Table of Contents

CHAPTER 28
ASA Firewall Configuration
In this chapter, I will explain how to configure the most common features of an ASA
firewall. Examples will be based on the ASA 5540, which uses the same commands as
the entire ASA line. Most commands are the same on the PIX firewalls, but since they
are no longer sold—with the exception of the Firewall Service Module (FWSM)—this
chapter focuses on ASAs.
There are slight differences among models. For example, the ASA 5505
base model cannot be run in failover or multicontext mode. The FWSM
also operates differently in that it is a module and has no configurable
physical interfaces.
ASA stands for Adaptive Security Appliance. This name indicates that these devices are
capable of being a firewall, a VPN device, and an IPS/IDS device. In this chapter, I will
concentrate on the basics of firewall services.
Configuring an ASA can be a bit confusing for people whose experience is with IOSbased
devices. While there are similarities in the way the command-line interpreter
works, there are some pretty interesting differences, too. One of my favorite features
of the ASA and even the PIX firewalls is the fact that you can execute the show runningconfig
command from within configuration mode. Recent versions of IOS allow similar
functionality using the do command (do show run, for example) from within configuration
mode, but using the command in the ASA is, in my opinion, more natural. NX-
OS, the operating system for Cisco Nexus switches, implements this feature as well.
Around the time the ASAs were released, Cisco revamped the Adaptive Security Device
Manager (ASDM) software used to control its PIX firewalls and ASA appliances. For
the first time, this software became a viable tool for configuring and managing a Cisco
firewall. While many of the examples in this chapter can also be accomplished with the
ASDM, I tend to be an old-school command-line kind of guy. This chapter deals with
configuring ASAs using the command line, and does not cover the ASDM. The ASDM
is a pretty great tool, however, and I encourage you to explore its use on your own.
469