Cisco Systems ASA 5555-X, ASA 5505, ASA 5545-X, ASA 5585-X, ASA 5580, ASA Services Module manual 16-26

Page 428

Chapter 16 Using the Cisco Unified Communication Wizard

Working with Certificates in the Unified Communication Wizard

Submit the CSR to the certificate authority (CA), for example, by pasting the CSR text into the CSR enrollment page on the CA website.

When the CA returns the signed identity certificate, rerun the Unified Communications Wizard. From the client-side or remote-side certificate management step of the wizard, click Install ASA’s Identity Certificate. See Installing the ASA Identity Certificate on the Mobility Advantage Server, page 16-26and Installing the ASA Identity Certificate on the Presence Federation and Cisco Intercompany Media Engine Servers, page 16-26for the steps to install the identity certificate.

Installing the ASA Identity Certificate on the Mobility Advantage Server

When configuring certificates for the Cisco Mobility Advantage Proxy, you must install the ASA identity certificate on the Cisco Mobility Advantage server.

Typically, a certificate authority returns two certificates: your signed identity certificate and the certificate authority’s certificate (referred to as the root certificate). However, some certificate authorities (for example, VeriSign) might also send you an intermediate certificate.

The root certificate from the certificate authority is used to sign other certificates. The root certificate is used by the ASA to authenticate your signed identity certificate received from the certificate authority.

If the certificate authority provided an intermediate certificate, you must enter the certificate text in the Intermediate Certificate (If Applicable) area of the Install ASA’s Identity Certificate dialog box.

For the Cisco Mobility Advantage Proxy, you install the root certificate in another dialog box. See Installing a Certificate, page 16-23for the steps to install the root certificate.

Step 1 In the Intermediate Certificate (If Applicable) area, perform on of the following actions:

•To add a certificate configuration from an existing file, click the Install from a file radio button (this is the default setting). Enter the path and file name, or click Browse to search for the file. Then click Install Certificate.

•To enroll manually, click the Paste the certificate data in base-64 format radio button. Copy and paste the PEM format (base64 or hexadecimal) certificate into the area provided.

Step 2 In the ASA’s Identity Certificate area, perform on of the following actions:

•To add a certificate configuration from an existing file, click the Install from a file radio button (this is the default setting). Enter the path and file name, or click Browse to search for the file. Then click Install Certificate.

•To enroll manually, click the Paste the certificate data in base-64 format radio button. Copy and paste the PEM format (base64 or hexadecimal) certificate into the area provided.

Step 3 Click Install Certificate.

Installing the ASA Identity Certificate on the Presence Federation and Cisco Intercompany Media Engine Servers

When configuring certificates for the Cisco Presence Federation Proxy and Cisco Intercompany Media Engine Proxy, you must install the ASA identity certificate and the root certificate on the Cisco Presence Federation server and Cisco Intercompany Media Engine server, respectively.

Cisco ASA Series Firewall ASDM Configuration Guide

16-26

Page 427 Page 429
Image 428
Page 427 Page 429
Contents Cisco ASA Series Firewall Asdm Configuration Guide Software VersionCisco ASA Series Firewall Asdm Configuration Guide N T E N T S NAT for VPN Guidelines and Limitations Default Settings NAT and Same Security Level Interfaces Configuring Access Rules Getting Started with Application Layer Protocol Inspection Select IM Map Add/Edit H.323 Match Criterion SIP Class Map Select Radius Accounting Map Cisco Unified Communications Manager Prerequisites ACL Rules Configuring the TLS Proxy for Encrypted Voice Inspection Creating the TLS Proxy TCP Intercept and Limiting Embryonic Connections Blocks Monitoring Cloud Web Security Related Documents IP Audit Policy Licensing Requirements for the ASA CX Module Operating Modes Management Access Host/Networks Related Documentation About This GuideDocument Objectives Bold font ConventionsConvention Indication Configuring Service Policies Page Supported Features Configuring a Service PolicyInformation About Service Policies Feature Directionality Feature Traffic? SeeFor Through Accounting onlyGlobal Direction Feature Matching Within a Service PolicyFeature Order in Which Multiple Feature Actions are Applied ASA IPS ASA CXFeature Matching for Multiple Service Policies Licensing Requirements for Service PoliciesIncompatibility of Certain Feature Actions Guidelines and Limitations Default Settings Default ConfigurationTask Flows for Configuring Service Policies Adding a Service Policy Rule for Through TrafficDefault Traffic Classes Task Flow for Configuring a Service Policy RuleCisco ASA Series Firewall Asdm Configuration Guide Click Next Click Match or Do Not Match Cisco ASA Series Firewall Asdm Configuration Guide Adding a Service Policy Rule for Management Traffic Configuring a Service Policy Rule for Management TrafficClick Match or Do Not Match Managing the Order of Service Policy Rules Moving an ACE Feature History for Service Policies Feature Name Releases Feature InformationIntroduced class-map type management, and inspect Radius-accountingPage Information About Inspection Policy Maps Default Inspection Policy Maps Choose Configuration Firewall Objects Inspect Maps Choose Configuration Firewall Objects Class MapsDefining Actions in an Inspection Policy Map Identifying Traffic in an Inspection Class MapWhere to Go Next Feature History for Inspection Policy MapsConfiguring Network Address Translation Page Why Use NAT? Information About NAT ASA 8.3 and LaterNAT Terminology NAT Types NAT Types OverviewStatic NAT Information About Static NATInformation About Static NAT with Port Translation Information About Static NAT with Port Address TranslationStatic NAT with Identity Port Translation Information About One-to-Many Static NAT Static Interface NAT with Port TranslationInformation About Other Mapping Scenarios Not Recommended Dynamic NAT 6shows a typical few-to-many static NAT scenarioInformation About Dynamic NAT 209.165.201.10Information About Dynamic PAT Dynamic PATDynamic NAT Disadvantages and Advantages Per-Session PAT vs. Multi-Session PAT Version 9.01 and Later Dynamic PAT Disadvantages and AdvantagesNAT in Routed and Transparent Mode Identity NATNAT in Routed Mode NAT in Transparent Mode13 NAT Example Transparent Mode Main Differences Between Network Object NAT and Twice NAT NAT and IPv6How NAT is Implemented Information About Network Object NAT Information About Twice NAT14 Twice NAT with Different Destination Addresses 15 Twice NAT with Different Destination Ports 16 Twice Static NAT with Destination Address Translation NAT Rule Order Rule Type Order of Rules within the SectionNAT Interfaces 10.1.2.0Routing NAT Packets Mapped Addresses and Routing18 Proxy ARP Problems with Identity NAT Transparent Mode Routing Requirements for Remote Networks Determining the Egress InterfaceNAT and Remote Access VPN NAT for VPNSrc 203.0.113.16070 4. Http request to NAT and Site-to-Site VPN DstSee the following sample NAT configuration for ASA1 Boulder NAT and VPN Management Access Subnet 10.2.2.025 VPN Management Access Troubleshooting NAT and VPN DNS and NATEnter show nat detail and show conn all Repeat show nat detail and show conn all26 DNS Reply Modification, DNS Server on Outside 192.168.1.10 28 DNS Reply Modification, DNS Server on Host Network 2001DB8D1A5C8E1 30 PTR Modification, DNS Server on Host Network Configuring Network Object NAT ASA 8.3 and Later Information About Network Object NATLicensing Requirements for Network Object NAT Prerequisites for Network Object NATAdditional Guidelines Configuring Network Object NAT Configuring Dynamic NAT or Dynamic PAT Using a PAT PoolDetailed Steps Check the Add Automatic Translation Rules check box Configuring Network Object NAT ASA 8.3 and Later Configuring Dynamic PAT Hide Configuring Network Object NAT ASA 8.3 and Later Check the Add Automatic Translation Rules check box Configuring Static NAT or Static NAT-with-Port-Translation Add NAT to a new or existing network objectConfiguring Network Object NAT ASA 8.3 and Later Check the Add Automatic Translation Rules check box Configuring Network Object NAT ASA 8.3 and Later Configuring Identity NAT From the Type drop-down list, choose Static Configuring Network Object NAT ASA 8.3 and Later Configuring Per-Session PAT Rules DefaultsMonitoring Network Object NAT FieldsConfiguration Examples for Network Object NAT Providing Access to an Inside Web Server Static NAT Static NAT for an Inside Web ServerCisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Dynamic NAT for Inside, Static NAT for Outside Web Server Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Static NAT with One-to-Many for an Inside Load Balancer Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Static NAT-with-Port-Translation Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Create a network object for the FTP server address Cisco ASA Series Firewall Asdm Configuration Guide DNS Reply Modification Using Outside NAT Cisco ASA Series Firewall Asdm Configuration Guide 2001DB8D1A5C8E1 IPv6 Net DNS Reply Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide No-proxy-arp and route-lookup keywords, to maintain Feature History for Network Object NATPlatform Feature Name Releases Feature Information This feature is not available in 8.51 or Platform Feature Name Releases Feature Information Platform Feature Name Releases Feature Information Platform Feature Name Releases Feature Information Page Configuring Twice NAT ASA 8.3 and Later Information About Twice NATLicensing Requirements for Twice NAT Prerequisites for Twice NATIPv6 Guidelines Configuring Twice NAT Choose Configuration Firewall NAT Rules, and then click Add Configuring Twice NAT ASA 8.3 and Later Source Destination Source Destination Configuring Twice NAT ASA 8.3 and Later Configuring Twice NAT ASA 8.3 and Later Click OK To configure dynamic PAT, perform the following steps Configuring Twice NAT ASA 8.3 and Later Source Destination Configuring Twice NAT ASA 8.3 and Later Source Destination Configuring Twice NAT ASA 8.3 and Later To configure static NAT, perform the following steps Configuring Twice NAT ASA 8.3 and Later Source Destination Source Destination Configuring Twice NAT ASA 8.3 and Later Configuring Twice NAT ASA 8.3 and Later To configure identity NAT, perform the following steps Configuring Twice NAT ASA 8.3 and Later 10.1.2.2 Source Destination Configuring Twice NAT ASA 8.3 and Later Monitoring Twice NAT Configuration Examples for Twice NAT Twice NAT with Different Destination Addresses Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Click Apply Twice NAT with Different Destination Ports Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Cisco ASA Series Firewall Asdm Configuration Guide Click Apply Feature History for Twice NAT This feature is not available in 8.51 or Platform Feature Name Releases Feature Information Platform Feature Name Releases Feature Information Page Introduction to NAT Configuring NAT ASA 8.2 and EarlierNAT Overview NAT Example Routed Mode NAT in Transparent Mode NAT Control 209.165.201.1NAT Control and Same Security Traffic NAT Types Dynamic NATRemote Host Attempts to Connect to the Real Address PAT Static NAT Static PATBypassing NAT When NAT Control is Enabled Policy NAT Policy NAT with Different Destination Addresses NAT and Same Security Level Interfaces 11 Policy Static NAT with Destination Address TranslationDNS and NAT Order of NAT Rules Used to Match Real AddressesMapped Address Guidelines 12 DNS Reply Modification Configuring NAT Control 13 DNS Reply Modification Using Outside NATUsing Dynamic NAT Dynamic NAT ImplementationReal Addresses and Global Pools Paired Using a Pool ID Global Pools on Different Interfaces with the Same Pool IDGlobal 1 Multiple Addresses in the Same Global Pool 16 Different NAT IDsOutside NAT 17 NAT and PAT TogetherManaging Global Pools 18 Outside NAT and Inside NAT CombinedConfiguring Dynamic NAT, PAT, or Identity NAT 19 Dynamic NAT ScenariosConfiguring NAT ASA 8.2 and Earlier Using Dynamic NAT Configuring Dynamic Policy NAT or PAT 20 Dynamic Policy NAT ScenariosConfiguring NAT ASA 8.2 and Earlier Using Dynamic NAT Using Static NAT Configuring Static NAT, PAT, or Identity NAT InsideUse IP Address Use Interface IP AddressClick OK Configuring Static Policy NAT, PAT, or Identity NAT 22 Static Policy NAT ScenariosUse IP Address Using NAT Exemption Click Action ExemptClick Action Do not exempt Configuring Access Control Page Configuring Access Rules Information About Access RulesGeneral Information About Rules Implicit PermitsUsing Remarks NAT and Access RulesRule Order Implicit DenyTransactional-Commit Model Outbound ACLAdditional Guidelines and Limitations Information About Access RulesAccess Rules for Returning Traffic Management Access Rules Information About EtherType RulesSupported EtherTypes and Other Traffic Traffic Type Protocol or PortAllowing Mpls Licensing Requirements for Access RulesDefault Settings Choose Configuration Firewall Access Rules Configuring Access RulesAdding an Access Rule Adding an EtherType Rule Transparent Mode Only Configuring Management Access Rules Advanced Access Rule Configuration PrerequisitesCheck the Enable Object Group Search Algorithm check box Configuring Http RedirectAccess Rule Explosion Edit HTTP/HTTPS Settings Configuring Transactional Commit ModelFeature History for Access Rules Platform Feature Name Releases Feature Information Page Licensing Requirements for AAA Rules Configuring AAA Rules for Network AccessAAA Performance Configuring Authentication for Network Access Information About AuthenticationOne-Time Authentication ASA Authentication PromptsDeployment Supporting Cut-through Proxy Authentication AAA Prompts and Identity FirewallAAA Rules as a Backup Authentication Method Static PAT and HttpConfiguring Network Access Authentication Authenticate Do not AuthenticateClick OK Enabling Secure Authentication of Web Clients Authenticating Directly with the ASA Authenticating Https Connections with a Virtual ServerAuthenticating Telnet Connections with a Virtual Server Configuring the Authentication Proxy Limit Choose Configuration Firewall AAA Rules, then click AdvancedAuthorize Do not Authorize Configuring Authorization for Network AccessConfiguring TACACS+ Authorization Configuring Radius Authorization About the Downloadable ACL Feature and Cisco Secure ACS Configuring Cisco Secure ACS for Downloadable ACLs Configuring Any Radius Server for Downloadable ACLs Configuring Accounting for Network Access Account Do not Account MAC Exempt No MAC Exempt Feature History for AAA Rules Licensing Requirements for Public Servers Configuring Public ServersInformation About Public Servers Adding a Public Server that Enables Static NAT Adding a Public Server that Enables Static NAT with PATEditing Settings for a Public Server Feature History for Public Servers Configuring Application Inspection Page 10-1 Getting Started with Application Layer Protocol InspectionHow Inspection Engines Work When to Use Application Protocol Inspection 10-2Failover Guidelines 10-310-4 Default Settings and NAT Limitations323 H.225 NetBIOS Name IP OptionsServer over IP 10-5Smtp SQL*NetSun RPC over 10-610-7 Configuring Application Layer Protocol InspectionChoose Configuration Firewall Service Policy Rules 10-8 11-1 Configuring Inspection of Basic Internet ProtocolsDNS Inspection Default Settings for DNS Inspection Information About DNS InspectionGeneral Information About DNS DNS Inspection ActionsChoose Configuration Firewall Objects Inspect Maps DNS 11-3Detailed Steps-Protocol Conformance 11-4Detailed Steps-Filtering 11-5Detailed Steps-Inspections 11-611-7 11-8 11-9 Header Flag 11-1011-11 DNS Type Field ValueClass 11-12 Resource Record 11-13Domain Name 11-1411-15 11-16 Configuring DNS InspectionClick Configure Using Strict FTP FTP InspectionFTP Inspection Overview 11-17Select FTP Map 11-18Configuration Global Objects Class Maps FTP FTP Class MapAdd/Edit FTP Traffic Class Map 11-19Add/Edit FTP Match Criterion 11-2011-21 Configuration Global Objects Inspect Maps FTPFTP Inspect Map 11-22 File Type FilteringAdd/Edit FTP Policy Map Security Level Add/Edit FTP Policy Map Details 11-23Add/Edit FTP Map 11-24Verifying and Monitoring FTP Inspection 11-25Http Inspection Http Inspection OverviewSelect Http Map 11-26Configuration Global Objects Class Maps Http Http Class MapAdd/Edit Http Traffic Class Map 11-27Add/Edit Http Match Criterion 11-2811-29 11-30 11-31 11-32 Configuration Global Objects Inspect Maps HttpHttp Inspect Map 11-33 URI FilteringAdd/Edit Http Policy Map Security Level Add/Edit Http Policy Map Details 11-34Add/Edit Http Map 11-3511-36 11-37 11-38 Icmp Error Inspection Icmp InspectionInstant Messaging Inspection 11-3911-40 IM Inspection OverviewAdding a Class Map for IM Inspection IP Options Inspection Select IM MapIP Options Inspection Overview 11-41Configuring IP Options Inspection 11-42Select IP Options Inspect Map 11-4311-44 IP Options Inspect MapAdd/Edit IP Options Inspect Map 11-45 IPsec Pass Through InspectionIPsec Pass Through Inspection Overview 11-46 Select IPsec-Pass-Thru MapIPsec Pass Through Inspect Map 11-47 Add/Edit IPsec Pass Thru Policy Map Security LevelAdd/Edit IPsec Pass Thru Policy Map Details Default Settings for IPv6 Inspection Optional Configuring an IPv6 Inspection Policy MapIPv6 Inspection Information about IPv6 InspectionConfiguring IPv6 Inspection 11-49NetBIOS Inspection NetBIOS Inspection OverviewSelect Netbios Map 11-50NetBIOS Inspect Map Add/Edit NetBIOS Policy MapConfiguration Global Objects Inspect Maps NetBIOS Pptp Inspection11-52 Smtp and Extended Smtp InspectionSmtp and Esmtp Inspection Overview Select Esmtp Map 11-5311-54 Configuration Global Objects Inspect Maps EsmtpEsmtp Inspect Map 11-55 Mime File Type FilteringAdd/Edit Esmtp Policy Map Security Level Add/Edit Esmtp Policy Map Details 11-56Add/Edit Esmtp Inspect 11-5711-58 11-59 Tftp Inspection 11-6011-61 11-62 Configuring Inspection for Voice and Video Protocols Ctiqbe InspectionCtiqbe Inspection Overview 12-112-2 InspectionLimitations and Restrictions 12-3 Inspection OverviewHow H.323 Works Support in H.245 Messages 12-4Configuration Global Objects Class Maps H.323 Select H.323 MapClass Map 12-512-6 Add/Edit H.323 Traffic Class MapAdd/Edit H.323 Match Criterion 12-7 Configuration Global Objects Inspect Maps H.323Inspect Map 12-8 Phone Number FilteringAdd/Edit H.323 Policy Map Security Level Add/Edit H.323 Policy Map Details 12-912-10 12-11 Add/Edit HSI GroupAdd/Edit H.323 Map 12-12 Mgcp InspectionMgcp Inspection Overview Using NAT with Mgcp 12-13Configuration Global Objects Inspect Maps Mgcp Select Mgcp MapMgcp Inspect Map 12-1412-15 Gateways and Call AgentsAdd/Edit Mgcp Policy Map 12-16 Rtsp InspectionAdd/Edit Mgcp Group 12-17 Using RealPlayerRtsp Inspection Overview Configuration Global Objects Inspect Maps Radius Restrictions and LimitationsSelect Rtsp Map Rtsp Inspect MapConfiguration Firewall Objects Class Maps Rtsp Add/Edit Rtsp Policy MapRtsp Class Map 12-1912-20 SIP InspectionAdd/Edit Rtsp Traffic Class Map SIP Inspection Overview 12-2112-22 SIP Instant MessagingSelect SIP Map 12-23 Configuration Global Objects Class Maps SIPSIP Class Map 12-24 Add/Edit SIP Traffic Class MapAdd/Edit SIP Match Criterion 12-25 12-26 Configuration Global Objects Inspect Maps SIPSIP Inspect Map Add/Edit SIP Policy Map Security Level 12-27Add/Edit SIP Policy Map Details 12-2812-29 Add/Edit SIP Inspect 12-3012-31 12-32 Skinny Sccp InspectionSccp Inspection Overview Supporting Cisco IP Phones 12-33Configuration Global Objects Inspect Maps Sccp Skinny Select Sccp Skinny MapSccp Skinny Inspect Map 12-34Message ID Filtering 12-35Add/Edit Sccp Skinny Policy Map Security Level 12-36Add/Edit Sccp Skinny Policy Map Details 12-37Add/Edit Message ID Filter 12-3813-1 Configuring Inspection of Database Directory ProtocolsILS Inspection SQL*Net Inspection 13-2Configuration Properties Sunrpc Server Sun RPC InspectionSun RPC Inspection Overview Sunrpc ServerAdd/Edit Sunrpc Service 13-4Configuring Inspection for Management Application Protocols Dcerpc InspectionDcerpc Overview 14-1Configuration Global Objects Inspect Maps Dcerpc Select Dcerpc MapDcerpc Inspect Map 14-2Add/Edit Dcerpc Policy Map 14-3GTP Inspection 14-414-5 GTP Inspection OverviewSelect GTP Map 14-6 Configuration Global Objects Inspect Maps GTPGTP Inspect Map 14-7 Imsi Prefix FilteringAdd/Edit GTP Policy Map Security Level Add/Edit GTP Policy Map Details 14-8Add/Edit GTP Map 14-9Radius Accounting Inspection 14-10Radius Accounting Inspection Overview Select Radius Accounting MapAdd Radius Accounting Policy Map 14-1114-12 Radius Inspect MapRadius Inspect Map Host RSH Inspection Snmp InspectionRadius Inspect Map Other 14-13Snmp Inspection Overview Select Snmp MapSnmp Inspect Map Add/Edit Snmp MapXdmcp Inspection 14-1514-16 Configuring Unified Communications Page 15-1 15-2 TLS Proxy Applications in Cisco Unified Communications 15-3Model License Requirement1 15-415-5 15-6 Using the Cisco Unified Communication Wizard 16-116-2 Licensing Requirements for the Unified Communication Wizard 16-316-4 Configuring the Private Network for the Phone Proxy 16-516-6 Configuring Servers for the Phone ProxyClick the Generate and Export LDC Certificate button Address Default Port Description 16-716-8 Configuring the Public IP Phone Network 16-916-10 16-11 16-12 16-13 16-14 Certificate, 16-1516-16 16-17 16-18 Basic DeploymentOff-path Deployment 16-19 16-20 16-21 16-22 16-23 Installing a CertificateExporting an Identity Certificate Click Install Certificate 16-24Saving the Identity Certificate Request 16-2516-26 16-27 16-28 Configuring the Cisco Phone Proxy Information About the Cisco Phone ProxyPhone Proxy Functionality 17-117-2 TCP/RTP TLS/SRTPSupported Cisco UCM and IP Phones for the Phone Proxy Cisco Unified Communications ManagerCisco Unified IP Phones 17-3Licensing Requirements for the Phone Proxy 17-417-5 17-6 Prerequisites for the Phone ProxyMedia Termination Instance Prerequisites Certificates from the Cisco UCM DNS Lookup PrerequisitesCisco Unified Communications Manager Prerequisites ACL RulesNAT and PAT Prerequisites Address Port Protocol DescriptionNAT Prerequisites PAT Prerequisites17-9 Prerequisites for IP Phones on Multiple Interfaces7940 IP Phones Support 17-10 Cisco IP Communicator PrerequisitesPrerequisites for Rate Limiting Tftp Requests Rate Limiting Configuration Example End-User Phone ProvisioningWays to Deploy IP Phones to End Users 17-1117-12 Phone Proxy Guidelines and LimitationsGeneral Guidelines and Limitations Media Termination Address Guidelines and Limitations 17-1317-14 Configuring the Phone ProxyTask Flow for Configuring the Phone Proxy Creating the CTL File 17-15Adding or Editing a Record Entry in a CTL File 17-16Creating the Media Termination Instance 17-17Creating the Phone Proxy Instance 17-1817-19 Adding or Editing the Tftp Server for a Phone Proxy 17-2017-21 Configuring Your RouterLinksys Routers Feature History for the Phone Proxy Application Start End Protocol IP Address EnabledChecked 17-2218-1 18-2 TLS Proxy Flow Cisco IP Phone Cisco ASASupported Cisco UCM and IP Phones for the TLS Proxy 18-3Licensing for the TLS Proxy 18-418-5 CTL Provider 18-6Add/Edit CTL Provider 18-7Configure TLS Proxy Pane 18-818-9 Add TLS Proxy Instance Wizard Server ConfigurationAdding a TLS Proxy Instance Add TLS Proxy Instance Wizard Client Configuration 18-1018-11 Add TLS Proxy Instance Wizard Other Steps 18-12Edit TLS Proxy Instance Server Configuration 18-13Edit TLS Proxy Instance Client Configuration 18-1418-15 18-16 TLS ProxyAdd/Edit TLS Proxy 18-17 18-18 19-1 Configuring Cisco Mobility AdvantageCisco Mobility Advantage Proxy Functionality Mobility Advantage Proxy Deployment Scenarios 19-219-3 MMP/SSL/TLS19-4 Mobility Advantage Proxy Using NAT/PATTrust Relationships for Cisco UMA Deployments 19-5 Configuring Cisco Mobility Advantage 19-619-7 Feature History for Cisco Mobility AdvantageTask Flow for Configuring Cisco Mobility Advantage 19-8 20-1 Configuring Cisco Unified PresenceInformation About Cisco Unified Presence 20-2 Typical Cisco Unified Presence/LCS Federation Scenario20-3 SIP/TLSTrust Relationship in the Presence Federation 20-4Xmpp Federation Deployments 20-5Configuration Requirements for Xmpp Federation 20-6Licensing for Cisco Unified Presence 20-7Configuring Cisco Unified Presence Proxy for SIP Federation 20-8Feature History for Cisco Unified Presence 20-920-10 21-1 Configuring Cisco Intercompany Media Engine ProxyFeatures of Cisco Intercompany Media Engine Proxy How the UC-IME Works with the Pstn and the Internet 21-2Tickets and Passwords 21-321-4 21-5 Call Fallback to the PstnArchitecture Basic Deployment 21-6Off Path Deployment 21-7Licensing for Cisco Intercompany Media Engine 21-821-9 21-10 21-11 Configuring Cisco Intercompany Media Engine ProxyTask Flow for Configuring Cisco Intercompany Media Engine Configuring NAT for Cisco Intercompany Media Engine Proxy 21-12Command Purpose 21-13Configuring PAT for the Cisco UCM Server Command PurposeWhat to Do Next 21-14Address of Cisco UCM that you want to translate 21-15Creating ACLs for Cisco Intercompany Media Engine Proxy 21-1621-17 ProcedureGuidelines Creating the Cisco Intercompany Media Engine Proxy 21-18See Creating the Media Termination Instance 21-19Show running-config uc-ime command 21-20Creating Trustpoints and Generating Certificates 21-21Prerequisites for Installing Certificates 21-22Certified 21-23Creating the TLS Proxy 21-2421-25 ACLs for Cisco Intercompany Media Engine Proxy 21-26Optional Configuring TLS within the Local Enterprise 21-27Commands Purpose 21-2821-29 Where proxytrustpoint for the server trust-pointWhere proxytrustpoint for the client trust-point Optional Configuring Off Path Signaling 21-30Engine Proxy, 21-3121-32 21-33 Show uc-ime signaling-sessions 21-3421-35 Show uc-ime signaling-sessions statisticsShow uc-ime media-sessions detail Show uc-ime mapping-service-sessions Show uc-ime mapping-service-sessions statisticsShow uc-ime fallback-notification statistics 21-36Feature History for Cisco Intercompany Media Engine Proxy 21-3721-38 Configuring Connection Settings and QoS Page 22-1 Configuring Connection SettingsInformation About Connection Settings 22-2 TCP Intercept and Limiting Embryonic ConnectionsDead Connection Detection DCD TCP Sequence Randomization TCP NormalizationTCP State Bypass 22-3Licensing Requirements for Connection Settings 22-4TCP State Bypass Unsupported Features Maximum Concurrent and Embryonic Connection GuidelinesTCP State Bypass 22-5Configuring Connection Settings Task Flow For Configuring Connection SettingsCustomizing the TCP Normalizer with a TCP Map 22-622-7 Configuring Connection Settings 22-8Configuring Global Timeouts 22-922-10 Feature History for Connection Settings Introduced set connection advanced-optionsTcp-state-bypass 22-1122-12 23-1 Configuring QoSInformation About QoS 23-2 Supported QoS FeaturesWhat is a Token Bucket? 23-3 Information About PolicingInformation About Priority Queuing 23-4 How QoS Features InteractInformation About Traffic Shaping Licensing Requirements for QoS Dscp and DiffServ PreservationModel Guidelines 23-5Configuring QoS 23-6125 23-7Configuring the Standard Priority Queue for an Interface 23-8Click Enable priority for this flow 23-923-10 23-11 Monitoring QoSClick Enforce priority to selected shape traffic 23-12 Viewing QoS Police StatisticsViewing QoS Standard Priority Statistics 23-13 Viewing QoS Shaping StatisticsViewing QoS Standard Priority Queue Statistics Feature History for QoS 23-14Troubleshooting Connections and Resources Testing Your ConfigurationPinging ASA Interfaces 24-1Network Diagram with Interfaces, Routers, and Hosts 24-2Information About Ping 24-3Troubleshooting the Ping Tool Pinging From an ASA InterfacePinging to an ASA Interface Pinging Through the ASA InterfaceUsing the Ping Tool 24-524-6 Output Symbol DescriptionDetermining Packet Routing with Traceroute Tracing Packets with Packet Tracer 24-7Monitoring Performance 24-824-9 Monitoring System ResourcesBlocks Memory 24-10Monitoring Connections 24-11Monitoring Per-Process CPU Usage 24-12Configuring Advanced Network Protection Page Configuring the ASA for Cisco Cloud Web Security 25-1User Authentication and Cloud Web Security Information About Cisco Cloud Web SecurityRedirection of Web Traffic to Cloud Web Security 25-225-3 Authentication KeysCompany Authentication Key Group Authentication Key ScanCenter Policy Directory GroupsCustom Groups 25-425-5 How Groups and the Authentication Key InteroperateCloud Web Security Actions Failover from Primary to Backup Proxy Server Licensing Requirements for Cisco Cloud Web SecurityBypassing Scanning with Whitelists IPv4 and IPv6 SupportOptional User Authentication Prerequisites Prerequisites for Cloud Web SecurityOptional Fully Qualified Domain Name Prerequisites 25-7Configuring Cisco Cloud Web Security 25-8Choose Configuration Device Management Cloud Web Security 25-925-10 25-11 25-12 25-13 25-14 25-15 25-16 Examples 25-1725-18 Check Cloud Web Security and click Configure 25-1925-20 Tcp/http 25-2125-22 Optional Configuring Whitelisted Traffic 25-2325-24 Optional Configuring the User Identity Monitor 25-2525-26 Configuring the Cloud Web Security PolicyMonitoring Cloud Web Security Feature History for Cisco Cloud Web Security Related DocumentsRelated Documents 25-2725-28 26-1 Configuring the Botnet Traffic FilterInformation About the Botnet Traffic Filter Botnet Traffic Filter Address Types Botnet Traffic Filter Actions for Known AddressesBotnet Traffic Filter Databases Information About the Dynamic DatabaseInformation About the Static Database 26-326-4 How the Botnet Traffic Filter Works 26-526-6 Licensing Requirements for the Botnet Traffic FilterPrerequisites for the Botnet Traffic Filter 26-7 Configuring the Botnet Traffic FilterTask Flow for Configuring the Botnet Traffic Filter Configuring the Dynamic Database 26-826-9 Adding Entries to the Static DatabaseEnabling DNS Snooping 26-10 Recommended Configuration 26-1126-12 Blocking Botnet Traffic ManuallyVery Low Moderate High Very High Searching the Dynamic Database 26-1326-14 Monitoring the Botnet Traffic FilterBotnet Traffic Filter Syslog Messaging Botnet Traffic Filter Monitor Panes 26-15Feature History for the Botnet Traffic Filter 26-16Configuring Threat Detection Information About Threat DetectionLicensing Requirements for Threat Detection 27-127-2 Configuring Basic Threat Detection StatisticsInformation About Basic Threat Detection Statistics Trigger Settings Packet Drop Reason Average Rate Burst Rate Guidelines and LimitationsSecurity Context Guidelines Types of Traffic MonitoredConfiguring Basic Threat Detection Statistics Monitoring Basic Threat Detection StatisticsPath Purpose 27-4Configuring Advanced Threat Detection Statistics Feature History for Basic Threat Detection StatisticsInformation About Advanced Threat Detection Statistics 27-527-6 Configuring Advanced Threat Detection StatisticsChoose the Configuration Firewall Threat Detection pane 27-7 Monitoring Advanced Threat Detection StatisticsLast 24 hour 27-8 Configuring Scanning Threat DetectionFeature History for Advanced Threat Detection Statistics Information About Scanning Threat Detection 27-927-10 Configuring Scanning Threat DetectionAverage Rate Burst Rate Feature History for Scanning Threat Detection 27-1127-12 Using Protection Tools Configuration Firewall Advanced Anti-Spoofing FieldsPreventing IP Spoofing 28-128-2 Configuring the Fragment SizeShow Fragment Configuring TCP Options 28-3TCP Reset Settings 28-4Configuring IP Audit for Basic IPS Support Add/Edit IP Audit Policy ConfigurationIP Audit Policy 28-5IP Audit Signatures IP Audit Signature ListSignature Message Number Signature Title 28-628-7 Message Number Signature Title 28-828-9 28-10 28-11 28-12 29-1 Configuring Filtering ServicesInformation About Web Traffic Filtering 29-2 Filtering URLs and FTP Requests with an External ServerInformation About URL Filtering Licensing Requirements for URL Filtering Guidelines and Limitations for URL FilteringIdentifying the Filtering Server 29-3Configuring Additional URL Filtering Settings 29-429-5 Buffering the Content Server ResponseCaching Server Addresses 29-6 Configuring Filtering RulesFiltering Http URLs 29-7 29-8 29-9 29-10 Filtering the Rule Table 29-1129-12 Feature History for URL FilteringDefining Queries Configuring Modules Page 30-1 Configuring the ASA CX ModuleInformation About the ASA CX Module How the ASA CX Module Works with the ASA 30-2Monitor-Only Mode Service Policy in Monitor-Only ModeTraffic-Forwarding Interface in Monitor-Only Mode 30-330-4 Initial ConfigurationInformation About ASA CX Management Information About Authentication Proxy Compatibility with ASA FeaturesPolicy Configuration and Management Information About VPN and the ASA CX Module30-6 Licensing Requirements for the ASA CX ModulePrerequisites 30-7 Monitor-Only Mode GuidelinesASA Clustering Guidelines Configuring the ASA CX Module Parameters DefaultTask Flow for the ASA CX Module 30-830-9 Connecting the ASA CX Management InterfaceASA 5585-X Hardware Module 30-10 If you have an inside routerIf you do not have an inside router ASA 5512-X through ASA 5555-X Software Module 30-1130-12 Example 30-1330-14 Multiple Context ModeASA 5585-X Changing the ASA CX Management IP Address Single Context Mode Sets the ASA CX management IP address, mask, and gatewayExample ASDM, choose Wizards Startup WizardConfiguring Basic ASA CX Settings at the ASA CX CLI 30-1630-17 Optional Configuring the Authentication Proxy Port 30-1830-19 Creating the ASA CX Service PolicyRedirecting Traffic to the ASA CX Module Click the ASA CX Inspection tab 30-20Check the Enable ASA CX for this traffic flow check box 30-2130-22 Configuring Traffic-Forwarding Interfaces Monitor-Only ModeChoose Tools Command Line Interface 30-23 Resetting the PasswordManaging the ASA CX Module Reloading or Resetting the Module 30-24Shutting Down the Module 30-2530-26 30-27 Admin123Monitoring the ASA CX Module Showing Module Status Showing Module StatisticsMonitoring Module Connections Module30-29 Ciscoasa# show asp table classify domain cxsc Input Table30-30 30-31 Ciscoasa# show asp dropTroubleshooting the ASA CX Module Problems with the Authentication ProxyCapturing Module Traffic 30-32Feature History for the ASA CX Module 30-33Capture interface asadataplane command 30-3431-1 Configuring the ASA IPS ModuleInformation About the ASA IPS Module How the ASA IPS Module Works with the ASA 31-231-3 Using Virtual Sensors ASA 5510 and HigherOperating Modes Information About Management Access 31-4Licensing Requirements for the ASA IPS module 31-5Vlan 31-631-7 Configuring the ASA IPS moduleTask Flow for the ASA IPS Module Connecting the ASA IPS Management Interface 31-831-9 ASA 31-10Sessioning to the Module from the ASA May Be Required 31-1131-12 ASA 5512-X through ASA 5555-X Booting the Software ModuleConfiguring Basic IPS Module Network Settings 31-13 ASA 5510 and Higher Configuring Basic Network SettingsChoose Wizards Startup Wizard 31-14 ASA 5505 Configuring Basic Network SettingsASDM, choose Configuration Device Setup SSC Setup Configuring the Security Policy on the ASA IPS Module 31-15Click Continue 31-1631-17 Diverting Traffic to the ASA IPS module 31-18Managing the ASA IPS module 31-19Installing and Booting an Image on the Module 31-2031-21 Uninstalling a Software Module Image 31-2231-23 Monitoring the ASA IPS module 31-24Feature History for the ASA IPS module 31-2531-26 32-1 Configuring the ASA CSC ModuleInformation About the CSC SSM ASA 32-2Determining What Traffic to Scan 32-3Common Network Configuration for CSC SSM Scanning 32-432-5 Licensing Requirements for the CSC SSMPrerequisites for the CSC SSM Parameter Default 32-632-7 Configuring the CSC SSMBefore Configuring the CSC SSM Connecting to the CSC SSM 32-8Determining Service Policy Rule Actions for CSC Scanning 32-9CSC SSM Setup Wizard 32-1032-11 IP ConfigurationActivation/License Host/Notification Settings 32-1232-13 Management Access Host/NetworksPassword 32-14 Restoring the Default PasswordChoose Tools CSC Password Reset 32-15 Wizard SetupCSC Setup Wizard Activation Codes Configuration 32-16 CSC Setup Wizard IP ConfigurationCSC Setup Wizard Host Configuration CSC Setup Wizard Management Access Configuration CSC Setup Wizard Password ConfigurationCSC Setup Wizard Traffic Selection for CSC Scan 32-17Specifying Traffic for CSC Scanning 32-18CSC Setup Wizard Summary 32-19Using the CSC SSM GUI Choose Configuration Trend Micro Content Security WebWeb 32-2032-21 MailSmtp Tab File Transfer 32-22Updates 32-23Choose Monitoring Trend Micro Content Security Threats Monitoring the CSC SSMThreats 32-2432-25 Live Security EventsLive Security Events Log Software Updates 32-26Troubleshooting the CSC Module Resource GraphsCSC Memory 32-2732-28 Installing an Image on the ModuleRecover command Resetting the Password 32-29Reloading or Resetting the Module Shutting Down the ModuleShuts down the module 32-30Feature History for the CSC SSM Feature Name Platform Releases Feature InformationAdditional References Related Topic Document Title32-32 D E IN-1FTP Http IN-2CSC CPU IN-3CSC SSM GUI IN-4Application inspection IN-5IPS IN-6See also class map IN-7See Icmp IN-8See QoS IN-9See PAT IN-10URL IN-11IN-12
Related manuals
Manual 712 pages 25.77 Kb Manual 52 pages 35.74 Kb

ASA Services Module, ASA 5555-X, ASA 5545-X, ASA 5585-X, ASA 5580 specifications

Cisco Systems has long been a leader in the field of network security, and its Adaptive Security Appliance (ASA) series is a testament to this expertise. Within the ASA lineup, models such as the ASA 5505, ASA 5580, ASA 5585-X, ASA 5545-X, and ASA 5555-X stand out for their unique features, capabilities, and technological advancements.

The Cisco ASA 5505 is designed for small businesses or branch offices. It provides essential security features such as firewall protection, flexible VPN capabilities, and intrusion prevention. The ASA 5505 supports a user-friendly interface, allowing for straightforward management. Its built-in threat detection and prevention tools provide a layered defense, and with scalability in mind, it can accommodate various expansion options as organizational needs grow.

Moving up the line, the ASA 5580 delivers greater throughput and advanced security features. This model is suited for medium to large enterprises that require robust protection against increasingly sophisticated threats. Its multi-core architecture allows it to manage high volumes of traffic seamlessly while maintaining excellent performance levels. The ASA 5580 also supports application-layer security and customizable access policies, making it highly adaptable to diverse security environments.

The ASA 5585-X further enhances Cisco's security offerings with advanced malware protection and extensive security intelligence capabilities. It incorporates next-generation firewall features, including context-aware security, and supports advanced threat detection technologies. This model is ideal for large enterprises or data centers that prioritize security while ensuring uninterrupted network performance and availability.

For enterprises requiring a balance of performance and security, the ASA 5545-X presents a compelling option. This model features scalable performance metrics, high availability, and integrated advanced threat protection. Coupled with advanced endpoint protection and detailed monitoring capabilities, the ASA 5545-X enables organizations to manage their security posture effectively.

Lastly, the ASA 5555-X blends cutting-edge technologies with strong security infrastructures. It boasts high throughput and the ability to execute deep packet inspections. Its sophisticated architecture supports threat intelligence feeds that provide real-time security updates, making it a powerful tool against modern threats.

Each of these Cisco ASA models brings specific advantages to varied environments. Their integrative capabilities enable businesses to enhance their security postures while benefiting from seamless scalability and management. As cybersecurity threats evolve, these advanced appliances play a vital role in protecting valuable digital assets.
Top Page Image Contents