Skip to main content

Cisco ASA Firewall Configuration

Step of configuration Firewall.


1. Make Topology:



2.assign ip accordingly on ASA & ISP Firewall

3.Set Inside and Outside On ASA firewall

4 Configure DHCP Server and DNS IP On ASA

5 configure Default Route On ASA

6 Configure OSPF  On ISP Router

7 Create Object Network & Enable NAT On ASA

8 Create ACL On ASA

9 Verify

Enable Mode:

ciscoasa>en

Password: 

ciscoasa#config t


------Remove the by-default dhcp rage using below commend--------------


ciscoasa(config)#no dhcpd address 192.168.1.5-192.168.1.36 inside


-----------------------------------------------------------------------


Set a ip address for Inside Firewall :


ciscoasa(config)#int vlan 1

ciscoasa(config-if)#ip add 10.1.36.1 255.255.255.0

ciscoasa(config-if)#nameif inside

ciscoasa(config-if)#security-level 100              [ Security Level (100-inside),(0-Outside), (1-99 DMZ using for server)]

ciscoasa(config-if)#exit

ciscoasa(config)#int e0/1

ciscoasa(config-if)#switchport access vlan 1


Set a ip address for Outside Firewall :


ciscoasa(config)#int vlan 2

ciscoasa(config-if)#ip add 50.1.1.2 255.255.255.0

ciscoasa(config-if)#nameif outside

ciscoasa(config-if)#security-level 0

ciscoasa(config)#int e0/0

ciscoasa(config-if)#switchport access vlan 1




-------------------------------Configure DHCP Server And DNS IP On ASA------------------------------------------



DHCP configuration On firewall:


ciscoasa(config)#dhcpd add 10.1.36.2-10.1.36.20 inside


DNS Configuration On firewall:


ciscoasa(config)#dhcpd dns 8.8.8.8 interface inside



--------------------------Configuration Default Route On ASA---------------------------------------------------


ciscoasa(config)#route outside  0.0.0.0 0.0.0.0 50.1.1.1

ciscoasa(config)#route outside  0.0.0.0 0.0.0.0 50.1.1.2


-----------------------------------ISP Router Configuration------------------------------------------------------


Router>enable

Router#config t

Router(config)#int f0/1

Router(config-if)#ip add 50.1.1.1 255.255.255.0

Router(config-if)#no shutdown

Router(config-if)#exit

Router(config)#int f0/0

Router(config-if)#ip add 8.8.8.1 255.255.255.0

Router(config-if)#no shutdown

Router(config-if)#exit



--------------------------Confugure OSPF On ISP Router----------------------------------------------------------

Router(config)#router ospf 1

Router(config-router)#network 50.0.0.0 255.255.255.0 area 0

Router(config-router)#network 8.0.0.0 255.255.255.0 area 0


--------------------------Create Object Network & Enable NAT On ASA----------------------------------------------


Create Object Network :


ciscoasa(config)#object network lan

ciscoasa(config-network-object)#subnet 10.0.0.0 255.25.255.0



Enable NAT :


ciscoasa(config-network-object)#nat (inside, outside) dynamic interface



---------------------------------------Create ACL On ASA------------------------------------------------------

ciscoasa(config)#access-list oti extended permit tcp any any   (note:oti is a name of acceess list not a command)


ciscoasa(config)#access-list oti extended permit icmp any any


ciscoasa(config)#access-group oti inside interface outside


/////////////////////////////////////////////////////////////////////////////////////////////////////////////////


Inportent Command:


ciscoasa#show nat  (for using how to work nat policies)


ciscoasa#show xlate 










Comments

Post a Comment

Popular posts from this blog

Access Controls Lists(ACL)

Access Controls   Lists(ACL): ACL is a set of rules which will allow or deny the traffic moving through the router. It is a layer 3 security which controls the flow of traffic from one router to another. It is also called as packet filtering firewall. ACL is two type: 1.Standard ACL: standard access controls   Lists(ACLs) are the oldest type of access control lists. Standard IP access lists are used to permit/deny traffic only based on source IP address of the IP datagram packets. Standard Access Control list can be created by using the access-list IOS command. Function: The access list number range is 1 -99 Can block a network, host and subnet Two way communication is stopped All services are blocked. Implemented closest to the destination. Filtering is done based on only source IP address. 2.Extended ACL: Extended Access Control Lists allow you to permit or deny traffic from specific IP addresses to a specific destination IP address and por...
Post a Comment
Read more

OSI Layer

Compare and contrast OSI and TCP/IP models : 1.Physical Layer:      it is responsible for moving data form one node to the next.  Function: I. Transmission media II. Types of encoding III. Data rate{no of bits sent each sec} IV. Synchronization of bits. V. Line configuration (Example: point to point , multipoint) VI. Topology (Bus,Star,Ring,Mesh) VII. Transmission (simplex ,half duplex, full duplex) 2.Data like Layer:      it transforms the physical layer into a reliable link. Function: I.Framing: conversion of bits to frames. framing are working in four methods can be used to mark the start to end of frame. i) Character Count: ii) Flag bytes with byte/character staffing iii) Starting and ending flags, with bits staffing iv) Physical bye coding valuations. II.  Physical addressing : header is adding to frame. III. Flow control IV. Error control V. Access control 3.Network Layer:      Re...
Post a Comment
Read more

HOW TO WORK DHCP?

Dynamic Host Configuration Protocol, a  protocol that allows a DHCP server to automatically set TCP/IP network configuration for a client computer. How does work DHCP? 1.Whenever a client computer boots up, it broadcasts a DHCPDISCOVER massage.  it doesn't matter where the client is in airport, at home, in a desert, or in a jungle  it would send this packet looking for a DHCP server.   And the client has no idea if there is any DHCP server closeby therefore broadcast the only way you may notice the destination  IP address is 255.255.255.255. DHCPDISCOVER packet simply says "Hello", is there any DHCP server out there? I want to connect the Internet." 2.supose there is a DHCP server close by  and it hears the DHCPDISCOVER massage. the DHCP server responds with a DHCPOFFER massage.   It is a broadcast UDP packet.   It simply replies :"I hear you. I can lease you this IP address and this subnet mask, so that you can connect to the local network. ...
Post a Comment
Read more