ASA防火墙初始化
合集下载
相关主题
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
Lesson 3
Getting Started with Cisco Security Appliances
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-1
User Interface
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-4
Access Configuration Mode: configure terminal Command
firewall#
configure terminal
• Used to start configuration mode to enter configuration commands from a terminal
dir [/recursive] [[•{dDiisspkla0y:t|hedidisrekc1to:r|yfcloanstehn:ts}. ][<path>}]]
ciscoasa# dir
Directory of flash:/
3
-rw- 4902912
13:37:33 Jul 27 2005 asa-802.bin
SNPA v4.0—3-8
Clearing Running Configustartupration
config (default)
Clear the runn clear
runningconfig
ciscoasa(config)# clear config all
Ciscoasa # write erase firewall(config)#
SNPA v4.0—3-10
Reload the Configuration: reload Command
firewall(config)#
reload [noconfirm] [cancel] [quick] [save-config] [max-hold-time [hh:]mm [{in [hh:]mm | {at hh:mm [{month day} | {day month}]}] [reason text]
• Monitors return packets to ensure that they are valid.
Configuration file*
* Space available
SNPA v4.0—3-12
Displaying Stored Files: System and Configuration
10.0.0.11
firewall(config)#
PIX Firewall Flash:
ASA Disk0: Disk1:
pixfirewall > help enable
USAGE:
enable [<priv_level>]
DESCRIPTION:
enable
Turn on privileged commands
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-6
startupconfig (default)
runningconfig
firewall#
write erase
• Clears the startup configuration
Fw1# write erase
© 2005 Cisco Systems, Inc. All rights reserved.
• copy run start – show running-config – show startup-config
• write memory – write terminal
To save configuration changes: copy run start
startupconfig (saved)
SNPA v4.0—3-16
Functions of the Security Appliance: Security Algorithm
• Implements stateful connection control through the security appliance.
• Allows one-way (outbound) connections with a minimum number of configuration changes. An outbound connection is a connection originating from a host on a more-protected interface and destined for a host on a less-protected network.
• Used to control access to the privileged mode • Enables you to enter other access modes
pixfirewall> enable password: pixfirewall#
© 2005 Cisco Systems, Inc. All rights reserved.
clear configure all
• Clears the running-configuration
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-9
Clearing Startup Configuration
Clear the startup configuration: Write erase
SNPA v4.0—3-2
Security Appliance Access Modes
A Cisco security appliance has four administrative access modes:
• Unprivileged • Privileged • Configuration • Monitor
10.0.0.11
Release 7.
and later
• Software image • Configuration file • Private data • ASDM image • Backup image* • Backup
configuration file* • Virtual firewall
firewall> firewall# firewall<config># monitor>
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-3
Access Privilege Mode
Internet
firewall>
enable [priv_level]
© 2005 Cisco Systems, Inc. All rights reserved.
Running Configured
SNPA v4.0—3-15
Security Appliance Security Levels
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-11
File System
Release 6.
and earlier
• Software Image • Configuration file • Private data file • PDM image • Crash
information
© 2005 Cisco Systems, Inc. All rights reserved.
firewall(config)#
sh•owDisbpolaoyttvhearsystem boot image.
10.0.0.11
ciscoasa# show bootvar
BOOT variable = disk0:/asa-802.bin Current BOOT variable = disk0:/asa-802.bin CONFIG_FILE variable = Current CONFIG_FILE variable =
firewall# dir
Directory of flash:/
3
-rw- 4902912
13:37:33 Jul 27 2005 pix-701.bin
4
-rw- 6748932
13:21:13 Jul 28 2005 asdm-501.bin
16128000 bytes total (4472832 bytes free)
runningconfig
Configuration Changes
ciscoasa# show running-config ciscoasa# show startup-config ciscoasa# write memory
© 2005 Cisco Systems, Inc. All rights reserved.
firewall(config)#
Boot [system | config} <url>
• Can store more than one system image and configuration file
• Designates which system image and startup configuration file to boot
File Management
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-7
Viewing and Saving Your Configuration
The following commands enable you to view or save your configuration:
iscoasa(config)# boot system disk0:/asa-802.bin
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-14
Verifying the Startup System Image
Boot Image flash:/pix-701.bin
© 2005 Cisco Systems, Inc. All rights reBiblioteka Baiduerved.
SNPA v4.0—3-5
help Command
pixfirewall > help ?
enable exit login logout quit
Turn on privileged commands Exit the current command mode Log in as a particular user Exit from current command mode, and to unprivileged mode Exit the current command mode
4
-rw- 6748932
13:21:13 Jul 28 2005 asdm-501.bin
16128000 bytes total (4472832 bytes free)
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-13
Selecting Boot System File
firewall#
exit
• Used to exit from an access mode
Ciscoasa> enable password: ciscoasa# configure terminal ciscoasa(config)# exit ciscoasa# exit ciscoasa>
• Reboots the security appliance and reloads the configuration
• Reboots can be scheduled
ciscoasa# reload Proceed with reload?[confirm] y Rebooting...
© 2005 Cisco Systems, Inc. All rights reserved.
Getting Started with Cisco Security Appliances
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-1
User Interface
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-4
Access Configuration Mode: configure terminal Command
firewall#
configure terminal
• Used to start configuration mode to enter configuration commands from a terminal
dir [/recursive] [[•{dDiisspkla0y:t|hedidisrekc1to:r|yfcloanstehn:ts}. ][<path>}]]
ciscoasa# dir
Directory of flash:/
3
-rw- 4902912
13:37:33 Jul 27 2005 asa-802.bin
SNPA v4.0—3-8
Clearing Running Configustartupration
config (default)
Clear the runn clear
runningconfig
ciscoasa(config)# clear config all
Ciscoasa # write erase firewall(config)#
SNPA v4.0—3-10
Reload the Configuration: reload Command
firewall(config)#
reload [noconfirm] [cancel] [quick] [save-config] [max-hold-time [hh:]mm [{in [hh:]mm | {at hh:mm [{month day} | {day month}]}] [reason text]
• Monitors return packets to ensure that they are valid.
Configuration file*
* Space available
SNPA v4.0—3-12
Displaying Stored Files: System and Configuration
10.0.0.11
firewall(config)#
PIX Firewall Flash:
ASA Disk0: Disk1:
pixfirewall > help enable
USAGE:
enable [<priv_level>]
DESCRIPTION:
enable
Turn on privileged commands
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-6
startupconfig (default)
runningconfig
firewall#
write erase
• Clears the startup configuration
Fw1# write erase
© 2005 Cisco Systems, Inc. All rights reserved.
• copy run start – show running-config – show startup-config
• write memory – write terminal
To save configuration changes: copy run start
startupconfig (saved)
SNPA v4.0—3-16
Functions of the Security Appliance: Security Algorithm
• Implements stateful connection control through the security appliance.
• Allows one-way (outbound) connections with a minimum number of configuration changes. An outbound connection is a connection originating from a host on a more-protected interface and destined for a host on a less-protected network.
• Used to control access to the privileged mode • Enables you to enter other access modes
pixfirewall> enable password: pixfirewall#
© 2005 Cisco Systems, Inc. All rights reserved.
clear configure all
• Clears the running-configuration
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-9
Clearing Startup Configuration
Clear the startup configuration: Write erase
SNPA v4.0—3-2
Security Appliance Access Modes
A Cisco security appliance has four administrative access modes:
• Unprivileged • Privileged • Configuration • Monitor
10.0.0.11
Release 7.
and later
• Software image • Configuration file • Private data • ASDM image • Backup image* • Backup
configuration file* • Virtual firewall
firewall> firewall# firewall<config># monitor>
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-3
Access Privilege Mode
Internet
firewall>
enable [priv_level]
© 2005 Cisco Systems, Inc. All rights reserved.
Running Configured
SNPA v4.0—3-15
Security Appliance Security Levels
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-11
File System
Release 6.
and earlier
• Software Image • Configuration file • Private data file • PDM image • Crash
information
© 2005 Cisco Systems, Inc. All rights reserved.
firewall(config)#
sh•owDisbpolaoyttvhearsystem boot image.
10.0.0.11
ciscoasa# show bootvar
BOOT variable = disk0:/asa-802.bin Current BOOT variable = disk0:/asa-802.bin CONFIG_FILE variable = Current CONFIG_FILE variable =
firewall# dir
Directory of flash:/
3
-rw- 4902912
13:37:33 Jul 27 2005 pix-701.bin
4
-rw- 6748932
13:21:13 Jul 28 2005 asdm-501.bin
16128000 bytes total (4472832 bytes free)
runningconfig
Configuration Changes
ciscoasa# show running-config ciscoasa# show startup-config ciscoasa# write memory
© 2005 Cisco Systems, Inc. All rights reserved.
firewall(config)#
Boot [system | config} <url>
• Can store more than one system image and configuration file
• Designates which system image and startup configuration file to boot
File Management
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-7
Viewing and Saving Your Configuration
The following commands enable you to view or save your configuration:
iscoasa(config)# boot system disk0:/asa-802.bin
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-14
Verifying the Startup System Image
Boot Image flash:/pix-701.bin
© 2005 Cisco Systems, Inc. All rights reBiblioteka Baiduerved.
SNPA v4.0—3-5
help Command
pixfirewall > help ?
enable exit login logout quit
Turn on privileged commands Exit the current command mode Log in as a particular user Exit from current command mode, and to unprivileged mode Exit the current command mode
4
-rw- 6748932
13:21:13 Jul 28 2005 asdm-501.bin
16128000 bytes total (4472832 bytes free)
© 2005 Cisco Systems, Inc. All rights reserved.
SNPA v4.0—3-13
Selecting Boot System File
firewall#
exit
• Used to exit from an access mode
Ciscoasa> enable password: ciscoasa# configure terminal ciscoasa(config)# exit ciscoasa# exit ciscoasa>
• Reboots the security appliance and reloads the configuration
• Reboots can be scheduled
ciscoasa# reload Proceed with reload?[confirm] y Rebooting...
© 2005 Cisco Systems, Inc. All rights reserved.