Network Warrior, 2nd Edition

Chapter 28. ASA Firewall Configuration

In this chapter, I will explain how to configure the most common features of an ASA firewall. Examples will be based on the ASA 5540, which uses the same commands as the entire ASA line. Most commands are the same on the PIX firewalls, but since they are no longer sold—with the exception of the Firewall Service Module (FWSM)—this chapter focuses on ASAs.

Note

There are slight differences among models. For example, the ASA 5505 base model cannot be run in failover or multicontext mode. The FWSM also operates differently in that it is a module and has no configurable physical interfaces.

ASA stands for Adaptive Security Appliance. This name indicates that these devices are capable of being a firewall, a VPN device, and an IPS/IDS device. In this chapter, I will concentrate on the basics of firewall services.

Configuring an ASA can be a bit confusing for people whose experience is with IOS-based devices. While there are similarities in the way the command-line interpreter works, there are some pretty interesting differences, too. One of my favorite features of the ASA and even the PIX firewalls is the fact that you can execute the show running-config command from within configuration mode. Recent versions of IOS allow similar functionality using the do command (do show run, for example) from within configuration mode, but using the command in the ASA is, in my opinion, more natural. NX-OS, the operating system for Cisco Nexus switches, implements ...