Sign In
Upload
Manuals
Brands
Cisco Manuals
Chassis
ASA 5508-X
Cisco ASA 5508-X Manuals
Manuals and User Guides for Cisco ASA 5508-X. We have
8
Cisco ASA 5508-X manuals available for free PDF download: Configuration Manual, Software Manual, Hardware Installation Manual, Manual, Easy Setup Manual, Quick Start Manual, Mount And Connect
Cisco ASA 5508-X Configuration Manual (429 pages)
Firewall CLI, ASA Services Module, and the Adaptive Security Virtual Appliance
Brand:
Cisco
| Category:
Network Hardware
| Size: 5.93 MB
Table of Contents
About this Guide
3
Document Objectives
3
Related Documentation
3
Obtaining Documentation and Submitting a Service Request
4
Introduction to Cisco ASA Firewall Services
5
How to Implement Firewall Services
5
Basic Access Control
6
Application Filtering
6
Url Filtering
7
Threat Protection
7
Network Address Translation
8
Application Inspection
9
Use Case: Expose a Server to the Public
9
Access Control
11
Objects for Access Control
13
Guidelines for Objects
13
Configure Objects
14
Configure Network Objects and Groups
14
Configure a Network Object
14
Configure a Network Object Group
15
Configure Service Objects and Service Groups
16
Configure a Service Object
16
Configure a Service Group
17
Configure Local User Groups
19
Configure Security Group Object Groups
20
Configure Time Ranges
21
Monitoring Objects
22
History for Objects
23
Access Control Lists
25
About Acls
25
ACL Types
25
ACL Names
26
Access Control Entry Order
27
Permit/Deny Vs. Match/Do Not Match
27
Access Control Implicit Deny
27
IP Addresses Used for Extended Acls When You Use NAT
28
Time-Based Aces
28
Guidelines for Acls
29
Configure Acls
30
Basic ACL Configuration and Management Options
30
Configure Extended Acls
31
Add an Extended ACE for IP Address or Fully-Qualified Domain Name-Based Matching
31
Add an Extended ACE for TCP or UDP-Based Matching, with Ports
33
Add an Extended ACE for ICMP-Based Matching
34
Add an Extended ACE for User-Based Matching (Identity Firewall)
34
Add an Extended ACE for Security Group-Based Matching (Cisco Trustsec)
35
Example of Converting Addresses to Objects for Extended Acls
37
Configure Standard Acls
37
Configure Webtype Acls
38
Add a Webtype ACE for URL Matching
38
Adding a Webtype ACE for IP Address Matching
39
Examples for Webtype Acls
40
Configure Ethertype Acls
41
Examples for Ethertype Acls
42
Edit Acls in an Isolated Configuration Session
42
Monitoring Acls
44
History for Acls
45
Access Rules
47
Controlling Network Access
47
General Information about Rules
48
Interface Access Rules and Global Access Rules
48
Inbound and Outbound Rules
48
Rule Order
49
Implicit Permits
49
Implicit Deny
50
NAT and Access Rules
50
Extended Access Rules
50
Extended Access Rules for Returning Traffic
51
Allowing Broadcast and Multicast Traffic through the Transparent Firewall Using Access Rules
51
Management Access Rules
51
Ethertype Rules
52
Guidelines for Access Control
53
Configure Access Control
53
Configure an Access Group
53
Configure ICMP Access Rules
54
Monitoring Access Rules
56
Evaluating Syslog Messages for Access Rules
56
History for Access Rules
58
Identity Firewall
61
About the Identity Firewall
61
Architecture for Identity Firewall Deployments
62
Features of the Identity Firewall
63
Deployment Scenarios
64
Guidelines for the Identity Firewall
67
Prerequisites for the Identity Firewall
69
Configure the Identity Firewall
70
Configure the Active Directory Domain
70
Configure Active Directory Agents
73
Configure Identity Options
74
Configure Identity-Based Security Policy
78
Collect User Statistics
79
Examples for the Identity Firewall
79
VPN Filter Example
80
VPN with IDFW Rule -1 Example
81
VPN with IDFW Rule -2 Example
81
Monitoring the Identity Firewall
81
History for the Identity Firewall
82
ASA and Cisco Trustsec
83
About Cisco Trustsec
83
About SGT and SXP Support in Cisco Trustsec
84
Roles in the Cisco Trustsec Feature
85
Security Group Policy Enforcement
85
How the ASA Enforces Security Group-Based Policies
86
Effects of Changes to Security Groups on the ISE
87
Speaker and Listener Roles on the ASA
88
SXP Chattiness
89
SXP Timers
89
IP-SGT Manager Database
90
Features of the ASA-Cisco Trustsec Integration
90
Register the ASA with the ISE
92
Create a Security Group on the ISE
92
Generate the PAC File
93
Guidelines for Cisco Trustsec
93
Configure the AAA Server for Cisco Trustsec Integration
95
Import a PAC File
97
Configure the Security Exchange Protocol
99
Add an SXP Connection Peer
101
Refresh Environment Data
102
Configure the Security Policy
102
Layer 2 Security Group Tagging Imposition
104
Usage Scenarios
104
Configure a Security Group Tag on an Interface
106
Configure IP-SGT Bindings Manually
107
Troubleshooting Tips
107
Example for Cisco Trustsec
108
Anyconnect VPN Support for Cisco Trustsec
108
Typical Steps for a Remote User Connecting to a Server
108
Add an SGT to Local Users and Groups
109
Monitoring Cisco Trustsec
109
History for Cisco Trustsec
110
ASA Firepower Module
111
About the ASA Firepower Module
111
How the ASA Firepower Module Works with the ASA
111
ASA Firepower Inline Mode
112
ASA Firepower Passive Monitor-Only Traffic Forwarding Mode
114
ASA Firepower Management
115
Compatibility with ASA Features
115
Licensing Requirements for the ASA Firepower Module
115
Guidelines for ASA Firepower
115
Defaults for ASA Firepower
116
Perform Initial ASA Firepower Setup
117
Deploy the ASA Firepower Module in Your Network
117
Access the ASA Firepower CLI
119
Configure ASA Firepower Basic Settings
119
Configure the ASA Firepower Module
120
Configure the Security Policy on the ASA Firepower Module
120
Redirect Traffic to the ASA Firepower Module
120
Configure Inline or Inline Tap Monitor-Only Modes
121
Configure Passive Traffic Forwarding
122
Managing the ASA Firepower Module
123
Install or Reimage the Module
123
Install or Reimage the Software Module
124
Reimage the ASA 5585-X ASA Firepower Hardware Module
126
Reset the Password
128
Reload or Reset the Module
128
Shut down the Module
129
Uninstall a Software Module Image
129
Session to the Software Module from the ASA
130
Upgrade the System Software
130
Monitoring the ASA Firepower Module
131
Showing Module Status
131
Showing Module Statistics
132
Monitoring Module Connections
132
Examples for the ASA Firepower Module
133
History for the ASA Firepower Module
134
ASA and Cisco Cloud Web Security
137
Information about Cisco Cloud Web Security
137
User Identity and Cloud Web Security
138
Authentication Keys
138
Scancenter Policy
138
Directory Groups
139
Custom Groups
139
How Groups and the Authentication Key Interoperate
140
Failover from Primary to Backup Proxy Server
140
Licensing Requirements for Cisco Cloud Web Security
140
Guidelines for Cloud Web Security
141
Configure Cisco Cloud Web Security
142
Configure Communications with the Cloud Web Security Proxy Server
142
Identify Whitelisted Traffic
144
Configure a Service Policy to Send Traffic to Cloud Web Security
145
Configure the User Identity Monitor
149
Configure the Cloud Web Security Policy
150
Monitoring Cloud Web Security
150
Examples for Cisco Cloud Web Security
151
Cloud Web Security Example with Identity Firewall
151
Active Directory Integration Example for Identity Firewall
153
History for Cisco Cloud Web Security
155
Network Address Translation
157
Network Address Translation (NAT)
159
NAT Basics
160
NAT Terminology
160
NAT Types
161
Network Object NAT and Twice NAT
161
Comparing Network Object NAT and Twice NAT
162
NAT Rule Order
163
NAT Interfaces
164
Guidelines for NAT
164
Firewall Mode Guidelines for NAT
165
Ipv6 NAT Guidelines
165
Ipv6 NAT Recommendations
165
Additional Guidelines for NAT
166
Network Object NAT Guidelines for Mapped Address Objects
167
Twice NAT Guidelines for Real and Mapped Address Objects
168
Twice NAT Guidelines for Service Objects for Real and Mapped Ports
169
Dynamic NAT
170
About Dynamic NAT
170
Dynamic NAT Disadvantages and Advantages
171
Configure Dynamic Network Object NAT
172
Configure Dynamic Twice NAT
174
Dynamic PAT
176
About Dynamic PAT
176
Dynamic PAT Disadvantages and Advantages
177
PAT Pool Object Guidelines
177
Configure Dynamic Network Object PAT
178
Configure Dynamic Twice PAT
180
Configure Per-Session PAT or Multi-Session PAT
183
About Static NAT
185
Static NAT with Port Translation
185
One-To-Many Static NAT
187
Other Mapping Scenarios (Not Recommended)
189
Configure Static Network Object NAT or Static NAT-With-Port-Translation
190
Configure Static Twice NAT or Static NAT-With-Port-Translation
192
Identity NAT
195
Configure Identity Network Object NAT
195
Configure Identity Twice NAT
197
Monitoring NAT
198
History for NAT
199
NAT Examples and Reference
205
Examples for Network Object NAT
205
Providing Access to an Inside Web Server (Static NAT)
205
NAT for Inside Hosts (Dynamic NAT) and NAT for an Outside Web Server (Static NAT)
206
Inside Load Balancer with Multiple Mapped Addresses (Static NAT, One-To-Many)
208
Examples for Twice NAT
210
Different Translation Depending on the Destination (Dynamic Twice PAT)
210
Example: Twice NAT with Destination Address Translation
213
NAT in Routed and Transparent Mode
213
NAT in Routed Mode
214
NAT in Transparent Mode
214
Routing NAT Packets
215
Mapped Addresses and Routing
216
Addresses on the same Network as the Mapped Interface
216
Addresses on a Unique Network
216
The same Address as the Real Address (Identity NAT)
217
Transparent Mode Routing Requirements for Remote Networks
218
Determining the Egress Interface
218
NAT and Remote Access VPN
219
NAT and Site-To-Site VPN
221
NAT and VPN Management Access
223
Troubleshooting NAT and VPN
225
DNS Reply Modification, DNS Server on Outside
226
DNS Reply Modification, DNS Server, Host, and Server on Separate Networks
227
DNS Reply Modification, DNS Server on Host Network
228
DNS64 Reply Modification Using Outside NAT
229
PTR Modification, DNS Server on Host Network
231
Service Policies and Application Inspection
233
About Service Policies
235
The Components of a Service Policy
235
Features Configured with Service Policies
238
Feature Matching Within a Service Policy
239
Order in Which Multiple Feature Actions Are Applied
240
Incompatibility of Certain Feature Actions
240
Feature Matching for Multiple Service Policies
242
Guidelines for Service Policies
242
Defaults for Service Policies
243
Default Service Policy Configuration
243
Default Class Maps (Traffic Classes)
244
Configure Service Policies
245
Identify Traffic (Layer 3/4 Class Maps)
247
Create a Layer 3/4 Class Map for through Traffic
247
Create a Layer 3/4 Class Map for Management Traffic
249
Define Actions (Layer 3/4 Policy Map)
250
Apply Actions to an Interface (Service Policy)
251
Monitoring Service Policies
252
Examples for Service Policies (Modular Policy Framework)
252
History for Service Policies
255
Application Layer Protocol Inspection
257
How Inspection Engines Work
257
When to Use Application Protocol Inspection
258
Inspection Policy Maps
259
Replacing an In-Use Inspection Policy Map
259
How Multiple Traffic Classes Are Handled
260
Guidelines for Application Inspection
261
Defaults for Application Inspection
262
Default Inspections and NAT Limitations
262
Default Inspection Policy Maps
265
Configure Application Layer Protocol Inspection
265
Choosing the Right Traffic Class for Inspection
270
Configure Regular Expressions
271
Create a Regular Expression
271
Create a Regular Expression Class Map
273
History for Application Inspection
274
DNS Inspection
275
DNS Inspection Actions
276
Defaults for DNS Inspection
276
Configure DNS Inspection
276
Configure DNS Inspection Policy Map
277
Configure the DNS Inspection Service Policy
280
Monitoring DNS Inspection
282
Strict FTP
283
ICMP Inspection
295
ICMP Error Inspection
295
Instant Messaging Inspection
295
Configure an Instant Messaging Inspection Policy Map
296
Configure the IM Inspection Service Policy
298
IP Options Inspection
300
IP Options Inspection Overview
300
What Happens When You Clear an Option
300
Supported IP Options for Inspection
301
Defaults for IP Options Inspection
301
Configure IP Options Inspection
301
Configure an IP Options Inspection Policy Map
302
Configure the IP Options Inspection Service Policy
302
Monitoring IP Options Inspection
304
Ipsec Pass through Inspection
304
Ipsec Pass through Inspection Overview
304
Configure Ipsec Pass through Inspection
304
Configure an Ipsec Pass through Inspection Policy Map
305
Configure the Ipsec Pass through Inspection Service Policy
306
Ipv6 Inspection
307
Defaults for Ipv6 Inspection
307
Configure Ipv6 Inspection
308
Configure an Ipv6 Inspection Policy Map
308
Configure the Ipv6 Inspection Service Policy
309
Netbios Inspection
311
Configure a Netbios Inspection Policy Map for Additional Inspection Control
311
Configure the Netbios Inspection Service Policy
312
PPTP Inspection
313
SMTP and Extended SMTP Inspection
313
SMTP and ESMTP Inspection Overview
314
Defaults for ESMTP Inspection
315
Configure ESMTP Inspection
316
Configure an ESMTP Inspection Policy Map
316
Configure the ESMTP Inspection Service Policy
318
TFTP Inspection
319
Inspection for Voice and Video Protocols
321
CTIQBE Inspection
321
Limitations for CTIQBE Inspection
321
Verifying and Monitoring CTIQBE Inspection
322
Inspection Overview
323
How H.323 Works
324
Limitations for H.323 Inspection
325
Configure H.323 Inspection
326
Configure H.323 Inspection Policy Map
326
Configure the H.323 Inspection Service Policy
329
Verifying and Monitoring H.323 Inspection
330
Monitoring H.225 Sessions
330
Monitoring H.245 Sessions
331
Monitoring H.323 RAS Sessions
332
MGCP Inspection Overview
332
Configure MGCP Inspection
333
Configuring an MGCP Inspection Policy Map for Additional Inspection Control
334
Configure the MGCP Inspection Service Policy
335
Configuring MGCP Timeout Values
336
Verifying and Monitoring MGCP Inspection
336
RTSP Inspection Overview
337
Realplayer Configuration Requirements
338
Limitations for RSTP Inspection
338
Configure RTSP Inspection
338
Configure RTSP Inspection Policy Map
339
Configure the RTSP Inspection Service Policy
341
SIP Inspection
342
SIP Inspection Overview
343
Limitations for SIP Inspection
343
Default SIP Inspection
344
Configure SIP Inspection
344
Configure SIP Inspection Policy Map
344
Configure the SIP Inspection Service Policy
348
Configure SIP Timeout Values
349
Verifying and Monitoring SIP Inspection
349
Skinny (SCCP) Inspection
350
SCCP Inspection Overview
350
Supporting Cisco IP Phones
351
Limitations for SCCP Inspection
351
Default SCCP Inspection
351
Configure SCCP (Skinny) Inspection
352
Configure a Skinny (SCCP) Inspection Policy Map for Additional Inspection Control
352
Configure the SCCP Inspection Service Policy
353
Verifying and Monitoring SCCP Inspection
355
History for Voice and Video Protocol Inspection
355
Inspection of Database, Directory, and Management Protocols
357
DCERPC Inspection
357
DCERPC Overview
357
Configure DCERPC Inspection
358
GTP Inspection Overview
361
Defaults for GTP Inspection
362
Configure GTP Inspection
362
Configure a GTP Inspection Policy Map
363
Configure the GTP Inspection Service Policy
365
Verifying and Monitoring GTP Inspection
367
ILS Inspection
368
RADIUS Accounting Inspection
369
RADIUS Accounting Inspection Overview
369
Configure RADIUS Accounting Inspection
369
Configure a RADIUS Accounting Inspection Policy Map
370
Configure the RADIUS Accounting Inspection Service Policy
371
RSH Inspection
372
SNMP Inspection
372
Sql*Net Inspection
374
Sun RPC Inspection Overview
375
Managing Sun RPC Services
375
Verifying and Monitoring Sun RPC Inspection
376
XDMCP Inspection
377
VXLAN Inspection
378
History for Database, Directory, and Management Protocol Inspection
378
Connection Management and Threat Detection
379
Connection Settings
381
What Are Connection Settings
381
Configure Connection Settings
382
Configure Global Timeouts
383
Protect Servers from a SYN Flood Dos Attack (TCP Intercept)
384
Customize Abnormal TCP Packet Handling (TCP Maps, TCP Normalizer)
387
Bypass TCP State Checks for Asynchronous Routing (TCP State Bypass)
390
The Asynchronous Routing Problem
390
Guidelines for TCP State Bypass
391
Configure TCP State Bypass
392
Disable TCP Sequence Randomization
393
Configure Connection Settings for Specific Traffic Classes (All Services)
394
Monitoring Connections
397
History for Connection Settings
398
Quality of Service
401
About Qos
401
Supported Qos Features
402
What Is a Token Bucket
402
Priority Queuing
403
How Qos Features Interact
403
DSCP (Diffserv) Preservation
403
Guidelines for Qos
403
Configure Qos
404
Determine the Queue and TX Ring Limits for a Priority Queue
404
TX Ring Limit Worksheet
405
Configure the Priority Queue for an Interface
406
Configure a Service Rule for Priority Queuing and Policing
407
Monitor Qos
409
Qos Police Statistics
409
Qos Priority Statistics
410
Qos Priority Queue Statistics
410
Configuration Examples for Priority Queuing and Policing
411
Class Map Examples for VPN Traffic
411
Priority and Policing Example
412
History for Qos
413
Threat Detection
415
Detecting Threats
415
Basic Threat Detection Statistics
416
Advanced Threat Detection Statistics
416
Scanning Threat Detection
417
Guidelines for Threat Detection
417
Defaults for Threat Detection
418
Configure Threat Detection
418
Configure Basic Threat Detection Statistics
419
Configure Advanced Threat Detection Statistics
419
Configure Scanning Threat Detection
421
Monitoring Threat Detection
422
Monitoring Basic Threat Detection Statistics
422
Monitoring Advanced Threat Detection Statistics
423
Evaluating Host Threat Detection Statistics
424
Monitoring Shunned Hosts, Attackers, and Targets
426
Examples for Threat Detection
427
History for Threat Detection
428
Advertisement
Cisco ASA 5508-X Hardware Installation Manual (32 pages)
Brand:
Cisco
| Category:
Wireless Access Point
| Size: 3.31 MB
Table of Contents
Table of Contents
3
Overview
5
Package Contents
6
Front Panel
7
Rear Panel
7
Leds
8
Network Ports
10
Console Ports
10
Internal and External Flash Storage
10
Solid State Drive
11
Power Supply Modules
11
Hardware Specifications
11
Power Cord Specifications
12
Installation Preparation
21
Installation Warnings
21
Safety Recommendations
22
Maintain Safety with Electricity
22
Prevent Electrostatic Discharge Damage
23
Site Environment
23
Site Considerations
24
Power Supply Considerations
24
Equipment Rack Configuration Considerations
24
Mount and Connect
25
Rack-Mount the ASA
25
Connect Cables, Turn on Power, and Verify Connectivity
26
Connect to a Console Terminal or PC
28
Connect to the Console Port with Microsoft Windows
28
Connect to the Console Port with Mac os X
30
Connect to the Console Port with Linux
30
Maintenance and Upgrades
31
Replace the SSD
31
Chapter
31
Cisco ASA 5508-X Software Manual (37 pages)
Threat Defense Reimage Guide
Brand:
Cisco
| Category:
Security System
| Size: 0.76 MB
Advertisement
Cisco ASA 5508-X Manual (14 pages)
Brand:
Cisco
| Category:
Network Router
| Size: 2.09 MB
Table of Contents
Table of Contents
1
About the ASA 5508-X and 5516-X
1
Package Contents
2
Front Panel
3
Rear Panel
3
Leds
4
Network Ports
6
Console Ports
6
Internal and External Flash Storage
6
Solid State Drive
7
Power Supply Modules
7
Hardware Specifications
7
Power Cord Specifications
8
Cisco ASA 5508-X Quick Start Manual (9 pages)
with FirePOWER Services
Brand:
Cisco
| Category:
Firewall
| Size: 0.86 MB
Table of Contents
Package Contents
1
License Requirements
2
Deploy the Firepower Threat Defense in Your Network
3
Power on the Firepower Threat Defense Device
4
Configure the Device for Firepower Management
5
Register the Device with the Firepower Management Center and Assign Smart Licenses
7
Where to Go Next
8
Cisco ASA 5508-X Easy Setup Manual (11 pages)
ASA with FirePOWER Services
Brand:
Cisco
| Category:
Firewall
| Size: 6.43 MB
Cisco ASA 5508-X Mount And Connect (6 pages)
Brand:
Cisco
| Category:
Firewall
| Size: 1.34 MB
Table of Contents
Connect Cables, Turn on Power, and Verify Connectivity
2
Connect to a Console Terminal or PC
4
Connect to the Console Port with Microsoft Windows
4
Connect to the Console Port with Mac os
5
Connect to the Console Port with Linux
6
Cisco ASA 5508-X Quick Start Manual (8 pages)
Brand:
Cisco
| Category:
Chassis
| Size: 1.5 MB
Advertisement
Related Products
Cisco ASA5500-HW - Hardware Accessory Kit Network Device
Cisco ASA 5516-X
Cisco AS5350XM
Cisco AS5350 - Universal Access Server
Cisco AMP PC3000
Cisco ASA5500-SC-5= - ASA 5500 Security Context
Cisco ASA 5506H-X
Cisco ASA 5506-X
Cisco ASA 5506W-X
Cisco Cisco ASA 5500 Series
Cisco Categories
Switch
IP Phone
Network Router
Wireless Access Point
Network Hardware
More Cisco Manuals
Login
Sign In
OR
Sign in with Facebook
Sign in with Google
Upload manual
Upload from disk
Upload from URL