Cisco Cisco ASA Series Manual de usuario

Getting Started

This chapter describes how to get started with your Cisco ASA.

•Access the Console for the Command-Line Interface, page 1

•Configure ASDM Access, page 9

•Start ASDM, page 15

•Factory Default Configurations, page 16

•Work with the Configuration, page 24

•Apply Configuration Changes to Connections, page 28

•Reload the ASA, page 28

Access the Console for the Command-Line Interface

For initial configuration, access the CLI directly from the console port. Later, you can configure remote access

using Telnet or SSH according to Management Access. If your system is already in multiple context mode,

then accessing the console port places you in the system execution space.

For ASAv console access, see the ASAv quick start guide.Note

Access the Appliance Console

Follow these steps to access the appliance console.

Procedure

Step 1 Connect a computer to the console port using the provided console cable, and connect to the console using a

terminal emulator set for 9600 baud, 8 data bits, no parity, 1 stop bit, no flow control.

See the hardware guide for your ASA for more information about the console cable.

CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5

Step 2 Press the Enter key to see the following prompt:

ciscoasa>

This prompt indicates that you are in user EXEC mode. Only basic commands are available from user EXEC

mode.

Step 3 To access privileged EXEC mode, enter the following command:

ciscoasa> enable

The following prompt appears:

Password:

All non-configuration commands are available in privileged EXEC mode. You can also enter configuration

mode from privileged EXEC mode.

Step 4 Enter the enable password at the prompt.

By default, the password is blank, and you can press the Enter key to continue. See Set the Hostname, Domain

Name, and the Enable and Telnet Passwords to change the enable password.

The prompt changes to:

ciscoasa#

To exit privileged mode, enter the disable,exit, or quit command.

Step 5 To access global configuration mode, enter the following command:

ciscoasa# configure terminal

The prompt changes to the following:

ciscoasa(config)#

You can begin to configure the ASA from global configuration mode. To exit global configuration mode,

enter the exit,quit, or end command.

Access the ASA Console on the Firepower 9300 Chassis

For initial configuration, access the command-line interface by connecting to the Firepower 9300 chassis

supervisor (either to the console port or remotely using Telnet or SSH) and then connecting to the ASA security

module.

Procedure

Step 1 Connect to the Firepower 9300 chassis supervisor CLI (console or SSH), and then session to the ASA:

connect module slot console

CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5

Getting Started

Access the ASA Console on the Firepower 9300 Chassis

The first time you access the module console, you access the FXOS module CLI. You must then connect to

the ASA application. Subsequent connections automatically connect to the ASA application, so you can skip

the following command.

connect asa

Example:

Firepower# connect module 1 console

Firepower-module1> connect asa

asa>

Step 2 Access privileged EXEC mode, which is the highest privilege level:

enable

Example:

asa> enable

Password:

asa#

Enter the enable password at the prompt. By default, the password is blank.

To exit privileged EXEC mode, enter the disable,exit, or quit command.

Step 3 Enter global configuration mode:

configure terminal

Example:

asa# configure terminal

asa(config)#

To exit global configuration mode, enter the disable,exit, or quit command.

Step 4 Exit the ASA console session by typing~to exit to the Telnet application, then quit to exit to the FXOS

supervisor CLI.

If you want to exit first to the FXOS module CLI for troubleshooting purposes, enter Ctrl-A-D.

Example:

Firepower# connect module 1 console

Telnet escape character is '~'.

Trying 127.5.1.1...

Connected to 127.5.1.1.

Escape character is '~'.

CISCO Serial Over LAN:

Close Network Connection to Exit

Firepower-module1> connect asa

asa> enable

Password:

asa# configure terminal

asa(config)#

asa(config)# [Ctrl-A-D]

Firepower-module1> ~

telnet> quit

Connection closed.

CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5

Getting Started

Access the ASA Console on the Firepower 9300 Chassis

Firepower#

Access the ASA Services Module Console

For initial configuration, access the command-line interface by connecting to the switch (either to the console

port or remotely using Telnet or SSH) and then connecting to the ASASM. This section describes how to

access the ASASM CLI.

About Connection Methods

From the switch CLI, you can use two methods to connect to the ASASM:

•Virtual console connection—Using the service-module session command, you create a virtual console

connection to the ASASM, with all the benefits and limitations of an actual console connection.

Benefits include:

◦The connection is persistent across reloads and does not time out.

◦You can stay connected through ASASM reloads and view startup messages.

◦You can access ROMMON if the ASASM cannot load the image.

◦No initial password configuration is required.

Limitations include:

◦The connection is slow (9600 baud).

◦You can only have one console connection active at a time.

◦You cannot use this command in conjunction with a terminal server where Ctrl-Shift-6,xis the

escape sequence to return to the terminal server prompt. Ctrl-Shift-6,xis also the sequence to

escape the ASASM console and return to the switch prompt. Therefore, if you try to exit the

ASASM console in this situation, you instead exit all the way to the terminal server prompt. If you

reconnect the terminal server to the switch, the ASASM console session is still active; you can

never exit to the switch prompt. You must use a direct serial connection to return the console to

the switch prompt. In this case, either change the terminal server or switch escape character in

Cisco IOS software, or use the Telnet session command instead.

Because of the persistence of the console connection, if you do not properly log out of

the ASASM, the connection may exist longer than intended. If someone else wants to

Note

•Telnet connection—Using the session command, you create a Telnet connection to the ASASM.

CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5

Getting Started

Access the ASA Services Module Console

You cannot connect using this method for a new ASASM; this method requires you to

configure a Telnet login password on the ASASM (there is no default password). After

you set a password using the passwd command, you can use this method.

Note

Benefits include:

◦You can have multiple sessions to the ASASM at the same time.

◦The Telnet session is a fast connection.

Limitations include:

◦The Telnet session is terminated when the ASASM reloads, and can time out.

◦You cannot access the ASASM until it completely loads; you cannot access ROMMON.

◦You must first set a Telnet login password; there is no default password.

Log Into the ASA Services Module

For initial configuration, access the command-line interface by connecting to the switch (either to the switch

console port or remotely using Telnet or SSH) and then connecting to the ASASM.

If your system is already in multiple context mode, then accessing the ASASM from the switch places you

in the system execution space.

Later, you can configure remote access directly to the ASASM using Telnet or SSH.

Procedure

Step 1 From the switch, perform one of the following:

•Available for initial access—From the switch CLI, enter this command to gain console access to the

ASASM:

service-module session [switch {1|2}] slot number

Example:

Router# service-module session slot 3

ciscoasa>

For a switch in a VSS, enter the switch argument.

To view the module slot numbers, enter the show module command at the switch prompt.

You access user EXEC mode.

•Available after you configure a login password—From the switch CLI, enter this command to Telnet

to the ASASM over the backplane:

session [switch {1 | |2}] slot number processor 1

CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5

Getting Started

Access the ASA Services Module Console

You are prompted for the login password:

ciscoasa passwd:

Example:

Router# session slot 3 processor 1

ciscoasa passwd: cisco

ciscoasa>

For a switch in a VSS, enter the switch argument.

The session slot processor 0 command, which is supported on other services modules, is not supported

on the ASASM; the ASASM does not have a processor 0.

To view the module slot numbers, enter the show module command at the switch prompt.

Enter the login password to the ASASM. Set the password using the passwd command. There is no

default password.

You access user EXEC mode.

Step 2 Access privileged EXEC mode, which is the highest privilege level:

enable

Example:

ciscoasa> enable

Password:

ciscoasa#

Enter the enable password at the prompt. By default, the password is blank.

To exit privileged EXEC mode, enter the disable,exit, or quit command.

Step 3 Access global configuration mode:

configure terminal

To exit global configuration mode, enter the disable,exit, or quit command.

Related Topics

Set the Hostname, Domain Name, and the Enable and Telnet Passwords

Log Out of a Console Session

If you do not log out of the ASASM, the console connection persists; there is no timeout. To end the ASASM

console session and access the switch CLI, perform the following steps.

To kill another user’s active connection, which may have been unintentionally left open, see Kill an Active

Console Connection, on page 7.

CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5

Getting Started

Access the ASA Services Module Console

Procedure

To return to the switch CLI, type the following:

Ctrl-Shift-6,x

You return to the switch prompt:

asasm# [Ctrl-Shift-6, x]

Router#

Shift-6 on US and UK keyboards issues the caret (^) character. If you have a different keyboard and

cannot issue the caret (^) character as a standalone character, you can temporarily or permanently

change the escape character to a different character. Use the terminal escape-character ascii_number

command (to change for this session) or the default escape-character ascii_number command (to

change permanently). For example, to change the sequence for the current session to Ctrl-w,x, enter

terminal escape-character 23.

Note

Kill an Active Console Connection

Because of the persistence of a console connection, if you do not properly log out of the ASASM, the connection

may exist longer than intended. If someone else wants to log in, they will need to kill the existing connection.

Procedure

Step 1 From the switch CLI, show the connected users using the show users command. A console user is called

“con”. The Host address shown is 127.0.0.slot0, where slot is the slot number of the module.

show users

For example, the following command output shows a user “con”on line 0 on a module in slot 2:

Router# show users

Line User Host(s) Idle Location

* 0 con 0 127.0.0.20 00:00:02

Step 2 To clear the line with the console connection, enter the following command:

clear line number

For example:

Router# clear line 0

Log Out of a Telnet Session

To end the Telnet session and access the switch CLI, perform the following steps.

CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5

Getting Started

Access the ASA Services Module Console

Procedure

To return to the switch CLI, type exit from the ASASM privileged or user EXEC mode. If you are in a

configuration mode, enter exit repeatedly until you exit the Telnet session.

You return to the switch prompt:

asasm# exit

Router#

You can alternatively escape the Telnet session using the escape sequence Ctrl-Shift-6,x; this escape

sequence lets you resume the Telnet session by pressing the Enter key at the switch prompt. To

disconnect your Telnet session from the switch, enter disconnect at the switch CLI. If you do not

disconnect the session, it will eventually time out according to the ASASM configuration.

Note

Access the Software Module Console

If you have a software module installed, such as the ASA FirePOWER module on the ASA 5506-X, you can

session to the module console.

You cannot access the hardware module CLI over the ASA backplane using the session command.

Note

Procedure

From the ASA CLI, session to the module:

session {sfr |cxsc |ips}console

Example:

ciscoasa# session sfr console

Opening console session with module sfr.

Connected to module sfr. Escape character sequence is 'CTRL-^X'.

Cisco ASA SFR Boot Image 5.3.1

asasfr login: admin

Password: Admin123

Access the ASA 5506W-X Wireless Access Point Console

To access the wireless access point console, perform the following steps.

Procedure

Step 1 From the ASA CLI, session to the access point:

session wlan console

CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5

Getting Started

Access the Software Module Console

Example:

ciscoasa# session wlan console

opening console session with module wlan

connected to module wlan. Escape character sequence is ‘CTRL-^X’

ap>

Step 2 See the Cisco IOS Configuration Guide for Autonomous Aironet Access Points for information about the

access point CLI.

Configure ASDM Access

This section describes how to access ASDM with a default configuration and how to configure access if you

do not have a default configuration.

Use the Factory Default Configuration for ASDM Access (Appliances, ASAv)

With a factory default configuration, ASDM connectivity is pre-configured with default network settings.

Procedure

Connect to ASDM using the following interface and network settings:

•The management interface depends on your model:

◦ASA 5506-X, ASA 5508-X, and ASA 5516-X—The interface to which you connect to ASDM is

GigabitEthernet 1/2.

◦ASA 5512-X and higher—The interface to which you connect to ASDM is Management 0/0.

◦ASAv—The interface to which you connect to ASDM is Management 0/0.

◦ISA 3000—The interface to which you connect to ASDM is Management 1/1.

◦ASA on the Firepower 9300 chassis—The interface to which you connect to ASDM is the

Management type interface of your choice defined on the FXOS Chassis supervisor

•The default management address is:

◦ASA appliances—192.168.1.1.

◦ASAv—You set the management interface IP address during deployment.

◦ASA on the Firepower 9300 chassis—You set the management interface IP address during

deployment.

•The clients allowed to access ASDM:

CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5

Getting Started

Configure ASDM Access

◦ASA appliances—Clients must be on the 192.168.1.0/24 network. The default configuration enables

DHCP so that your management station can be assigned an IP address in this range.

◦ASAv—You set the management client IP address during deployment. The ASAv does not act as

the DHCP server for connected clients.

◦ASA on the Firepower 9300 chassis—All hosts are allowed to access ASDM on the management

interface. The ASAv does not act as the DHCP server for connected clients.

If you change to multiple context mode, you can access ASDM from the admin context using the

network settings above.

Note

Manuales populares de Cortafuegos de otras marcas

Fortinet

Fortinet FortiGate Voice Series Manual de usuario

ADTRAN

ADTRAN NetVanta 2300 Manual de usuario

SecureLogix

SecureLogix ETM System Manual de usuario

NETGEAR

NETGEAR ProSafe FVX538 Manual de usuario

Lanner

Lanner FW-8877 Manual de usuario

Huawei

Huawei USG6000 Series Manual de instalación y operación

H3C

H3C SecPath F5000-AI-15 Manual de usuario

Nexcom

Nexcom DNA 1150 Manual de usuario

Fortinet

Fortinet FortiGate-60 series Manual de usuario

Draytek

Draytek Vigor2860 Series Manual de usuario

Lanner electronics

Lanner electronics FW-7650 Series Manual de usuario

Swisscom

Swisscom Internet Backup Manual de usuario

SonicWALL

SonicWALL NSa 5700 Manual de usuario

DPtech

DPtech FW1000 SERIES Manual de usuario

FEITIAN

FEITIAN MultiPass FIDO Manual de usuario

EBLOCKER

EBLOCKER PRO Manual de usuario

GTA

GTA GB-200 Manual de usuario

Trend Micro

Trend Micro Deep Edge Manual de usuario