SNMP stands for Simple Network Management Protocol. Up to ASA software 8.1, the SNMP version supported was v1 and v2c. The newest ASA software 8.2 supports also SNMP v3 which is the most secure snmp protocol version. The ASA works as an SNMP server (or agent), so you need also a Network Management System (NMS) […]
How to Configure VLAN subinterfaces on Cisco ASA 5500 Firewall
One of the advantages of the Cisco ASA firewall is that you can configure multiple virtual interfaces (subinterfaces) on the same physical interface, thus extending the number of security zones (firewall “legs”) on your network. Each subinterface must belong to a different Layer2 VLAN, with a separate Layer3 subnet. There are limits on the number of […]
How to configure DHCP Relay on Cisco ASA Firewall
The ASA 5500 and 5500-X series firewall can work as DHCP relay agent which means that it receives DHCP requests from clients on one interface and forwards the requests to a DHCP server on another interface. Usually the DHCP server is located in the same layer 3 subnet with its clients. There are situations however […]
Permitting Traffic to Enter and Exit the Same Interface on Cisco ASA
With the older Cisco PIX firewall appliances, there was no way for traffic to enter a specific interface and then exit back from the same interface again. With the new Cisco ASA models, this is also not supported by default, but you can enable this functionality with the same-security-traffic permit intra-interface command. The schematic above […]
Cisco ASA Policy Based Routing (PBR) Configuration
Policy Based Routing (PBR) is a feature that has been supported on Cisco Routers for ages. However, Cisco ASA firewalls didn’t support this until version 9.4.1 and later. Finally Cisco acknowledged the usefulness of PBR on firewall devices and has implemented this on ASA as well. In this article I will show you how to […]
Cisco ASA 5506-X Configuration Tutorial – Guide
Throughout my professional career in networking I was lucky to work with all Cisco firewall models and therefore I have experienced the “evolution” of every firewall product developed by Cisco. For the SMB/SOHO market, Cisco’s initial offering was the PIX 501, followed by the successful Cisco ASA 5505. The latter came to an End-of-Sale in […]
Cisco ASA Firewall Commands – Cheat Sheet
In this post I have gathered the most useful Cisco ASA Firewall Commands and created a Cheat Sheet list that you can download also as PDF at the end of the article. I have been working with Cisco firewalls since 2000 where we had the legacy PIX models before the introduction of the ASA 5500 […]
Configuration of Cisco ASA for ASDM Access
I have created the following video on youtube a few months ago and thought about embedding the video here as well. It is about configuring the Cisco ASA in order to install the ASDM image (Adaptive Security Device Manager) and hence be able to manage the device with the graphical ASDM GUI. The video shows […]
New Cisco ASA 5506-5508 models with FirePOWER
Cisco announced more details about its new ASA models (5506, 5508) which are using FirePOWER services and are geared towards small and medium size businesses. According to Cisco, the new ASA models are “industry’s first threat-focused Next Generation Firewalls” and offer application visibility and control, advanced malware protection (using AMP Threat Grid), next generation intrusion […]
Cisco ASA VPN Hairpinning
EDIT: My Book “Cisco ASA Firewall Fundamentals-3rd Edition” is now available on Amazon as Paperback physical book. MORE INFORMATION HERE Some time ago a visitor of my website asked me to help him on a special Cisco ASA VPN configuration and thought about sharing it here to help other people as well. The specific network […]
How to pass authenticated BGP Sessions through Cisco ASA (BGP Pass Through)
The following article describes the proper way to allow BGP sessions between two routers to pass through a Cisco ASA firewall appliance. Especially if the BGP configuration between the two routers uses MD5 authentication (which is a good security practice), you need some special “treatment” on this session in order to pass it successfully through […]
Cisco ASA5510 Vs ASA5512-X or 5515-X
The Cisco ASA product line for small and branch offices includes 4 ASA models: ASA5505 (either Basic License or Security Plus License) ASA5510 (either Basic License or Security Plus License) ASA5512-X (either Basic License or Security Plus License) ASA5515-X In this article I will describe the main differences between the ASA5510 and the newest generation […]
Cisco ASA CX Security Module on new 5500-X Firewalls
The new series of Cisco ASA devices (ASA 5500-X models which include 5512-X, 5515-X, 5525-X, 5545-X, 5555-X and 5585-X) have the capabilities to support Next Generation Firewall Security Services. They support these security services as cloud-based services (such as Cloud Web Security and Web Security Essentials) or as software based modules which do not need […]