Cisco Cisco ASA Series Manual de usuario

Cisco Systems, Inc.

www.cisco.com

Cisco has more than 200 offices worldwide.

Addresses, phone numbers, and fax numbers

are listed on the Cisco website at

www.cisco.com/go/offices.

Cisco ASA Series Firewall CLI

Configuration Guide

Software Version 9.4

For the ASA 5506-X, ASA 5506H-X, ASA 5506W-X, ASA 5508-X, ASA 5512-X,

ASA 5515-X, ASA 5516-X, ASA 5525-X, ASA 5545-X, ASA 5555-X,

ASA 5585-X, ASA Services Module, and the

Adaptive Security Virtual Appliance

First Published: March 23, 2015

Last Updated: April 7, 2015

Text Part Number: N/A, Online only

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT

TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS

MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,

EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY

PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT

SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE

OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH

ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT

LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF

DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,

WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO

OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this

URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership

relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display

output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in

illustrative content is unintentional and coincidental.

Cisco ASA Series Firewall CLI Configuration Guide

iii

Cisco ASA Series Firewall CLI Configuration Guide

About This Guide

•Document Objectives, page iii

•Related Documentation, page iii

•Conventions, page iii

•Obtaining Documentation and Submitting a Service Request, page iv

Document Objectives

The purpose of this guide is to help you configure the firewall features for Cisco ASA series using the

command-line interface. This guide does not cover every feature, but describes only the most common

configuration scenarios.

You can also configure and monitor the ASA by using the Adaptive Security Device Manager (ASDM),

a web-based GUI application. ASDM includes configuration wizards to guide you through some

common configuration scenarios, and online help for less common scenarios.

Throughout this guide, the term “ASA” applies generically to supported models, unless specified

otherwise.

Related Documentation

For more information, see Navigating the Cisco ASA Series Documentation at

http://www.cisco.com/go/asadocs.

Conventions

This document uses the following conventions:

Convention Indication

bold font Commands and keywords and user-entered text appear in bold font.

italic font Document titles, new or emphasized terms, and arguments for which you supply

values are in italic font.

[ ] Elements in square brackets are optional.

Cisco ASA Series Firewall CLI Configuration Guide

Note Means reader take note.

Tip Means the following information will help you solve a problem.

Caution Means reader be careful. In this situation, you might perform an action that could result in equipment

damage or loss of data.

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a

service request, and gathering additional information, see What’s New in Cisco Product Documentation

at: http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html.

Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised Cisco technical

documentation, as an RSS feed and deliver content directly to your desktop using a reader application. The

RSS feeds are a free service.

{x | y | z } Required alternative keywords are grouped in braces and separated by

vertical bars.

[ x | y | z ] Optional alternative keywords are grouped in brackets and separated by

vertical bars.

string A nonquoted set of characters. Do not use quotation marks around the string or

the string will include the quotation marks.

courier font Terminal sessions and information the system displays appear in courier font.

courier bold font Commands and keywords and user-entered text appear in bold courier font.

courier italic font Arguments for which you supply values are in courier italic font.

< > Nonprinting characters such as passwords are in angle brackets.

[ ] Default responses to system prompts are in square brackets.

!, # An exclamation point (!) or a pound sign (#) at the beginning of a line of code

indicates a comment line.

CHAPTER

1-1

Cisco ASA Series Firewall CLI Configuration Guide

Introduction to Cisco ASA Firewall Services

First Published: March 23, 2015

Last Updated: April 7, 2015

Firewall services are those ASA features that are focused on controlling access to the network, including

services that block traffic and services that enable traffic flow between internal and external networks.

These services include those that protect the network against threats, such as Denial of Service (DoS)

and other attacks.

The following topics provide an overview of firewall services.

•How to Implement Firewall Services, page 1-1

•Basic Access Control, page 1-2

•Application Filtering, page 1-2

•URL Filtering, page 1-3

•Threat Protection, page 1-3

•Network Address Translation, page 1-4

•Application Inspection, page 1-5

•Use Case: Expose a Server to the Public, page 1-5

How to Implement Firewall Services

The following procedure provides a general sequence for implementing firewall services. However, each

step is optional, needed only if you want to provide the service to your network.

Before You Begin

Configure the ASA according to the general operations configuration guide, including at minimum basic

settings, interface configuration, routing, and management access.

Procedure

Step 1 Implement access control for the network. See Basic Access Control, page 1-2.

Step 2 Implement application filtering. See Application Filtering, page 1-2.

Step 3 Implement URL filtering. See URL Filtering, page 1-3.

Step 4 Implement threat protection. See Threat Protection, page 1-3.

1-2

Cisco ASA Series Firewall CLI Configuration Guide

Chapter 1

Basic Access Control

Step 5 Implement Network Address Translation (NAT). See Network Address Translation, page 1-4.

Step 6 Implement application inspection if the default settings are insufficient for your network. See

Application Inspection, page 1-5.

Basic Access Control

Access rules, applied per interface or globally, are your first line of defense. You can drop, upon entry,

specific types of traffic, or traffic from (or to) specific hosts or networks. By default, the ASA allows

traffic to flow freely from an inside network (higher security level) to an outside network (lower security

level).

You can apply an access rule to limit traffic from inside to outside, or allow traffic from outside to inside.

Basic access rules control traffic using a “5-tuple” of source address and port, destination address and

port, and protocol.

You can augment your rules by making them identity aware. This lets you configure rules based on user

identity or group membership. To implement identity control, do any combination of the following:

•Install Cisco Context Directory Agent (CDA), also known as AD agent, on a separate server to

collect user and group information already defined in your Active Directory (AD) server. Then,

configure the ASA to get this information, and add user or group criteria to your access rules.

•Install Cisco Identity Services Engine (ISE) on a separate server to implement Cisco Trustsec. You

can then add security group criteria to your access rules.

•Install the ASA FirePOWER module on the ASA and implement identity policies in the module. The

identity-aware access policies in ASA FirePOWER would apply to any traffic that you redirect to

the module.

Related Topics

•Access Control Lists, page 3-1

•Access Rules, page 4-1

•Identity Firewall, page 5-1

•ASA and Cisco TrustSec, page 6-1

•ASA FirePOWER Module, page 7-1

Application Filtering

The wide-spread use of web-based applications means that a lot of traffic runs over the HTTP or HTTPS

protocols. With traditional 5-tuple access rules, you either allow or disallow all HTTP/HTTPS traffic.

You might require more granular control of web traffic.

You can install a module on the ASA to provide application filtering to selectively allow HTTP or other

traffic based on the application being used. Thus, you do not have to make a blanket permit for HTTP.

You can look inside the traffic and prevent applications that are unacceptable for your network (for

example, inappropriate file sharing). When you add a module for application filtering, do not configure

HTTP inspection on the ASA.

1-3

Cisco ASA Series Firewall CLI Configuration Guide

Chapter 1

URL Filtering

To implement application filtering, install the ASA FirePOWER module on the ASA and use application

filtering criteria in your ASA FirePOWER access rules. These policies apply to any traffic that you

redirect to the module.

Related Topics

•ASA FirePOWER Module, page 7-1

URL Filtering

URL filtering denies or allows traffic based on the URL of the destination site.

The purpose of URL filtering is primarily to completely block or allow access to a web site. Although

you can target individual pages, you typically specify a host name (such as www.example.com) or a URL

category, which defines a list of host names that provide a particular type of service (such as Gambling).

When trying to decide whether to use URL filtering or application filtering for HTTP/HTTPS traffic,

consider whether your intention is to create a policy that applies to all traffic directed at a web site. If

your intention is to treat all such traffic the same way (denying it or allowing it), use URL filtering. If

your intention is to selectively block or allow traffic to the site, use application filtering.

To implement URL filtering, do one of the following:

•Subscribe to the Cloud Web Security service, where you configure your filtering policies in

ScanCenter, and then configure the ASA to send traffic to your Cloud Web Security account.

•Install the ASA FirePOWER module on the ASA and use URL filtering criteria in your ASA

FirePOWER access rules. These policies apply to any traffic that you redirect to the module.

Related Topics

•ASA and Cisco Cloud Web Security, page 8-1

•ASA FirePOWER Module, page 7-1

Threat Protection

You can implement a number of measures to protect against scanning, denial of service (DoS), and other

attacks. A number of ASA features help protect against attacks by applying connection limits and

dropping abnormal TCP packets. Some features are automatic, others are configurable but have defaults

appropriate in most cases, while others are completely optional and you must configure them if you want

them.

Following are the threat protection services available with the ASA.

•IP packet fragmentation protection—The ASA performs full reassembly of all ICMP error messages

and virtual reassembly of the remaining IP fragments that are routed through the ASA, and drops

fragments that fail the security check. No configuration is necessary.

•Connection limits, TCP normalization, and other connection-related features—Configure

connection-related services such as TCP and UDP connection limits and timeouts, TCP sequence

number randomization, TCP normalization, and TCP state bypass. TCP normalization is designed

to drop packets that do not appear normal.

1-4

Cisco ASA Series Firewall CLI Configuration Guide

Chapter 1

Network Address Translation

For example, you can limit TCP and UDP connections and embryonic connections (a connection

request that has not finished the necessary handshake between source and destination). Limiting the

number of connections and embryonic connections protects you from a DoS attack. The ASA uses

the embryonic limit to trigger TCP Intercept, which protects inside systems from a DoS attack

perpetrated by flooding an interface with TCP SYN packets.

•Threat detection—Implement threat detection on the ASA to collect statistics to help identify

attacks. Basic threat detection is enabled by default, but you can implement advanced statistics and

scanning threat detection. You can shun hosts that are identified as a scanning threat.

•Next-Generation IPS—Install the ASA FirePOWER module on the ASA and implement Next

Generation IPS intrusion rules in your ASA FirePOWER. These policies would apply to any traffic

that you redirect to ASA FirePOWER.

Related Topics

•Connection Settings, page 16-1

•Threat Detection, page 18-1

•ASA FirePOWER Module, page 7-1

Network Address Translation

One of the main functions of Network Address Translation (NAT) is to enable private IP networks to

connect to the Internet. NAT replaces a private IP address with a public IP address, translating the private

addresses in the internal private network into legal, routable addresses that can be used on the public

Internet. In this way, NAT conserves public addresses because you can advertise at a minimum only one

public address for the entire network to the outside world.

Other functions of NAT include:

•Security—Keeping internal IP addresses hidden discourages direct attacks.

•IP routing solutions—Overlapping IP addresses are not a problem when you use NAT.

•Flexibility—You can change internal IP addressing schemes without affecting the public addresses

available externally; for example, for a server accessible to the Internet, you can maintain a fixed IP

address for Internet use, but internally, you can change the server address.

•Translating between IPv4 and IPv6 (Routed mode only)—If you want to connect an IPv6 network

to an IPv4 network, NAT lets you translate between the two types of addresses.

NAT is not required. If you do not configure NAT for a given set of traffic, that traffic will not be

translated, but will have all of the security policies applied as normal.

Related Topics

•Network Address Translation (NAT), page 9-1

•NAT Examples and Reference, page 10-1

1-5

Cisco ASA Series Firewall CLI Configuration Guide

Chapter 1

Application Inspection

Application inspection engines are required for services that embed IP addressing information in the user

data packet or that open secondary channels on dynamically assigned ports. These protocols require the

ASA to do a deep packet inspection, to open the required pinholes and to apply network address

translation (NAT).

The default ASA policy already applies inspection globally for many popular protocols, such as DNS,

FTP, SIP, ESMTP, TFTP, and others. The default inspections might be all you require for your network.

However, you might need to enable inspection for other protocols, or fine-tune an inspection. Many

inspections include detailed options that let you control packets based on their contents. If you know a

protocol well, you can apply fine-grained control on that traffic.

You use service policies to configure application inspection. You can configure a global service policy,

or apply a service policy to each interface, or both.

Related Topics

•Service Policy Using the Modular Policy Framework, page 11-1

•Getting Started with Application Layer Protocol Inspection, page 12-1

•Inspection of Basic Internet Protocols, page 13-1

•Inspection for Voice and Video Protocols, page 14-1

•Inspection of Database, Directory, and Management Protocols, page 15-1

Use Case: Expose a Server to the Public

You can make certain application services on a server available to the public. For example, you could

expose a web server, so that users can connect to the web pages but not make any other connections to

the server.

To expose a server to the public, you typically need to create access rules that allow the connection and

NAT rules to translate between the server’s internal IP address and an external address that the public

can use. In addition, you can use port address translation (PAT) to map an internal port to an external

port, if you do not want the externally exposed service to use the same port as the internal server. For

example, if the internal web server is not running on TCP/80, you can map it to TCP/80 to make

connections easier for external users.

The following example makes a web server on the inside private network available for public access.

1-6

Cisco ASA Series Firewall CLI Configuration Guide

Chapter 1

Use Case: Expose a Server to the Public

Figure 1-1 Static NAT for an Inside Web Server

Procedure

Step 1 Create a network object for the internal web server.

hostname(config)# object network myWebServ

hostname(config-network-object)# host 10.1.2.27

Step 2 Configure static NAT for the object:

hostname(config-network-object)# nat (inside,outside) static 209.165.201.10

Step 3 Add an access rule to the access group attached to the outside interface to permit web access to the

server.

hostname(config)# access-list outside_access_in line 1 extended permit tcp any4 object

myWebServ eq http

Step 4 If you do not already have an access group on the outside interface, apply it using the access-group

command:

hostname(config)# access-group outside_access_in in interface outside

Related Topics

•Static NAT, page 9-27

Outside

Inside

10.1.2.1

209.165.201.1

Security

Appliance

myWebServ

10.1.2.27

209.165.201.12

10.1.2.27 209.165.201.10

248772

Undo Translation

Otros manuales para Cisco ASA Series

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Hardware de red de Cisco

Cisco

Cisco Firepower 4100 Series Manual de usuario

Cisco

Cisco NM-1FE-TX - Interface Module Ethernet Manual de usuario

Cisco

Cisco C8510MSR-SKIT-DC - Catalyst 8510 Multiservice Switch... Manual de usuario

Cisco

Cisco CVPN3015-NR - VPN Concentrator 3015 Manual de usuario

Cisco

Cisco Meraki MX65W Manual de usuario

Cisco

Cisco 7606 Manual de usuario

Cisco

Cisco VPN 3002 Hardware Client Manager Manual de usuario

Cisco

Cisco AIR-BR1410A-A-K9 - Aironet 1410 Wireless... Guía de referencia rápida

Cisco

Cisco Firepower 1010 FPR1010-NGFW-K9 Manual

Cisco

Cisco LightStream 1010 Manual

Cisco

Cisco Cisco 5400 ENCS Manual

Cisco

Cisco NM-1A-T3 - 1port Ds3 Atm Network Module Manual de usuario

Cisco

Cisco MGX 8260 Guía de inicio rápido

Cisco

Cisco Secure Firewall Management Center 1700 Manual de usuario

Cisco

Cisco Octal-Port DMT ATU-C Line Card Manual técnico

Cisco

Cisco Physical Access 1125 Appliance Manual de usuario

Cisco

Cisco IPS-4260-K9 - IPS Sensor 4260 Manual de usuario

Cisco

Cisco Edge 300 Series Guía de inicio rápido

Cisco

Cisco GS7000 Guía

Cisco

Cisco 220 Series Smart Plus Manual de usuario

Cisco

Cisco Cisco ONS 15600 SDH Manual de usuario

Cisco

Cisco WS-CE500 - Catalyst Express 500-24PC Manual de instrucciones

Cisco

Cisco IDS 4210 - Intrusion Detection Sys 4210... Manual de usuario

Cisco

Cisco Secure Network Server 3700 Series Manual

Manuales populares de Hardware de red de otras marcas

Matrix Switch Corporation

Matrix Switch Corporation MSC-HD161DEL Manual de usuario

B&B Electronics

B&B Electronics ZXT9-IO-222R2 Manual de usuario

Yudor

Yudor YDS-16 Manual de usuario

D-Link

D-Link ShareCenter DNS-320L Manual de usuario

Samsung

Samsung ES1642dc Instrucciones de uso

Honeywell Home

Honeywell Home LTEM-PV Instrucciones de montaje

evertz

evertz 7700 Series Manual de usuario

D-Link

D-Link ShareCenter DNS-343 Manual de usuario

Asante

Asante AsanteBridge 1012 Manual de usuario

FireBrick

FireBrick FB2700 Manual de usuario

Audiovox Electronics

Audiovox Electronics ARWH2T Manual de usuario

ADC

ADC DSX-1 Manual

NetComm

NetComm NF2 Manual de usuario

Alcatel-Lucent

Alcatel-Lucent 5620 Manual de usuario

Dell EMC

Dell EMC XC6420 Series Manual de usuario

Lanner

Lanner NCA-1020A Manual de usuario

Allied Telesis

Allied Telesis AT-TN121-A Manual de usuario

Arista

Arista CCA-ETM-Q12 Manual de usuario