CISCO ASA Knowledge Base

The Cisco ASA configuration notes and configuration templates found on this page are a work in progress. They have been used to configure several firewalls, and may need tweaking for specific applications. They are here to serve as a guide, and they are not a substitute for an understanding of how to program a Cisco Pix Firewall.

Default Cisco ASA Configuration:

Default ASA Configuration

Base Cisco ASA Configuration:

This is a base configuration for a Cisco ASA. It includes local authentication. This configuration receives a DHCP address for its external ip address.

Base ASA Configuration

Local Authentiction:

These are the commands needed to add to a configuration to enable local Authentication.

Local Authentication PIX Configuration

Enable Banners:

Steps needed to enable banners

Enable banners

VPN with Local Authentiction:

These are the commands needed to enable Remote VPN Access using local Authentication.

VPN with Local Authentication Configuration

VPN with RADIUS Authentiction:

These are the commands needed to enable Remote VPN Access using RADIUS Authentication. You can further restrict traffic passing through the vpn tunnel by assigning filter id's to users as they connect to the vpn server. Filter id's can be assigned to users with IAS, and using windows domain groups. While the user is connecting to the vpn, an access-list with the same name as the filter id will be applied to the vpn user.

PIX/ASA 7.x and Cisco VPN Client 4.x with Windows 2003 IAS RADIUS (Against Active Directory) Authentication Configuration Example

Clientless SSL VPN:

These are the commands needed to enable Remote Clientless VPN Access.

Clientless SSL VPN (WebVPN) on ASA Configuration Example

Nat Traversal

Nat traversal extends support for site-to-site and remote access IPSec-based VPNs to network environments that implement Network Address Translation (NAT) or Port Address Translation (PAT).