In this chapter, I will explain how to configure the most common features of an ASA firewall. Examples will be based on the ASA 5540, which uses the same commands as the entire ASA line. Most commands are the same on the PIX firewalls, but since they are no longer sold—with the exception of the Firewall Service Module (FWSM)—this chapter focuses on ASAs.
There are slight differences among models. For example, the ASA 5505 base model cannot be run in failover or multicontext mode. The FWSM also operates differently in that it is a module and has no configurable physical interfaces.
ASA stands for Adaptive Security Appliance. This name indicates that these devices are capable of being a firewall, a VPN device, and an IPS/IDS device. In this chapter, I will concentrate on the basics of firewall services.
Configuring an ASA can be a bit confusing for people whose experience
is with IOS-based devices. While there are similarities in the way the
command-line interpreter works, there are some pretty interesting
differences, too. One of my favorite features of the ASA and even the PIX
firewalls is the fact that you can execute the
command from within configuration mode. Recent versions of IOS allow similar
functionality using the
do show run, for example) from within configuration mode, but using the command in the ASA is, in my opinion, more natural. NX-OS, the operating system for Cisco Nexus switches, implements ...