Lesson 2

Getting Started with Cisco Security

Appliances

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-1

User Interface

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-2

 Security Appliance Access Modes

A Cisco security appliance

has four administrative
access modes:
• Unprivileged firewall>

• Privileged firewall#

• Configuration firewall<config>#

• Monitor monitor>

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-3

 Access Privilege Mode

Internet

firewall>
enable [priv_level]
• Used to control access to the privileged mode
• Enables you to enter other access modes

pixfirewall> enable
password:
pixfirewall#

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-4

 Access Configuration Mode: configure
terminal Command

firewall#
configure terminal
• Used to start configuration mode to enter
configuration commands from a terminal

firewall#
exit
• Used to exit from an access mode

pixfirewall> enable
password:
pixfirewall# configure terminal
pixfirewall(config)# exit
pixfirewall# exit
pixfirewall>

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-5

 help Command

pixfirewall > help ?

enable Turn on privileged commands

exit Exit the current command mode
login Log in as a particular user
logout Exit from current command mode, and to unprivileged
mode
quit Exit the current command mode

pixfirewall > help enable

USAGE:

enable [<priv_level>]

DESCRIPTION:

enable Turn on privileged commands

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-6

File Management

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-7

 Viewing and Saving Your Configuration

The following commands

enable you to view or
save your configuration: To save configuration changes:
copy run start
• copy run start
– show running-config startup- running- Configuration
– show startup-config config config Changes
(saved)
• write memory
– write terminal

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-8

 Clearing Running Configuration

Clear the running configuration:

clear config all

startup- running-
config config
(default)

firewall(config)#

clear configure all

• Clears the running-configuration

fw1(config)# clear config all

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-9

 Clearing Startup Configuration

Clear the startup configuration:

Write erase

startup- running-
config config
(default)

firewall#

write erase
• Clears the startup configuration

Fw1# write erase

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-10

 Reload the Configuration: reload Command

firewall(config)#
reload [noconfirm] [cancel] [quick] [save-config]
[max-hold-time [hh:]mm [{in [hh:]mm |
{at hh:mm [{month day} | {day month}]}] [reason
text]
• Reboots the security appliance and reloads the configuration
• Reboots can be scheduled

fw1# reload
Proceed with reload?[confirm] y
Rebooting...

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-11

 Displaying Stored Files: System and
Configuration

10.0.0.11

PIX Firewall ASA

Flash: Disk0:
Disk1:
firewall(config)#

dir [/recursive] [[{disk0:|disk1:|flash:}]

• Display the directory contents.
[<path>}]]

firewall# dir

Directory of flash:/

3 -rw- 4902912 13:37:33 Jul 27 2005 pix-701.bin

4 -rw- 6748932 13:21:13 Jul 28 2005 asdm-501.bin

16128000 bytes total (4472832 bytes free)

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-12

 Selecting Boot System File

firewall# dir

Directory of flash:/

3 -rw- 4902912 13:37:33 Jul 27 2005 pix-701.bin

4 -rw- 6748932 13:21:13 Jul 28 2005 asdm-501.bin

16128000 bytes total (4472832 bytes free)

firewall(config)#

Boot [system | config} <url>

• Can store more than one system image and configuration file
• Designates which system image and startup configuration
file to boot

fw1(config)# boot system flash:/pix-701.bin

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-13

 Verifying the Startup System Image

10.0.0.11

Boot Image
flash:/pix-701.bin

firewall(config)#

show bootvar
• Display the system boot image.

fw1# show bootvar

BOOT variable = flash:/pix-701.bin Running

Current BOOT variable = flash:/pix-701.bin Configured
CONFIG_FILE variable =
Current CONFIG_FILE variable =

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-14

Security Appliance Security Levels

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-15

 Functions of the Security Appliance:
Security Algorithm

• Implements stateful connection control through the

security appliance.
• Allows one-way (outbound) connections with a minimum
number of configuration changes. An outbound
connection is a connection originating from a host on a
more-protected interface and destined for a host on a
less-protected network.
• Monitors return packets to ensure that they are valid.
• Randomizes the first TCP sequence number to minimize
the risk of attack.

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-16

 Security Level Example

DMZ Network
Ethernet2
• Security level 50
• Interface name = DMZ

e2
Internet
e0 e1

Outside Network Inside Network

Ethernet0 Ethernet1
• Security level 0 • Security level 100
• Interface name = outside • Interface name = inside

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-17

Basic Security Appliance Configuration

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-18

 interface Command and Subcommands

Ethernet2
e2
Internet
e0 e1
Ethernet0 Ethernet1

firewall(config)#

interface hardware_id
• Specifies a perimeter interface and its slot location on the
firewall

fw1(config)# interface ethernet0 (GigabitEthernet0/0)

fw1(config-if)#

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-19

 Assign an Interface Name:
nameif Subcommand
Ethernet2
• Interface name = dmz

e2
Internet
e0 e1
Ethernet0 Ethernet1
• Interface name = outside • Interface name = inside

firewall(config-if)#

nameif hardware_id if_name

• Assigns a name to each perimeter interface on the PIX Firewall Security Appliance.

fw1(config)# interface ethernet0 (GigabitEthernet0/0)

fw1(config-if)# nameif outside

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-20

 Assign Interface IP Address:
ip address Subcommand

e2
Internet
e0 e1
Ethernet0
• Interface name = outside
• IP address = 192.168.1.2
firewall(config-if)#

ip address ip_address [netmask]

• Assigns an IP address to each interface

fw1(config)# interface ethernet0 (GigabitEthernet0/0)

fw1(config-if)# nameif outside
fw1(config-if)# ip address 192.168.1.2 255.255.255.0

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-21

 DHCP-Assigned Address
DHCP
Assigned

Internet
e0
Ethernet0
• Interface name = outside
• IP address = DHCP
firewall(config-if)#

ip address if_name dhcp [setroute] [retry

retry_cnt]
• Enables the DHCP client feature on the outside interface

fw1(config)# interface ethernet0 (GigabitEthernet0/0)

fw1(config-if)# nameif outside
fw1(config-if)# ip address dhcp

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-22

 Assign a Security Level: security-level
SubCommands

e2
Internet
e0 e1
Ethernet0
• Interface name = outside
• IP address = 192.168.1.2
• Security level = 0
firewall(config-if)#

security-level number
• Assigns a security level to the interface

fw1(config)# interface ethernet0 (GigabitEthernet0/0)

fw1(config-if)# nameif outside
fw1(config-if)# ip address 192.168.1.2
fw1(config-if)# security-level 0

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-23

 Assign an Interface Speed and Duplex:
speed and duplex SubCommands

e2
Internet
e0 e1
Ethernet0
• Speed =100
• Duplex = full
firewall(config-if)#

speed [hardware_speed]
duplex [duplex_operation]

• Enables an interface speed and duplex

fw1(config)# interface ethernet0 (GigabitEthernet0/0)
fw1(config-if)# nameif outside
fw1(config-if)# ip address 192.168.1.2
fw1(config-if)# security-level 0
fw1(config-if)# speed 100
fw1(config-if)# duplex full
© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-24
 ASA Management Interface

e2
Internet
e0 e1
Ethernet0
• Management = only
firewall(config-if)#

management-only
no management-only
• To set an interface to accept management traffic only

fw1(config)# interface management 0/0

fw1(config-if)# nameif outside
fw1(config-if)# ip address 192.168.1.2
fw1(config-if)# security-level 0

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-25

 Configure a Static Route: route Command
Default Route Static Route

Internet
10.0.1.11
192.168.0.1 10.0.0.102

10.0.1.4

firewall(config)#

route if_name ip_address netmask gateway_ip

[metric]
• Defines a static or default route for an interface

fw1(config)# route outside 0.0.0.0 0.0.0.0 192.168.0.1 1

fw1(config)# route inside 10.0.1.0 255.255.255.0 10.0.0.102 1

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-26

 show Commands
show run interface
fw1# show run interface
!
interface Ethernet0
speed 100
duplex full
nameif outside
security-level 0
ip address 192.168.2.2 255.255.255.0
!
interface Ethernet1
speed 100
duplex full
nameif inside
security-level 100
ip address 10.0.2.1 255.255.255.0

show interface
fw1# show interface
Interface GigabitEthernet0/0 "outside", is up, line protocol is up
Detected: Speed 100 Mbps, Full-duplex
Requested: Auto
MAC address 000b.fcf8.c538, MTU 1500
IP address 192.168.1.2, subnet mask 255.255.255.0
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 packets output, 0 bytes, 0 underruns
input queue (curr/max blocks): hardware (0/0) software (0/0)
output queue (curr/max blocks): hardware (0/0) software (0/0)
Received 0 VLAN untagged packets, 0 bytes
Transmitted 0 VLAN untagged packets, 0 bytes
Dropped 0 VLAN untagged packets

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-27

 show memory Command

firewall#
show memory
• Displays system memory usage information

fw1# show memory

Free memory: 49046552 bytes
Used memory: 18062312 bytes
------------- ----------------
Total memory: 67108864 bytes

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-28

 show cpu usage Command

Internet
10.0.0.11

10.0.0.4

firewall#

show cpu usage

• Displays CPU use

fw1# show cpu usage

CPU utilization for 5 seconds = 0%; 1 minute: 0%; 5 minutes: 0%

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-29

 show version Command

firewall#
show version
• Displays the security appliance’s software version, operating time
since its last reboot, processor type, Flash memory type, interface
boards, serial number (BIOS identification), and activation key value.

Cisco PIX Security Appliance Software Version 7.0(1)

Compiled on Thu 31-Mar-05 14:37 by builders

System image file is "flash:/pix-701.bin"
Config file at boot was "startup-config"

pixfirewall up 12 mins 24 secs

Hardware: PIX-515, 128 MB RAM, CPU Pentium 200 MHz

Flash i28F640J5 @ 0x300, 16MB……………

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-30

 show ip address Command

172.16.6.0
.1
192.168.6.0 10.0.6.0 10.1.6.0
Internet .2 .1 .1

fw1# show ip address

System IP Addresses:
Interface Name IP address Subnet mask
Ethernet0 outside 192.168.1.2 255.255.255.0
CONFIG
Ethernet1 inside 10.0.1.1 255.255.255.0
CONFIG
Ethernet2 dmz 172.16.1.1 255.255.255.0
CONFIG
Current IP Addresses:
Interface Name IP address Subnet mask
Ethernet0 outside 192.168.1.2 255.255.255.0
CONFIG
Ethernet1 inside 10.0.1.1 255.255.255.0
CONFIG
Ethernet2 dmz 172.16.1.1 255.255.255.0
CONFIG

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-31

 show interface Command

fw1# show interface

interface ethernet0 "outside" is up, line protocol is up
Hardware is i82559 ethernet, address is 0050.54ff.653a
IP address 192.168.0.2, subnet mask 255.255.255.0
MTU 1500 bytes, BW 100000 Kbit full duplex
4 packets input, 282 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
20 packets output, 1242 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
input queue (curr/max blocks): hardware (128/128) software (0
output queue (curr/max blocks): hardware (0/1) software (0/1)

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-32

 show nameif Command

Ethernet2
• Interface name = dmz
• Security level = 50
e2
Internet
e0 e1
Ethernet0 Ethernet1
• Interface name = outside • Interface name = inside
• Security level = 0 • Security level = 100

fw1# show nameif

Interface Name Security
Ethernet0 outside 0
Ethernet1 inside 100
Ethernet2 dmz 50

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-33

 ping Command

Internet
10.0.0.11

10.0.0.4

firewall#

ping host
• Determines whether other IP addresses are visible from
the security appliance

fw1# ping 10.0.1.11

Sending 5, 100-byte ICMP Echos to 10.0.1.11, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 10/12/20 ms

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-34

 show route Command

e2
Internet
e0 e1

• Works only with the ASA 5500 Series Adaptive

Security Appliances
fw1(config)# sh route

S 0.0.0.0 0.0.0.0 [1/0] via 192.168.1.1, outside

C 10.0.1.0 255.255.255.0 is directly connected, inside
C* 127.0.0.0 255.255.0.0 is directly connected, cplane
C 172.16.1.0 255.255.255.0 is directly connected, dmz
C 192.168.1.0 255.255.255.0 is directly connected, outside

* ASA 55X0 only

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-35
 clock Command

Internet
10.0.0.11
Wed 23-Jul-03
21:00

10.0.0.4

firewall#

clock set hh:mm:ss {day month | month day} year

• Sets the security appliance clock

fw1# clock set 21:0:0 jul 23 2003

© 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-36