Cisco Security Appliance Command Line Configuration Guide, Version 7.2

1014 Pages·2009·12.55 MB·English

Cisco Security Appliance Command Line
Configuration Guide
For the Cisco ASA 5500 Series and Cisco PIX 500 Series
Software Version 7.2
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Customer Order Number: N/A, Online only
Text Part Number: OL-10088-02
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
CCDE, CCSI, CCENT, Cisco Eos, Cisco HealthPresence, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco Stackpower, Cisco StadiumVision,
Cisco TelePresence, Cisco WebEx, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn and Cisco Store are
service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the
Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without
Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study,
IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar,
PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath,
WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (0903R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the
document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
Cisco Security Appliance Command Line Configuration Guide
Copyright © 2008 Cisco Systems, Inc. All rights reserved.
C O N T E N T S
About This Guide xxxv
Document Objectives xxxv
Audience xxxv
Related Documentation xxxvi
Document Organization xxxvi
Document Conventions xxxix
Obtaining Documentation and Submitting a Service Request xxxix
1-xl
PART 1 Getting Started and General Information
CHAPTER 1 Introduction to the Security Appliance 1-1
Firewall Functional Overview 1-1
Security Policy Overview 1-2
Permitting or Denying Traffic with Access Lists 1-2
Applying NAT 1-2
Using AAA for Through Traffic 1-2
Applying HTTP, HTTPS, or FTP Filtering 1-3
Applying Application Inspection 1-3
Sending Traffic to the Advanced Inspection and Prevention Security Services Module 1-3
Sending Traffic to the Content Security and Control Security Services Module 1-3
Applying QoS Policies 1-3
Applying Connection Limits and TCP Normalization 1-3
Firewall Mode Overview 1-3
Stateful Inspection Overview 1-4
VPN Functional Overview 1-5
Intrusion Prevention Services Functional Overview 1-5
Security Context Overview 1-6
CHAPTER 2 Getting Started 2-1
Getting Started with Your Platform Model 2-1
Factory Default Configurations 2-1
Restoring the Factory Default Configuration 2-2
Cisco Security Appliance Command Line Configuration Guide
OL-10088-02 iii
Contents

ASA 5505 Default Configuration 2-2
ASA 5510 and Higher Default Configuration 2-3
PIX 515/515E Default Configuration 2-4
Accessing the Command-Line Interface 2-4
Setting Transparent or Routed Firewall Mode 2-5
Working with the Configuration 2-6
Saving Configuration Changes 2-6
Saving Configuration Changes in Single Context Mode 2-7
Saving Configuration Changes in Multiple Context Mode 2-7
Copying the Startup Configuration to the Running Configuration 2-8
Viewing the Configuration 2-8
Clearing and Removing Configuration Settings 2-9
Creating Text Configuration Files Offline 2-9
CHAPTER 3 Enabling Multiple Context Mode 3-1
Security Context Overview 3-1
Common Uses for Security Contexts 3-1
Unsupported Features 3-2
Context Configuration Files 3-2
Context Configurations 3-2
System Configuration 3-2
Admin Context Configuration 3-2
How the Security Appliance Classifies Packets 3-3
Valid Classifier Criteria 3-3
Invalid Classifier Criteria 3-4
Classification Examples 3-5
Cascading Security Contexts 3-8
Management Access to Security Contexts 3-9
System Administrator Access 3-9
Context Administrator Access 3-10
Enabling or Disabling Multiple Context Mode 3-10
Backing Up the Single Mode Configuration 3-10
Enabling Multiple Context Mode 3-10
Restoring Single Context Mode 3-11
CHAPTER 4 Configuring Switch Ports and VLAN Interfaces for the Cisco ASA 5505 Adaptive Security
Appliance 4-1
Interface Overview 4-1
Understanding ASA 5505 Ports and Interfaces 4-2
Cisco Security Appliance Command Line Configuration Guide
iv OL-10088-02
Contents

Maximum Active VLAN Interfaces for Your License 4-2
Default Interface Configuration 4-4
VLAN MAC Addresses 4-4
Power Over Ethernet 4-4
Monitoring Traffic Using SPAN 4-4
Security Level Overview 4-5
Configuring VLAN Interfaces 4-5
Configuring Switch Ports as Access Ports 4-9
Configuring a Switch Port as a Trunk Port 4-11
Allowing Communication Between VLAN Interfaces on the Same Security Level 4-13
CHAPTER 5 Configuring Ethernet Settings and Subinterfaces 5-1
Configuring and Enabling RJ-45 Interfaces 5-1
Configuring and Enabling Fiber Interfaces 5-3
Configuring and Enabling VLAN Subinterfaces and 802.1Q Trunking 5-3
CHAPTER 6 Adding and Managing Security Contexts 6-1
Configuring Resource Management 6-1
Classes and Class Members Overview 6-1
Resource Limits 6-2
Default Class 6-3
Class Members 6-4
Configuring a Class 6-4
Configuring a Security Context 6-7
Automatically Assigning MAC Addresses to Context Interfaces 6-11
Changing Between Contexts and the System Execution Space 6-11
Managing Security Contexts 6-12
Removing a Security Context 6-12
Changing the Admin Context 6-13
Changing the Security Context URL 6-13
Reloading a Security Context 6-14
Reloading by Clearing the Configuration 6-14
Reloading by Removing and Re-adding the Context 6-15
Monitoring Security Contexts 6-15
Viewing Context Information 6-15
Viewing Resource Allocation 6-16
Viewing Resource Usage 6-19
Monitoring SYN Attacks in Contexts 6-20
Cisco Security Appliance Command Line Configuration Guide
OL-10088-02 v
Contents

CHAPTER 7 Configuring Interface Parameters 7-1
Security Level Overview 7-1
Configuring the Interface 7-2
Allowing Communication Between Interfaces on the Same Security Level 7-6
CHAPTER 8 Configuring Basic Settings 8-1
Changing the Login Password 8-1
Changing the Enable Password 8-1
Setting the Hostname 8-2
Setting the Domain Name 8-2
Setting the Date and Time 8-2
Setting the Time Zone and Daylight Saving Time Date Range 8-3
Setting the Date and Time Using an NTP Server 8-4
Setting the Date and Time Manually 8-5
Setting the Management IP Address for a Transparent Firewall 8-5
CHAPTER 9 Configuring IP Routing 9-1
How Routing Behaves Within the ASA Security Appliance 9-1
Egress Interface Selection Process 9-1
Next Hop Selection Process 9-2
Configuring Static and Default Routes 9-2
Configuring a Static Route 9-3
Configuring a Default Route 9-4
Configuring Static Route Tracking 9-5
Defining Route Maps 9-7
Configuring OSPF 9-8
OSPF Overview 9-9
Enabling OSPF 9-10
Redistributing Routes Into OSPF 9-10
Configuring OSPF Interface Parameters 9-11
Configuring OSPF Area Parameters 9-13
Configuring OSPF NSSA 9-14
Configuring Route Summarization Between OSPF Areas 9-15
Configuring Route Summarization When Redistributing Routes into OSPF 9-16
Defining Static OSPF Neighbors 9-16
Generating a Default Route 9-17
Configuring Route Calculation Timers 9-17
Logging Neighbors Going Up or Down 9-18
Cisco Security Appliance Command Line Configuration Guide
vi OL-10088-02
Contents

Displaying OSPF Update Packet Pacing 9-19
Monitoring OSPF 9-19
Restarting the OSPF Process 9-20
Configuring RIP 9-20
Enabling and Configuring RIP 9-20
Redistributing Routes into the RIP Routing Process 9-22
Configuring RIP Send/Receive Version on an Interface 9-22
Enabling RIP Authentication 9-23
Monitoring RIP 9-23
The Routing Table 9-24
Displaying the Routing Table 9-24
How the Routing Table is Populated 9-24
Backup Routes 9-26
How Forwarding Decisions are Made 9-26
Dynamic Routing and Failover 9-26
CHAPTER 10 Configuring DHCP, DDNS, and WCCP Services 10-1
Configuring a DHCP Server 10-1
Enabling the DHCP Server 10-2
Configuring DHCP Options 10-3
Using Cisco IP Phones with a DHCP Server 10-4
Configuring DHCP Relay Services 10-5
Configuring Dynamic DNS 10-6
Example 1: Client Updates Both A and PTR RRs for Static IP Addresses 10-7
Example 2: Client Updates Both A and PTR RRs; DHCP Server Honors Client Update Request; FQDN
Provided Through Configuration 10-7
Example 3: Client Includes FQDN Option Instructing Server Not to Update Either RR; Server Overrides
Client and Updates Both RRs. 10-8
Example 4: Client Asks Server To Perform Both Updates; Server Configured to Update PTR RR Only;
Honors Client Request and Updates Both A and PTR RR 10-8
Example 5: Client Updates A RR; Server Updates PTR RR 10-9
Configuring Web Cache Services Using WCCP 10-9
WCCP Feature Support 10-9
WCCP Interaction With Other Features 10-10
Enabling WCCP Redirection 10-10
CHAPTER 11 Configuring Multicast Routing 11-13
Multicast Routing Overview 11-13
Enabling Multicast Routing 11-14
Cisco Security Appliance Command Line Configuration Guide
OL-10088-02 vii
Contents

Configuring IGMP Features 11-14
Disabling IGMP on an Interface 11-15
Configuring Group Membership 11-15
Configuring a Statically Joined Group 11-15
Controlling Access to Multicast Groups 11-15
Limiting the Number of IGMP States on an Interface 11-16
Modifying the Query Interval and Query Timeout 11-16
Changing the Query Response Time 11-17
Changing the IGMP Version 11-17
Configuring Stub Multicast Routing 11-17
Configuring a Static Multicast Route 11-17
Configuring PIM Features 11-18
Disabling PIM on an Interface 11-18
Configuring a Static Rendezvous Point Address 11-19
Configuring the Designated Router Priority 11-19
Filtering PIM Register Messages 11-19
Configuring PIM Message Intervals 11-20
Configuring a Multicast Boundary 11-20
Filtering PIM Neighbors 11-20
Supporting Mixed Bidirectional/Sparse-Mode PIM Networks 11-21
For More Information about Multicast Routing 11-22
CHAPTER 12 Configuring IPv6 12-1
IPv6-enabled Commands 12-1
Configuring IPv6 12-2
Configuring IPv6 on an Interface 12-3
Configuring a Dual IP Stack on an Interface 12-4
Enforcing the Use of Modified EUI-64 Interface IDs in IPv6 Addresses 12-4
Configuring IPv6 Duplicate Address Detection 12-4
Configuring IPv6 Default and Static Routes 12-5
Configuring IPv6 Access Lists 12-6
Configuring IPv6 Neighbor Discovery 12-7
Configuring Neighbor Solicitation Messages 12-7
Configuring Router Advertisement Messages 12-9
Multicast Listener Discovery Support 12-11
Configuring a Static IPv6 Neighbor 12-11
Verifying the IPv6 Configuration 12-11
The show ipv6 interface Command 12-12
The show ipv6 route Command 12-12
Cisco Security Appliance Command Line Configuration Guide
viii OL-10088-02
Contents

The show ipv6 mld traffic Command 12-13
CHAPTER 13 Configuring AAA Servers and the Local Database 13-1
AAA Overview 13-1
About Authentication 13-1
About Authorization 13-2
About Accounting 13-2
AAA Server and Local Database Support 13-2
Summary of Support 13-3
RADIUS Server Support 13-3
Authentication Methods 13-4
Attribute Support 13-4
RADIUS Authorization Functions 13-4
TACACS+ Server Support 13-4
SDI Server Support 13-4
SDI Version Support 13-5
Two-step Authentication Process 13-5
SDI Primary and Replica Servers 13-5
NT Server Support 13-5
Kerberos Server Support 13-5
LDAP Server Support 13-6
Authentication with LDAP 13-6
Authorization with LDAP for VPN 13-7
LDAP Attribute Mapping 13-8
SSO Support for WebVPN with HTTP Forms 13-9
Local Database Support 13-9
User Profiles 13-10
Fallback Support 13-10
Configuring the Local Database 13-10
Identifying AAA Server Groups and Servers 13-12
Using Certificates and User Login Credentials 13-15
Using User Login Credentials 13-15
Using certificates 13-16
Supporting a Zone Labs Integrity Server 13-16
Overview of Integrity Server and Security Appliance Interaction 13-17
Configuring Integrity Server Support 13-17
CHAPTER 14 Configuring Failover 14-1
Understanding Failover 14-1
Cisco Security Appliance Command Line Configuration Guide
OL-10088-02 ix
Contents

Failover System Requirements 14-2
Hardware Requirements 14-2
Software Requirements 14-2
License Requirements 14-2
The Failover and Stateful Failover Links 14-3
Failover Link 14-3
Stateful Failover Link 14-5
Active/Active and Active/Standby Failover 14-6
Active/Standby Failover 14-6
Active/Active Failover 14-10
Determining Which Type of Failover to Use 14-15
Regular and Stateful Failover 14-15
Regular Failover 14-16
Stateful Failover 14-16
Failover Health Monitoring 14-16
Unit Health Monitoring 14-17
Interface Monitoring 14-17
Failover Feature/Platform Matrix 14-18
Failover Times by Platform 14-18
Configuring Failover 14-19
Failover Configuration Limitations 14-19
Configuring Active/Standby Failover 14-19
Prerequisites 14-20
Configuring Cable-Based Active/Standby Failover (PIX Security Appliance Only) 14-20
Configuring LAN-Based Active/Standby Failover 14-21
Configuring Optional Active/Standby Failover Settings 14-25
Configuring Active/Active Failover 14-27
Prerequisites 14-27
Configuring Cable-Based Active/Active Failover (PIX security appliance) 14-27
Configuring LAN-Based Active/Active Failover 14-29
Configuring Optional Active/Active Failover Settings 14-33
Configuring Unit Health Monitoring 14-39
Configuring Failover Communication Authentication/Encryption 14-39
Verifying the Failover Configuration 14-40
Using the show failover Command 14-40
Viewing Monitored Interfaces 14-48
Displaying the Failover Commands in the Running Configuration 14-48
Testing the Failover Functionality 14-49
Controlling and Monitoring Failover 14-49
Forcing Failover 14-49
Cisco Security Appliance Command Line Configuration Guide
x OL-10088-02