-10
Cipc security-mode authenticated
Cisco IP Communicator Prerequisites
16-11
Rate Limiting Configuration Example
Prerequisites for Rate Limiting Tftp Requests
Icmp deny any outside
16-12
Phone Proxy Guidelines and Limitations
End-User Phone Provisioning
Ways to Deploy IP Phones to End Users
16-13
General Guidelines and Limitations
16-14
Configuring the Phone Proxy
Media Termination Address Guidelines and Limitations
16-15
Importing Certificates from the Cisco UCM
Choose Security Certificate Management
Certificate Name Required for
Authenticating IP phones with an LSC
Hostnameconfig# crypto ca trustpoint trustpointname
Hostnameconfig# crypto ca authenticate trustpoint
16-17
Creating Trustpoints and Generating Certificates
16-18
Creating the CTL File
Prerequisites
What to Do Next
16-19
16-20
Using an Existing CTL File
16-21
Creating the TLS Proxy for a Mixed-mode Cisco UCM Cluster
16-22
16-23
Creating the Media Termination Instance
Cucm/cucos/504/iptpch6.html#wp1040848
Cucm/cucos/504/iptpch6.html#wp1040354
16-24
Creating the Phone Proxy Instance
See Media Termination Instance Prerequisites
16-25
See Creating the Media Termination Instance
16-26
Enabling the Phone Proxy with SIP and Skinny Inspection
See Cisco IP Communicator Prerequisites
16-27
16-28
Troubleshooting the Phone Proxy
Configuring Your Router
Debugging Information from the Security Appliance
16-29
Use the Command
16-30
Show conn all
Show asp drop
Debugging Information from IP Phones
Show asp table classify domain
16-32
Debugging Information from IP Phones
16-33
Tftp Auth Error Displays on IP Phone Console
Problem The IP phone displays the following Status message
IP Phone Registration Failure
16-34
Configuration File Parsing Error
Configuration File Parsing Error Unable to Get DNS Response
Ciscoasa# show running-config all ctl-file ctlname
Hostname# debug phone-proxy tftp
Non-configuration File Parsing Error
Phone-proxy tftp
16-35
Hostname# capture out interface outside
16-36
16-37
IP Phone Requesting Unsigned File Error
Hostnameconfig# show running-config all phone-proxy
IP Phone Unable to Download CTL File
16-38
IP Phone Registration Failure from Signaling Connections
Hostname# show run all ssl
To add the required ciphers, enter the following command
Debug sip Debug skinny
16-39
16-40
SSL Handshake Failure
16-41
Media Termination Address Errors
Certificate Validation Errors
16-42
Audio Problems with IP Phones
Saving Sast Keys
16-43
Record-entry capf trustpoint trustpoint address address
Configuration Examples for the Phone Proxy
16-44
Record-entry cucm trustpoint trustpoint address address
Corporate Network
16-45
Fqdn my-ldc-ca.exmaple.com
16-46
Phone a 10.10.0.24
16-47
16-48
ASA Outside Interface Phone a 10.10.0.24
16-49
16-50
16-51
Enroll terminal crypto ca authenticate capf ctl-file myctl
16-52
Example 6 Vlan Transversal
ASA Inside Interface 10.130.50.24
16-53
16-54
Feature History for the Phone Proxy
17-1
17-2
Supported Cisco UCM and IP Phones for the TLS Proxy
17-3
CTL Client Overview
17-4
CTL Client TLS Proxy Features ASA IP Address or Domain Name
17-5
Licensing for the TLS Proxy
17-6
17-7
Configuring the TLS Proxy for Encrypted Voice Inspection
17-8
Ciscoasaconfig# tls-proxy maximum-sessions
Ciscoasaconfig# show crypto ca server certificate
17-9
17-10
Creating an Internal CA
17-11
Creating a CTL Provider Instance
17-12
Creating the TLS Proxy Instance
17-13
Crypto ca trustpoint command
17-14
17-15
Monitoring the TLS Proxy
AES128-SHA
17-16
17-17
2lists the release history for this feature
TLS Proxy TLS proxy feature was introduced
17-18
18-1
Cisco Mobility Advantage Proxy Functionality
18-2
Hostnameconfig-tlsp#no server authenticate-client
Mobility Advantage Proxy Deployment Scenarios
TLS
18-3
18-4
Mobility Advantage Proxy Using NAT/PAT
Versus
18-5
Trust Relationships for Cisco UMA Deployments
18-6
Configuring Cisco Mobility Advantage
Longer requires a Unified Communications Proxy license
18-7
Task Flow for Configuring Cisco Mobility Advantage
Installing the Cisco UMA Server Certificate
Enabling the TLS Proxy for MMP Inspection,
18-8
18-9
Enabling the TLS Proxy for MMP Inspection
18-10
Exits from the Policy Map configuration mode
Enables the service policy on all interfaces
Monitoring for Cisco Mobility Advantage
18-11
Configuration Examples for Cisco Mobility Advantage
18-12
18-13
18-14
Feature History for Cisco Mobility Advantage
19-1
Information About Cisco Unified Presence
19-2
Ciscoasaconfig# object network obj-10.0.0.2-01
19-3
19-4
Trust Relationship in the Presence Federation
19-5
Xmpp Federation Deployments
19-6
Configuration Requirements for Xmpp Federation
Configure the following NAT commands
Allow traffic from any address to any single node on port
19-7
Licensing for Cisco Unified Presence
19-8
Configuring Cisco Unified Presence Proxy for SIP Federation
19-9
Install the certificates. See Installing Certificates,
19-10
Installing Certificates
Trustpoint for the remote entity
19-11
19-12
19-13
Trust-pointcommand is the remote entity proxy
Enabling the TLS Proxy for SIP Inspection
19-14
Configuration Example for Cisco Unified Presence
Example Configuration for SIP Federation Deployments,
Monitoring Cisco Unified Presence
19-15
Example Configuration for SIP Federation Deployments
19-16
19-17
Example ACL Configuration for Xmpp Federation
19-18
Example NAT Configuration for Xmpp Federation
19-19
19-20
Feature History for Cisco Unified Presence
20-1
Features of Cisco Intercompany Media Engine Proxy
20-2
How the UC-IME Works with the Pstn and the Internet
20-3
Tickets and Passwords
20-4
Call Fallback to the Pstn
20-5
Architecture
Architecture, Basic Deployment, Off Path Deployment,
20-6
Basic Deployment
20-7
Licensing for Cisco Intercompany Media Engine
Off Path Deployment
20-8
Supported in single context mode only
Supported in routed firewall mode only
Does not support IPv6 addresses
20-9
20-10
Configuring Cisco Intercompany Media Engine Proxy
Task Flow for Configuring Cisco Intercompany Media Engine
20-11
Configuring NAT for Cisco Intercompany Media Engine Proxy
Create the TLS proxy. See Creating the TLS Proxy,
20-12
Cisco UCM that you want to translate
20-13
Configuring PAT for the Cisco UCM Server
20-14
20-15
Creating ACLs for Cisco Intercompany Media Engine Proxy
20-16
Procedure
Guidelines
20-17
Creating the Cisco Intercompany Media Engine Proxy
See Creating the Cisco Intercompany Media Engine
20-18
20-19
Show running-config uc-ime command
20-20
20-21
Prerequisites for Installing Certificates
20-22
20-23
Creating the TLS Proxy
Creating Trustpoints and Generating
Certificates section on
20-24
20-25
Created in , page 20-15of the task Creating
ACLs for Cisco Intercompany Media Engine Proxy
20-26
Optional Configuring TLS within the Local Enterprise
Where policymapname is the name of the policy
Map you created in of this task
20-27
Commands Purpose
20-28
Where proxytrustpoint for the server trust-point
Where proxytrustpoint for the client trust-point
20-29
Optional Configuring Off Path Signaling
20-30
Intercompany Media Engine Proxy,
Creating the Cisco Intercompany Media
Engine Proxy,
20-31
20-32
20-33
Show uc-ime signaling-sessions
20-34
Show uc-ime signaling-sessions statistics
Show uc-ime media-sessions detail
20-35
Show uc-ime mapping-service-sessions
Show uc-ime mapping-service-sessions statistics
Show uc-ime fallback-notification statistics
20-36
Configuring Connection Settings and QoS
Page
22-1
Information About Connection Settings
22-2
TCP Intercept and Limiting Embryonic Connections
Dead Connection Detection DCD
22-3
TCP Sequence Randomization
TCP Normalization
TCP State Bypass
22-4
Licensing Requirements for Connection Settings
TCP Normalizer
TCP State Bypass Unsupported Features
Maximum Concurrent and Embryonic Connection Guidelines
TCP State Bypass
Customizing the TCP Normalizer with a TCP Map
Configuring Connection Settings
Task Flow For Configuring Connection Settings
For each TCP map, you can customize one or more settings
22-7
22-8
Command
22-9
Command
22-10
22-11
Configuring Connection Settings
Urgent-flag allow clear
Window-variation allow drop
22-12
22-13
Random-sequence-number enable disable keyword
TCP Sequence Randomization section on page 22-3 section for
Embryonic-conn-max keywords
To 0, which means the connection never times out
Command in the command reference
Embryonic hh mm ss keyword sets the timeout period until a
Idle hh mm ss keyword sets the idle timeout period after
22-15
Monitoring Connection Settings
Configuration Examples for Connection Settings
Configuration Examples for Connection Limits and Timeouts
22-16
Configuration Examples for TCP State Bypass
Configuration Examples for TCP Normalization
Following is a sample configuration for TCP state bypass
22-17
Feature History for Connection Settings
Per-client-max
Timeout half-closed,timeout half-closed
Conn-max,set connection embryonic-conn-max,set
Connection per-client-embryonic-max,set connection
23-1
Information About QoS
23-2
Supported QoS Features
What is a Token Bucket?
23-3
Information About Policing
Information About Priority Queuing
23-4
How QoS Features Interact
Information About Traffic Shaping
Model Guidelines
Licensing Requirements for QoS
Dscp and DiffServ Preservation
Does not support IPv6
23-6
Configuring QoS
23-7
Mbps
125
Kbps
23-8
Configuring the Standard Priority Queue for an Interface
Priority queue, or for the ASA 5505 or ASASM, the Vlan
Interface name
23-9
23-10
23-11
Step
23-12
23-13
23-14
Configuring the Service Rule
23-15
Multiple of 8000. See the Information About Traffic Shaping
Priority Queuing Policy section on
23-16
Ciscoasa# show service-policy police
Monitoring QoS
Viewing QoS Police Statistics
23-17
Viewing QoS Standard Priority Statistics
Viewing QoS Shaping Statistics
Ciscoasa# show priority-queue statistics test
Viewing QoS Standard Priority Queue Statistics
23-18
23-19
Feature History for QoS
23-20
24-1
Troubleshooting Connections and Resources
Testing Your Configuration
24-2
Enabling Icmp Debugging Messages and Syslog Messages
24-3
Pinging ASA Interfaces
24-4
ASA
24-5
Passing Traffic Through the ASA
24-6
Disabling the Test Configuration
24-7
Monitoring Per-Process CPU Usage
Determining Packet Routing with Traceroute
Tracing Packets with Packet Tracer
24-8
Configuring Advanced Network Protection
Page
25-1
Configuring the ASA for Cisco Cloud Web Security
25-2
User Authentication and Cloud Web Security
Information About Cisco Cloud Web Security
Redirection of Web Traffic to Cloud Web Security
25-3
Authentication Keys
Company Authentication Key Group Authentication Key
Company Authentication Key, Group Authentication Key,
25-4
ScanCenter Policy
Directory Groups
Custom Groups
25-5
How Groups and the Authentication Key Interoperate
Cloud Web Security Actions
IPv4 and IPv6 Support
Failover from Primary to Backup Proxy Server
Licensing Requirements for Cisco Cloud Web Security
Bypassing Scanning with Whitelists
25-7
Optional User Authentication Prerequisites
Prerequisites for Cloud Web Security
Optional Fully Qualified Domain Name Prerequisites
25-8
Configuring Cisco Cloud Web Security
By default, Cisco Cloud Web Security is not enabled
25-9
See the Authentication Keys section on
25-10
Config-url disk0/onectx.cfg Context two
25-11
Optional Configuring Whitelisted Traffic section on
25-12
Adding an Extended Access Control List,
25-13
Policy section on page 1-17for more information
25-14
25-15
Optional Configuring Whitelisted Traffic
25-16
Optional Configuring the User Identity Monitor
Configuring the Cloud Web Security Policy
Object-group-user-Specifies an object-group user name
25-17
Monitoring Cloud Web Security
Http//Whoami.scansafe.net
25-18
Configuration Examples for Cisco Cloud Web Security
Single Mode Example
25-19
Multiple Mode Example
Whitelist Example
To attach class-maps to the Cloud Web Security Policy map
25-20
Configuring the Active Directory Server Using Ldap
Directory Integration Examples
Creating the ASA as a Client on the AD Agent Server
Configuring the Active Directory Agent Using Radius
Testing the AD Agent
Configuring the Identity Options on the ASA
Showing a List of Active Users
Cloud Web Security with Identity Firewall Example
Monitoring the Active Directory Groups
Downloading the Database from the AD Agent
25-23
Aaa-server AD inside host 192.168.116.220 server-port
25-24
No call-home reporting anonymous call-home
25-25
25-26
Feature History for Cisco Cloud Web Security
Related Documents
Related Documents
26-1
Information About the Botnet Traffic Filter
Botnet Traffic Filter Address Types,
Information About the Dynamic Database
Botnet Traffic Filter Address Types
Botnet Traffic Filter Actions for Known Addresses
Botnet Traffic Filter Databases
26-3
Information About the Static Database
26-4
26-5
How the Botnet Traffic Filter Works
26-6
Licensing Requirements for the Botnet Traffic Filter
Prerequisites for the Botnet Traffic Filter
26-7
Configuring the Botnet Traffic Filter
Task Flow for Configuring the Botnet Traffic Filter
26-8
Configuring the Dynamic Database
26-9
Adding Entries to the Static Database
See the Adding Entries to the Static Database section on
26-10
Enabling DNS Snooping
See the Enabling DNS Snooping section on
TCP DNS traffic is not supported
26-11
26-12
Inspection section on page 10-1 for more information about
26-13
Recommended Configuration
Very-low Low Moderate High Very-high
Subset of the dynamic-filter enable ACL
See the Blocking Botnet Traffic Manually section on
Threat-level range moderate very-high
26-15
For dropping purposes. If you do not enable this command
Blocking Botnet Traffic Manually
About the greylist
26-16
Searching the Dynamic Database
26-17
Botnet Traffic Filter Commands
Monitoring the Botnet Traffic Filter
Botnet Traffic Filter Syslog Messaging
26-18
Infected-hosts command
Dns-snoop command
Ciscoasa# show dynamic-filter reports top malware-ports
Configuration Examples for the Botnet Traffic Filter
Recommended Configuration Example
26-19
Outside
Other Configuration Examples
26-20
26-21
26-22
Feature History for the Botnet Traffic Filter
27-1
Configuring Threat Detection
Information About Threat Detection
Licensing Requirements for Threat Detection
27-2
Configuring Basic Threat Detection Statistics
Information About Basic Threat Detection Statistics
Types of Traffic Monitored
Trigger Settings Packet Drop Reason Average Rate Burst Rate
Guidelines and Limitations
Security Context Guidelines
27-4
Configuring Basic Threat Detection Statistics
27-5
Monitoring Basic Threat Detection Statistics
Threat Detection Statistics section on
27-6
Configuring Advanced Threat Detection Statistics
Feature History for Basic Threat Detection Statistics
Information About Advanced Threat Detection Statistics
27-7
Configuring Advanced Threat Detection Statistics
27-8
27-9
Monitoring Advanced Threat Detection Statistics
27-10
27-11
Using the show threat-detection rate acl-drop command
27-12
Protocolnumber argument is an integer between 0
Statistics
Field
27-13
Field Description
27-14
Feature History for Advanced Threat Detection Statistics
27-15
Configuring Scanning Threat Detection
Information About Scanning Threat Detection
27-16
Average Rate Burst Rate
Displays the hosts that are currently shunned
Configuring Scanning Threat Detection
Configuration see the Configuring Basic Threat Detection
Monitoring Shunned Hosts, Attackers, and Targets
27-18
Feature History for Scanning Threat Detection
27-19
Configuration Examples for Threat Detection
27-20
28-1
Preventing IP Spoofing
28-2
Configuring the Fragment Size
Blocking Unwanted Connections
28-3
Configuring IP Audit for Basic IPS Support
Configuring IP Audit
Configuring IP Audit, IP Audit Signature List,
28-4
IP Audit Signature List
1lists supported signatures and system message numbers
Signature Message Number Signature Title
28-5
28-6
28-7
28-8
29-1
Information About Web Traffic Filtering
29-2
Configuring ActiveX Filtering
Licensing Requirements for ActiveX Filtering
Information About ActiveX Filtering
29-3
Configuring ActiveX Filtering
Configuration Examples for ActiveX Filtering
Guidelines and Limitations for ActiveX Filtering
Licensing Requirements for Java Applet Filtering
Configuring Java Applet Filtering
Feature History for ActiveX Filtering
Information About Java Applet Filtering
29-5
Configuring Java Applet Filtering
Configuration Examples for Java Applet Filtering
Guidelines and Limitations for Java Applet Filtering
29-6
Feature History for Java Applet Filtering
Filtering URLs and FTP Requests with an External Server
Information About URL Filtering
29-7
Licensing Requirements for URL Filtering
Guidelines and Limitations for URL Filtering
29-8
Identifying the Filtering Server
Choose from the following options
29-9
Maximum memory allocation of 2 KB to 10 MB
Configuring Additional URL Filtering Settings
Buffering the Content Server Response
Replaces block-buffer with the maximum number of Http
Websense server
Caching Server Addresses
Filtering Http URLs
On the Websense server
29-12
29-13
Filtering Https URLs
29-14
Filtering FTP Requests
Might enter cd ./files instead of cd /public/files
Ciscoasa# show url-server
Following is sample output from the show url-servercommand
Monitoring Filtering Statistics
29-15
29-16
Following is sample output from the show url-blockcommand
Following is sample output from the show perfmon command
Following is sample output from the show filter command
29-17
Feature History for URL Filtering
29-18
Configuring Modules
Page
30-1
Information About the ASA CX Module
30-2
How the ASA CX Module Works with the ASA
30-3
Monitor-Only Mode
Service Policy in Monitor-Only Mode
Traffic-Forwarding Interface in Monitor-Only Mode
30-4
Initial Configuration
Initial Configuration, Policy Configuration and Management,
Information About ASA CX Management
Information About VPN and the ASA CX Module
Information About Authentication Proxy
Compatibility with ASA Features
Policy Configuration and Management
30-6
Licensing Requirements for the ASA CX Module
30-7
Monitor-Only Mode Guidelines
ASA Clustering Guidelines
Does not support clustering
Task Flow for the ASA CX Module
Configuring the ASA CX Module
See the Compatibility with ASA Features section on
Parameters Default
30-9
Connecting the ASA CX Management Interface
ASA 5585-X Hardware Module
30-10
If you have an inside router
If you do not have an inside router
30-11
ASA 5512-X through ASA 5555-X Software Module
30-12
30-13
Example
Partition the SSD
30-14
Session 1 do setup host ip
ASA 5585-X Changing the ASA CX Management IP Address
Sets the ASA CX management IP address, mask, and gateway
Enter an IPv6 address 2001DB80CD301234/64
Configuring Basic ASA CX Settings at the ASA CX CLI
30-15
Ciscoasa# session cxsc console
30-16
Change the admin password by entering the following command
Asacx config passwd
30-17
Optional Configuring the Authentication Proxy Port
30-18
Creating the ASA CX Service Policy
Redirecting Traffic to the ASA CX Module
30-19
See the Monitor-Only Mode section on page 30-3 for more
30-20
Configuring Traffic-Forwarding Interfaces Monitor-Only Mode
See the Feature Matching Within a Service Policy section on
30-21
Managing the ASA CX Module
30-22
Resetting the Password
Reloading or Resetting the Module
For a software module ASA 5512-X through ASA
30-23
Shutting Down the Module
Reload
Sw-module module cxsc uninstall
New module type
30-24
30-25
Admin123
Monitoring the ASA CX Module
Showing Module Status
30-26
Showing Module Statistics
30-27
Monitoring Module Connections
Show asp event dp-cp cxsc-msg
Dp-cp
‘X’ flag
30-28
Ciscoasa# show asp event dp-cp cxsc-msg
30-29
Ciscoasa# show asp drop
30-30
Troubleshooting the ASA CX Module
Capturing Module Traffic
Debugging the Module
30-31
Problems with the Authentication Proxy
30-32
Configuration Examples for the ASA CX Module
Check the authentication proxy port
Check the authentication proxy rules
30-33
Feature History for the ASA CX Module
30-34
We modified or introduced the following commands cxsc
Fail-close fail-openmonitor-only,traffic-forward
Cxsc monitor-only
30-35
Capture interface asadataplane command
Asadataplane
30-36
31-1
Information About the ASA IPS Module
31-2
How the ASA IPS Module Works with the ASA
31-3
Using Virtual Sensors ASA 5510 and Higher
Operating Modes
31-4
Information About Management Access
31-5
Licensing Requirements for the ASA IPS module
31-6
1lists the default settings for the ASA IPS module
Management Vlan ASA 5505 only
31-7
Configuring the ASA IPS module
Task Flow for the ASA IPS Module
31-8
Connecting the ASA IPS Management Interface
31-9
31-10
ASA
31-11
ASA 5512-X through ASA 5555-X Booting the Software Module
Sessioning to the Module from the ASA
31-12
Configuring Basic IPS Module Network Settings
For example, using the filename in the example in , enter
Ciscoasa# sw-module module ips recover boot
Sessioning to the Module from the ASA Section on
ASA 5510 and Higher Configuring Basic Network Settings
ASA 5505 Configuring Basic Network Settings
Connecting the ASA IPS Management Interface section on
31-14
31-15
Configuring the Security Policy on the ASA IPS Module
Details command
31-16
31-17
31-18
Diverting Traffic to the ASA IPS module
31-19
31-20
31-21
Installing and Booting an Image on the Module
Managing the ASA IPS module
IPS module
31-22
31-23
Uninstalling a Software Module Image
Sw-module module ips uninstall
For a software module for example, the ASA 5545-X
31-24
Sw-module module ips password-reset
For a software module for example, the ASA
31-25
Monitoring the ASA IPS module
Ips for a software module
Ciscoasa# show module ips
Configuration Examples for the ASA IPS module
31-26
31-27
Feature History for the ASA IPS module
Allow-ssc-mgmt,hw-module module ip, and hw-module
Module allow-ip
31-28
Inventory, show environment
Session, show module, sw-module
32-1
Information About the CSC SSM
32-2
ASA
32-3
Determining What Traffic to Scan
32-4
Common Network Configuration for CSC SSM Scanning
32-5
Licensing Requirements for the CSC SSM
Prerequisites for the CSC SSM
32-6
1lists the default settings for the CSC SSM
Parameter Default
Supported in single and multiple context modes
32-7
Configuring the CSC SSM
Before Configuring the CSC SSM
32-8
Connecting to the CSC SSM
See the Connecting to the CSC SSM section on
32-9
32-10
Diverting Traffic to the CSC SSM
See the Diverting Traffic to the CSC SSM section on
Determining What Traffic to Scan section on
32-11
32-12
Guidelines and Limitations section on
Displays additional status information
Monitoring the CSC SSM
See the Monitoring the CSC SSM section on
Displays the status
32-14
Troubleshooting the CSC Module
Installing an Image on the Module
32-15
Resetting the Password
Recover command
32-16
Reloading or Resetting the Module
Shuts down the module
Configuration Examples for the CSC SSM
Ciscoasaconfig-cmap#policy-map cscinpolicy
Shutting Down the Module
Assistance with the Startup Wizard
Additional References
Related Topic Document Title
Instructions on use of the CSC SSM GUI
32-19
Feature History for the CSC SSM
Feature Name Platform Releases Feature Information
Details recover
32-20
IN-1
IN-2
IN-3
IN-4
IN-5
IN-6
See also policy map
LDP 6-7router-id 6-7TDP Multi-session PAT
RPC not supported with
IN-7
IN-8
IN-9
IN-10