- Firewalls
- Joe
The Cisco ASA 5505 Firewall is the smallest model in the new 5500 Cisco series of hardware appliances. Although this model is suitable for small businesses, branch offices or even home use, its firewall security capabilities are the same as the biggest models (5510, 5520, 5540 etc). The Adaptive Security technology of the ASA firewalls offers solid and reliable firewall protection, advanced application-aware security, denial of service attack protection and much more. Moreover, the performance of the ASA 5505 appliance supports 150Mbps firewall throughput and 4000 firewall connections per second, which is more than enough for small networks.In this article, I will explain the basic Cisco ASA 5505 configuration for connecting a small network to the Internet (here thecompleteguides).
We assume that our ISP has assigned us a static public IP address (e.g 200.200.200.1 as an example) and that our internal network range is 192.168.1.0/24. We will use Port Address Translation (PAT) to translate our internal IP addresses to the public address of the outside interface. The difference of the 5505 model from the bigger ASA models is that it has an 8-port 10/100 switch which acts as Layer 2 only. That is, you can not configure the physical ports as Layer 3 ports, rather you have to create interface VLANs and assign the Layer 2 interfaces in each VLAN. By default, interface Ethernet0/0 is assigned to VLAN 2 and it’s the outside interface (the one which connects to the Internet), and the other 7 interfaces (Ethernet0/1 to 0/7) are assigned by default to VLAN 1 and are used for connecting to the internal network. Let’s see the basic configuration setup of the most important steps that you need to configure.
Cisco ASA 5505 configuration
Let’s now have a look at the Cisco ASA 5505 configuration, in a step by step fashion.
Step1: Configure the internal interface vlan
ASA5505(config)# interface Vlan 1
ASA5505(config-if)# nameif inside
ASA5505(config-if)# security-level 100
ASA5505(config-if)# ip address 192.168.1.1 255.255.255.0
ASA5505(config-if)# no shut
Step 2: Configure the external interface vlan (connected to Internet)
ASA5505(config)# interface Vlan 2
ASA5505(config-if)# nameif outside
ASA5505(config-if)# security-level 0
ASA5505(config-if)# ip address 200.200.200.1 255.255.255.0
ASA5505(config-if)# no shut
Step 3: Assign Ethernet 0/0 to Vlan 2
ASA5505(config)# interface Ethernet0/0
ASA5505(config-if)# switchport access vlan 2
ASA5505(config-if)# no shut
Step 4: Enable the rest interfaces with no shut
ASA5505(config)# interface Ethernet0/1
ASA5505(config-if)# no shut
Do the same for Ethernet0/1 to 0/7.
Step 5: Configure PAT on the outside interface
ASA5505(config)# global (outside) 1 interface
ASA5505(config)# nat (inside) 1 0.0.0.0 0.0.0.0
UPDATE for ASA Version 8.3 and later (including ASA versions 9.x)
From March 2010, Cisco announced the new Cisco ASA software version 8.3. This version introduced several important configuration changes, especially on the NAT/PAT mechanism. The “global” command is no longer supported. NAT (static and dynamic) and PAT are configured under network objects. The PAT configuration below is for ASA 8.3 and later:object network obj_any
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface
The above commands will accomplish the same task as the “global” and “nat” commands we had in versions prior to 8.3.
Step 6: Configure default route
Default route towards the ISP (assume default gateway is 200.200.200.2)ASA5505(config)# route outside 0.0.0.0 0.0.0.0 200.200.200.2 1
The above steps are the absolutely necessary steps you need to configure for making the appliance operational. Of course there are much more configuration details that you need to implement in order to enhance the security and functionality of your appliance, such as Access Control Lists, Static NAT, DHCP, DMZ zones, authentication etc.
You can also learn how to configure any Cisco ASA 5500 Firewall Hereand also VPNs.
For more Cisco configuration examples and other related details about designing and implementing Cisco solutions: Cisco Tips and Tutorials.
Joe
Senior Network Engineer, technology enthusiast, guitar and bass player. Joe Wilson is the creator of RouterFreak.com as well as other niche websites that can be found around on the Internets.
What do you think about this article?
13 comments
mikeyb
September 5, 2021 at 10:49 pm
I can config vlan 2, using ip add dhcp set route and it gets an address and i can ping IPs like 8.8.8.8 but when i set VLAN 1 to 192.168.1.1, it sez there is a conflict with vlan 2 which has 192.168.1 158. Tried 192.168. 10.1 but didnt work
Reply
Tony Cruz
August 2, 2021 at 11:49 am
Will work on 5501 ?
Reply
test_machine
January 13, 2020 at 8:25 am
Hi shoeb …. you write
Not working for me –
Tried to ping from 192.168.1.100 to 12.12.12.2. its not working …i got basic question.
You write 12.12.12.x is on Vlan2 and 192.168.1.100 is not on vlan 2 , as might be on the default vlan .
No communication is possible, please re-assign the proper vlan 🙂Reply
Matthew
May 31, 2019 at 12:23 pm
This config is missing access list
Reply
shoeb
January 10, 2018 at 5:39 am
Not working for me –
Tried to ping from 192.168.1.100 to 12.12.12.2. its not working
Packet tracer file is here – https://ufile.io/5nxj1ciscoasa#sh run
: Saved
:
ASA Version 8.4(2)
!
hostname ciscoasa
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 10.10.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 12.12.12.1 255.255.255.0
!
object network obj_10.10.10.0
subnet 10.10.1.0 255.255.255.0
object network obj_192.168.1.0
subnet 192.168.1.0 255.255.255.0
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network obj_static
subnet 192.168.1.100 255.255.255.255
!
route inside 192.168.1.0 255.255.255.0 10.10.1.2 1
route outside 0.0.0.0 0.0.0.0 12.12.12.2 1
!
!
!
object network obj_10.10.10.0
nat (inside,outside) dynamic interface
object network obj_192.168.1.0
nat (inside,outside) dynamic interface
object network obj_any
nat (inside,outside) dynamic interface
object network obj_static
nat (inside,outside) static 12.12.12.100
!
!
!
!
!
!
!
telnet timeout 5
ssh timeout 5
!
!
!
!
!
!
!
ciscoasa#See AlsoEnterprise Cyber SecurityReply
warren
December 22, 2017 at 4:29 am
This is very helpful the last firewall I touch was a pix, I think it was a 5510E, anyways now I have to support an ASA5520 V8.4. I have 2 questions is there a difference in configuring a 5505 and 5520? Also any advice I where I can read/watch online a step by step tutorial that can bring me up to speed on a 5520 ASA?
Thank you all in advance!!
Reply
chelsie ortega
December 9, 2016 at 1:27 am
Practical post , Incidentally , people want a MD PFH Checklist , I encountered a fillable form here
https://goo.gl/jdLFpY
.Reply
Dan
October 21, 2015 at 11:42 am
HOT DAMN! Thank you so much for the final piece of the puzzle for the setup: Configure Default Route. I’ve been messing with this for hours now not knowing it was required. Every other tutorial had no mention of this! Thanks again.
Reply
Daniele Besana
October 22, 2015 at 12:45 am
Glad it helped!
Reply
dmace
April 3, 2015 at 7:50 am
Good article. I’ve disconnected my ASA yesterday, as it couldn’t handle my Chromecast (something with UPnP), and i got non-the-wiser from the logs.
It also cannot tunnel IPv6 through a broker.
Still a nice apparatus, though.Reply
moel
December 16, 2012 at 8:13 pm
Can you add to the DMZ configuration. tk’s
Reply
Pingback: Preparing for Your Interview as a Network Engineer | Network Engineer Job
Pingback: Network Engineer Interview Questions - Tips for Interviewing
Leave a Reply
This site uses Akismet to reduce spam. Learn how your comment data is processed.
About us
RouterFreak is a blog dedicated to professional network engineers. We
focus on network fundamentals, product/service reviews, and career advancements.
Disclaimer
As an Amazon Associate, I earn from qualifying purchases.
RouterFreak is supported by its audience. We may receive a small commission from the affiliate links in this post, at no extra cost to our readers.
Topics
Popular articles
- How To Program A GE Universal Remote Without Codes
- How To Sync Roku Remote Without Pairing Button