Cisco Systems ASA 5505, ASA 5545-X, ASA 5555-X For a software module for example, the ASA, 31-24

Page 678

Chapter 31 Configuring the ASA IPS Module

Managing the ASA IPS module

Resetting the Password

You can reset the module password to the default. For the user cisco, the default password is cisco. After resetting the password, you should change it to a unique value using the module application.

Resetting the module password causes the module to reboot. Services are not available while the module is rebooting.

To reset the module password to the default of cisco, perform the following steps.

Detailed Steps

Command

Purpose

For a hardware module (for example, the ASA 5585-X):

Resets the module password to cisco for user cisco.

hw-module module 1 password-reset

 

For a software module (for example, the ASA 5545-X):

 

sw-module module ips password-reset

 

Example:

ciscoasa# hw-module module 1 password-reset

Cisco ASA Series Firewall CLI Configuration Guide

31-24

Image 678
Contents Cisco ASA Series Firewall CLI Configuration Guide Software VersionCisco ASA Series Firewall CLI Configuration Guide N T E N T S IiiGuidelines and Limitations Default Inspection Policy Maps NAT for VPN Guidelines and Limitations Rules ViiGetting Started with Application Layer Protocol Inspection ViiiIPv6 Inspection Verifying and Monitoring Sun RPC Inspection Configuring Unified Communications Installing a Certificate XiiEnabling the Phone Proxy with SIP and Skinny Inspection XiiiCTL Client Overview XivArchitecture Configuring Connection Settings and QoS XviConfiguring the Standard Priority Queue for an Interface XviiBypassing Scanning with Whitelists XviiiInformation About the Static Database XixConfiguring Java Applet Filtering Filtering URLs and FTP Requests with an External Server XxiXxii 30-15ASA 5505 Configuring Basic Network Settings XxiiiXxiv Conventions Document ObjectivesRelated Documentation Convention IndicationObtaining Documentation and Submitting a Service Request XxviR T Page Information About Service Policies Feature Traffic? See Supported FeaturesFeature Directionality For ThroughFeature Matching Within a Service Policy FeatureGlobal Direction Order in Which Multiple Feature Actions are Applied ASA IPS ASA CXIncompatibility of Certain Feature Actions Licensing Requirements for Service Policies Feature Matching for Multiple Service PoliciesGuidelines and Limitations Service Policy Guidelines Class Map GuidelinesPolicy Map Guidelines Default Settings Default ConfigurationDefault Configuration, Default Class Maps, Task Flow for Using the Modular Policy Framework Task Flows for Configuring Service PoliciesDefault Class Maps This section includes the following topicsSee the Identifying Traffic Layer 3/4 Class Maps section on Layer 3/4 Policy Map Creating a Layer 3/4 Class Map for Through Traffic Command PurposeIdentifying Traffic Layer 3/4 Class Maps ExampleSee the Default Settings and NAT Limitations section on Ports are included in the match default-inspection-trafficMatch default-inspection-traffic command to narrow Except for the match any , match access-list , or match Match flow ip destination-address command to match flowsCreating a Layer 3/4 Class Map for Management Traffic Creates a management class map, where classmapname is a Defining Actions Layer 3/4 Policy MapIdentifying Traffic Layer 3/4 Class Maps section on Task Flow for Configuring Hierarchical Policy Maps forSee the Supported Features section on QoS Traffic Shaping section on page 1-11 for moreApplying Actions to an Interface Service Policy Monitoring Modular Policy Framework Configuration Examples for Modular Policy FrameworkDisplays the service policy statistics IPv6, see the IPv6 Guidelines section onApplying Inspection and QoS Policing to Http Traffic See the following commands for this exampleCiscoasaconfig# class-map httptraffic Applying Inspection to Http Traffic GloballyCiscoasaconfig# policy-map httptrafficpolicy Ciscoasaconfig# service-policy httptrafficpolicy globalObj-192.168.1.1 Ciscoasaconfig# service-policy httpclient interface insideApplying Inspection to Http Traffic with NAT HostIntroduced class-map type management, and inspect Feature History for Service PoliciesFeature Name Releases Feature Information Radius-accountingInformation About Inspection Policy Maps Guidelines and Limitations Default Inspection Policy Maps Defining Actions in an Inspection Policy Map Identifying Traffic in an Inspection Class Map section onIdentifying Traffic in an Inspection Class Map Getting Started with Application Layer Protocol Inspection Where to Go Next Feature History for Inspection Policy Maps1lists the release history for this feature Page Configuring Network Address Translation Page Why Use NAT? Information About NATNAT Terminology Static NAT NAT TypesNAT Types Overview Information About Static NATInformation About Static NAT with Port Translation Information About Static NAT with Port Address TranslationInformation About One-to-Many Static NAT Static NAT with Identity Port TranslationInformation About Other Mapping Scenarios Not Recommended 4shows a typical few-to-many static NAT scenarioDynamic NAT Information About Dynamic NATDynamic PAT Dynamic NAT Disadvantages and AdvantagesInformation About Dynamic PAT Per-Session PAT vs. Multi-Session PAT Dynamic PAT Disadvantages and AdvantagesNAT in Routed and Transparent Mode Identity NATNAT in Routed Mode, NAT in Transparent Mode, NAT in Routed Mode NAT in Transparent Mode10 NAT Example Transparent Mode NAT and IPv6 How NAT is ImplementedMain Differences Between Network Object NAT and Twice NAT Information About Network Object NAT Information About Twice NAT11 Twice NAT with Different Destination Addresses 12 Twice NAT with Different Destination Ports 13 Twice Static NAT with Destination Address Translation NAT Rule Order Rule Type Order of Rules within the SectionNAT Interfaces Routing NAT PacketsMapped Addresses and Routing Transparent Mode Routing Requirements for Remote Networks Too lateNAT for VPN NAT and Remote Access VPN 203.0.113.16075NAT and Site-to-Site VPN Same-security-traffic permit intra-interfaceSee the following sample NAT configuration for ASA1 Boulder 19 Interface PAT and Identity NAT for Site-to-Site VPNObject network boulderinside Subnet 10.1.1.0 NAT and VPN Management AccessSubnet 10.2.2.0 Object network vpnlocal Subnet 10.3.3.0Management-access inside Subnet 10.1.1.0 Nat inside,outside dynamic interfaceDNS and NAT Troubleshooting NAT and VPNAdd the identity NAT configuration Enter show nat detail and show conn all22 DNS Reply Modification, DNS Server on Outside 192.168.1.10 24 DNS Reply Modification, DNS Server on Host Network 2001DB8D1A5C8E1 26 PTR Modification, DNS Server on Host Network Page Configuring Network Object NAT Information About Network Object NATLicensing Requirements for Network Object NAT Prerequisites for Network Object NATSupports IPv6. See also the NAT and IPv6 section on Additional Guidelines Configuring Network Object NAT Adding Network Objects for Mapped AddressesConfiguring Dynamic NAT ObjectObject network objname Additional Guidelines section on DNS and NAT section on page 3-28 for more informationConfiguring Dynamic PAT Hide Nat inside,outside dynamic nat-pat-grp interfaceSee the Adding Network Objects for Mapped Addresses section Configures a network object for which you want to configureOptional Create a network object or group for Mapped addressesUsed. For this option, you must configure a specific Configures dynamic PAT for the object IP addresses. You canInterface-Routed mode only The IP address When you want to use the interface IP address youCiscoasaconfig-network-object#nat inside,outside dynamic Configuring Static NAT or Static NAT-with-Port-Translation Ciscoasaconfig# object network IPv4POOLCiscoasaconfig# object network IPv6INSIDE Addresses IPv4 or IPv6 that you want to translate Static NAT section on See the DNS and NAT section on page 3-28. This option isSee the Mapped Addresses and Routing section on Configuring Identity NAT Translate. See the Adding Network Objects for MappedAddresses section on Mapped Addresses and Routing section on NAT command. See the Determining the Egress InterfaceSee the Additional Guidelines section on Section on page 3-22 for more informationConfiguring Per-Session PAT Rules By default, the following rules are installedMonitoring Network Object NAT Shows NAT statistics, including hits for each NAT ruleHow many times they were allocated Configuration Examples for Network Object NAT Ciscoasaconfig# object network myWebServ Providing Access to an Inside Web Server Static NATConfigure static NAT for the object Create a network object for the internal web serverCreate a network object for the inside network Configure static NAT for the web serverCiscoasaconfig-network-object#nat outside,inside static Create a network object for the outside web serverCiscoasaconfig# object network myLBHost Configure static NAT for the load balancerCiscoasaconfig# object network myPublicIPs Create a network object for the load balancerCreate a network object for the FTP server address Ciscoasaconfig# object network FtpserverCiscoasaconfig# object network Httpserver Create a network object for the Http server addressCiscoasaconfig# object network Smtpserver Create a network object for the Smtp server addressDNS Reply Modification DNS Reply Modification Using Outside NAT 2001DB8D1A5C8E1 Ciscoasaconfig# object network Dnsserver Feature History for Network Object NAT Platform Feature Name Releases Feature InformationPat-pool mappedobject flat include-reserve Pat-pool mappedobject extendedGeneral-attributes configuration mode Configuration mode, show nat, show nat pool, show xlateNat-assigned-to-public-ip interface tunnel-group Show nat pool Page Configuring Twice NAT Information About Twice NATLicensing Requirements for Twice NAT Prerequisites for Twice NATSupports IPv6 Configuring Twice NAT Guidelines and Limitations Configuring Twice NAT Adding Network Objects for Real and Mapped AddressesConfiguring Twice NAT Optional Adding Service Objects for Real and Mapped Ports Configure service objects forCommand Purpose See the Optional Adding Service Objects for Real and Mapped See the Adding Network Objects for Real and MappedPorts section on Anywhere in the applicable section using the line argument Configure dynamic NAT. See the following guidelinesSection and Line-Optional By default, the NAT rule is You can optionally configure the following fallbackCommand Purpose For a PAT pool Subnet 203.0.113.0Subnet 2001DB8AAAA/96 Configuring Twice NAT Detailed Steps Interface-Routed mode only Specify the interface Configures dynamic PAT hide. See the following guidelinesMapped-Configure one of the following Interface keyword enables interface PAT fallback. AfterCommand Purpose Command Purpose Service tcp destination eq Subnet 192.168.1.0Host 2001DB823 Source or Destination real ports Source or Destination mapped portsRule Order section on page 3-18for more information about See the Static Interface NAT with Port TranslationExamples Subnet 2001DB8BBBB/96 ObjectMAPPEDIPv6NW OUTSIDEIPv6NWSource real addresses you will typically use Static Interface NAT with Port Translation section on Shows NAT statistics, including hits for each NAT rule To monitor twice NAT, enter one of the following commandsMonitoring Twice NAT How many times they were allocatedAdd a network object for the inside network Configuration Examples for Twice NATCiscoasaconfig# object network PATaddress1 Add a network object for the DMZ networkConfigure the first twice NAT rule Configure the second twice NAT ruleCiscoasaconfig# object network myInsideNetwork Add a network object for the PAT address when using TelnetAdd a service object for Telnet Ciscoasaconfig# object network TelnetWebServerAdd a service object for Http Show nat, show xlate, show nat pool Feature History for Twice NATWe modified the following command nat source static Existing functionality. The unidirectional keyword isPat-pool mappedobject flat include-reserve Nat-assigned-to-public-ip interface tunnel-group Show nat pool Configuring Access Control Page Configuring Access Rules Information About Access RulesGeneral Information About Rules Implicit PermitsInformation About EtherType Rules, Implicit Deny Inbound and Outbound RulesTransactional-Commit Model Outbound ACLInformation About Extended Access Rules Access Rules for Returning TrafficAdditional Guidelines and Limitations Supported EtherTypes and Other Traffic Management Access RulesInformation About EtherType Rules Traffic Type Protocol or PortAllowing Mpls Licensing Requirements for Access RulesPrerequisites Supported in routed and transparent firewall modesTo apply an access rule, perform the following steps Default SettingsConfiguring Access Rules Per-User ACL GuidelinesPer-user-override option See Per-User ACL Guidelines,Show running-config access-group Monitoring Access RulesTo monitor network access, enter the following command Hostname config# object-group service myaclogFeature History for Access Rules ExtendedPermit deny is-is Access-list extended, service-object, service Extended, access-list webtypeIpv6 access-list webtype, ipv6-vpn-filter Transactional-commit,show running-config aspAAA Performance Licensing Requirements for AAA RulesConfiguring Authentication for Network Access Information About AuthenticationOne-Time Authentication ASA Authentication PromptsName name1@name2 Password password1@password2 AAA Prompts and Identity FirewallAAA Rules as a Backup Authentication Method Static PAT and HttpNat inside,outside static 10.48.66.155 service tcp 111 Configuring Network Access Authentication Authentication include command whichUser-group any and user-group none can be Lockout command Aaa authentication match Auth inside Ldap Ldap-login-passwordLdap-over-ssl enable Protocol ldapEnabling Secure Authentication of Web Clients Authenticating Directly with the ASA Authenticating Https Connections with a Virtual ServerAuthenticating Telnet Connections with a Virtual Server Authentication include command Configuring Authorization for Network Access Configuring TACACS+ AuthorizationTraffic from authentication. Be sure to include Authenticate. For details, see the general operationsAuthentication, while deny entries exclude matching FTP in the ACL, because the user must authenticateAuthentication match command Authorization include command whichConfiguring Radius Authorization About the Downloadable ACL Feature and Cisco Secure ACSACSCiscoSecure-Defined-ACL=acl-set-name Configuring Cisco Secure ACS for Downloadable ACLs Access-list aclname extendedDownloaded ACL on the ASA consists of the following lines With the following textIpinacl#nnn= Configuring Accounting for Network Access Filter-id=aclnameAccess-list command Information, see the Configuring Network AccessAuthentication section on page 7-7. If you want Accounting include command whichConfiguring AAA Rules for Network Access Mac-exempt match command Feature History for AAA Rules Page Configuring Application Inspection Page Getting Started with Application Layer Protocol Inspection How Inspection Engines WorkWhen to Use Application Protocol Inspection How Inspection Engines WorkFailover Guidelines Supports IPv6 for the following inspectionsDefault Settings and NAT Limitations 323 H.225NetBIOS Name IP OptionsServer over IP Smtp SQL*NetSun RPC over Configuring Application Layer Protocol Inspection View the entire class map using the following command Ciscoasaconfig# policy-mapname ciscoasaconfig-pmap# Keywords Ip-options mapname Icmp Icmp error IlsNetbios mapname Ipsec-pass-thru mapnameScansafe mapname Sqlnet SunrpcTftp Waas Xdmcp DNS Inspection 10-1General Information About DNS Default Settings for DNS InspectionInformation About DNS Inspection DNS Inspection ActionsDo one of the following 10-3Class-map type inspect dns match-all Defining Actions in an Inspection Policy Map section on 10-4Section the additional keyword specifies the Additional RR Keyword specifies the question portion of a DNS message.Section the authority keyword specifies the Authority RR SectionMatches a DNS message domain name list. The regexname 10-6Match not domain-name regex regexid Tsig enforced action drop log-Requires a Tsig Id-mismatch count number duration seconds actionMessage-length maximum length client length auto 10-7Configuring DNS Inspection Layer 3/4 Class Maps section on page 1-12 for more10-8 Monitoring DNS Inspection Dynamic-filter-snoop keyword, see the Enabling DNS10-9 FTP Inspection Overview Ciscoasa# show service-policyFTP Inspection 10-10Using the strict Option 10-1110-12 10-13 Ciscoasaconfig# policy-map type inspect ftp mymap 10-14Verifying and Monitoring FTP Inspection Ciscoasaconfig# service-policy ftp-policy interface insideHttp Inspection Http Inspection Overview10-16 Ciscoasaconfig-cmap#match not req-resp content-type mismatch 10-17Ciscoasaconfig# policy-map type inspect http policymapname 10-1810-19 Instant Messaging Inspection Icmp Error InspectionIcmp Inspection IM Inspection OverviewCiscoasaconfig-cmap#match not protocol im-yahoo im-msn 10-21Conference games Ciscoasaconfig# policy-map type inspect im policymapname 10-22IP Options Inspection 10-23IP Options Inspection Overview 10-24Ciscoasaconfig-pmap-p#router-alert action allow clear IPsec Pass Through Inspection10-25 Example for Defining an IPsec Pass Through Parameter Map IPv6 InspectionIPsec Pass Through Inspection Overview 10-26Information about IPv6 Inspection Default Settings for IPv6 InspectionOptional Configuring an IPv6 Inspection Policy Map 10-27Routing-address count gt number -Sets the maximum 10-28Configuring IPv6 Inspection To enable IPv6 inspection, perform the following steps10-29 NetBIOS Inspection NetBIOS Inspection Overview10-30 10-31 Smtp and Esmtp Inspection Overview Pptp InspectionSmtp and Extended Smtp Inspection 10-3210-33 Ciscoasaconfig# policy-map type inspect esmtp policymapname 10-34Tftp Inspection 10-3510-36 Ctiqbe Inspection Ctiqbe Inspection Overview11-1 Limitations and Restrictions Verifying and Monitoring Ctiqbe Inspection11-2 Inspection 11-3Inspection Overview How H.323 Works11-4 Support in H.245 Messages 11-511-6 Ciscoasaconfig-cmap#match not media-type audio data video Ciscoasaconfig# policy-map type inspect h323 policymapname11-7 Ciscoasaconfig-pmap-p#state-checking h225 ras Ciscoasaconfig# ras-rcf-pinholes enableCiscoasaconfig-pmap-p#rtp-conformance enforce-payloadtype 11-8Monitoring H.225 Sessions Configuring H.323 and H.225 Timeout ValuesVerifying and Monitoring H.323 Inspection 11-911-10 Monitoring H.245 SessionsMonitoring H.323 RAS Sessions Ciscoasa# show h323-rasMgcp Inspection Mgcp Inspection Overview11-11 Ciscoasaconfig# policy-map type inspect mgcp mapname 11-12Configuring Mgcp Timeout Values Following example shows how to define an Mgcp map11-13 Rtsp Inspection Verifying and Monitoring Mgcp Inspection11-14 Restrictions and Limitations Using RealPlayerRtsp Inspection Overview 11-15Ciscoasaconfig-cmap#match not request-method method 11-16Ciscoasaconfig# policy-map type inspect rtsp policymapname 11-17SIP Inspection SIP Inspection Overview11-18 SIP Instant Messaging 11-1911-20 Ciscoasaconfig-cmap#match not content length gt length 11-21Ciscoasaconfig-cmap#match not uri sip tel length gt length Ciscoasaconfig# policy-map type inspect sip policymapname11-22 Ciscoasaconfig-pmap-p#software-version action mask log log Ciscoasaconfig-pmap-p#uri-non-sip action mask log log11-23 Verifying and Monitoring SIP Inspection Configuring SIP Timeout ValuesSkinny Sccp Inspection 11-24Sccp Inspection Overview Supporting Cisco IP Phones11-25 Ciscoasaconfig# policy-map type inspect skinny policymapname 11-26Ciscoasaconfig-pmap-p#sccp-prefix-len max min valuelength 11-27Verifying and Monitoring Sccp Inspection 11-28ILS Inspection ILS Inspection, SQL*Net Inspection, Sun RPC Inspection,12-1 SQL*Net Inspection 12-2Sun RPC Inspection Sun RPC Inspection Overview12-3 Managing Sun RPC Services Verifying and Monitoring Sun RPC Inspection12-4 12-5 Ciscoasa# show sunrpc-server active12-6 Dcerpc Inspection Dcerpc Overview13-1 Ciscoasaconfig# policy-map type inspect dcerpc policymapname 13-2GTP Inspection GTP Inspection Overview13-3 Ciscoasaconfig# policy-map type inspect gtp policymapname 13-4Ciscoasaconfig# object-group network GSN-pool-name Ciscoasaconfig-network#network-object host13-5 Ciscoasaconfig# object-group network SGSN-name Ciscoasaconfig# object-group network sgsn3213-6 Verifying and Monitoring GTP Inspection Ciscoasaconfig# service-policy globalpolicy globalCiscoasa# show service-policy inspect gtp statistics 13-7Ciscoasa# show service-policy gtp statistics grep gsn Radius Accounting Inspection13-8 13-9 Configure the service policyRadius Accounting Inspection Overview Inspect radius-accounting radiusaccountingmapSnmp Inspection Overview RSH InspectionSnmp Inspection 13-10Xdmcp Inspection 13-1113-12 Configuring Unified Communications Page 14-1 14-2 Phone proxy Might not needCertificate for ApplicationASA Base License 2 sessions Model License Requirement1ASA Base License and Security Plus License 2 sessions 14-4ASA 5585-X with Base License 2 sessions SSP-10 ASA 5585-X with Base License 2 sessions SSP-20, -40, or14-5 IME 14-6Cisco Intercompany Media Engine Proxy Cisco Mobility Advantage ProxyCisco Presence Federation Proxy 15-115-2 Licensing Requirements for the Unified Communication Wizard 15-3Supports IPv6 addresses 15-4Configuring the Private Network for the Phone Proxy 15-5Configuring Servers for the Phone Proxy Click the Generate and Export LDC Certificate button15-6 Address Default Port Description 15-715-8 Configuring the Public IP Phone Network 15-915-10 15-11 15-12 15-13 15-14 Dialog box. See Installing a Certificate, Certificate,15-15 15-16 15-17 Basic Deployment Off-path Deployment15-18 15-19 15-20 Supports installing self-signed certificates Wizard supports using self-signed certificates onlyCisco UCMs need to be installed on the security appliance Other, respectively, during TLS handshakes15-22 Installing a Certificate Exporting an Identity Certificate15-23 Click Install Certificate 15-24Saving the Identity Certificate Request 15-2515-26 15-27 15-28 Information About the Cisco Phone Proxy Phone Proxy Functionality16-1 16-2 TCP/RTP TLS/SRTPCisco Unified IP Phones Supported Cisco UCM and IP Phones for the Phone ProxyCisco Unified Communications Manager 16-3Licensing Requirements for the Phone Proxy 16-416-5 This section contains the following topics Prerequisites for the Phone ProxyMedia Termination Instance Prerequisites 16-6Cisco Unified Communications Manager Prerequisites Certificates from the Cisco UCMDNS Lookup Prerequisites ACL RulesNAT Prerequisites NAT and PAT PrerequisitesAddress Port Protocol Description PAT PrerequisitesThere must be two CTL file record entries for the Cisco UCM Prerequisites for IP Phones on Multiple Interfaces7940 IP Phones Support 16-9Cipc security-mode authenticated Cisco IP Communicator Prerequisites16-10 Icmp deny any outside Rate Limiting Configuration ExamplePrerequisites for Rate Limiting Tftp Requests 16-11Ways to Deploy IP Phones to End Users Phone Proxy Guidelines and LimitationsEnd-User Phone Provisioning 16-12General Guidelines and Limitations 16-13Configuring the Phone Proxy Media Termination Address Guidelines and Limitations16-14 Importing Certificates from the Cisco UCM Choose Security Certificate Management16-15 Hostnameconfig# crypto ca authenticate trustpoint Authenticating IP phones with an LSCHostnameconfig# crypto ca trustpoint trustpointname Certificate Name Required forCreating Trustpoints and Generating Certificates 16-17What to Do Next Creating the CTL FilePrerequisites 16-1816-19 Using an Existing CTL File 16-20Creating the TLS Proxy for a Mixed-mode Cisco UCM Cluster 16-2116-22 Cucm/cucos/504/iptpch6.html#wp1040354 Creating the Media Termination InstanceCucm/cucos/504/iptpch6.html#wp1040848 16-23Creating the Phone Proxy Instance See Media Termination Instance Prerequisites16-24 See Creating the Media Termination Instance 16-25Enabling the Phone Proxy with SIP and Skinny Inspection See Cisco IP Communicator Prerequisites16-26 16-27 Debugging Information from the Security Appliance Troubleshooting the Phone ProxyConfiguring Your Router 16-28Use the Command 16-2916-30 Show asp table classify domain Show asp dropDebugging Information from IP Phones Show conn allDebugging Information from IP Phones 16-32IP Phone Registration Failure Tftp Auth Error Displays on IP Phone ConsoleProblem The IP phone displays the following Status message 16-33Ciscoasa# show running-config all ctl-file ctlname Configuration File Parsing ErrorConfiguration File Parsing Error Unable to Get DNS Response 16-3416-35 Non-configuration File Parsing ErrorPhone-proxy tftp Hostname# debug phone-proxy tftp16-36 Hostname# capture out interface outsideIP Phone Unable to Download CTL File IP Phone Requesting Unsigned File ErrorHostnameconfig# show running-config all phone-proxy 16-37IP Phone Registration Failure from Signaling Connections 16-3816-39 To add the required ciphers, enter the following commandDebug sip Debug skinny Hostname# show run all sslSSL Handshake Failure 16-40Media Termination Address Errors Certificate Validation Errors16-41 Audio Problems with IP Phones Saving Sast Keys16-42 16-43 Record-entry cucm trustpoint trustpoint address address Configuration Examples for the Phone Proxy16-44 Record-entry capf trustpoint trustpoint address address16-45 Corporate Network16-46 Fqdn my-ldc-ca.exmaple.com16-47 Phone a 10.10.0.2416-48 16-49 ASA Outside Interface Phone a 10.10.0.2416-50 Enroll terminal crypto ca authenticate capf ctl-file myctl 16-51Example 6 Vlan Transversal 16-5216-53 ASA Inside Interface 10.130.50.24Feature History for the Phone Proxy 16-5417-1 Supported Cisco UCM and IP Phones for the TLS Proxy 17-2CTL Client Overview 17-3CTL Client TLS Proxy Features ASA IP Address or Domain Name 17-4Licensing for the TLS Proxy 17-517-6 Configuring the TLS Proxy for Encrypted Voice Inspection 17-7Ciscoasaconfig# tls-proxy maximum-sessions Ciscoasaconfig# show crypto ca server certificate17-8 17-9 Creating an Internal CA 17-10Creating a CTL Provider Instance 17-11Creating the TLS Proxy Instance 17-12Crypto ca trustpoint command 17-1317-14 Monitoring the TLS Proxy 17-1517-16 AES128-SHA2lists the release history for this feature TLS Proxy TLS proxy feature was introduced17-17 17-18 Cisco Mobility Advantage Proxy Functionality 18-1Hostnameconfig-tlsp#no server authenticate-client Mobility Advantage Proxy Deployment Scenarios18-2 18-3 TLSMobility Advantage Proxy Using NAT/PAT Versus18-4 Trust Relationships for Cisco UMA Deployments 18-5Configuring Cisco Mobility Advantage Longer requires a Unified Communications Proxy license18-6 Enabling the TLS Proxy for MMP Inspection, Task Flow for Configuring Cisco Mobility AdvantageInstalling the Cisco UMA Server Certificate 18-718-8 Enabling the TLS Proxy for MMP Inspection 18-9Monitoring for Cisco Mobility Advantage Exits from the Policy Map configuration modeEnables the service policy on all interfaces 18-10Configuration Examples for Cisco Mobility Advantage 18-1118-12 18-13 Feature History for Cisco Mobility Advantage 18-14Information About Cisco Unified Presence 19-1Ciscoasaconfig# object network obj-10.0.0.2-01 19-219-3 Trust Relationship in the Presence Federation 19-4Xmpp Federation Deployments 19-5Allow traffic from any address to any single node on port Configuration Requirements for Xmpp FederationConfigure the following NAT commands 19-6Licensing for Cisco Unified Presence 19-7Configuring Cisco Unified Presence Proxy for SIP Federation 19-8Install the certificates. See Installing Certificates, 19-9Installing Certificates Trustpoint for the remote entity19-10 19-11 19-12 Trust-pointcommand is the remote entity proxy Enabling the TLS Proxy for SIP Inspection19-13 Monitoring Cisco Unified Presence Configuration Example for Cisco Unified PresenceExample Configuration for SIP Federation Deployments, 19-14Example Configuration for SIP Federation Deployments 19-1519-16 Example ACL Configuration for Xmpp Federation 19-17Example NAT Configuration for Xmpp Federation 19-1819-19 Feature History for Cisco Unified Presence 19-20Features of Cisco Intercompany Media Engine Proxy 20-1How the UC-IME Works with the Pstn and the Internet 20-2Tickets and Passwords 20-3Call Fallback to the Pstn 20-4Architecture Architecture, Basic Deployment, Off Path Deployment,20-5 Basic Deployment 20-6Licensing for Cisco Intercompany Media Engine Off Path Deployment20-7 Does not support IPv6 addresses Supported in single context mode onlySupported in routed firewall mode only 20-820-9 Configuring Cisco Intercompany Media Engine Proxy Task Flow for Configuring Cisco Intercompany Media Engine20-10 Configuring NAT for Cisco Intercompany Media Engine Proxy Create the TLS proxy. See Creating the TLS Proxy,20-11 Cisco UCM that you want to translate 20-12Configuring PAT for the Cisco UCM Server 20-1320-14 Creating ACLs for Cisco Intercompany Media Engine Proxy 20-15Procedure Guidelines20-16 Creating the Cisco Intercompany Media Engine Proxy See Creating the Cisco Intercompany Media Engine20-17 20-18 Show running-config uc-ime command 20-1920-20 Prerequisites for Installing Certificates 20-2120-22 Certificates section on Creating the TLS ProxyCreating Trustpoints and Generating 20-2320-24 Created in , page 20-15of the task Creating ACLs for Cisco Intercompany Media Engine Proxy20-25 Map you created in of this task Optional Configuring TLS within the Local EnterpriseWhere policymapname is the name of the policy 20-26Commands Purpose 20-27Where proxytrustpoint for the server trust-point Where proxytrustpoint for the client trust-point20-28 Optional Configuring Off Path Signaling 20-29Engine Proxy, Intercompany Media Engine Proxy,Creating the Cisco Intercompany Media 20-3020-31 20-32 Show uc-ime signaling-sessions 20-33Show uc-ime signaling-sessions statistics Show uc-ime media-sessions detail20-34 Show uc-ime fallback-notification statistics Show uc-ime mapping-service-sessionsShow uc-ime mapping-service-sessions statistics 20-3520-36 Configuring Connection Settings and QoS Page Information About Connection Settings 22-1TCP Intercept and Limiting Embryonic Connections Dead Connection Detection DCD22-2 TCP State Bypass TCP Sequence RandomizationTCP Normalization 22-3Licensing Requirements for Connection Settings 22-4TCP State Bypass TCP State Bypass Unsupported FeaturesMaximum Concurrent and Embryonic Connection Guidelines TCP NormalizerFor each TCP map, you can customize one or more settings Configuring Connection SettingsTask Flow For Configuring Connection Settings Customizing the TCP Normalizer with a TCP Map22-7 Command 22-8Command 22-922-10 Window-variation allow drop Configuring Connection SettingsUrgent-flag allow clear 22-1122-12 Embryonic-conn-max keywords Random-sequence-number enable disable keywordTCP Sequence Randomization section on page 22-3 section for 22-13Idle hh mm ss keyword sets the idle timeout period after Command in the command referenceEmbryonic hh mm ss keyword sets the timeout period until a To 0, which means the connection never times outConfiguration Examples for Connection Limits and Timeouts Monitoring Connection SettingsConfiguration Examples for Connection Settings 22-15Following is a sample configuration for TCP state bypass Configuration Examples for TCP State BypassConfiguration Examples for TCP Normalization 22-16Feature History for Connection Settings 22-17Connection per-client-embryonic-max,set connection Timeout half-closed,timeout half-closedConn-max,set connection embryonic-conn-max,set Per-client-maxInformation About QoS 23-1Supported QoS Features What is a Token Bucket?23-2 Information About Policing Information About Priority Queuing23-3 How QoS Features Interact Information About Traffic Shaping23-4 Does not support IPv6 Licensing Requirements for QoSDscp and DiffServ Preservation Model GuidelinesConfiguring QoS 23-6Kbps Mbps125 23-7Interface name Configuring the Standard Priority Queue for an InterfacePriority queue, or for the ASA 5505 or ASASM, the Vlan 23-823-9 23-10 Step 23-1123-12 23-13 Configuring the Service Rule 23-14Multiple of 8000. See the Information About Traffic Shaping Priority Queuing Policy section on23-15 Viewing QoS Police Statistics Ciscoasa# show service-policy policeMonitoring QoS 23-16Viewing QoS Standard Priority Statistics Viewing QoS Shaping Statistics23-17 Viewing QoS Standard Priority Queue Statistics 23-18Ciscoasa# show priority-queue statistics test Feature History for QoS 23-1923-20 Troubleshooting Connections and Resources Testing Your Configuration24-1 Enabling Icmp Debugging Messages and Syslog Messages 24-2Pinging ASA Interfaces 24-3ASA 24-4Passing Traffic Through the ASA 24-5Disabling the Test Configuration 24-6Tracing Packets with Packet Tracer Monitoring Per-Process CPU UsageDetermining Packet Routing with Traceroute 24-724-8 Configuring Advanced Network Protection Page Configuring the ASA for Cisco Cloud Web Security 25-1Redirection of Web Traffic to Cloud Web Security User Authentication and Cloud Web SecurityInformation About Cisco Cloud Web Security 25-2Company Authentication Key, Group Authentication Key, Authentication KeysCompany Authentication Key Group Authentication Key 25-3Custom Groups ScanCenter PolicyDirectory Groups 25-4How Groups and the Authentication Key Interoperate Cloud Web Security Actions25-5 Bypassing Scanning with Whitelists Failover from Primary to Backup Proxy ServerLicensing Requirements for Cisco Cloud Web Security IPv4 and IPv6 SupportOptional Fully Qualified Domain Name Prerequisites Optional User Authentication PrerequisitesPrerequisites for Cloud Web Security 25-7Configuring Cisco Cloud Web Security By default, Cisco Cloud Web Security is not enabled25-8 See the Authentication Keys section on 25-9Config-url disk0/onectx.cfg Context two 25-10Optional Configuring Whitelisted Traffic section on 25-11Adding an Extended Access Control List, 25-12Policy section on page 1-17for more information 25-1325-14 Optional Configuring Whitelisted Traffic 25-15Object-group-user-Specifies an object-group user name Optional Configuring the User Identity MonitorConfiguring the Cloud Web Security Policy 25-16Monitoring Cloud Web Security Http//Whoami.scansafe.net25-17 Configuration Examples for Cisco Cloud Web Security Single Mode Example25-18 To attach class-maps to the Cloud Web Security Policy map Multiple Mode ExampleWhitelist Example 25-19Configuring the Active Directory Server Using Ldap Directory Integration Examples25-20 Configuring the Identity Options on the ASA Configuring the Active Directory Agent Using RadiusTesting the AD Agent Creating the ASA as a Client on the AD Agent ServerDownloading the Database from the AD Agent Cloud Web Security with Identity Firewall ExampleMonitoring the Active Directory Groups Showing a List of Active Users25-23 25-24 Aaa-server AD inside host 192.168.116.220 server-port25-25 No call-home reporting anonymous call-homeRelated Documents Feature History for Cisco Cloud Web SecurityRelated Documents 25-26Information About the Botnet Traffic Filter Botnet Traffic Filter Address Types,26-1 Botnet Traffic Filter Databases Botnet Traffic Filter Address TypesBotnet Traffic Filter Actions for Known Addresses Information About the Dynamic DatabaseInformation About the Static Database 26-326-4 How the Botnet Traffic Filter Works 26-5Licensing Requirements for the Botnet Traffic Filter Prerequisites for the Botnet Traffic Filter26-6 Configuring the Botnet Traffic Filter Task Flow for Configuring the Botnet Traffic Filter26-7 Configuring the Dynamic Database 26-8Adding Entries to the Static Database See the Adding Entries to the Static Database section on26-9 TCP DNS traffic is not supported Enabling DNS SnoopingSee the Enabling DNS Snooping section on 26-1026-11 Inspection section on page 10-1 for more information about 26-12Recommended Configuration 26-13Threat-level range moderate very-high Subset of the dynamic-filter enable ACLSee the Blocking Botnet Traffic Manually section on Very-low Low Moderate High Very-highAbout the greylist For dropping purposes. If you do not enable this commandBlocking Botnet Traffic Manually 26-15Searching the Dynamic Database 26-16Botnet Traffic Filter Syslog Messaging Botnet Traffic Filter CommandsMonitoring the Botnet Traffic Filter 26-17Infected-hosts command Dns-snoop command26-18 26-19 Configuration Examples for the Botnet Traffic FilterRecommended Configuration Example Ciscoasa# show dynamic-filter reports top malware-portsOther Configuration Examples 26-20Outside 26-21 Feature History for the Botnet Traffic Filter 26-22Licensing Requirements for Threat Detection Configuring Threat DetectionInformation About Threat Detection 27-1Configuring Basic Threat Detection Statistics Information About Basic Threat Detection Statistics27-2 Security Context Guidelines Trigger Settings Packet Drop Reason Average Rate Burst RateGuidelines and Limitations Types of Traffic MonitoredConfiguring Basic Threat Detection Statistics 27-4Monitoring Basic Threat Detection Statistics Threat Detection Statistics section on27-5 Information About Advanced Threat Detection Statistics Configuring Advanced Threat Detection StatisticsFeature History for Basic Threat Detection Statistics 27-6Configuring Advanced Threat Detection Statistics 27-727-8 Monitoring Advanced Threat Detection Statistics 27-927-10 Using the show threat-detection rate acl-drop command 27-11Field Protocolnumber argument is an integer between 0Statistics 27-12Field Description 27-13Feature History for Advanced Threat Detection Statistics 27-14Configuring Scanning Threat Detection Information About Scanning Threat Detection27-15 Average Rate Burst Rate 27-16Monitoring Shunned Hosts, Attackers, and Targets Configuring Scanning Threat DetectionConfiguration see the Configuring Basic Threat Detection Displays the hosts that are currently shunnedFeature History for Scanning Threat Detection 27-18Configuration Examples for Threat Detection 27-1927-20 Preventing IP Spoofing 28-1Configuring the Fragment Size Blocking Unwanted Connections28-2 Configuring IP Audit, IP Audit Signature List, Configuring IP Audit for Basic IPS SupportConfiguring IP Audit 28-3Signature Message Number Signature Title IP Audit Signature List1lists supported signatures and system message numbers 28-428-5 28-6 28-7 28-8 Information About Web Traffic Filtering 29-1Information About ActiveX Filtering Configuring ActiveX FilteringLicensing Requirements for ActiveX Filtering 29-2Guidelines and Limitations for ActiveX Filtering Configuring ActiveX FilteringConfiguration Examples for ActiveX Filtering 29-3Information About Java Applet Filtering Configuring Java Applet FilteringFeature History for ActiveX Filtering Licensing Requirements for Java Applet FilteringGuidelines and Limitations for Java Applet Filtering Configuring Java Applet FilteringConfiguration Examples for Java Applet Filtering 29-5Information About URL Filtering Feature History for Java Applet FilteringFiltering URLs and FTP Requests with an External Server 29-6Licensing Requirements for URL Filtering Guidelines and Limitations for URL Filtering29-7 Identifying the Filtering Server Choose from the following options29-8 29-9 Replaces block-buffer with the maximum number of Http Configuring Additional URL Filtering SettingsBuffering the Content Server Response Maximum memory allocation of 2 KB to 10 MBOn the Websense server Caching Server AddressesFiltering Http URLs Websense server29-12 Filtering Https URLs 29-13Filtering FTP Requests Might enter cd ./files instead of cd /public/files29-14 29-15 Following is sample output from the show url-servercommandMonitoring Filtering Statistics Ciscoasa# show url-serverFollowing is sample output from the show filter command Following is sample output from the show url-blockcommandFollowing is sample output from the show perfmon command 29-16Feature History for URL Filtering 29-1729-18 Configuring Modules Page Information About the ASA CX Module 30-1How the ASA CX Module Works with the ASA 30-2Traffic-Forwarding Interface in Monitor-Only Mode Monitor-Only ModeService Policy in Monitor-Only Mode 30-3Information About ASA CX Management Initial ConfigurationInitial Configuration, Policy Configuration and Management, 30-4Policy Configuration and Management Information About Authentication ProxyCompatibility with ASA Features Information About VPN and the ASA CX ModuleLicensing Requirements for the ASA CX Module 30-6Does not support clustering Monitor-Only Mode GuidelinesASA Clustering Guidelines 30-7Parameters Default Configuring the ASA CX ModuleSee the Compatibility with ASA Features section on Task Flow for the ASA CX ModuleConnecting the ASA CX Management Interface ASA 5585-X Hardware Module30-9 If you have an inside router If you do not have an inside router30-10 ASA 5512-X through ASA 5555-X Software Module 30-1130-12 Example Partition the SSD30-13 Sets the ASA CX management IP address, mask, and gateway Session 1 do setup host ipASA 5585-X Changing the ASA CX Management IP Address 30-14Ciscoasa# session cxsc console Configuring Basic ASA CX Settings at the ASA CX CLI30-15 Enter an IPv6 address 2001DB80CD301234/64Change the admin password by entering the following command Asacx config passwd30-16 Optional Configuring the Authentication Proxy Port 30-17Creating the ASA CX Service Policy Redirecting Traffic to the ASA CX Module30-18 See the Monitor-Only Mode section on page 30-3 for more 30-19Configuring Traffic-Forwarding Interfaces Monitor-Only Mode See the Feature Matching Within a Service Policy section on30-20 Managing the ASA CX Module 30-21For a software module ASA 5512-X through ASA Resetting the PasswordReloading or Resetting the Module 30-22Shutting Down the Module 30-2330-24 Sw-module module cxsc uninstallNew module type ReloadShowing Module Status Admin123Monitoring the ASA CX Module 30-25Showing Module Statistics 30-26Monitoring Module Connections 30-2730-28 Dp-cp‘X’ flag Show asp event dp-cp cxsc-msg30-29 Ciscoasa# show asp dropCiscoasa# show asp event dp-cp cxsc-msg Debugging the Module Troubleshooting the ASA CX ModuleCapturing Module Traffic 30-30Problems with the Authentication Proxy 30-31Check the authentication proxy rules Configuration Examples for the ASA CX ModuleCheck the authentication proxy port 30-32Feature History for the ASA CX Module 30-33Cxsc monitor-only We modified or introduced the following commands cxscFail-close fail-openmonitor-only,traffic-forward 30-34Capture interface asadataplane command Asadataplane30-35 30-36 Information About the ASA IPS Module 31-1How the ASA IPS Module Works with the ASA 31-2Using Virtual Sensors ASA 5510 and Higher Operating Modes31-3 Information About Management Access 31-4Licensing Requirements for the ASA IPS module 31-51lists the default settings for the ASA IPS module Management Vlan ASA 5505 only31-6 Configuring the ASA IPS module Task Flow for the ASA IPS Module31-7 Connecting the ASA IPS Management Interface 31-831-9 ASA 31-10ASA 5512-X through ASA 5555-X Booting the Software Module Sessioning to the Module from the ASA31-11 Ciscoasa# sw-module module ips recover boot Configuring Basic IPS Module Network SettingsFor example, using the filename in the example in , enter 31-12Connecting the ASA IPS Management Interface section on ASA 5510 and Higher Configuring Basic Network SettingsASA 5505 Configuring Basic Network Settings Sessioning to the Module from the ASA Section on31-14 Configuring the Security Policy on the ASA IPS Module Details command31-15 31-16 31-17 Diverting Traffic to the ASA IPS module 31-1831-19 31-20 IPS module Installing and Booting an Image on the ModuleManaging the ASA IPS module 31-2131-22 For a software module for example, the ASA 5545-X Uninstalling a Software Module ImageSw-module module ips uninstall 31-23Sw-module module ips password-reset For a software module for example, the ASA31-24 Monitoring the ASA IPS module Ips for a software module31-25 Configuration Examples for the ASA IPS module 31-26Ciscoasa# show module ips Module allow-ip Feature History for the ASA IPS moduleAllow-ssc-mgmt,hw-module module ip, and hw-module 31-27Inventory, show environment Session, show module, sw-module31-28 Information About the CSC SSM 32-1ASA 32-2Determining What Traffic to Scan 32-3Common Network Configuration for CSC SSM Scanning 32-4Licensing Requirements for the CSC SSM Prerequisites for the CSC SSM32-5 Supported in single and multiple context modes 1lists the default settings for the CSC SSMParameter Default 32-6Configuring the CSC SSM Before Configuring the CSC SSM32-7 Connecting to the CSC SSM See the Connecting to the CSC SSM section on32-8 32-9 Determining What Traffic to Scan section on Diverting Traffic to the CSC SSMSee the Diverting Traffic to the CSC SSM section on 32-1032-11 Guidelines and Limitations section on 32-12Displays the status Monitoring the CSC SSMSee the Monitoring the CSC SSM section on Displays additional status informationTroubleshooting the CSC Module Installing an Image on the Module32-14 Resetting the Password Recover command32-15 Reloading or Resetting the Module 32-16Shutting Down the Module Configuration Examples for the CSC SSMCiscoasaconfig-cmap#policy-map cscinpolicy Shuts down the moduleInstructions on use of the CSC SSM GUI Additional ReferencesRelated Topic Document Title Assistance with the Startup WizardDetails recover Feature History for the CSC SSMFeature Name Platform Releases Feature Information 32-1932-20 IN-1 IN-2 IN-3 IN-4 IN-5 RPC not supported with See also policy mapLDP 6-7router-id 6-7TDP Multi-session PAT IN-6IN-7 IN-8 IN-9 IN-10
Related manuals
Manual 754 pages 55.66 Kb Manual 52 pages 35.74 Kb

ASA 5555-X, and the ASA Services Module, ASA 5545-X, ASA 5585-X, ASA 5580 specifications

Cisco Systems has long been a leader in the field of network security, and its Adaptive Security Appliance (ASA) series is a testament to this expertise. Within the ASA lineup, models such as the ASA 5505, ASA 5580, ASA 5585-X, ASA 5545-X, and ASA 5555-X stand out for their unique features, capabilities, and technological advancements.

The Cisco ASA 5505 is designed for small businesses or branch offices. It provides essential security features such as firewall protection, flexible VPN capabilities, and intrusion prevention. The ASA 5505 supports a user-friendly interface, allowing for straightforward management. Its built-in threat detection and prevention tools provide a layered defense, and with scalability in mind, it can accommodate various expansion options as organizational needs grow.

Moving up the line, the ASA 5580 delivers greater throughput and advanced security features. This model is suited for medium to large enterprises that require robust protection against increasingly sophisticated threats. Its multi-core architecture allows it to manage high volumes of traffic seamlessly while maintaining excellent performance levels. The ASA 5580 also supports application-layer security and customizable access policies, making it highly adaptable to diverse security environments.

The ASA 5585-X further enhances Cisco's security offerings with advanced malware protection and extensive security intelligence capabilities. It incorporates next-generation firewall features, including context-aware security, and supports advanced threat detection technologies. This model is ideal for large enterprises or data centers that prioritize security while ensuring uninterrupted network performance and availability.

For enterprises requiring a balance of performance and security, the ASA 5545-X presents a compelling option. This model features scalable performance metrics, high availability, and integrated advanced threat protection. Coupled with advanced endpoint protection and detailed monitoring capabilities, the ASA 5545-X enables organizations to manage their security posture effectively.

Lastly, the ASA 5555-X blends cutting-edge technologies with strong security infrastructures. It boasts high throughput and the ability to execute deep packet inspections. Its sophisticated architecture supports threat intelligence feeds that provide real-time security updates, making it a powerful tool against modern threats.

Each of these Cisco ASA models brings specific advantages to varied environments. Their integrative capabilities enable businesses to enhance their security postures while benefiting from seamless scalability and management. As cybersecurity threats evolve, these advanced appliances play a vital role in protecting valuable digital assets.