Cisco 5505 - ASA Firewall Edition Bundle Bedienungsanleitung

Corporate Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 526-4100

Cisco ASA 5505 Getting Started

Guide

Customer Order Number: DOC-7817612=

Text Part Number: 78-17612-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT

NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT

ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR

THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE

INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU

ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A

COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE

PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED

OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL

DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR

INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH

DAMAGES.

CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We

Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA,

CCDP, CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems

Capital, the Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive,

GigaStack, HomeLink, Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace,

MGX, the Networkers logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX,

ScriptShare, SlideCast, SMARTnet, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems,

Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply

a partnership relationship between Cisco and any other company. (0601R)

Cisco ASA 5505 Getting Started Guide

iii

Cisco ASA 5505 Getting Started Guide

78-17612-01

CONTENTS

CHAPTER

1Before You Begin 1-1

CHAPTER

2Planning for a VLAN Configuration 2-1

Understanding VLANS 2-1

Deployment Scenarios with VLANs 2-2

Scenario 1: Inside VLAN with External Connectivity 2-3

Scenario 2: Multiple VLANs 2-4

Scenario 3: Network with an Inside VLAN and Dual ISP Connectivity 2-5

Scenario 4: Private VLAN Services 2-6

Maximum Number and Types of VLANs 2-7

What to Do Next 2-8

CHAPTER

3Installing the ASA 5505 3-1

Verifying the Package Contents 3-2

PoE Ports and Devices 3-3

Installing the Chassis 3-4

Connecting to Network Interfaces 3-4

Powering on the ASA 5505 3-5

Setting Up a PC for System Administration 3-6

Optional Procedures 3-7

Connecting to the Console 3-7

Installing a Cable Lock 3-8

Ports and LEDs 3-9

Front Panel Components 3-9

Contents

Cisco ASA 5505 Getting Started Guide

78-17612-01

Rear Panel Components 3-12

What to Do Next 3-13

CHAPTER

4Configuring the Adaptive Security Appliance 4-1

About the Factory Default Configuration 4-1

About the Adaptive Security Device Manager 4-2

Using the Startup Wizard 4-3

Before Launching the Startup Wizard 4-3

Running the Startup Wizard 4-5

What to Do Next 4-7

CHAPTER

5Scenario: Easy VPN Hardware Client Configuration 5-1

Using an ASA 5505 as an Easy VPN Hardware Client 5-1

Client Mode and Network Extension Mode 5-2

Configuring the Easy VPN Hardware Client 5-5

Configuring Advanced Easy VPN Attributes 5-8

What to Do Next 5-9

CHAPTER

6Scenario: DMZ Configuration 6-1

Example DMZ Network Topology 6-1

Configuring the Security Appliance for a DMZ Deployment 6-4

Configuration Requirements 6-5

Starting ASDM 6-6

Creating IP Pools for Network Address Translation 6-7

Configuring NAT for Inside Clients to Communicate with the DMZ Web

Server 6-12

Configuring NAT for Inside Clients to Communicate with Devices on the

Internet 6-15

Configuring an External Identity for the DMZ Web Server 6-16

Cisco ASA 5505 Getting Started Guide

78-17612-01

Contents

Providing Public HTTP Access to the DMZ Web Server 6-18

What to Do Next 6-24

CHAPTER

7Scenario: IPsec Remote-Access VPN Configuration 7-1

Example IPsec Remote-Access VPN Network Topology 7-1

Implementing the IPsec Remote-Access VPN Scenario 7-2

Information to Have Available 7-3

Starting ASDM 7-4

Configuring the ASA 5505 for an IPsec Remote-Access VPN 7-5

Selecting VPN Client Types 7-6

Specifying the VPN Tunnel Group Name and Authentication Method 7-7

Specifying a User Authentication Method 7-8

(Optional) Configuring User Accounts 7-10

Configuring Address Pools 7-11

Configuring Client Attributes 7-12

Configuring the IKE Policy 7-13

Configuring IPsec Encryption and Authentication Parameters 7-15

Specifying Address Translation Exception and Split Tunneling 7-16

Verifying the Remote-Access VPN Configuration 7-17

What to Do Next 7-18

CHAPTER

8Scenario: Site-to-Site VPN Configuration 8-1

Example Site-to-Site VPN Network Topology 8-1

Implementing the Site-to-Site Scenario 8-2

Information to Have Available 8-2

Configuring the Site-to-Site VPN 8-3

Starting ASDM 8-3

Configuring the Security Appliance at the Local Site 8-4

Providing Information About the Remote VPN Peer 8-6

Contents

Cisco ASA 5505 Getting Started Guide

78-17612-01

Configuring the IKE Policy 8-7

Configuring IPsec Encryption and Authentication Parameters 8-9

Specifying Hosts and Networks 8-10

Viewing VPN Attributes and Completing the Wizard 8-11

Configuring the Other Side of the VPN Connection 8-13

What to Do Next 8-13

APPENDIX

AObtaining a DES License or a 3DES-AES License A-1

CHAPTER

1-1

Cisco ASA 5505 Getting Started Guide

78-17612-01

Before You Begin

Use the following table to find the installation and configuration steps that are

required for your implementation of the adaptive security appliance.

To Do This ... See ...

Learn about deploying the ASA 5505

using VLANs

Chapter 2, “Planning for a VLAN

Configuration”

Install the chassis Chapter 3, “Installing the ASA 5505”

Perform initial setup of the adaptive

security appliance

Chapter 4, “Configuring the

Adaptive Security Appliance”

Configure the adaptive security

appliance for your implementation

Chapter 5, “Scenario: Easy VPN

Hardware Client Configuration”

Chapter 6, “Scenario: DMZ

Configuration”

Chapter 7, “Scenario: IPsec

Remote-Access VPN Configuration”

Chapter 8, “Scenario: Site-to-Site

VPN Configuration”

Chapter 1 Before You Begin

1-2

Cisco ASA 5505 Getting Started Guide

78-17612-01

Refine configuration

Configure optional and advanced

features

Cisco Security Appliance Command

Line Configuration Guide

Cisco Security Appliance Command

Reference

Cisco Security Appliance Logging

Configuration and System Log

Messages

To Do This ... (continued) See ...

CHAPTER

2-1

Cisco ASA 5505 Getting Started Guide

78-17612-01

Planning for a VLAN Configuration

Before you install the ASA 5505, you should consider whether you want to use

the device to segment your network into VLANs. This chapter describes the

options and benefits of deploying the ASA 5505 in a VLAN configuration and

presents several typical VLAN scenarios.

If you do not want to use VLANs in your ASA 5505 configuration, continue with

Chapter 3, “Installing the ASA 5505.”

This chapter includes the following sections:

•Understanding VLANS, page 2-1

•Deployment Scenarios with VLANs, page 2-2

•Maximum Number and Types of VLANs, page 2-7

•What to Do Next, page 2-8

Understanding VLANS

On the ASA 5505, you can divide the eight physical interfaces into groups, called

VLANs, that function as separate networks. Grouping ports into VLANs enables

you to segment large private networks and provide additional protection to critical

network segments that may host resources such as servers, corporate computers,

and IP phones.

You can group ports into a maximum of three VLANs (for example, one each for

Personal use, Business, and Internet). Using VLANs, you can also segregate

network traffic so that even devices on the same VLAN are unable to

communicate with each other.

Chapter 2 Planning for a VLAN Configuration

Deployment Scenarios with VLANs

2-2

Cisco ASA 5505 Getting Started Guide

78-17612-01

With the Base license, each switch port can be assigned to any one VLAN at a

time. That is, configuring a single port to trunk between the VLANs of an external

switch is not possible. However, with the Security Plus license, you can use a

single port to trunk between three VLANs on an external switch.

Physical interfaces on the same VLAN communicate with each other using

hardware switching. Security policies can be applied to all communications

between VLANs to enable strict access control and protection of sensitive devices

in the Business VLAN.

VLANs can be configured in both Layer 2 Transparent mode as well as in the

Layer 3 Routed mode. (In routed mode, forwarding is done based on the route

table. In transparent mode, forwarding is done based on the Layer 2 bridge table.)

Deployment Scenarios with VLANs

This section describes several deployment scenarios using the ASA 5505 in which

the network is divided into VLANs.

This section includes the following topics:

•Scenario 1: Inside VLAN with External Connectivity, page 2-3

•Scenario 2: Multiple VLANs, page 2-4

•Scenario 3: Network with an Inside VLAN and Dual ISP Connectivity,

page 2-5

•Scenario 4: Private VLAN Services, page 2-6

Andere Handbücher für 5505 - ASA Firewall Edition Bundle

Inhaltsverzeichnis

Andere Cisco Firewall Handbücher

Cisco

Cisco 515E - PIX Restricted Bundle Bedienungsanleitung

Cisco

Cisco PIX 506E - Security Appliance Bedienungsanleitung

Cisco

Cisco RV110W Bedienungsanleitung

Cisco

Cisco PIX 506 - Firewall Bedienungsanleitung

Cisco

Cisco Small Business Pro SA 520W Bedienungsanleitung

Cisco

Cisco PIX 520 - PIX Firewall 520 Bedienungsanleitung

Cisco

Cisco 5510 - ASA SSL / IPsec VPN Edition Bedienungsanleitung

Cisco

Cisco 3110 Handbuch

Cisco

Cisco Small Business RV215W Bedienungsanleitung

Cisco

Cisco ISA3000-4C-K9 Handbuch

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Bedienungsanleitung

Cisco

Cisco RV120W Bedienungsanleitung

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Bedienungsanleitung

Cisco

Cisco MX400 Bedienungsanleitung

Cisco

Cisco 2100 Series Bedienungsanleitung

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Bedienungsanleitung

Cisco

Cisco 5510 - ASA SSL / IPsec VPN Edition Bedienungsanleitung

Cisco

Cisco M690 Bedienungsanleitung

Cisco

Cisco RV120W Bedienungsanleitung

Cisco

Cisco Cisco ASA Series Bedienungsanleitung

Cisco

Cisco TelePresence Server 7010 Bedienungsanleitung

Cisco

Cisco Firepower 3500 Technisches Dokument

Cisco

Cisco PIX 501 - Security Appliance Bedienungsanleitung

Cisco

Cisco Small Business RV220W Bedienungsanleitung

Beliebte Firewall Handbücher anderer Marken

Fortinet

Fortinet FortiGate Voice Series Bedienungsanleitung

ADTRAN

ADTRAN NetVanta 2300 Bedienungsanleitung

SecureLogix

SecureLogix ETM System Bedienungsanleitung

NETGEAR

NETGEAR ProSafe FVX538 Bedienungsanleitung

Lanner

Lanner FW-8877 Bedienungsanleitung

Huawei

Huawei USG6000 Series Installations- und Betriebshandbuch

H3C

H3C SecPath F5000-AI-15 Bedienungsanleitung

Nexcom

Nexcom DNA 1150 Bedienungsanleitung

Fortinet

Fortinet FortiGate-60 series Bedienungsanleitung

Draytek

Draytek Vigor2860 Series Bedienungsanleitung

Lanner electronics

Lanner electronics FW-7650 Series Bedienungsanleitung

Swisscom

Swisscom Internet Backup Bedienungsanleitung

SonicWALL

SonicWALL NSa 5700 Bedienungsanleitung

DPtech

DPtech FW1000 SERIES Bedienungsanleitung

FEITIAN

FEITIAN MultiPass FIDO Bedienungsanleitung

EBLOCKER

EBLOCKER PRO Bedienungsanleitung

GTA

GTA GB-200 Bedienungsanleitung

Trend Micro

Trend Micro Deep Edge Bedienungsanleitung