CCNP Security FIREWALL 642-618 Official Cert Guide (2012)

You might also use a regular expression to display command output that contains IP addresses within a range. For example, the following command filters the output to contain only IP addresses that begin with 10.10.5, 10.10.6, and 10.10.7:

ciscoasa# show log | include 10.10.[5-7].*

Terminal Screen Format

By default, all output from an ASA is displayed for a terminal session screen that is 80 characters wide by 24 lines long. To change the terminal screen width, use the following configuration command:

ciscoasa(config)# terminal width characters

Here, characters is a value from 40 to 511. You can also specify 0, meaning the full 511-character width.

To change the screen length, or the number of lines displayed when paging through a large amount of output, use the following configuration command:

ciscoasa(config)# pager [lines] number

Here, number can be any positive value starting at 1. The lines keyword is optional, where the number of lines given is the same either with or without it.

You can also disable screen paging completely by using pager 0 or no pager. This action might be useful if you are capturing a large configuration or logging message output with a terminal emulator. With paging disabled, all of the output could scroll by and be captured into the emulator’s capture buffer. Otherwise, you would have to use the spacebar to page through the output and then later remove all the <-- More --> prompts that were captured.

Using Cisco ASDM

Cisco ASDM provides a GUI that you can use to administer, configure, and monitor an ASA. Although ASDM does not use a regular web browser, it does use the HTTPS protocol to communicate with the ASA.

To access ASDM, you need a PC-based launcher utility. The launcher allows you to select an ASA and enter administrator credentials. The launcher will then connect to the ASA, download the ASDM application (if it has not already been installed on the PC), and automatically launch it on the PC.

Before you can use ASDM, you need to enter an initial “bootstrap” configuration in the ASA using the following steps:

Step 1. Copy an ASDM image file into ASA flash memory.

Use a file transfer method such as TFTP to copy an ASDM image file from your PC to the ASA’s flash memory. Be aware that a specific ASDM image release might work with only a specific release of the ASA operating system. You can verify that the ASDM image is ready to use by using the dir disk0:/ command to display the flash file system contents, as shown here:

ciscoasa# dir disk0:/
Directory of disk0:/
132 -rwx 17232256 18:37:02 Nov 02 2011 asdm-645.bin
131 -rwx 25159680 18:36:08 Nov 02 2011 asa842-k8.bin
3 drwx 8192 14:04:34 Apr 27 2007 log
13 drwx 8192 14:05:02 Apr 27 2007 crypto_archive

255426560 bytes total (225050624 bytes free)
ciscoasa#

Step 2. Specify the ASDM image file to use.

Use the asdm image configuration command to specify which ASDM image file to use. For example, the following command tells the ASA to use ASDM release 6.4(5), contained in file disk0:/asdm-645.bin:

ciscoasa(config)# asdm image disk0:/asdm-645.bin

Once the ASDM image file has been specified, you can use the show asdm image command to display the file location and name.

Step 3. Enable the HTTP server process.

Use the following command to enable the HTTP server on the ASA. Both HTTP and HTTPS are supported, although ASDM uses only HTTPS.

ciscoasa(config)# http server enable

Step 4. Specify IP addresses that are permitted to access ASDM.

Because ASDM uses the HTTP server process, you can enter the following command to specify which IP addresses are permitted to access ASDM through a specified interface:

ciscoasa(config)# http ip-address subnet-mask interface

For example, you can use the following commands to permit clients in the 192.168.100.0/24 subnet on the outside interface and 192.168.2.0/24 on the inside interface to access ASDM:

ciscoasa(config)# http 192.168.100.0 255.255.255.0 outside
ciscoasa(config)# http 192.168.2.0 255.255.255.0 inside

You can also use the http 0.0.0.0 0.0.0.0 outside command to permit ASDM access to any host on the outside interface.

Next, you need to access ASDM for the first time. Open a web browser to the ASA interface that you have configured to permit HTTP connections. In Figure 2-1, the web browser has been opened to https://192.168.100.10—the outside interface of an ASA.

Figure 2-1. Accessing ASDM

The initial ASDM page gives you the following three options:

• Install ASDM Launcher and Run ASDM: The Launcher and ASDM will run as native applications on the PC, without the need for a web browser.

• Run ASDM: You can run ASDM from within the web browser as a Java application.

• Run Startup Wizard: ASDM will initiate a wizard to step you through the initial ASA configuration, if you have not already done so.

The first option is the most common choice and needs to be done only once. After the Launcher application is installed, you can run it directly to initiate an ASDM session. Click the Install ASDM Launcher and Run ASDM button. You will be prompted for an ASA username and password. The installer must authenticate with the ASA to download the Launcher file. ASDM always needs “enable” or the highest available user access in order to launch and run.

Next, the ASA prompts you to enter a location to store the downloaded Launcher installer, as shown in Figure 2-2. Click Save File and browse to the desired location. Once the installer file has been downloaded onto your PC, find the file and double-click it. The Launcher application will install and run automatically.

Figure 2-2. Saving the ASDM Installer File

Figure 2-3 shows the ASDM Launcher application. To connect to an ASA and begin an ASDM session, enter the ASA’s IP address and administrator credentials. The IP address will be cached and added to a list of possible ASAs so that you can choose from a list the next time you run the Launcher.

Figure 2-3. ASDM Launcher Application

Once the Launcher successfully connects to the ASA, the full-blown ASDM application window appears. Figure 2-4 shows the initial ASDM Home view. By clicking the buttons in the upper-left portion of the window, you can navigate through the following functions:

Figure 2-4. ASDM Home View

• Home: Displays information about the ASA platform, VPN sessions, CPU and memory resource usage, interface status, and traffic bandwidth.

• Configuration: Provides a hierarchy of ASA features and parameters that you configure and verify.

• Monitoring: Offers categories and lists of specific ASA parameters that you can monitor or observe.

At any time, you can click the Save button to save the current running configuration to the startup configuration, or click the Refresh button to load the current running configuration into ASDM.

In Configuration view, which is shown in Figure 2-5, you can select any of the following different feature categories in the lower-left area of the window:

• Device Setup: Features such as interfaces, routing, device name, and system time that are necessary for the ASA to operate

• Firewall: Stateful inspection features needed to inspect traffic and secure a network

• Remote Access VPN: Virtual private networks (VPN) used for remote clients to securely connect to the ASA

• Site-to-Site VPN: VPNs used for remote sites to securely connect to the ASA

• Device Management: Features such as management access, feature licensing, high availability, logging, DNS, and DHCP services

Figure 2-5. ASDM Configuration View

After selecting a feature category, you can select a specific feature to configure from the list in the middle-left portion of the ASDM window. You can then configure individual parameters that are shown in the main part of the window.

As you make configuration changes in ASDM, be aware that the changes are not made to the ASA dynamically. Instead, you must click the Apply button that is shown in Configuration view to actually apply the ASDM changes to the ASA’s running configuration.

In Monitoring view, shown in Figure 2-6, you can select categories of ASA functions to monitor. For example, you can select interface operation, VPN status, routing activity, device properties, and logging.

Figure 2-6. ASDM Monitoring View

Understanding the Factory Default Configuration

When an ASA boots for the first time, it comes up running a factory default or initial configuration. For the most part, the configuration is barebones, but provides enough functionality so that someone can connect a PC to the ASA and configure it further.

The initial configuration brings up the following basic functions:

• One interface is set aside as a protected “management” network, where a PC will be connected.

• A DHCP server is enabled on the management network, to automatically provide an IP address for the PC.

• An HTTP server is enabled on the management network, to allow the PC to access secure web-based ASDM sessions with the ASA via HTTPS over TCP port 443.

In the initial configuration, the management interface is always configured to use IP address 192.168.1.1 and subnet mask 255.255.255.0. The DHCP server is configured to provide addresses from a range of 192.168.1.2 to 192.168.1.254. The HTTP server is configured to allow ASDM sessions from devices on the 192.168.1.0/24 management network.

On ASA 5510 and higher platforms, the initial configuration always uses the Management0/0 physical interface for the management network, as shown in the top portion of Figure 2-7. The ASA 5505, however, doesn’t have a dedicated management interface. Instead, it uses VLAN 1 for the secure “inside” network, which is assigned to physical interfaces Ethernet0/1 through 0/7.

Figure 2-7. Using the ASA Factory Default Configuration

Because the ASA 5505 is usually installed in smaller environments, it often connects directly to an Internet service provider (ISP) through a broadband connection. The ASA 5505 default configuration provides basic connectivity from its inside network to the outside world, as shown in the bottom portion of Figure 2-7. The outside network must be connected to physical interface Ethernet0/0, which is mapped to VLAN 2. The ASA is configured to obtain an IP address for its outside interface automatically, through a DHCP request. Then, any device that is connected to the inside network will have its IP address translated as it passes through the ASA toward the outside world.

At any time in the future, you can force an ASA to return to its factory default configuration by entering the configure factory-default command in configuration mode. Be aware that this command immediately takes effect, with no further confirmation, as shown in Example 2-8. If you are connected to the ASA remotely, through Telnet, SSH, or ASDM, you will likely be cut off; instead, you should enter this command only while directly connected to the ASA console port.

Example 2-8. Returning an ASA to the Factory Default Configuration