Security Appliance

Admin Context Configuration

The admin context is just like any other context, except that when a user logs in to the admin context, then that user has system administrator rights and can access the system and all other contexts. The admin context is not restricted in any way, and can be used as a regular context. However, because logging into the admin context grants you administrator privileges over all contexts, you might need to restrict access to the admin context to appropriate users. The admin context must reside on...

Configuring L2TP over IPSec Connections

To configure the security appliance to accept L2TP over IPSec connections, follow these steps Configuring L2TP over IPSec Connections H Note The security appliance does not establish an L2TP IPSec tunnel with Windows 2000 if either the Cisco VPN Client Version 3.x or the Cisco VPN 3000 Client Version 2.5 is installed. Disable the Cisco VPN Service for the Cisco VPN Client Version 3.x, or the ANetIKE Service for the Cisco VPN 3000 Client Version 2.5 from the Services panel in Windows 2000 (click...

Configuring VLAN Interfaces

For each VLAN to pass traffic, you need to configure an interface name (the nameif command), and for routed mode, an IP address. You should also change the security level from the default, which is 0. If you name an interface inside and you do not set the security level explicitly, then the adaptive security appliance sets the security level to 100. For information about how many VLANs you can configure, see the Maximum Active VLAN Interfaces for Your License section on page 4-2. If you are...

Configuring and Enabling VLAN Subinterfaces and 8021Q Trunking

This section describes how to configure and enable a VLAN subinterface. An interface with one or more VLAN subinterfaces is automatically configured as an 802.1Q trunk. You must enable the physical interface before any traffic can pass through an enabled subinterface (see the Configuring and Enabling RJ-45 Interfaces section on page 5-1 or the Configuring and Enabling Fiber Interfaces section on page 5-2). For multiple context mode, if you allocate a subinterface to a context, the interfaces...

Using the show failover Command

This section describes the show failover command output. On each unit you can verify the failover status by entering the show failover command. The information displayed depends upon whether you are using Active Standby or Active Active failover. This section includes the following topics show failover Active Standby, page 14-40 Show Failover Active Active, page 14-44 The following is sample output from the show failover command for Active Standby Failover. Table 14-7 provides descriptions for...

Creating a Policy for Traffic Shaping and Hierarchical Priority Queueing

You can create a policy map for an interface or globally for all interfaces that assigns QoS actions (and other feature actions) to the traffic in the class map. (See the Chapter 21, Using Modular Policy Framework, for information about other features. This chapter only discusses QoS.) You can configure traffic shaping for all traffic on an interface, and optionally hierarchical priority queueing for a subset of latency-sensitive traffic. See the How QoS Features Interact section on page 24-4...

Configuring Dynamic NAT or PAT

This section describes how to configure dynamic NAT or dynamic PAT. The configuration for dynamic NAT and PAT are almost identical for NAT you specify a range of mapped addresses, and for PAT you specify a single address. Figure 17-19 shows a typical dynamic NAT scenario. Only translated hosts can create a NAT session, and responding traffic is allowed back. The mapped address is dynamically assigned from a pool defined by the global command. Figure 17-20 shows a typical dynamic PAT scenario....

Using Dynamic Crypto Maps

A dynamic crypto map is a crypto map without all of the parameters configured. It acts as a policy template where the missing parameters are later dynamically learned, as the result of an IPSec negotiation, to match the peer requirements. The security appliance applies a dynamic crypto map to let a peer negotiate a tunnel if its IP address is not already identified in a static crypto map. This occurs with the following types of peers Peers with dynamically assigned public IP addresses. Both...

Configuring an IPSec Pass Through Inspection Policy Map for Additional Inspection Control

Inspect IPSec Pass Through is disabled by default. When enabled without using a parameter map, the inspection uses the default IPSec Pass Through parameter map, which allows only ESP traffic with unlimited connections and the default idle timeout of 10 minutes for the ESP connection. To pass ESP or AH traffic, IPSec Pass Through parameter map is required. To create an IPSec Pass Through map, perform the following steps Step 1 To create an IPSec Pass Through inspection policy map, enter the...

Enabling the DHCP Server

The security appliance can act as a DHCP server. DHCP is a protocol that supplies network settings to hosts including the host IP address, the default gateway, and a DNS server. Note The security appliance DHCP server does not support BOOTP requests. In multiple context mode, you cannot enable the DHCP server or DHCP relay on an interface that is used by more than one context. You can configure a DHCP server on each interface of the security appliance. Each interface can have its own pool of...

SCCP Inspection Overview

Skinny (SCCP) is a simplified protocol used in VoIP networks. Cisco IP Phones using SCCP can coexist in an H.323 environment. When used with Cisco CallManager, the SCCP client can interoperate with H.323 compliant terminals. Application layer functions in the security appliance recognize SCCP Version 3.3. There are 5 versions of the SCCP protocol 2.4, 3.0.4, 3.1.1, 3.2, and 3.3.2. The security appliance supports all versions through Version 3.3.2. The security appliance supports PAT and NAT for...

Using Static PAT

This section describes how to configure a static port translation. Static PAT lets you translate the real IP address to a mapped IP address, as well as the real port to a mapped port. You can choose to translate the real port to the same port, which lets you translate only specific types of traffic, or you can take it further by translating to a different port. Figure 17-22 shows a typical static PAT scenario. The translation is always active so both translated and remote hosts can originate...

Configuring Firewall Policies

A firewall isolates and protects a computer from the Internet by inspecting each inbound and outbound individual packet of data to determine whether to allow or drop it. Firewalls provide extra security if remote users in a group have split tunneling configured. In this case, the firewall protects the user's PC, and thereby the corporate network, from intrusions by way of the Internet or the user's local LAN. Remote users connecting to the security appliance with the VPN client can choose the...

Configuring IPv6 Access Lists

Configuring an IPv6 access list is similar configuring an IPv4 access, but with IPv6 addresses. To configure an IPv6 access list, perform the following steps Step 1 Create an access entry. To create an access list, use the ipv6 access-list command to create entries for the access list. There are two main forms of this command to choose from, one for creating access list entries specifically for ICMP traffic, and one to create access list entries for all other types of IP traffic. To create an...

Sessioning to the Aip Ssm and Running Setup

After you have completed configuration of the ASA 5500 series adaptive security appliance to divert traffic to the AIP SSM, session to the AIP SSM and run the setup utility for initial configuration. _ Note You can either session to the SSM from the adaptive security appliance (by using the session 1 command) or you can connect directly to the SSM using SSH or Telnet on its management interface. Alternatively, you can use ASDM. To session to the AIP SSM from the adaptive security appliance,...

Getting Started with the Csc Ssm

Note The SSM management port IP address must be accessible by the hosts used to run ASDM. The IP addresses for the SSM management port and the adaptive security appliance management interface can be in different subnets. HTTP proxy server IP address (required only if your security policies require use of a proxy server for HTTP access to the Internet). Domain name and hostname for the SSM. An email address and an SMTP server IP address and port number, for email notifications. IP addresses of...

Enabling IPSec over TCP

IPSec over TCP enables a Cisco VPN client to operate in an environment in which standard ESP or ISAKMP cannot function, or can function only with modification to existing firewall rules. IPSec over TCP encapsulates both the ISAKMP and IPSec protocols within a TCP-like packet, and enables secure tunneling through both NAT and PAT devices and firewalls. This feature is disabled by default. _ Note This feature does not work with proxy-based firewalls. IPSec over TCP works with remote access...

How DNS Rewrite Works

When DNS inspection is enabled, DNS rewrite provides full support for NAT of DNS messages originating from any interface. If a client on an inside network requests DNS resolution of an inside address from a DNS server on an outside interface, the DNS A-record is translated correctly. If the DNS inspection engine is disabled, the A-record is not translated. As long as DNS inspection remains enabled, you can configure DNS rewrite using the alias, static, or nat commands. For details about the...

Verifying and Monitoring Ctiqbe Inspection

The show ctiqbe command displays information regarding the CTIQBE sessions established across the security appliance. It shows information about the media connections allocated by the CTIQBE inspection engine. The following is sample output from the show ctiqbe command under the following conditions. There is only one active CTIQBE session setup across the security appliance. It is established between an internal CTI device (for example, a Cisco IP SoftPhone) at local address 10.0.0.99 and an...

Configuring WebVPN Tunnel Group WebVPN Attributes

To configure the parameters specific to a WebVPN tunnel group, follow the steps in this section. Step 1 To specify the attributes of a WebVPN tunnel-group, enter tunnel-group webvpn-attributes mode by entering the following command. The prompt changes to indicate the mode change hostname(config) tunnel-group tunnel-group-name webvpn-attributes hostname(config-tunnel-ipsec) For example, to specify the webvpn-attributes for the WebVPN tunnel-group named sales, enter the following command...

Configuring Security Attributes

The attributes in this section specify certain security settings for the group Step 1 Specify whether to let users store their login passwords on the client system, using the password-storage command with the enable keyword in group-policy configuration mode. To disable password storage, use the password-storage command with the disable keyword. hostname(config-group-policy) password-storage enable disable hostname(config-group-policy) For security reasons, password storage is disabled by...

ICMP Error Inspection

When this feature is enabled, the security appliance creates translation sessions for intermediate hops that send ICMP error messages, based on the NAT configuration. The security appliance overwrites the packet with the translated IP addresses. When disabled, the security appliance does not create translation sessions for intermediate nodes that generate ICMP error messages. ICMP error messages generated by the intermediate nodes between the inside host and the security appliance reach the...

Enabling the TCP Normalizer

This feature uses Modular Policy Framework, so that implementing TCP normalization consists of identifying traffic, specifying the TCP normalization actions, and activating TCP normalization on an interface. See Chapter 21, Using Modular Policy Framework, for more information. To configure TCP normalization, perform the following steps Step 1 To specify the TCP normalization criteria that you want to look for, create a TCP map by entering the following command hostname(config) tcp-map...

Active Standby Failover

This section describes Active Standby failover and includes the following topics Active Standby Failover Overview, page 14-6 Primary Secondary Status and Active Standby Status, page 14-6 Device Initialization and Configuration Synchronization, page 14-7 Command Replication, page 14-7 Failover Triggers, page 14-8 Failover Actions, page 14-9 Active Standby failover lets you use a standby security appliance to take over the functionality of a failed unit. When the active unit fails, it changes to...

Configuring Radius Authorization

When authentication succeeds, the RADIUS protocol returns user authorizations in the access-accept message sent by a RADIUS server. For more information about configuring authentication, see the Configuring Authentication for Network Access section on page 19-1. When you configure the security appliance to authenticate users for network access, you are also implicitly enabling RADIUS authorizations therefore, this section contains no information about configuring RADIUS authorization on the...

Group Policies

This section describes group policies and how to configure them. It includes the following sections Default Group Policy, page 30-31 Configuring Group Policies, page 30-33 A group policy is a set of user-oriented attribute value pairs for IPSec connections that are stored either internally (locally) on the device or externally on a RADIUS server. The tunnel group uses a group policy that sets terms for user connections after the tunnel is established. Group policies let you apply whole sets of...

Configuring WINS and DNS Servers

You can specify primary and secondary WINS servers and DNS servers. The default value in each case is none. To specify these servers, do the following steps Step 1 Specify the primary and secondary WINS servers hostname(config-group-policy) wins-server value ip_address ip_address none hostname(config-group-policy) The first IP address specified is that of the primary WINS server. The second (optional) IP address is that of the secondary WINS server. Specifying the none keyword instead of an IP...

Configuring IPSec Remote Access Tunnel Group IPSec Attributes

To configure the IPSec attributes for a remote-access tunnel group, do the following steps. The following description assumes that you have already created the IPSec remote-access tunnel group. IPSec remote-access tunnel groups have more attributes than IPSec LAN-to-LAN tunnel groups Step 1 To specify the attributes of an IPSec remote-access tunnel-group, enter tunnel-group ipsec-attributes mode by entering the following command. The prompt changes to indicate the mode change hostname(config)...

LDAP Attribute Mapping

If you are introducing a security appliance to an existing LDAP directory, your existing LDAP attribute names and values are probably different from the existing ones. You must create LDAP attribute maps that map your existing user-defined attribute names and values to Cisco attribute names and values that are compatible with the security appliance. You can then bind these attribute maps to LDAP servers or remove them as needed. You can also show or clear attribute maps. Note To use the...

Clearing Security Associations

Certain configuration changes take effect only during the negotiation of subsequent SAs. If you want the new settings to take effect immediately, clear the existing SAs to reestablish them with the changed configuration. If the security appliance is actively processing IPSec traffic, clear only the portion of the SA database that the configuration changes affect. Reserve clearing the full SA database for large-scale changes, or when the security appliance is processing a small amount of IPSec...

Configuring the Interface

By default, all physical interfaces are shut down. You must enable the physical interface before any traffic can pass through an enabled subinterface. For multiple context mode, if you allocate a physical interface or subinterface to a context, the interfaces are enabled by default in the context. However, before traffic can pass through the context interface, you must also enable the interface in the system configuration. If you shut down an interface in the system execution space, then that...

License Requirements

On the PIX 500 series security appliance, at least one of the units must have an unrestricted (UR) license. The other unit can have a Failover Only (FO) license, a Failover Only Active-Active (FO_AA) license, or another UR license. Units with a Restricted license cannot be used for failover, and two units with FO or FO_AA licenses cannot be used together as a failover pair. _ Note The FO license does not support Active Active failover. The FO and FO_AA licenses are intended to be used solely...

Active Active Failover

This section describes Active Active failover. This section includes the following topics Active Active Failover Overview, page 14-10 Primary Secondary Status and Active Standby Status, page 14-10 Device Initialization and Configuration Synchronization, page 14-11 Command Replication, page 14-12 Failover Triggers, page 14-13 Failover Actions, page 14-13 Active Active failover is only available to security appliances in multiple context mode. In an Active Active failover configuration, both...

Configuring LANBased Active Active Failover

This section describes how to configure Active Active failover using an Ethernet failover link. When configuring LAN-based failover, you must bootstrap the secondary device to recognize the failover link before the secondary device can obtain the running configuration from the primary device. This section includes the following topics Configure the Primary Unit, page 14-29 Configure the Secondary Unit, page 14-31 To configure the primary unit in an Active Active failover configuration, perform...

IPSec Pass Through Inspection Overview

The IPSec Pass Through inspection engine lets the security appliance pass ESP (IP protocol 50) and AH (IP protocol 51) traffic that is formed between two hosts because of successful IKE (UDP port 500) negotiation without the requirement of specific ESP or AH access lists. The inspection engine works on IKE UDP port 500 to create the control flow. The inspect ipsec-pass-thru command is attached to an UDP flow as defined in the MPF framework. When an ESP or AH packet between the two peers arrives...

SQLNet Inspection

SQL*Net inspection is enabled by default. The SQL*Net protocol consists of different packet types that the security appliance handles to make the data stream appear consistent to the Oracle applications on either side of the security appliance. The default port assignment for SQL*Net is 1521. This is the value used by Oracle for SQL*Net, but this value does not agree with IANA port assignments for Structured Query Language (SQL). Use the class-map command to apply SQL*Net inspection to a range...

Configuring DNS Rewrite

Using the Static Command for DNS Rewrite Note Using the nat command is similar to using the static command except that DNS Rewrite is based on dynamic translation instead of a static mapping. Using the Alias Command for DNS Rewrite The alias command causes the security appliance to translate addresses on an IP network residing on any interface into addresses on another IP network connected through a different interface. The syntax for this command is as follows hostname(config) alias...

Configuring a DNS Inspection Policy Map for Additional Inspection Control

DNS application inspection supports DNS message controls that provide protection against DNS spoofing and cache poisoning. User configurable rules allow filtering based on DNS header, domain name, resource record type and class. Zone transfer can be restricted between servers with this function, for example. The Recursion Desired and Recursion Available flags in the DNS header can be masked to protect a public server from attack if that server only supports a particular internal zone. In...

ASA 5510 and Higher Default Configuration

The default factory configuration for the ASA 5510 and higher adaptive security appliance configures the following The management interface, Management 0 0. If you did not set the IP address in the configure factory-default command, then the IP address and mask are 192.168.1.1 and 255.255.255.0. The DHCP server is enabled on the security appliance, so a PC connecting to the interface receives an address between 192.168.1.2 and 192.168.1.254. The HTTP server is enabled for ASDM and is accessible...

Enabling ActiveX Filtering

This section describes how to remove ActiveX objects in HTTP traffic passing through the security appliance. To remove ActiveX objects, enter the following command in global configuration mode hostname(config) filter activexport -port local_ip local_maskforeign_ip foreign_mask To use this command, replace port with the TCP port to which filtering is applied. Typically, this is port 80, but other values are accepted. The http or url literal can be used for port 80. You can specify a range of...

Filtering Java Applets

This section describes how to apply filtering to remove Java applets from HTTP traffic passing through the firewall. Java applets may pose security risks because they can contain code intended to attack hosts and servers on a protected network. You can remove Java applets with the filter java command. The filter java command filters out Java applets that return to the security appliance from an outbound connection. The user still receives the HTML page, but the web page source for the applet is...

Managing Sun RPC Services

Use the Sun RPC services table to control Sun RPC traffic through the security appliance based on established Sun RPC sessions. To create entries in the Sun RPC services table, use the sunrpc-server command in global configuration mode hostname(config) sunrpc-server interface_name ip_address mask service service_type protocol tcp udp port -port timeout hh mm ss You can use this command to specify the timeout after which the pinhole that was opened by Sun RPC application inspection will be...

Caching Server Addresses

After a user accesses a site, the filtering server can allow the security appliance to cache the server address for a certain amount of time, as long as every site hosted at the address is in a category that is permitted at all times. Then, when the user accesses the server again, or if another user accesses the server, the security appliance does not need to consult the filtering server again. Note Requests for cached IP addresses are not passed to the filtering server and are not logged. As a...

Configuring IPv6 Duplicate Address Detection

During the stateless autoconfiguration process, duplicate address detection verifies the uniqueness of new unicast IPv6 addresses before the addresses are assigned to interfaces (the new addresses remain in a tentative state while duplicate address detection is performed). Duplicate address detection is performed first on the new link-local address. When the link local address is verified as unique, then duplicate address detection is performed all the other IPv6 unicast addresses on the...

Permitting Intra Interface Traffic

The security appliance includes a feature that lets a VPN client send IPSec-protected traffic to another VPN user by allowing such traffic in and out of the same interface. Also called hairpinning, this feature can be thought of as VPN spokes (clients) connecting through a VPN hub (security appliance). In another application, this feature can redirect incoming VPN traffic back out through the same interface as unencrypted traffic. This would be useful, for example, to a VPN client that does not...

Using Active Directory to Enforce Minimum Password Length

To enforce a minimum length for passwords, specify the password-management command in tunnel-group general-attributes configuration mode on the security appliance and do the following steps under Active Directory Step 1 Select Start > Programs > Administrative Tools > Domain Security Policy. Step 2 Select Windows Settings > Security Settings > Account Policies > Password Policy. Step 3 Double-click Minimum Password Length. This opens the Security Policy Setting dialog box. Step 4...

Interface Monitoring

You can monitor up to 250 interfaces divided between all contexts. You should monitor important interfaces, for example, you might configure one context to monitor a shared interface (because the interface is shared, all contexts benefit from the monitoring). When a unit does not receive hello messages on a monitored interface for half of the configured hold time, it runs the following tests 1. Link Up Down test A test of the interface status. If the Link Up Down test indicates that the...

Dcerpc Inspection

This section describes the DCERPC inspection engine. This section includes the following topics DCERPC Overview, page 25-11 Configuring a DCERPC Inspection Policy Map for Additional Inspection Control, page 25-12 DCERPC is a protocol widely used by Microsoft distributed client and server applications that allows software clients to execute programs on a server remotely. This typically involves a client querying a server called the Endpoint Mapper listening on a well known port number for the...

Creating the Standard Priority Queue for an Interface

If you enable standard priority queueing for traffic on a physical interface, then you need to also create the priority queue on each interface. Each physical interface uses two queues one for priority traffic, and the other for all other traffic. For the other traffic, you can optionally configure policing. Note The standard priority queue is not required for hierarchical priority queueing with traffic shaping see the Priority Queueing Overview section on page 24-3 for more information. To...

Configuring Static Route Tracking

One of the problems with static routes is that there is no inherent mechanism for determining if the route is up or down. They remain in the routing table even if the next hop gateway becomes unavailable. Static routes are only removed from the routing table if the associated interface on the security appliance goes down. The static route tracking feature provides a method for tracking the availability of a static route and installing a backup route if the primary route should fail. This allows...

An Inside User Visits a Web Server on the DMZ

Figure 15-4 shows an inside user accessing the DMZ web server. The following steps describe how data moves through the security appliance (see Figure 15-4) 1. A user on the inside network requests a web page from the DMZ web server using the destination address of 10.1.1.3. 2. The security appliance receives the packet and because it is a new session, the security appliance verifies that the packet is allowed according to the terms of the security policy (access lists, filters, AAA). For...

Traffic Shaping Overview

Traffic shaping is used to match device and link speeds, thereby controlling packet loss, variable delay, and link saturation, which can cause jitter and delay. Traffic shaping must be applied to all outgoing traffic on a physical interface or in the case of the ASA 5505, on a VLAN. You cannot configure traffic shaping for specific types of traffic. Traffic shaping is implemented when packets are ready to be transmitted on an interface, so the rate calculation is performed based on the actual...

Enabling WCCP Redirection

There are two steps to configuring WCCP redirection on the security appliance. The first involves identifying the service to be redirected with the wccp command, and the second is defining on which interface the redirection occurs with the wccp redirect command. The wccp command can optionally also define which cache engines can participate in the service group, and what traffic should be redirected to the cache engine. WCCP redirect is supported only on the ingress of an interface. The only...

NAT Control

NAT control requires that packets traversing from an inside interface to an outside interface match a NAT rule for any host on the inside network to access a host on the outside network, you must configure NAT to translate the inside host address (see Figure 17-2). Figure 17-2 NAT Control and Outbound Traffic Figure 17-2 NAT Control and Outbound Traffic Interfaces at the same security level are not required to use NAT to communicate. However, if you configure dynamic NAT or PAT on a same...

Using Active Directory to Force the User to Change Password at Next Logon

To force a user to change the user password at the next logon, specify the password-management command in tunnel-group general-attributes configuration mode on the security appliance and do the following steps under Active Directory Step 1 Select to Start > Programs > Administrative Tools > Active Directory Users and Computers (Figure 30-1). Figure 30-1 Active Directory Administrative Tools Menu Figure 30-1 Active Directory Administrative Tools Menu Step 2 Right-click Username >...

An Outside User Visits a Web Server on the DMZ

Figure 15-3 shows an outside user accessing the DMZ web server. j Cisco Security Appliance Command Line Configuration Guide The following steps describe how data moves through the security appliance (see Figure 15-3) 1. A user on the outside network requests a web page from the DMZ web server using the global destination address of 209.165.201.3, which is on the outside interface subnet. 2. The security appliance receives the packet and because it is a new session, the security appliance...

Verifying and Monitoring Sun RPC Inspection

The sample output in this section is for a Sun RPC server with an IP address of 192.168.100.2 on the inside interface and a Sun RPC client with an IP address of 209.168.200.5 on the outside interface. To view information about the current Sun RPC connections, enter the show conn command. The following is sample output from the show conn command hostname show conn 15 in use, 21 most used UDP out 209.165.200.5 800 in 192.168.100.2 2049 idle 0 00 04 flags -UDP out 209.165.200.5 714 in...

Configuring an Esmtp Inspection Policy Map for Additional Inspection Control

To specify actions when a message violates a parameter, create an ESMTP inspection policy map. You can then apply the inspection policy map when you enable ESMTP inspection according to the Configuring Application Inspection section on page 25-5. To create an ESMTP inspection policy map, perform the following steps Step 1 (Optional) Add one or more regular expressions for use in traffic matching commands according to the Creating a Regular Expression section on page 21-12. See the types of text...

Using MAC Addresses to Exempt Traffic from Authentication and Authorization

The security appliance can exempt from authentication and authorization any traffic from specific MAC addresses. For example, if the security appliance authenticates TCP traffic originating on a particular network but you want to allow unauthenticated TCP connections from a specific server, you would use a MAC exempt rule to exempt from authentication and authorization any traffic from the server specified by the rule. This feature is particularly useful to exempt devices such as IP phones that...

ActiveX Filtering Overview

ActiveX objects may pose security risks because they can contain code intended to attack hosts and servers on a protected network. You can disable ActiveX objects with ActiveX filtering. ActiveX controls, formerly known as OLE or OCX controls, are components you can insert in a web page or other application. These controls include custom forms, calendars, or any of the extensive third-party forms for gathering or displaying information. As a technology, ActiveX creates many potential problems...

Managing Aip Ssm and Csc Ssm

The Cisco ASA 5500 series adaptive security appliance supports a variety of SSMs. This chapter describes how to configure the adaptive security appliance to support an AIP SSM or a CSC SSM, including how to send traffic to these SSMs. For information about the 4GE SSM for the ASA 5000 series adaptive security appliance, see Chapter 5, Configuring Ethernet Settings and Subinterfaces. Note The Cisco PIX 500 series security appliances cannot support SSMs. This chapter includes the following...

Dynamic NAT and PAT Implementation

Figure 17-13 nat and global ID Matching See the following commands for this example hostname(config) nat (inside) 1 10.1.2.0 255.255.255.0 hostname(config) global (outside) 1 209.165.201.3-209.165.201.10 You can enter a nat command for each interface using the same NAT ID they all use the same global command when traffic exits a given interface. For example, you can configure nat commands for Inside and DMZ interfaces, both on NAT ID 1. Then you configure a global command on the Outside...

Configuring NAT Exemption

NAT exemption exempts addresses from translation and allows both real and remote hosts to originate connections. NAT exemption lets you specify the real and destination addresses when determining the real traffic to exempt (similar to policy NAT), so you have greater control using NAT exemption than identity NAT. However unlike policy NAT, NAT exemption does not consider the ports in the access list. Use static identity NAT to consider ports in the access list. Figure 17-25 shows a typical NAT...

Using Static NAT

This section describes how to configure a static translation. Figure 17-21 shows a typical static NAT scenario. The translation is always active so both translated and remote hosts can originate connections, and the mapped address is statically assigned by the static command. You cannot use the same real or mapped address in multiple static commands between the same two interfaces. Do not use a mapped address in the static command that is also defined in a global command for the same mapped...

Configuring WebVPN Tunnel Group General Attributes

To configure or change the tunnel group general attributes, specify the parameters in the following steps. Step 1 To configure the general attributes, enter tunnel-group general-attributes command, which enters tunnel-group general-attributes configuration mode. Note that the prompt changes hostname(config) tunnel-group tunnel_group_name general-attributes hostname(config-tunnel-general) To configure the general attributes for TunnelGroup3, created in the previous section, enter the following...

SMTP and Extended SMTP Inspection

ESMTP application inspection provides improved protection against SMTP-based attacks by restricting the types of SMTP commands that can pass through the security appliance and by adding monitoring capabilities. SMTP and Extended SMTP Inspection ESMTP is an enhancement to the SMTP protocol and is similar is most respects to SMTP. For convenience, the term SMTP is used in this document to refer to both SMTP and ESMTP. The application inspection process for extended SMTP is similar to SMTP...

GTP Inspection Overview

GPRS provides uninterrupted connectivity for mobile subscribers between GSM networks and corporate networks or the Internet. The GGSN is the interface between the GPRS wireless data network and other networks. The SGSN performs mobility, data session management, and data compression (See Figure 25-3). The UMTS is the commercial convergence of fixed-line telephony, mobile, Internet and computer technology. UTRAN is the networking protocol used for implementing wireless networks in this system....

SSO Support for WebVPN with HTTP Forms

The security appliance can use the HTTP Form protocol for single sign-on (SSO) authentication of WebVPN users only. Single sign-on support lets WebVPN users enter a username and password only once to access multiple protected services and Web servers. The WebVPN server running on the security appliance acts as a proxy for the user to the authenticating server. When a user logs in, the WebVPN server sends an SSO authentication request, including username and password, to the authenticating...

Configuring Tacacs Authorization

You can configure the security appliance to perform network access authorization with TACACS+. You identify the traffic to be authorized by specifying access lists that authorization rules must match. Alternatively, you can identify the traffic directly in authorization rules themselves. Tip Using access lists to identify traffic to be authorized can greatly reduced the number of authorization commands you must enter. This is because each authorization rule you enter can specify only one source...