Cisco 5505 - ASA Firewall Edition Bundle Bedienungsanleitung

Corporate Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 526-4100

Cisco ASA 5505

Getting Started Guide

Software Version 7.2

Customer Order Number: DOC-7817612=

Text Part Number: 78-17612-02

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT

NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT

ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR

THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION

PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO

LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE

PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED

OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL

DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR

INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH

DAMAGES.

CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We

Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP,

CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the

Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink,

Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers

logo, Networking Academy, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast,

SMARTnet, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates

in the United States and certain other countries.

All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply

a partnership relationship between Cisco and any other company. (0601R)

Cisco ASA 5505 Getting Started Guide

78-17612-02

CONTENTS

CHAPTER

1Before You Begin 1-1

CHAPTER

2Deployment Planning 2-1

Scenarios for Deployment Planning and Configuration 2-1

Scenario 1: Private Network with External Connectivity 2-3

Scenario 2: Basic Installation with DMZ 2-4

Scenario 3: IPSec Remote-Access VPN 2-5

Scenario 4: Site-to-Site VPN 2-6

Scenario 5: ASA 5505 Deployed as a Hardware VPN Client 2-7

Configuration Procedures for Scenarios 2-8

What to Do Next 2-9

CHAPTER

3Planning for a VLAN Configuration 3-1

Understanding VLANs on the ASA 5505 3-1

About Physical Ports on the ASA 5505 3-2

About VLANs 3-2

Maximum Number and Types of VLANs 3-3

Deployment Scenarios Using VLANs 3-4

Basic Deployment Using Two VLANs 3-5

DMZ Deployment 3-7

Teleworker Deployment Using Three VLANs 3-8

What to Do Next 3-9

Contents

Cisco ASA 5505 Getting Started Guide

78-17612-02

CHAPTER

4Installing the ASA 5505 4-1

Verifying the Package Contents 4-1

PoE Ports and Devices 4-3

Installing the Chassis 4-4

Connecting to Network Interfaces 4-4

Powering on the Cisco ASA 5505 4-6

Setting Up a PC for System Administration 4-6

Optional Procedures 4-7

Connecting to the Console 4-8

Installing a Cable Lock 4-9

Ports and LEDs 4-9

Front Panel Components 4-9

Rear Panel Components 4-12

What to Do Next 4-13

CHAPTER

5Configuring the Adaptive Security Appliance 5-1

About the Factory Default Configuration 5-1

About the Adaptive Security Device Manager 5-3

Using the Startup Wizard 5-4

Before Launching the Startup Wizard 5-4

Running the Startup Wizard 5-5

What to Do Next 5-7

CHAPTER

6Scenario: DMZ Configuration 6-1

Example DMZ Network Topology 6-1

Configuring the Security Appliance for a DMZ Deployment 6-5

Configuration Requirements 6-5

Starting ASDM 6-6

Cisco ASA 5505 Getting Started Guide

78-17612-02

Contents

Enabling Inside Clients to Communicate with Devices on the Internet 6-7

Enabling Inside Clients to Communicate with the DMZ Web Server 6-8

Translating Internal Client IP Addresses Between the Inside and DMZ

Interfaces 6-8

Translating the Public Address of the Web Server to its Real

Address 6-10

Configuring an External Identity for the DMZ Web Server 6-12

Providing Public HTTP Access to the DMZ Web Server 6-15

What to Do Next 6-18

CHAPTER

7Scenario: IPSec Remote-Access VPN Configuration 7-1

Example IPSec Remote-Access VPN Network Topology 7-1

Implementing the IPSec Remote-Access VPN Scenario 7-2

Information to Have Available 7-3

Starting ASDM 7-3

Configuring the ASA 5505 for an IPSec Remote-Access VPN 7-5

Selecting VPN Client Types 7-6

Specifying the VPN Tunnel Group Name and Authentication Method 7-7

Specifying a User Authentication Method 7-8

(Optional) Configuring User Accounts 7-10

Configuring Address Pools 7-11

Configuring Client Attributes 7-12

Configuring the IKE Policy 7-13

Configuring IPSec Encryption and Authentication Parameters 7-15

Specifying Address Translation Exception and Split Tunneling 7-16

Verifying the Remote-Access VPN Configuration 7-17

What to Do Next 7-18

CHAPTER

8Scenario: Site-to-Site VPN Configuration 8-1

Example Site-to-Site VPN Network Topology 8-1

Contents

Cisco ASA 5505 Getting Started Guide

78-17612-02

Implementing the Site-to-Site Scenario 8-2

Information to Have Available 8-3

Configuring the Site-to-Site VPN 8-3

Starting ASDM 8-3

Configuring the Security Appliance at the Local Site 8-4

Providing Information About the Remote VPN Peer 8-6

Configuring the IKE Policy 8-7

Configuring IPSec Encryption and Authentication Parameters 8-9

Specifying Hosts and Networks 8-10

Viewing VPN Attributes and Completing the Wizard 8-11

Configuring the Other Side of the VPN Connection 8-13

What to Do Next 8-14

CHAPTER

9Scenario: Easy VPN Hardware Client Configuration 9-1

Using an ASA 5505 as an Easy VPN Hardware Client 9-1

Client Mode and Network Extension Mode 9-3

Configuring the Easy VPN Hardware Client 9-5

Configuring Advanced Easy VPN Attributes 9-8

What to Do Next 9-9

APPENDIX

AObtaining a 3DES/AES License A-1

CHAPTER

1-1

Cisco ASA 5505 Getting Started Guide

78-17612-02

Before You Begin

Use the following table to find the installation and configuration steps that are

required for your implementation of the adaptive security appliance.

To Do This... See...

Learn about typical deployments of the

ASA 5505

Chapter 2, “Deployment Planning”

Learn about VLANs and port allocation

on the ASA 5505

Chapter 3, “Planning for a VLAN

Configuration”

Install the chassis Chapter 4, “Installing the ASA 5505”

Perform initial setup of the adaptive

security appliance

Chapter 5, “Configuring the

Adaptive Security Appliance”

Configure the adaptive security

appliance for your implementation

Chapter 6, “Scenario: DMZ

Configuration”

Chapter 7, “Scenario: IPSec

Remote-Access VPN Configuration”

Chapter 8, “Scenario: Site-to-Site

VPN Configuration”

Chapter 9, “Scenario: Easy VPN

Hardware Client Configuration”

Chapter 1 Before You Begin

1-2

Cisco ASA 5505 Getting Started Guide

78-17612-02

Refine configuration

Configure optional and advanced

features

Cisco Security Appliance Command

Line Configuration Guide

Cisco Security Appliance Command

Reference

Cisco Security Appliance Logging

Configuration and System Log

Messages

To Do This... (continued) See...

CHAPTER

2-1

Cisco ASA 5505 Getting Started Guide

78-17612-02

Deployment Planning

This document is based on several example scenarios that represent typical

customer deployments of the ASA 5505. The deployment scenarios in this

chapter correspond to subsequent configuration chapters.

This chapter includes the following sections:

• Scenarios for Deployment Planning and Configuration, page 2-1

• Scenario 1: Private Network with External Connectivity, page 2-3

• Scenario 2: Basic Installation with DMZ, page 2-4

• Scenario 3: IPSec Remote-Access VPN, page 2-5

• Scenario 4: Site-to-Site VPN, page 2-6

• Scenario 5: ASA 5505 Deployed as a Hardware VPN Client, page 2-7

Scenarios for Deployment Planning and

Configuration

An extended adaptive security appliance deployment can include two or more of

the different deployment scenarios described in this chapter. You can use the

deployment scenarios in this chapter to help you determine how you want to

deploy the adaptive security appliance on your network, and then determine which

configuration chapters apply to you.

Figure 2-1 illustrates an extended network that includes most of the deployment

and configuration scenarios included in this document.

Chapter 2 Deployment Planning

Scenarios for Deployment Planning and Configuration

2-2

Cisco ASA 5505 Getting Started Guide

78-17612-02

Figure 2-1 Extended Network Deployment

190924

Web Server

Remote Site

Adaptive Security

Appliance

Mobile Client

Using VPN

software client

Scenario 3: IPSec VPN

Connection

Scenario 6: Site-to-site VPN

Connection

Email Server

Adaptive Security

Appliance

CiscoASA SSC-05

Status

Security

Services

CardSlot

console

RESET

POWER

VDC

POWERoverETHERNET

543210

Scenario 2: Basic Installation

with DMZ

Scenario 1: Basic Installation

Internet

CiscoASA SSC-05

Status

Security

Services

CardSlot

console

RESET

POWER

VDC

POWERoverETHERNET

543210

Mobile Client

Using Cisco SSL

VPN Client software

Scenario 4: Cisco SSL

VPN Client

Mobile Client

Clientless SSL VPN

Scenario 5: Cisco SSL

VPN Client

Andere Handbücher für 5505 - ASA Firewall Edition Bundle

Inhaltsverzeichnis

Andere Cisco Firewall Handbücher

Cisco

Cisco ASA 5506-X Kurzanleitung

Cisco

Cisco Firepower 2100 Bedienungsanleitung

Cisco

Cisco M190 Bedienungsanleitung

Cisco

Cisco Small Business RV215W Bedienungsanleitung

Cisco

Cisco Cisco ASA Series Montageanleitung

Cisco

Cisco PIX 501 Handbuch

Cisco

Cisco MX400 Bedienungsanleitung

Cisco

Cisco ISA3000-4C-K9 Handbuch

Cisco

Cisco M690 Bedienungsanleitung

Cisco

Cisco PIX 520 - PIX Firewall 520 Bedienungsanleitung

Cisco

Cisco Meraki MX100 Bedienungsanleitung

Cisco

Cisco Firepower 1010 Bedienungsanleitung

Cisco

Cisco ISA 3000 Bedienungsanleitung

Cisco

Cisco ASA 5512-X Bedienungsanleitung

Cisco

Cisco Small Business RV220W Bedienungsanleitung

Cisco

Cisco 881W - Integrated Services Router Wireless Bedienungsanleitung

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Bedienungsanleitung

Cisco

Cisco Firepower 1100 Bedienungsanleitung

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Bedienungsanleitung

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Bedienungsanleitung

Cisco

Cisco ASA 5508-X Bedienungsanleitung

Cisco

Cisco Firepower 2120 Handbuch

Cisco

Cisco LightStream 1010 Bedienungsanleitung

Cisco

Cisco Cisco ASA Series Bedienungsanleitung

Beliebte Firewall Handbücher anderer Marken

Fortinet

Fortinet FortiGate Voice Series Bedienungsanleitung

ADTRAN

ADTRAN NetVanta 2300 Bedienungsanleitung

SecureLogix

SecureLogix ETM System Bedienungsanleitung

NETGEAR

NETGEAR ProSafe FVX538 Bedienungsanleitung

Lanner

Lanner FW-8877 Bedienungsanleitung

Huawei

Huawei USG6000 Series Installations- und Betriebshandbuch

H3C

H3C SecPath F5000-AI-15 Bedienungsanleitung

Nexcom

Nexcom DNA 1150 Bedienungsanleitung

Fortinet

Fortinet FortiGate-60 series Bedienungsanleitung

Draytek

Draytek Vigor2860 Series Bedienungsanleitung

Lanner electronics

Lanner electronics FW-7650 Series Bedienungsanleitung

Swisscom

Swisscom Internet Backup Bedienungsanleitung

SonicWALL

SonicWALL NSa 5700 Bedienungsanleitung

DPtech

DPtech FW1000 SERIES Bedienungsanleitung

FEITIAN

FEITIAN MultiPass FIDO Bedienungsanleitung

EBLOCKER

EBLOCKER PRO Bedienungsanleitung

GTA

GTA GB-200 Bedienungsanleitung

Trend Micro

Trend Micro Deep Edge Bedienungsanleitung