Cisco 5505 - ASA Firewall Edition Bundle Manual de usuario

Corporate Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 526-4100

Cisco ASA 5505

Getting Started Guide

Software Version 7.2

Customer Order Number: DOC-7817612=

Text Part Number: 78-17612-02

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT

NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT

ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR

THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION

PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO

LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE

PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED

OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL

DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR

INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH

DAMAGES.

CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We

Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP,

CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the

Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink,

Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers

logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast,

SMARTnet, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates

in the United States and certain other countries.

All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply

a partnership relationship between Cisco and any other company. (0601R)

Cisco ASA 5505 Getting Started Guide

78-17612-02

CONTENTS

CHAPTER

1Before You Begin 1-1

CHAPTER

2Deployment Planning 2-1

Scenarios for Deployment Planning and Configuration 2-1

Scenario 1: Private Network with External Connectivity 2-3

Scenario 2: Basic Installation with DMZ 2-4

Scenario 3: IPSec Remote-Access VPN 2-5

Scenario 4: Site-to-Site VPN 2-6

Scenario 5: ASA 5505 Deployed as a Hardware VPN Client 2-7

Configuration Procedures for Scenarios 2-8

What to Do Next 2-9

CHAPTER

3Planning for a VLAN Configuration 3-1

Understanding VLANs on the ASA 5505 3-1

About Physical Ports on the ASA 5505 3-2

About VLANs 3-2

Maximum Number and Types of VLANs 3-3

Deployment Scenarios Using VLANs 3-4

Basic Deployment Using Two VLANs 3-5

DMZ Deployment 3-7

Teleworker Deployment Using Three VLANs 3-8

What to Do Next 3-9

Contents

Cisco ASA 5505 Getting Started Guide

78-17612-02

CHAPTER

4Installing the ASA 5505 4-1

Verifying the Package Contents 4-1

PoE Ports and Devices 4-3

Installing the Chassis 4-4

Connecting to Network Interfaces 4-4

Powering on the Cisco ASA 5505 4-6

Setting Up a PC for System Administration 4-6

Optional Procedures 4-7

Connecting to the Console 4-8

Installing a Cable Lock 4-9

Ports and LEDs 4-9

Front Panel Components 4-9

Rear Panel Components 4-12

What to Do Next 4-13

CHAPTER

5Configuring the Adaptive Security Appliance 5-1

About the Factory Default Configuration 5-1

About the Adaptive Security Device Manager 5-3

Using the Startup Wizard 5-4

Before Launching the Startup Wizard 5-4

Running the Startup Wizard 5-5

What to Do Next 5-7

CHAPTER

6Scenario: DMZ Configuration 6-1

Example DMZ Network Topology 6-1

Configuring the Security Appliance for a DMZ Deployment 6-5

Configuration Requirements 6-5

Starting ASDM 6-6

Cisco ASA 5505 Getting Started Guide

78-17612-02

Contents

Enabling Inside Clients to Communicate with Devices on the Internet 6-7

Enabling Inside Clients to Communicate with the DMZ Web Server 6-8

Translating Internal Client IP Addresses Between the Inside and DMZ

Interfaces 6-8

Translating the Public Address of the Web Server to its Real

Address 6-10

Configuring an External Identity for the DMZ Web Server 6-12

Providing Public HTTP Access to the DMZ Web Server 6-15

What to Do Next 6-18

CHAPTER

7Scenario: IPSec Remote-Access VPN Configuration 7-1

Example IPSec Remote-Access VPN Network Topology 7-1

Implementing the IPSec Remote-Access VPN Scenario 7-2

Information to Have Available 7-3

Starting ASDM 7-3

Configuring the ASA 5505 for an IPSec Remote-Access VPN 7-5

Selecting VPN Client Types 7-6

Specifying the VPN Tunnel Group Name and Authentication Method 7-7

Specifying a User Authentication Method 7-8

(Optional) Configuring User Accounts 7-10

Configuring Address Pools 7-11

Configuring Client Attributes 7-12

Configuring the IKE Policy 7-13

Configuring IPSec Encryption and Authentication Parameters 7-15

Specifying Address Translation Exception and Split Tunneling 7-16

Verifying the Remote-Access VPN Configuration 7-17

What to Do Next 7-18

CHAPTER

8Scenario: Site-to-Site VPN Configuration 8-1

Example Site-to-Site VPN Network Topology 8-1

Contents

Cisco ASA 5505 Getting Started Guide

78-17612-02

Implementing the Site-to-Site Scenario 8-2

Information to Have Available 8-3

Configuring the Site-to-Site VPN 8-3

Starting ASDM 8-3

Configuring the Security Appliance at the Local Site 8-4

Providing Information About the Remote VPN Peer 8-6

Configuring the IKE Policy 8-7

Configuring IPSec Encryption and Authentication Parameters 8-9

Specifying Hosts and Networks 8-10

Viewing VPN Attributes and Completing the Wizard 8-11

Configuring the Other Side of the VPN Connection 8-13

What to Do Next 8-14

CHAPTER

9Scenario: Easy VPN Hardware Client Configuration 9-1

Using an ASA 5505 as an Easy VPN Hardware Client 9-1

Client Mode and Network Extension Mode 9-3

Configuring the Easy VPN Hardware Client 9-5

Configuring Advanced Easy VPN Attributes 9-8

What to Do Next 9-9

APPENDIX

AObtaining a 3DES/AES License A-1

CHAPTER

1-1

Cisco ASA 5505 Getting Started Guide

78-17612-02

Before You Begin

Use the following table to find the installation and configuration steps that are

required for your implementation of the adaptive security appliance.

To Do This... See...

Learn about typical deployments of the

ASA 5505

Chapter 2, “Deployment Planning”

Learn about VLANs and port allocation

on the ASA 5505

Chapter 3, “Planning for a VLAN

Configuration”

Install the chassis Chapter 4, “Installing the ASA 5505”

Perform initial setup of the adaptive

security appliance

Chapter 5, “Configuring the

Adaptive Security Appliance”

Configure the adaptive security

appliance for your implementation

Chapter 6, “Scenario: DMZ

Configuration”

Chapter 7, “Scenario: IPSec

Remote-Access VPN Configuration”

Chapter 8, “Scenario: Site-to-Site

VPN Configuration”

Chapter 9, “Scenario: Easy VPN

Hardware Client Configuration”

Chapter 1 Before You Begin

1-2

Cisco ASA 5505 Getting Started Guide

78-17612-02

Refine configuration

Configure optional and advanced

features

Cisco Security Appliance Command

Line Configuration Guide

Cisco Security Appliance Command

Reference

Cisco Security Appliance Logging

Configuration and System Log

Messages

To Do This... (continued) See...

CHAPTER

2-1

Cisco ASA 5505 Getting Started Guide

78-17612-02

Deployment Planning

This document is based on several example scenarios that represent typical

customer deployments of the ASA 5505. The deployment scenarios in this

chapter correspond to subsequent configuration chapters.

This chapter includes the following sections:

• Scenarios for Deployment Planning and Configuration, page 2-1

• Scenario 1: Private Network with External Connectivity, page 2-3

• Scenario 2: Basic Installation with DMZ, page 2-4

• Scenario 3: IPSec Remote-Access VPN, page 2-5

• Scenario 4: Site-to-Site VPN, page 2-6

• Scenario 5: ASA 5505 Deployed as a Hardware VPN Client, page 2-7

Scenarios for Deployment Planning and

Configuration

An extended adaptive security appliance deployment can include two or more of

the different deployment scenarios described in this chapter. You can use the

deployment scenarios in this chapter to help you determine how you want to

deploy the adaptive security appliance on your network, and then determine which

configuration chapters apply to you.

Figure 2-1 illustrates an extended network that includes most of the deployment

and configuration scenarios included in this document.

Chapter 2 Deployment Planning

Scenarios for Deployment Planning and Configuration

2-2

Cisco ASA 5505 Getting Started Guide

78-17612-02

Figure 2-1 Extended Network Deployment

190924

Web Server

Remote Site

Adaptive Security

Appliance

Mobile Client

Using VPN

software client

Scenario 3: IPSec VPN

Connection

Scenario 6: Site-to-site VPN

Connection

Email Server

Adaptive Security

Appliance

CiscoASA SSC-05

Status

Security

Services

CardSlot

console

RESET

POWER

VDC

POWERoverETHERNET

543210

Scenario 2: Basic Installation

with DMZ

Scenario 1: Basic Installation

Internet

CiscoASA SSC-05

Status

Security

Services

CardSlot

console

RESET

POWER

VDC

POWERoverETHERNET

543210

Mobile Client

Using Cisco SSL

VPN Client software

Scenario 4: Cisco SSL

VPN Client

Mobile Client

Clientless SSL VPN

Scenario 5: Cisco SSL

VPN Client

Otros manuales para 5505 - ASA Firewall Edition Bundle

Tabla de contenidos

Otros manuales de Cortafuegos de Cisco

Cisco

Cisco Firepower 7010, Firepower 7020, Firepower 7030, Firepower 7050, Firepower 7110, Firepower 7120, Firepower 7115, Firepower... Manual de usuario

Cisco

Cisco 5580-40 - ASA Firewall Edition Manual

Cisco

Cisco PIX 501 Manual

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Manual de usuario

Cisco

Cisco 881W - Integrated Services Router Wireless Manual de instrucciones

Cisco

Cisco PIX 506 - Firewall Manual de usuario

Cisco

Cisco Firepower 2100 Manual de usuario

Cisco

Cisco LightStream 1010 Manual de instrucciones

Cisco

Cisco ASA 5512-X Manual

Cisco

Cisco M690 Manual de usuario

Cisco

Cisco PIX 501 Manual de usuario

Cisco

Cisco Meraki MX100 Manual de usuario

Cisco

Cisco 515E - PIX Restricted Bundle Manual de usuario

Cisco

Cisco PIX 501 Manual de usuario

Cisco

Cisco Firepower 4100 Series Manual de instalación y operación

Cisco

Cisco 2100 Series Manual de usuario

Cisco

Cisco MX400 Manual de usuario

Cisco

Cisco ASA 5508-X Manual de usuario

Cisco

Cisco Firepower 4100 Series Manual de usuario

Cisco

Cisco RV110W Manual de usuario

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Manual de usuario

Cisco

Cisco Firepower 4100 Series Manual

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Manual de usuario

Cisco

Cisco Cisco ASA Series Instrucciones de instalación

Manuales populares de Cortafuegos de otras marcas

Fortinet

Fortinet FortiGate Voice Series Manual de usuario

ADTRAN

ADTRAN NetVanta 2300 Manual de usuario

SecureLogix

SecureLogix ETM System Manual de usuario

NETGEAR

NETGEAR ProSafe FVX538 Manual de usuario

Lanner

Lanner FW-8877 Manual de usuario

Huawei

Huawei USG6000 Series Manual de instalación y operación

H3C

H3C SecPath F5000-AI-15 Manual de usuario

Nexcom

Nexcom DNA 1150 Manual de usuario

Fortinet

Fortinet FortiGate-60 series Manual de usuario

Draytek

Draytek Vigor2860 Series Manual de usuario

Lanner electronics

Lanner electronics FW-7650 Series Manual de usuario

Swisscom

Swisscom Internet Backup Manual de usuario

SonicWALL

SonicWALL NSa 5700 Manual de usuario

DPtech

DPtech FW1000 SERIES Manual de usuario

FEITIAN

FEITIAN MultiPass FIDO Manual de usuario

EBLOCKER

EBLOCKER PRO Manual de usuario

GTA

GTA GB-200 Manual de usuario

Trend Micro

Trend Micro Deep Edge Manual de usuario