Contents
Software Version
Cisco ASA Series Firewall CLI Configuration Guide
Cisco ASA Series Firewall CLI Configuration Guide
Iii
N T E N T S
Guidelines and Limitations Default Inspection Policy Maps
NAT for VPN
Guidelines and Limitations
Vii
Rules
Viii
Getting Started with Application Layer Protocol Inspection
IPv6 Inspection
Verifying and Monitoring Sun RPC Inspection
Configuring Unified Communications
Xii
Installing a Certificate
Xiii
Enabling the Phone Proxy with SIP and Skinny Inspection
Xiv
CTL Client Overview
Architecture
Xvi
Configuring Connection Settings and QoS
Xvii
Configuring the Standard Priority Queue for an Interface
Xviii
Bypassing Scanning with Whitelists
Xix
Information About the Static Database
Configuring Java Applet Filtering
Xxi
Filtering URLs and FTP Requests with an External Server
30-15
Xxii
Xxiii
ASA 5505 Configuring Basic Network Settings
Xxiv
Related Documentation
Document Objectives
Conventions
Convention Indication
Xxvi
Obtaining Documentation and Submitting a Service Request
R T
Page
Information About Service Policies
Feature Directionality
Supported Features
Feature Traffic? See
For Through
Global Direction
Feature Matching Within a Service Policy
Feature
ASA IPS ASA CX
Order in Which Multiple Feature Actions are Applied
Incompatibility of Certain Feature Actions
Guidelines and Limitations
Licensing Requirements for Service Policies
Feature Matching for Multiple Service Policies
Policy Map Guidelines
Service Policy Guidelines
Class Map Guidelines
Default Configuration, Default Class Maps,
Default Settings
Default Configuration
Default Class Maps
Task Flows for Configuring Service Policies
Task Flow for Using the Modular Policy Framework
This section includes the following topics
See the Identifying Traffic Layer 3/4 Class Maps section on
Layer 3/4 Policy Map
Identifying Traffic Layer 3/4 Class Maps
Command Purpose
Creating a Layer 3/4 Class Map for Through Traffic
Example
Match default-inspection-traffic command to narrow
See the Default Settings and NAT Limitations section on
Ports are included in the match default-inspection-traffic
Creating a Layer 3/4 Class Map for Management Traffic
Except for the match any , match access-list , or match
Match flow ip destination-address command to match flows
Defining Actions Layer 3/4 Policy Map
Creates a management class map, where classmapname is a
See the Supported Features section on
Task Flow for Configuring Hierarchical Policy Maps for
Identifying Traffic Layer 3/4 Class Maps section on
QoS Traffic Shaping section on page 1-11 for more
Applying Actions to an Interface Service Policy
Displays the service policy statistics
Configuration Examples for Modular Policy Framework
Monitoring Modular Policy Framework
IPv6, see the IPv6 Guidelines section on
Ciscoasaconfig# class-map httptraffic
See the following commands for this example
Applying Inspection and QoS Policing to Http Traffic
Applying Inspection to Http Traffic Globally
Ciscoasaconfig# service-policy httptrafficpolicy global
Ciscoasaconfig# policy-map httptrafficpolicy
Applying Inspection to Http Traffic with NAT
Ciscoasaconfig# service-policy httpclient interface inside
Obj-192.168.1.1
Host
Feature Name Releases Feature Information
Feature History for Service Policies
Introduced class-map type management, and inspect
Radius-accounting
Information About Inspection Policy Maps
Guidelines and Limitations
Default Inspection Policy Maps
Identifying Traffic in an Inspection Class Map section on
Defining Actions in an Inspection Policy Map
Identifying Traffic in an Inspection Class Map
Getting Started with Application Layer Protocol Inspection
1lists the release history for this feature
Where to Go Next
Feature History for Inspection Policy Maps
Page
Configuring Network Address Translation
Page
Information About NAT
Why Use NAT?
NAT Terminology
NAT Types Overview
NAT Types
Static NAT
Information About Static NAT
Information About Static NAT with Port Address Translation
Information About Static NAT with Port Translation
Static NAT with Identity Port Translation
Information About One-to-Many Static NAT
4shows a typical few-to-many static NAT scenario
Information About Other Mapping Scenarios Not Recommended
Information About Dynamic NAT
Dynamic NAT
Information About Dynamic PAT
Dynamic PAT
Dynamic NAT Disadvantages and Advantages
Dynamic PAT Disadvantages and Advantages
Per-Session PAT vs. Multi-Session PAT
NAT in Routed Mode, NAT in Transparent Mode,
NAT in Routed and Transparent Mode
Identity NAT
NAT in Transparent Mode
NAT in Routed Mode
10 NAT Example Transparent Mode
Main Differences Between Network Object NAT and Twice NAT
NAT and IPv6
How NAT is Implemented
Information About Twice NAT
Information About Network Object NAT
11 Twice NAT with Different Destination Addresses
12 Twice NAT with Different Destination Ports
13 Twice Static NAT with Destination Address Translation
Rule Type Order of Rules within the Section
NAT Rule Order
Routing NAT Packets
NAT Interfaces
Mapped Addresses and Routing
Too late
Transparent Mode Routing Requirements for Remote Networks
NAT for VPN
203.0.113.16075
NAT and Remote Access VPN
Same-security-traffic permit intra-interface
NAT and Site-to-Site VPN
19 Interface PAT and Identity NAT for Site-to-Site VPN
See the following sample NAT configuration for ASA1 Boulder
Subnet 10.2.2.0
NAT and VPN Management Access
Object network boulderinside Subnet 10.1.1.0
Object network vpnlocal Subnet 10.3.3.0
Subnet 10.1.1.0 Nat inside,outside dynamic interface
Management-access inside
Add the identity NAT configuration
Troubleshooting NAT and VPN
DNS and NAT
Enter show nat detail and show conn all
22 DNS Reply Modification, DNS Server on Outside
192.168.1.10
24 DNS Reply Modification, DNS Server on Host Network
2001DB8D1A5C8E1
26 PTR Modification, DNS Server on Host Network
Page
Information About Network Object NAT
Configuring Network Object NAT
Supports IPv6. See also the NAT and IPv6 section on
Licensing Requirements for Network Object NAT
Prerequisites for Network Object NAT
Additional Guidelines
Adding Network Objects for Mapped Addresses
Configuring Network Object NAT
Object network objname
Configuring Dynamic NAT
Object
DNS and NAT section on page 3-28 for more information
Additional Guidelines section on
Nat inside,outside dynamic nat-pat-grp interface
Configuring Dynamic PAT Hide
Optional Create a network object or group for
Configures a network object for which you want to configure
See the Adding Network Objects for Mapped Addresses section
Mapped addresses
Interface-Routed mode only The IP address
Configures dynamic PAT for the object IP addresses. You can
Used. For this option, you must configure a specific
When you want to use the interface IP address you
Ciscoasaconfig-network-object#nat inside,outside dynamic
Ciscoasaconfig# object network IPv6INSIDE
Configuring Static NAT or Static NAT-with-Port-Translation
Ciscoasaconfig# object network IPv4POOL
Addresses IPv4 or IPv6 that you want to translate
See the Mapped Addresses and Routing section on
Static NAT section on
See the DNS and NAT section on page 3-28. This option is
Addresses section on
Configuring Identity NAT
Translate. See the Adding Network Objects for Mapped
See the Additional Guidelines section on
NAT command. See the Determining the Egress Interface
Mapped Addresses and Routing section on
Section on page 3-22 for more information
By default, the following rules are installed
Configuring Per-Session PAT Rules
How many times they were allocated
Monitoring Network Object NAT
Shows NAT statistics, including hits for each NAT rule
Configuration Examples for Network Object NAT
Configure static NAT for the object
Providing Access to an Inside Web Server Static NAT
Ciscoasaconfig# object network myWebServ
Create a network object for the internal web server
Ciscoasaconfig-network-object#nat outside,inside static
Configure static NAT for the web server
Create a network object for the inside network
Create a network object for the outside web server
Ciscoasaconfig# object network myPublicIPs
Configure static NAT for the load balancer
Ciscoasaconfig# object network myLBHost
Create a network object for the load balancer
Ciscoasaconfig# object network Httpserver
Ciscoasaconfig# object network Ftpserver
Create a network object for the FTP server address
Create a network object for the Http server address
Create a network object for the Smtp server address
Ciscoasaconfig# object network Smtpserver
DNS Reply Modification
DNS Reply Modification Using Outside NAT
2001DB8D1A5C8E1
Ciscoasaconfig# object network Dnsserver
Platform Feature Name Releases Feature Information
Feature History for Network Object NAT
Pat-pool mappedobject extended
Pat-pool mappedobject flat include-reserve
Nat-assigned-to-public-ip interface tunnel-group
General-attributes configuration mode
Configuration mode, show nat, show nat pool, show xlate
Show nat pool
Page
Information About Twice NAT
Configuring Twice NAT
Supports IPv6
Licensing Requirements for Twice NAT
Prerequisites for Twice NAT
Configuring Twice NAT Guidelines and Limitations
Adding Network Objects for Real and Mapped Addresses
Configuring Twice NAT
Configuring Twice NAT
Configure service objects for
Optional Adding Service Objects for Real and Mapped Ports
Command Purpose
Ports section on
See the Optional Adding Service Objects for Real and Mapped
See the Adding Network Objects for Real and Mapped
Section and Line-Optional By default, the NAT rule is
Configure dynamic NAT. See the following guidelines
Anywhere in the applicable section using the line argument
You can optionally configure the following fallback
Command Purpose
Subnet 2001DB8AAAA/96
For a PAT pool
Subnet 203.0.113.0
Configuring Twice NAT
Detailed Steps
Mapped-Configure one of the following
Configures dynamic PAT hide. See the following guidelines
Interface-Routed mode only Specify the interface
Interface keyword enables interface PAT fallback. After
Command Purpose
Command Purpose
Host 2001DB823
Service tcp destination eq
Subnet 192.168.1.0
Source or Destination mapped ports
Source or Destination real ports
See the Static Interface NAT with Port Translation
Rule Order section on page 3-18for more information about
Examples
MAPPEDIPv6NW
Object
Subnet 2001DB8BBBB/96
OUTSIDEIPv6NW
Source real addresses you will typically use
Static Interface NAT with Port Translation section on
Monitoring Twice NAT
To monitor twice NAT, enter one of the following commands
Shows NAT statistics, including hits for each NAT rule
How many times they were allocated
Ciscoasaconfig# object network PATaddress1
Configuration Examples for Twice NAT
Add a network object for the inside network
Add a network object for the DMZ network
Configure the second twice NAT rule
Configure the first twice NAT rule
Add a service object for Telnet
Add a network object for the PAT address when using Telnet
Ciscoasaconfig# object network myInsideNetwork
Ciscoasaconfig# object network TelnetWebServer
Add a service object for Http
We modified the following command nat source static
Feature History for Twice NAT
Show nat, show xlate, show nat pool
Existing functionality. The unidirectional keyword is
Pat-pool mappedobject flat include-reserve
Nat-assigned-to-public-ip interface tunnel-group
Show nat pool
Configuring Access Control
Page
Information About Access Rules
Configuring Access Rules
Information About EtherType Rules,
General Information About Rules
Implicit Permits
Inbound and Outbound Rules
Implicit Deny
Outbound ACL
Transactional-Commit Model
Additional Guidelines and Limitations
Information About Extended Access Rules
Access Rules for Returning Traffic
Information About EtherType Rules
Management Access Rules
Supported EtherTypes and Other Traffic
Traffic Type Protocol or Port
Prerequisites
Licensing Requirements for Access Rules
Allowing Mpls
Supported in routed and transparent firewall modes
Configuring Access Rules
Default Settings
To apply an access rule, perform the following steps
Per-User ACL Guidelines
See Per-User ACL Guidelines,
Per-user-override option
To monitor network access, enter the following command
Monitoring Access Rules
Show running-config access-group
Hostname config# object-group service myaclog
Permit deny is-is
Feature History for Access Rules
Extended
Ipv6 access-list webtype, ipv6-vpn-filter
Extended, access-list webtype
Access-list extended, service-object, service
Transactional-commit,show running-config asp
Licensing Requirements for AAA Rules
AAA Performance
Information About Authentication
Configuring Authentication for Network Access
ASA Authentication Prompts
One-Time Authentication
AAA Prompts and Identity Firewall
Name name1@name2 Password password1@password2
Static PAT and Http
AAA Rules as a Backup Authentication Method
Nat inside,outside static 10.48.66.155 service tcp 111
User-group any and user-group none can be
Configuring Network Access Authentication
Authentication include command which
Lockout command
Ldap-over-ssl enable
Ldap-login-password
Aaa authentication match Auth inside Ldap
Protocol ldap
Enabling Secure Authentication of Web Clients
Authenticating Https Connections with a Virtual Server
Authenticating Directly with the ASA
Authenticating Telnet Connections with a Virtual Server
Authentication include command
Configuring TACACS+ Authorization
Configuring Authorization for Network Access
Authentication, while deny entries exclude matching
Authenticate. For details, see the general operations
Traffic from authentication. Be sure to include
FTP in the ACL, because the user must authenticate
Authorization include command which
Authentication match command
About the Downloadable ACL Feature and Cisco Secure ACS
Configuring Radius Authorization
ACSCiscoSecure-Defined-ACL=acl-set-name
Access-list aclname extended
Configuring Cisco Secure ACS for Downloadable ACLs
Ipinacl#nnn=
Downloaded ACL on the ASA consists of the following lines
With the following text
Filter-id=aclname
Configuring Accounting for Network Access
Authentication section on page 7-7. If you want
Information, see the Configuring Network Access
Access-list command
Accounting include command which
Configuring AAA Rules for Network Access
Mac-exempt match command
Feature History for AAA Rules
Page
Configuring Application Inspection
Page
How Inspection Engines Work
Getting Started with Application Layer Protocol Inspection
How Inspection Engines Work
When to Use Application Protocol Inspection
Supports IPv6 for the following inspections
Failover Guidelines
323 H.225
Default Settings and NAT Limitations
Server over IP
NetBIOS Name
IP Options
Sun RPC over
Smtp
SQL*Net
Configuring Application Layer Protocol Inspection
View the entire class map using the following command
Ciscoasaconfig# policy-mapname ciscoasaconfig-pmap#
Keywords
Netbios mapname
Icmp Icmp error Ils
Ip-options mapname
Ipsec-pass-thru mapname
Tftp Waas Xdmcp
Scansafe mapname
Sqlnet Sunrpc
10-1
DNS Inspection
Information About DNS Inspection
Default Settings for DNS Inspection
General Information About DNS
DNS Inspection Actions
Class-map type inspect dns match-all
Do one of the following
10-3
10-4
Defining Actions in an Inspection Policy Map section on
Section the authority keyword specifies the Authority RR
Keyword specifies the question portion of a DNS message.
Section the additional keyword specifies the Additional RR
Section
Match not domain-name regex regexid
Matches a DNS message domain name list. The regexname
10-6
Message-length maximum length client length auto
Id-mismatch count number duration seconds action
Tsig enforced action drop log-Requires a Tsig
10-7
10-8
Configuring DNS Inspection
Layer 3/4 Class Maps section on page 1-12 for more
10-9
Monitoring DNS Inspection
Dynamic-filter-snoop keyword, see the Enabling DNS
FTP Inspection
Ciscoasa# show service-policy
FTP Inspection Overview
10-10
10-11
Using the strict Option
10-12
10-13
10-14
Ciscoasaconfig# policy-map type inspect ftp mymap
Http Inspection
Ciscoasaconfig# service-policy ftp-policy interface inside
Verifying and Monitoring FTP Inspection
Http Inspection Overview
10-16
10-17
Ciscoasaconfig-cmap#match not req-resp content-type mismatch
10-18
Ciscoasaconfig# policy-map type inspect http policymapname
10-19
Icmp Inspection
Icmp Error Inspection
Instant Messaging Inspection
IM Inspection Overview
Conference games
Ciscoasaconfig-cmap#match not protocol im-yahoo im-msn
10-21
10-22
Ciscoasaconfig# policy-map type inspect im policymapname
10-23
IP Options Inspection
10-24
IP Options Inspection Overview
10-25
Ciscoasaconfig-pmap-p#router-alert action allow clear
IPsec Pass Through Inspection
IPsec Pass Through Inspection Overview
IPv6 Inspection
Example for Defining an IPsec Pass Through Parameter Map
10-26
Optional Configuring an IPv6 Inspection Policy Map
Default Settings for IPv6 Inspection
Information about IPv6 Inspection
10-27
10-28
Routing-address count gt number -Sets the maximum
10-29
Configuring IPv6 Inspection
To enable IPv6 inspection, perform the following steps
10-30
NetBIOS Inspection
NetBIOS Inspection Overview
10-31
Smtp and Extended Smtp Inspection
Pptp Inspection
Smtp and Esmtp Inspection Overview
10-32
10-33
10-34
Ciscoasaconfig# policy-map type inspect esmtp policymapname
10-35
Tftp Inspection
10-36
11-1
Ctiqbe Inspection
Ctiqbe Inspection Overview
11-2
Limitations and Restrictions
Verifying and Monitoring Ctiqbe Inspection
11-3
Inspection
11-4
Inspection Overview
How H.323 Works
11-5
Support in H.245 Messages
11-6
11-7
Ciscoasaconfig-cmap#match not media-type audio data video
Ciscoasaconfig# policy-map type inspect h323 policymapname
Ciscoasaconfig-pmap-p#rtp-conformance enforce-payloadtype
Ciscoasaconfig# ras-rcf-pinholes enable
Ciscoasaconfig-pmap-p#state-checking h225 ras
11-8
Verifying and Monitoring H.323 Inspection
Configuring H.323 and H.225 Timeout Values
Monitoring H.225 Sessions
11-9
Monitoring H.323 RAS Sessions
Monitoring H.245 Sessions
11-10
Ciscoasa# show h323-ras
11-11
Mgcp Inspection
Mgcp Inspection Overview
11-12
Ciscoasaconfig# policy-map type inspect mgcp mapname
11-13
Configuring Mgcp Timeout Values
Following example shows how to define an Mgcp map
11-14
Rtsp Inspection
Verifying and Monitoring Mgcp Inspection
Rtsp Inspection Overview
Using RealPlayer
Restrictions and Limitations
11-15
11-16
Ciscoasaconfig-cmap#match not request-method method
11-17
Ciscoasaconfig# policy-map type inspect rtsp policymapname
11-18
SIP Inspection
SIP Inspection Overview
11-19
SIP Instant Messaging
11-20
11-21
Ciscoasaconfig-cmap#match not content length gt length
11-22
Ciscoasaconfig-cmap#match not uri sip tel length gt length
Ciscoasaconfig# policy-map type inspect sip policymapname
11-23
Ciscoasaconfig-pmap-p#software-version action mask log log
Ciscoasaconfig-pmap-p#uri-non-sip action mask log log
Skinny Sccp Inspection
Configuring SIP Timeout Values
Verifying and Monitoring SIP Inspection
11-24
11-25
Sccp Inspection Overview
Supporting Cisco IP Phones
11-26
Ciscoasaconfig# policy-map type inspect skinny policymapname
11-27
Ciscoasaconfig-pmap-p#sccp-prefix-len max min valuelength
11-28
Verifying and Monitoring Sccp Inspection
12-1
ILS Inspection
ILS Inspection, SQL*Net Inspection, Sun RPC Inspection,
12-2
SQL*Net Inspection
12-3
Sun RPC Inspection
Sun RPC Inspection Overview
12-4
Managing Sun RPC Services
Verifying and Monitoring Sun RPC Inspection
Ciscoasa# show sunrpc-server active
12-5
12-6
13-1
Dcerpc Inspection
Dcerpc Overview
13-2
Ciscoasaconfig# policy-map type inspect dcerpc policymapname
13-3
GTP Inspection
GTP Inspection Overview
13-4
Ciscoasaconfig# policy-map type inspect gtp policymapname
13-5
Ciscoasaconfig# object-group network GSN-pool-name
Ciscoasaconfig-network#network-object host
13-6
Ciscoasaconfig# object-group network SGSN-name
Ciscoasaconfig# object-group network sgsn32
Ciscoasa# show service-policy inspect gtp statistics
Ciscoasaconfig# service-policy globalpolicy global
Verifying and Monitoring GTP Inspection
13-7
13-8
Ciscoasa# show service-policy gtp statistics grep gsn
Radius Accounting Inspection
Radius Accounting Inspection Overview
Configure the service policy
13-9
Inspect radius-accounting radiusaccountingmap
Snmp Inspection
RSH Inspection
Snmp Inspection Overview
13-10
13-11
Xdmcp Inspection
13-12
Configuring Unified Communications
Page
14-1
14-2
Certificate for
Might not need
Phone proxy
Application
ASA Base License and Security Plus License 2 sessions
Model License Requirement1
ASA Base License 2 sessions
14-4
14-5
ASA 5585-X with Base License 2 sessions SSP-10
ASA 5585-X with Base License 2 sessions SSP-20, -40, or
14-6
IME
Cisco Presence Federation Proxy
Cisco Mobility Advantage Proxy
Cisco Intercompany Media Engine Proxy
15-1
15-2
15-3
Licensing Requirements for the Unified Communication Wizard
15-4
Supports IPv6 addresses
15-5
Configuring the Private Network for the Phone Proxy
15-6
Configuring Servers for the Phone Proxy
Click the Generate and Export LDC Certificate button
15-7
Address Default Port Description
15-8
15-9
Configuring the Public IP Phone Network
15-10
15-11
15-12
15-13
15-14
15-15
Dialog box. See Installing a Certificate,
Certificate,
15-16
15-17
15-18
Basic Deployment
Off-path Deployment
15-19
15-20
Cisco UCMs need to be installed on the security appliance
Wizard supports using self-signed certificates only
Supports installing self-signed certificates
Other, respectively, during TLS handshakes
15-22
15-23
Installing a Certificate
Exporting an Identity Certificate
15-24
Click Install Certificate
15-25
Saving the Identity Certificate Request
15-26
15-27
15-28
16-1
Information About the Cisco Phone Proxy
Phone Proxy Functionality
TCP/RTP TLS/SRTP
16-2
Cisco Unified Communications Manager
Supported Cisco UCM and IP Phones for the Phone Proxy
Cisco Unified IP Phones
16-3
16-4
Licensing Requirements for the Phone Proxy
16-5
Media Termination Instance Prerequisites
Prerequisites for the Phone Proxy
This section contains the following topics
16-6
DNS Lookup Prerequisites
Certificates from the Cisco UCM
Cisco Unified Communications Manager Prerequisites
ACL Rules
Address Port Protocol Description
NAT and PAT Prerequisites
NAT Prerequisites
PAT Prerequisites
7940 IP Phones Support
Prerequisites for IP Phones on Multiple Interfaces
There must be two CTL file record entries for the Cisco UCM
16-9
16-10
Cipc security-mode authenticated
Cisco IP Communicator Prerequisites
Prerequisites for Rate Limiting Tftp Requests
Rate Limiting Configuration Example
Icmp deny any outside
16-11
End-User Phone Provisioning
Phone Proxy Guidelines and Limitations
Ways to Deploy IP Phones to End Users
16-12
16-13
General Guidelines and Limitations
16-14
Configuring the Phone Proxy
Media Termination Address Guidelines and Limitations
16-15
Importing Certificates from the Cisco UCM
Choose Security Certificate Management
Hostnameconfig# crypto ca trustpoint trustpointname
Authenticating IP phones with an LSC
Hostnameconfig# crypto ca authenticate trustpoint
Certificate Name Required for
16-17
Creating Trustpoints and Generating Certificates
Prerequisites
Creating the CTL File
What to Do Next
16-18
16-19
16-20
Using an Existing CTL File
16-21
Creating the TLS Proxy for a Mixed-mode Cisco UCM Cluster
16-22
Cucm/cucos/504/iptpch6.html#wp1040848
Creating the Media Termination Instance
Cucm/cucos/504/iptpch6.html#wp1040354
16-23
16-24
Creating the Phone Proxy Instance
See Media Termination Instance Prerequisites
16-25
See Creating the Media Termination Instance
16-26
Enabling the Phone Proxy with SIP and Skinny Inspection
See Cisco IP Communicator Prerequisites
16-27
Configuring Your Router
Troubleshooting the Phone Proxy
Debugging Information from the Security Appliance
16-28
16-29
Use the Command
16-30
Debugging Information from IP Phones
Show asp drop
Show asp table classify domain
Show conn all
16-32
Debugging Information from IP Phones
Problem The IP phone displays the following Status message
Tftp Auth Error Displays on IP Phone Console
IP Phone Registration Failure
16-33
Configuration File Parsing Error Unable to Get DNS Response
Configuration File Parsing Error
Ciscoasa# show running-config all ctl-file ctlname
16-34
Phone-proxy tftp
Non-configuration File Parsing Error
16-35
Hostname# debug phone-proxy tftp
Hostname# capture out interface outside
16-36
Hostnameconfig# show running-config all phone-proxy
IP Phone Requesting Unsigned File Error
IP Phone Unable to Download CTL File
16-37
16-38
IP Phone Registration Failure from Signaling Connections
Debug sip Debug skinny
To add the required ciphers, enter the following command
16-39
Hostname# show run all ssl
16-40
SSL Handshake Failure
16-41
Media Termination Address Errors
Certificate Validation Errors
16-42
Audio Problems with IP Phones
Saving Sast Keys
16-43
16-44
Configuration Examples for the Phone Proxy
Record-entry cucm trustpoint trustpoint address address
Record-entry capf trustpoint trustpoint address address
Corporate Network
16-45
Fqdn my-ldc-ca.exmaple.com
16-46
Phone a 10.10.0.24
16-47
16-48
ASA Outside Interface Phone a 10.10.0.24
16-49
16-50
16-51
Enroll terminal crypto ca authenticate capf ctl-file myctl
16-52
Example 6 Vlan Transversal
ASA Inside Interface 10.130.50.24
16-53
16-54
Feature History for the Phone Proxy
17-1
17-2
Supported Cisco UCM and IP Phones for the TLS Proxy
17-3
CTL Client Overview
17-4
CTL Client TLS Proxy Features ASA IP Address or Domain Name
17-5
Licensing for the TLS Proxy
17-6
17-7
Configuring the TLS Proxy for Encrypted Voice Inspection
17-8
Ciscoasaconfig# tls-proxy maximum-sessions
Ciscoasaconfig# show crypto ca server certificate
17-9
17-10
Creating an Internal CA
17-11
Creating a CTL Provider Instance
17-12
Creating the TLS Proxy Instance
17-13
Crypto ca trustpoint command
17-14
17-15
Monitoring the TLS Proxy
AES128-SHA
17-16
17-17
2lists the release history for this feature
TLS Proxy TLS proxy feature was introduced
17-18
18-1
Cisco Mobility Advantage Proxy Functionality
18-2
Hostnameconfig-tlsp#no server authenticate-client
Mobility Advantage Proxy Deployment Scenarios
TLS
18-3
18-4
Mobility Advantage Proxy Using NAT/PAT
Versus
18-5
Trust Relationships for Cisco UMA Deployments
18-6
Configuring Cisco Mobility Advantage
Longer requires a Unified Communications Proxy license
Installing the Cisco UMA Server Certificate
Task Flow for Configuring Cisco Mobility Advantage
Enabling the TLS Proxy for MMP Inspection,
18-7
18-8
18-9
Enabling the TLS Proxy for MMP Inspection
Enables the service policy on all interfaces
Exits from the Policy Map configuration mode
Monitoring for Cisco Mobility Advantage
18-10
18-11
Configuration Examples for Cisco Mobility Advantage
18-12
18-13
18-14
Feature History for Cisco Mobility Advantage
19-1
Information About Cisco Unified Presence
19-2
Ciscoasaconfig# object network obj-10.0.0.2-01
19-3
19-4
Trust Relationship in the Presence Federation
19-5
Xmpp Federation Deployments
Configure the following NAT commands
Configuration Requirements for Xmpp Federation
Allow traffic from any address to any single node on port
19-6
19-7
Licensing for Cisco Unified Presence
19-8
Configuring Cisco Unified Presence Proxy for SIP Federation
19-9
Install the certificates. See Installing Certificates,
19-10
Installing Certificates
Trustpoint for the remote entity
19-11
19-12
19-13
Trust-pointcommand is the remote entity proxy
Enabling the TLS Proxy for SIP Inspection
Example Configuration for SIP Federation Deployments,
Configuration Example for Cisco Unified Presence
Monitoring Cisco Unified Presence
19-14
19-15
Example Configuration for SIP Federation Deployments
19-16
19-17
Example ACL Configuration for Xmpp Federation
19-18
Example NAT Configuration for Xmpp Federation
19-19
19-20
Feature History for Cisco Unified Presence
20-1
Features of Cisco Intercompany Media Engine Proxy
20-2
How the UC-IME Works with the Pstn and the Internet
20-3
Tickets and Passwords
20-4
Call Fallback to the Pstn
20-5
Architecture
Architecture, Basic Deployment, Off Path Deployment,
20-6
Basic Deployment
20-7
Licensing for Cisco Intercompany Media Engine
Off Path Deployment
Supported in routed firewall mode only
Supported in single context mode only
Does not support IPv6 addresses
20-8
20-9
20-10
Configuring Cisco Intercompany Media Engine Proxy
Task Flow for Configuring Cisco Intercompany Media Engine
20-11
Configuring NAT for Cisco Intercompany Media Engine Proxy
Create the TLS proxy. See Creating the TLS Proxy,
20-12
Cisco UCM that you want to translate
20-13
Configuring PAT for the Cisco UCM Server
20-14
20-15
Creating ACLs for Cisco Intercompany Media Engine Proxy
20-16
Procedure
Guidelines
20-17
Creating the Cisco Intercompany Media Engine Proxy
See Creating the Cisco Intercompany Media Engine
20-18
20-19
Show running-config uc-ime command
20-20
20-21
Prerequisites for Installing Certificates
20-22
Creating Trustpoints and Generating
Creating the TLS Proxy
Certificates section on
20-23
20-24
20-25
Created in , page 20-15of the task Creating
ACLs for Cisco Intercompany Media Engine Proxy
Where policymapname is the name of the policy
Optional Configuring TLS within the Local Enterprise
Map you created in of this task
20-26
20-27
Commands Purpose
20-28
Where proxytrustpoint for the server trust-point
Where proxytrustpoint for the client trust-point
20-29
Optional Configuring Off Path Signaling
Creating the Cisco Intercompany Media
Intercompany Media Engine Proxy,
Engine Proxy,
20-30
20-31
20-32
20-33
Show uc-ime signaling-sessions
20-34
Show uc-ime signaling-sessions statistics
Show uc-ime media-sessions detail
Show uc-ime mapping-service-sessions statistics
Show uc-ime mapping-service-sessions
Show uc-ime fallback-notification statistics
20-35
20-36
Configuring Connection Settings and QoS
Page
22-1
Information About Connection Settings
22-2
TCP Intercept and Limiting Embryonic Connections
Dead Connection Detection DCD
TCP Normalization
TCP Sequence Randomization
TCP State Bypass
22-3
22-4
Licensing Requirements for Connection Settings
Maximum Concurrent and Embryonic Connection Guidelines
TCP State Bypass Unsupported Features
TCP State Bypass
TCP Normalizer
Task Flow For Configuring Connection Settings
Configuring Connection Settings
For each TCP map, you can customize one or more settings
Customizing the TCP Normalizer with a TCP Map
22-7
22-8
Command
22-9
Command
22-10
Urgent-flag allow clear
Configuring Connection Settings
Window-variation allow drop
22-11
22-12
TCP Sequence Randomization section on page 22-3 section for
Random-sequence-number enable disable keyword
Embryonic-conn-max keywords
22-13
Embryonic hh mm ss keyword sets the timeout period until a
Command in the command reference
Idle hh mm ss keyword sets the idle timeout period after
To 0, which means the connection never times out
Configuration Examples for Connection Settings
Monitoring Connection Settings
Configuration Examples for Connection Limits and Timeouts
22-15
Configuration Examples for TCP Normalization
Configuration Examples for TCP State Bypass
Following is a sample configuration for TCP state bypass
22-16
22-17
Feature History for Connection Settings
Conn-max,set connection embryonic-conn-max,set
Timeout half-closed,timeout half-closed
Connection per-client-embryonic-max,set connection
Per-client-max
23-1
Information About QoS
23-2
Supported QoS Features
What is a Token Bucket?
23-3
Information About Policing
Information About Priority Queuing
23-4
How QoS Features Interact
Information About Traffic Shaping
Dscp and DiffServ Preservation
Licensing Requirements for QoS
Does not support IPv6
Model Guidelines
23-6
Configuring QoS
125
Mbps
Kbps
23-7
Priority queue, or for the ASA 5505 or ASASM, the Vlan
Configuring the Standard Priority Queue for an Interface
Interface name
23-8
23-9
23-10
23-11
Step
23-12
23-13
23-14
Configuring the Service Rule
23-15
Multiple of 8000. See the Information About Traffic Shaping
Priority Queuing Policy section on
Monitoring QoS
Ciscoasa# show service-policy police
Viewing QoS Police Statistics
23-16
23-17
Viewing QoS Standard Priority Statistics
Viewing QoS Shaping Statistics
Ciscoasa# show priority-queue statistics test
Viewing QoS Standard Priority Queue Statistics
23-18
23-19
Feature History for QoS
23-20
24-1
Troubleshooting Connections and Resources
Testing Your Configuration
24-2
Enabling Icmp Debugging Messages and Syslog Messages
24-3
Pinging ASA Interfaces
24-4
ASA
24-5
Passing Traffic Through the ASA
24-6
Disabling the Test Configuration
Determining Packet Routing with Traceroute
Monitoring Per-Process CPU Usage
Tracing Packets with Packet Tracer
24-7
24-8
Configuring Advanced Network Protection
Page
25-1
Configuring the ASA for Cisco Cloud Web Security
Information About Cisco Cloud Web Security
User Authentication and Cloud Web Security
Redirection of Web Traffic to Cloud Web Security
25-2
Company Authentication Key Group Authentication Key
Authentication Keys
Company Authentication Key, Group Authentication Key,
25-3
Directory Groups
ScanCenter Policy
Custom Groups
25-4
25-5
How Groups and the Authentication Key Interoperate
Cloud Web Security Actions
Licensing Requirements for Cisco Cloud Web Security
Failover from Primary to Backup Proxy Server
Bypassing Scanning with Whitelists
IPv4 and IPv6 Support
Prerequisites for Cloud Web Security
Optional User Authentication Prerequisites
Optional Fully Qualified Domain Name Prerequisites
25-7
25-8
Configuring Cisco Cloud Web Security
By default, Cisco Cloud Web Security is not enabled
25-9
See the Authentication Keys section on
25-10
Config-url disk0/onectx.cfg Context two
25-11
Optional Configuring Whitelisted Traffic section on
25-12
Adding an Extended Access Control List,
25-13
Policy section on page 1-17for more information
25-14
25-15
Optional Configuring Whitelisted Traffic
Configuring the Cloud Web Security Policy
Optional Configuring the User Identity Monitor
Object-group-user-Specifies an object-group user name
25-16
25-17
Monitoring Cloud Web Security
Http//Whoami.scansafe.net
25-18
Configuration Examples for Cisco Cloud Web Security
Single Mode Example
Whitelist Example
Multiple Mode Example
To attach class-maps to the Cloud Web Security Policy map
25-19
25-20
Configuring the Active Directory Server Using Ldap
Directory Integration Examples
Testing the AD Agent
Configuring the Active Directory Agent Using Radius
Configuring the Identity Options on the ASA
Creating the ASA as a Client on the AD Agent Server
Monitoring the Active Directory Groups
Cloud Web Security with Identity Firewall Example
Downloading the Database from the AD Agent
Showing a List of Active Users
25-23
Aaa-server AD inside host 192.168.116.220 server-port
25-24
No call-home reporting anonymous call-home
25-25
Related Documents
Feature History for Cisco Cloud Web Security
Related Documents
25-26
26-1
Information About the Botnet Traffic Filter
Botnet Traffic Filter Address Types,
Botnet Traffic Filter Actions for Known Addresses
Botnet Traffic Filter Address Types
Botnet Traffic Filter Databases
Information About the Dynamic Database
26-3
Information About the Static Database
26-4
26-5
How the Botnet Traffic Filter Works
26-6
Licensing Requirements for the Botnet Traffic Filter
Prerequisites for the Botnet Traffic Filter
26-7
Configuring the Botnet Traffic Filter
Task Flow for Configuring the Botnet Traffic Filter
26-8
Configuring the Dynamic Database
26-9
Adding Entries to the Static Database
See the Adding Entries to the Static Database section on
See the Enabling DNS Snooping section on
Enabling DNS Snooping
TCP DNS traffic is not supported
26-10
26-11
26-12
Inspection section on page 10-1 for more information about
26-13
Recommended Configuration
See the Blocking Botnet Traffic Manually section on
Subset of the dynamic-filter enable ACL
Threat-level range moderate very-high
Very-low Low Moderate High Very-high
Blocking Botnet Traffic Manually
For dropping purposes. If you do not enable this command
About the greylist
26-15
26-16
Searching the Dynamic Database
Monitoring the Botnet Traffic Filter
Botnet Traffic Filter Commands
Botnet Traffic Filter Syslog Messaging
26-17
26-18
Infected-hosts command
Dns-snoop command
Recommended Configuration Example
Configuration Examples for the Botnet Traffic Filter
26-19
Ciscoasa# show dynamic-filter reports top malware-ports
Outside
Other Configuration Examples
26-20
26-21
26-22
Feature History for the Botnet Traffic Filter
Information About Threat Detection
Configuring Threat Detection
Licensing Requirements for Threat Detection
27-1
27-2
Configuring Basic Threat Detection Statistics
Information About Basic Threat Detection Statistics
Guidelines and Limitations
Trigger Settings Packet Drop Reason Average Rate Burst Rate
Security Context Guidelines
Types of Traffic Monitored
27-4
Configuring Basic Threat Detection Statistics
27-5
Monitoring Basic Threat Detection Statistics
Threat Detection Statistics section on
Feature History for Basic Threat Detection Statistics
Configuring Advanced Threat Detection Statistics
Information About Advanced Threat Detection Statistics
27-6
27-7
Configuring Advanced Threat Detection Statistics
27-8
27-9
Monitoring Advanced Threat Detection Statistics
27-10
27-11
Using the show threat-detection rate acl-drop command
Statistics
Protocolnumber argument is an integer between 0
Field
27-12
27-13
Field Description
27-14
Feature History for Advanced Threat Detection Statistics
27-15
Configuring Scanning Threat Detection
Information About Scanning Threat Detection
27-16
Average Rate Burst Rate
Configuration see the Configuring Basic Threat Detection
Configuring Scanning Threat Detection
Monitoring Shunned Hosts, Attackers, and Targets
Displays the hosts that are currently shunned
27-18
Feature History for Scanning Threat Detection
27-19
Configuration Examples for Threat Detection
27-20
28-1
Preventing IP Spoofing
28-2
Configuring the Fragment Size
Blocking Unwanted Connections
Configuring IP Audit
Configuring IP Audit for Basic IPS Support
Configuring IP Audit, IP Audit Signature List,
28-3
1lists supported signatures and system message numbers
IP Audit Signature List
Signature Message Number Signature Title
28-4
28-5
28-6
28-7
28-8
29-1
Information About Web Traffic Filtering
Licensing Requirements for ActiveX Filtering
Configuring ActiveX Filtering
Information About ActiveX Filtering
29-2
Configuration Examples for ActiveX Filtering
Configuring ActiveX Filtering
Guidelines and Limitations for ActiveX Filtering
29-3
Feature History for ActiveX Filtering
Configuring Java Applet Filtering
Information About Java Applet Filtering
Licensing Requirements for Java Applet Filtering
Configuration Examples for Java Applet Filtering
Configuring Java Applet Filtering
Guidelines and Limitations for Java Applet Filtering
29-5
Filtering URLs and FTP Requests with an External Server
Feature History for Java Applet Filtering
Information About URL Filtering
29-6
29-7
Licensing Requirements for URL Filtering
Guidelines and Limitations for URL Filtering
29-8
Identifying the Filtering Server
Choose from the following options
29-9
Buffering the Content Server Response
Configuring Additional URL Filtering Settings
Replaces block-buffer with the maximum number of Http
Maximum memory allocation of 2 KB to 10 MB
Filtering Http URLs
Caching Server Addresses
On the Websense server
Websense server
29-12
29-13
Filtering Https URLs
29-14
Filtering FTP Requests
Might enter cd ./files instead of cd /public/files
Monitoring Filtering Statistics
Following is sample output from the show url-servercommand
29-15
Ciscoasa# show url-server
Following is sample output from the show perfmon command
Following is sample output from the show url-blockcommand
Following is sample output from the show filter command
29-16
29-17
Feature History for URL Filtering
29-18
Configuring Modules
Page
30-1
Information About the ASA CX Module
30-2
How the ASA CX Module Works with the ASA
Service Policy in Monitor-Only Mode
Monitor-Only Mode
Traffic-Forwarding Interface in Monitor-Only Mode
30-3
Initial Configuration, Policy Configuration and Management,
Initial Configuration
Information About ASA CX Management
30-4
Compatibility with ASA Features
Information About Authentication Proxy
Policy Configuration and Management
Information About VPN and the ASA CX Module
30-6
Licensing Requirements for the ASA CX Module
ASA Clustering Guidelines
Monitor-Only Mode Guidelines
Does not support clustering
30-7
See the Compatibility with ASA Features section on
Configuring the ASA CX Module
Parameters Default
Task Flow for the ASA CX Module
30-9
Connecting the ASA CX Management Interface
ASA 5585-X Hardware Module
30-10
If you have an inside router
If you do not have an inside router
30-11
ASA 5512-X through ASA 5555-X Software Module
30-12
30-13
Example
Partition the SSD
ASA 5585-X Changing the ASA CX Management IP Address
Session 1 do setup host ip
Sets the ASA CX management IP address, mask, and gateway
30-14
30-15
Configuring Basic ASA CX Settings at the ASA CX CLI
Ciscoasa# session cxsc console
Enter an IPv6 address 2001DB80CD301234/64
30-16
Change the admin password by entering the following command
Asacx config passwd
30-17
Optional Configuring the Authentication Proxy Port
30-18
Creating the ASA CX Service Policy
Redirecting Traffic to the ASA CX Module
30-19
See the Monitor-Only Mode section on page 30-3 for more
30-20
Configuring Traffic-Forwarding Interfaces Monitor-Only Mode
See the Feature Matching Within a Service Policy section on
30-21
Managing the ASA CX Module
Reloading or Resetting the Module
Resetting the Password
For a software module ASA 5512-X through ASA
30-22
30-23
Shutting Down the Module
New module type
Sw-module module cxsc uninstall
30-24
Reload
Monitoring the ASA CX Module
Admin123
Showing Module Status
30-25
30-26
Showing Module Statistics
30-27
Monitoring Module Connections
‘X’ flag
Dp-cp
30-28
Show asp event dp-cp cxsc-msg
Ciscoasa# show asp event dp-cp cxsc-msg
30-29
Ciscoasa# show asp drop
Capturing Module Traffic
Troubleshooting the ASA CX Module
Debugging the Module
30-30
30-31
Problems with the Authentication Proxy
Check the authentication proxy port
Configuration Examples for the ASA CX Module
Check the authentication proxy rules
30-32
30-33
Feature History for the ASA CX Module
Fail-close fail-openmonitor-only,traffic-forward
We modified or introduced the following commands cxsc
Cxsc monitor-only
30-34
30-35
Capture interface asadataplane command
Asadataplane
30-36
31-1
Information About the ASA IPS Module
31-2
How the ASA IPS Module Works with the ASA
31-3
Using Virtual Sensors ASA 5510 and Higher
Operating Modes
31-4
Information About Management Access
31-5
Licensing Requirements for the ASA IPS module
31-6
1lists the default settings for the ASA IPS module
Management Vlan ASA 5505 only
31-7
Configuring the ASA IPS module
Task Flow for the ASA IPS Module
31-8
Connecting the ASA IPS Management Interface
31-9
31-10
ASA
31-11
ASA 5512-X through ASA 5555-X Booting the Software Module
Sessioning to the Module from the ASA
For example, using the filename in the example in , enter
Configuring Basic IPS Module Network Settings
Ciscoasa# sw-module module ips recover boot
31-12
ASA 5505 Configuring Basic Network Settings
ASA 5510 and Higher Configuring Basic Network Settings
Connecting the ASA IPS Management Interface section on
Sessioning to the Module from the ASA Section on
31-14
31-15
Configuring the Security Policy on the ASA IPS Module
Details command
31-16
31-17
31-18
Diverting Traffic to the ASA IPS module
31-19
31-20
Managing the ASA IPS module
Installing and Booting an Image on the Module
IPS module
31-21
31-22
Sw-module module ips uninstall
Uninstalling a Software Module Image
For a software module for example, the ASA 5545-X
31-23
31-24
Sw-module module ips password-reset
For a software module for example, the ASA
31-25
Monitoring the ASA IPS module
Ips for a software module
Ciscoasa# show module ips
Configuration Examples for the ASA IPS module
31-26
Allow-ssc-mgmt,hw-module module ip, and hw-module
Feature History for the ASA IPS module
Module allow-ip
31-27
31-28
Inventory, show environment
Session, show module, sw-module
32-1
Information About the CSC SSM
32-2
ASA
32-3
Determining What Traffic to Scan
32-4
Common Network Configuration for CSC SSM Scanning
32-5
Licensing Requirements for the CSC SSM
Prerequisites for the CSC SSM
Parameter Default
1lists the default settings for the CSC SSM
Supported in single and multiple context modes
32-6
32-7
Configuring the CSC SSM
Before Configuring the CSC SSM
32-8
Connecting to the CSC SSM
See the Connecting to the CSC SSM section on
32-9
See the Diverting Traffic to the CSC SSM section on
Diverting Traffic to the CSC SSM
Determining What Traffic to Scan section on
32-10
32-11
32-12
Guidelines and Limitations section on
See the Monitoring the CSC SSM section on
Monitoring the CSC SSM
Displays the status
Displays additional status information
32-14
Troubleshooting the CSC Module
Installing an Image on the Module
32-15
Resetting the Password
Recover command
32-16
Reloading or Resetting the Module
Ciscoasaconfig-cmap#policy-map cscinpolicy
Configuration Examples for the CSC SSM
Shutting Down the Module
Shuts down the module
Related Topic Document Title
Additional References
Instructions on use of the CSC SSM GUI
Assistance with the Startup Wizard
Feature Name Platform Releases Feature Information
Feature History for the CSC SSM
Details recover
32-19
32-20
IN-1
IN-2
IN-3
IN-4
IN-5
LDP 6-7router-id 6-7TDP Multi-session PAT
See also policy map
RPC not supported with
IN-6
IN-7
IN-8
IN-9
IN-10