Cisco ASA 5550 Series Bedienungsanleitung

Corporate Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 526-4100

Cisco ASA 5550

Getting Started Guide

Customer Order Number: DOC-7817644=

Text Part Number: 78-17644-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT

NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT

ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR

THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION

PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO

LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE

PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED

OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND

NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL

DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR

INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH

DAMAGES.

CCSP, CCVP, the Cisco Square Bridge logo, Follow Me Browsing, and StackWise are trademarks of Cisco Systems, Inc.; Changing the Way We

Work, Live, Play, and Learn, and iQuick Study are service marks of Cisco Systems, Inc.; and Access Registrar, Aironet, BPX, Catalyst, CCDA, CCDP,

CCIE, CCIP, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the

Cisco Systems logo, Cisco Unity, Enterprise/Solver, EtherChannel, EtherFast, EtherSwitch, Fast Step, FormShare, GigaDrive, GigaStack, HomeLink,

Internet Quotient, IOS, IP/TV, iQ Expertise, the iQ logo, iQ Net Readiness Scorecard, LightStream, Linksys, MeetingPlace, MGX, the Networkers

logo, Networking Academy, Network Registrar, Packe t, PIX, Post-Routing, Pre-Routing, ProConnect, RateMUX, ScriptShare, SlideCast,

SMARTnet, The Fastest Way to Increase Your Internet Quotient, and TransPath are registered trademarks of Cisco Systems, Inc. and/or its affiliates

in the United States and certain other countries.

All other trademarks mentioned in this document or Website are the property of their respective owners. The use of the word partner does not imply

a partnership relationship between Cisco and any other company. (0601R)

Cisco ASA 5550 Getting Started Guide

iii

Cisco ASA 5550 Getting Started Guide

78-17644-01

CONTENTS

CHAPTER

1Before You Begin 1-1

CHAPTER

2Maximizing Throughput on the ASA 5550 Adaptive Security Appliance 2-1

Embedded Network Interfaces 2-1

Balancing Traffic to Maximize Throughput 2-2

What to Do Next 2-5

CHAPTER

3Installing the Cisco ASA 5550 Security Appliance 3-1

Verifying the Package Contents 3-2

Installing the Chassis 3-3

Rack-Mounting the Chassis 3-4

Installing SFP Modules 3-5

SFP Module 3-6

Installing an SFP Module 3-7

Ports and LEDs 3-9

Front Panel LEDs 3-9

Rear Panel LEDs and Ports in Slot 0 3-10

Ports and LEDs in Slot 1 3-12

What to Do Next 3-13

CHAPTER

4Connecting Cables to Network Interfaces 4-1

Connecting Interface Cables 4-1

What to Do Next 4-7

Contents

Cisco ASA 5550 Getting Started Guide

78-17644-01

CHAPTER

5Configuring the Adaptive Security Appliance 5-1

About the Factory-Default Configuration 5-2

About the Adaptive Security Device Manager 5-2

Using the Startup Wizard 5-3

Before Launching the Startup Wizard 5-4

Running the Startup Wizard 5-4

Setting the Media Type for Fiber Interfaces 5-6

What to Do Next 5-7

CHAPTER

6Scenario: DMZ Configuration 6-1

Example DMZ Network Topology 6-1

Configuring the Security Appliance for a DMZ Deployment 6-4

Configuration Requirements 6-5

Starting ASDM 6-6

Creating IP Pools for Network Address Translation 6-7

Configuring NAT for Inside Clients to Communicate with the DMZ Web

Server 6-12

Configuring NAT for Inside Clients to Communicate with Devices on the

Internet 6-15

Configuring an External Identity for the DMZ Web Server 6-16

Providing Public HTTP Access to the DMZ Web Server 6-18

What to Do Next 6-24

CHAPTER

7Scenario: Remote-Access VPN Configuration 7-1

Example IPsec Remote-Access VPN Network Topology 7-1

Implementing the IPsec Remote-Access VPN Scenario 7-2

Information to Have Available 7-3

Starting ASDM 7-4

Configuring the ASA 5550 for an IPsec Remote-Access VPN 7-5

Cisco ASA 5550 Getting Started Guide

78-17644-01

Contents

Selecting VPN Client Types 7-6

Specifying the VPN Tunnel Group Name and Authentication Method 7-7

Specifying a User Authentication Method 7-8

(Optional) Configuring User Accounts 7-10

Configuring Address Pools 7-11

Configuring Client Attributes 7-12

Configuring the IKE Policy 7-13

Configuring IPsec Encryption and Authentication Parameters 7-15

Specifying Address Translation Exception and Split Tunneling 7-16

Verifying the Remote-Access VPN Configuration 7-17

What to Do Next 7-18

CHAPTER

8Scenario: Site-to-Site VPN Configuration 8-1

Example Site-to-Site VPN Network Topology 8-1

Implementing the Site-to-Site Scenario 8-2

Information to Have Available 8-2

Configuring the Site-to-Site VPN 8-3

Starting ASDM 8-3

Configuring the Security Appliance at the Local Site 8-4

Providing Information About the Remote VPN Peer 8-6

Configuring the IKE Policy 8-7

Configuring IPsec Encryption and Authentication Parameters 8-9

Specifying Hosts and Networks 8-10

Viewing VPN Attributes and Completing the Wizard 8-11

Configuring the Other Side of the VPN Connection 8-13

What to Do Next 8-13

APPENDIX

AObtaining a DES License or a 3DES-AES License A-1

Contents

Cisco ASA 5550 Getting Started Guide

78-17644-01

CHAPTER

1-1

Cisco ASA 5550 Getting Started Guide

78-17644-01

Before You Begin

Use the following table to find the installation and configuration steps that are

required for your implementation of the adaptive security appliance.

To Do This ... See ...

Install the chassis Chapter 3, “Installing the Cisco ASA

5550 Security Appliance”

Connect cables to network interfaces Chapter 4, “Connecting Cables to

Network Interfaces”

Perform initial setup of the adaptive

security appliance

Chapter 5, “Configuring the Adaptive

Security Appliance”

Configure the adaptive security

appliance for your implementation

Chapter 6, “Scenario: DMZ

Configuration”

Chapter 7, “Scenario: Remote-Access

VPN Configuration”

Chapter 8, “Scenario: Site-to-Site VPN

Configuration”

Refine configuration

Configure optional and advanced

features

Cisco Security Appliance Command

Line Configuration Guide

Cisco Security Appliance Command

Reference

Cisco Security Appliance Logging

Configuration and System Log

Messages

Chapter 1 Before You Begin

1-2

Cisco ASA 5550 Getting Started Guide

78-17644-01

CHAPTER

2-1

Cisco ASA 5550 Getting Started Guide

78-17644-01

Maximizing Throughput on the ASA

5550 Adaptive Security Appliance

The Cisco ASA 5550 Series Security Appliance is designed to deliver maximum

throughput when configured according to the guidelines described in this chapter.

This chapter includes the following sections:

•Embedded Network Interfaces, page 2-1

•Balancing Traffic to Maximize Throughput, page 2-2

•What to Do Next, page 2-5

Embedded Network Interfaces

The adaptive security appliance has two internal buses providing copper Gigabit

Ethernet and fiber Gigabit Ethernet connectivity:

•Slot 0 (corresponding to Bus 0) has four embedded copper Gigabit Ethernet

ports

•Slot 1 (corresponding to Bus 1) has four embedded copper Gigabit Ethernet

ports and four embedded SFPs that support fiber Gigabit Ethernet

connectivity

Chapter 2 Maximizing Throughput on the ASA 5550 Adaptive Security Appliance

Balancing Traffic to Maximize Throughput

2-2

Cisco ASA 5550 Getting Started Guide

78-17644-01

Note To establish fiber connectivity on the adaptive security appliance, you must order

and install SFP modules for each fiber port you want to use. For more information

on fiber ports and SFP modules, see the “Installing SFP Modules” section on

page 3-5.

Figure 2-1 shows the embedded ports on the FWSM.

Figure 2-1 Embedded Ports on the ASA 5550

Note Although Slot 1 has four copper Ethernet ports and four fiber Ethernet ports, you

can use only four Slot 1 ports at a time. For example, you could use two Slot 1

copper ports and two fiber ports, but you cannot use fiber ports if you are already

using all four Slot 1 copper ports.

Balancing Traffic to Maximize Throughput

To maximize traffic throughput, configure the adaptive security appliance so that

traffic is distributed equally between the two buses in the device. To achieve this,

lay out the network so that all traffic flows through both Bus 0 (Slot 0) and Bus 1

(Slot 1), entering through one bus and exiting through the other.

153217

LINK SPD

MGMT USB2 USB1

FLASH

CONSOLE AUX

POWER

STATUS

FLASH

VPN

ACTIVE

PWR

STATUS

LNK SPD0123

Slot 1 Slot 0

Ethernet Fiber Ethernet

Inhaltsverzeichnis

Andere Cisco Firewall Handbücher

Cisco

Cisco Cisco ASA 5500 Series Bedienungsanleitung

Cisco

Cisco 5510 - ASA SSL / IPsec VPN Edition Bedienungsanleitung

Cisco

Cisco RV110W Bedienungsanleitung

Cisco

Cisco FPR1010-ASA-K9 Bedienungsanleitung

Cisco

Cisco Firepower 9300 Handbuch

Cisco

Cisco PIX 506E - Security Appliance Bedienungsanleitung

Cisco

Cisco Meraki MX64W Bedienungsanleitung

Cisco

Cisco RV120W Bedienungsanleitung

Cisco

Cisco amp threat grid Bedienungsanleitung

Cisco

Cisco Small Business RV215W Bedienungsanleitung

Cisco

Cisco Firepower 2100 Series Kurzanleitung

Cisco

Cisco RV110W Bedienungsanleitung

Cisco

Cisco Firepower 4110 Bedienungsanleitung

Cisco

Cisco MEREAKI MX65W Bedienungsanleitung

Cisco

Cisco Firepower 2120 Handbuch

Cisco

Cisco C170 Bedienungsanleitung

Cisco

Cisco Firepower 3500 Technisches Dokument

Cisco

Cisco ISA3000-4C-K9 Handbuch

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Bedienungsanleitung

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Bedienungsanleitung

Cisco

Cisco 5580-40 - ASA Firewall Edition Handbuch

Cisco

Cisco M190 Bedienungsanleitung

Cisco

Cisco ASA 5506-X Bedienungsanleitung

Cisco

Cisco PIX 506E - Security Appliance Bedienungsanleitung

Beliebte Firewall Handbücher anderer Marken

Fortinet

Fortinet FortiGate Voice Series Bedienungsanleitung

ADTRAN

ADTRAN NetVanta 2300 Bedienungsanleitung

SecureLogix

SecureLogix ETM System Bedienungsanleitung

NETGEAR

NETGEAR ProSafe FVX538 Bedienungsanleitung

Lanner

Lanner FW-8877 Bedienungsanleitung

Huawei

Huawei USG6000 Series Installations- und Betriebshandbuch

H3C

H3C SecPath F5000-AI-15 Bedienungsanleitung

Nexcom

Nexcom DNA 1150 Bedienungsanleitung

Fortinet

Fortinet FortiGate-60 series Bedienungsanleitung

Draytek

Draytek Vigor2860 Series Bedienungsanleitung

Lanner electronics

Lanner electronics FW-7650 Series Bedienungsanleitung

Swisscom

Swisscom Internet Backup Bedienungsanleitung

SonicWALL

SonicWALL NSa 5700 Bedienungsanleitung

DPtech

DPtech FW1000 SERIES Bedienungsanleitung

FEITIAN

FEITIAN MultiPass FIDO Bedienungsanleitung

EBLOCKER

EBLOCKER PRO Bedienungsanleitung

GTA

GTA GB-200 Bedienungsanleitung

Trend Micro

Trend Micro Deep Edge Bedienungsanleitung