Cisco Adaptive Security Device Manager Configuration Guide

Brand: Cisco

Model: Adaptive Security Device Manager

Category: Software

Type: Configuration Guide

ASDM Book 1: Cisco ASA Series General Operations ASDM

Configuration Guide, 7.15

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,

INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,

EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH

THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,

CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.

CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF

MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT

LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS

HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network

topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional

and coincidental.

All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.

Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:

https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a

partnership relationship between Cisco and any other company. (1721R)

CONTENTS

About This Guide xlix

PREFACE

Document Objectives xlix

Related Documentation xlix

Document Conventions xlix

Communications, Services, and Additional Information li

Getting Started with the ASA 53

PART I

Introduction to the Cisco ASA 1

CHAPTER 1

ASDM Requirements 1

ASDM Java Requirements 1

ASDM Compatibility Notes 2

Hardware and Software Compatibility 5

VPN Compatibility 6

New Features 6

New Features in ASA 9.14(2) 6

New Features in ASA 9.14(1.30) 6

New Features in ASDM 7.14(1.48) 6

New Features in ASAv 9.14(1.6) 7

New Features in ASA 9.14(1)/ASDM 7.14(1) 7

Firewall Functional Overview 10

Security Policy Overview 11

Permitting or Denying Traffic with Access Rules 11

Applying NAT 11

Protecting from IP Fragments 11

Applying HTTP, HTTPS, or FTP Filtering 11

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

iii

Applying Application Inspection 12

Sending Traffic to Supported Hardware or Software Modules 12

Applying QoS Policies 12

Applying Connection Limits and TCP Normalization 12

Enabling Threat Detection 12

Firewall Mode Overview 12

Stateful Inspection Overview 13

VPN Functional Overview 14

Security Context Overview 15

ASA Clustering Overview 15

Special, Deprecated, and Legacy Services 15

Getting Started 17

CHAPTER 2

Access the Console for the Command-Line Interface 17

Access the Appliance Console 17

Access the Firepower 2100 Platform Mode Console 18

Access the Firepower 1000 and 2100 Appliance Mode Console 20

Access the ASA Console on the Firepower 4100/9300 Chassis 22

Access the Software Module Console 23

Access the ASA 5506W-X Wireless Access Point Console 24

Configure ASDM Access 24

Use the Factory Default Configuration for ASDM Access (Appliances, ASAv) 24

Customize ASDM Access 25

Start ASDM 27

Customize ASDM Operation 29

Install an Identity Certificate for ASDM 29

Increase the ASDM Configuration Memory 29

Increase the ASDM Configuration Memory in Windows 29

Increase the ASDM Configuration Memory in Mac OS 30

Factory Default Configurations 30

Restore the Factory Default Configuration 32

Restore the ASAv Deployment Configuration 34

ASA 5506-X Series Default Configuration 35

ASA 5508-X and 5516-X Default Configuration 37

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

Contents

ASA 5525-X through ASA 5555-X Default Configuration 38

Firepower 1010 Default Configuration 38

Firepower 1100 Default Configuration 40

Firepower 2100 Platform Mode Default Configuration 41

Firepower 2100 Appliance Mode Default Configuration 43

Firepower 4100/9300 Chassis Default Configuration 44

ISA 3000 Default Configuration 45

ASAv Deployment Configuration 46

Set the Firepower 2100 to Appliance or Platform Mode 48

Get Started with the Configuration 50

Use the Command Line Interface Tool in ASDM 50

Use the Command Line Interface Tool 50

Show Commands Ignored by ASDM on the Device 51

Apply Configuration Changes to Connections 52

ASDM Graphical User Interface 53

CHAPTER 3

About the ASDM User Interface 53

Navigate the ASDM User Interface 56

Menus 57

File Menu 57

View Menu 58

Tools Menu 59

Wizards Menu 61

Window Menu 61

Help Menu 61

Toolbar 62

ASDM Assistant 63

Status Bar 64

Connection to Device 64

Device List 64

Common Buttons 65

Keyboard Shortcuts 66

Find Function in ASDM Panes 68

Find Function in Rule Lists 68

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

Contents

Enable Extended Screen Reader Support 69

Organizational Folder 69

Home Pane (Single Mode and Context) 70

Device Dashboard Tab 70

Device Information Pane 71

Interface Status Pane 72

VPN Sessions Pane 72

Failover Status Pane 72

System Resources Status Pane 72

Traffic Status Pane 73

Latest ASDM Syslog Messages Pane 73

Firewall Dashboard Tab 74

Traffic Overview Pane 75

Top 10 Access Rules Pane 75

Top Usage Status Pane 75

Top Ten Protected Servers Under SYN Attack Pane 76

Top 200 Hosts Pane 76

Top Botnet Traffic Filter Hits Pane 76

Cluster Dashboard Tab 77

Cluster Firewall Dashboard Tab 78

Content Security Tab 79

Intrusion Prevention Tab 80

ASA CX Status Tab 82

ASA FirePower Status Tabs 82

Home Pane (System) 83

Define ASDM Preferences 84

Search with the ASDM Assistant 86

Enable History Metrics 87

Unsupported Commands 87

Ignored and View-Only Commands 87

Effects of Unsupported Commands 88

Discontinuous Subnet Masks Not Supported 88

Interactive User Commands Not Supported by the ASDM CLI Tool 89

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

Contents

Licenses: Product Authorization Key Licensing 91

CHAPTER 4

About PAK Licenses 91

Preinstalled License 91

Permanent License 91

Time-Based Licenses 92

Time-Based License Activation Guidelines 92

How the Time-Based License Timer Works 92

How Permanent and Time-Based Licenses Combine 92

Stacking Time-Based Licenses 93

Time-Based License Expiration 94

License Notes 94

AnyConnect Plus and Apex Licenses 94

Other VPN License 95

Total VPN Sessions Combined, All Types 95

VPN Load Balancing 95

Legacy VPN Licenses 95

Encryption License 95

Carrier License 96

Total TLS Proxy Sessions 96

VLANs, Maximum 97

Botnet Traffic Filter License 97

IPS Module License 97

Shared AnyConnect Premium Licenses (AnyConnect 3 and Earlier) 97

Failover or ASA Cluster Licenses 97

Failover License Requirements and Exceptions 97

ASA Cluster License Requirements and Exceptions 99

How Failover or ASA Cluster Licenses Combine 99

Loss of Communication Between Failover or ASA Cluster Units 100

Upgrading Failover Pairs 101

No Payload Encryption Models 101

Licenses FAQ 101

Guidelines for PAK Licenses 102

Configure PAK Licenses 104

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

vii

Contents

Order License PAKs and Obtain an Activation Key 104

Obtain a Strong Encryption License 105

Activate or Deactivate Keys 107

Configure a Shared License (AnyConnect 3 and Earlier) 108

About Shared Licenses 109

About the Shared Licensing Server and Participants 109

Communication Issues Between Participant and Server 110

About the Shared Licensing Backup Server 110

Failover and Shared Licenses 111

Maximum Number of Participants 112

Configure the Shared Licensing Server 113

Configure the Shared Licensing Participant and the Optional Backup Server 113

Supported Feature Licenses Per Model 114

Licenses Per Model 114

ASA 5506-X and ASA 5506W-X License Features 114

ASA 5506H-X License Features 115

ASA 5508-X License Features 116

ASA 5516-X License Features 117

ASA 5525-X License Features 118

ASA 5545-X License Features 119

ASA 5555-X License Features 120

ISA 3000 License Features 122

Monitoring PAK Licenses 123

Viewing Your Current License 123

Monitoring the Shared License 123

History for PAK Licenses 124

Licenses: Smart Software Licensing (ASAv, ASA on Firepower) 133

CHAPTER 5

About Smart Software Licensing 133

Smart Software Licensing for the ASA on the Firepower 4100/9300 Chassis 133

Smart Software Manager and Accounts 134

Offline Management 134

Permanent License Reservation 134

Satellite Server (Smart Software Manager On-Prem) 136

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

viii

Contents

Licenses and Devices Managed per Virtual Account 136

Evaluation License 136

About Licenses by Type 137

AnyConnect Plus, AnyConnect Apex, And VPN Only Licenses 137

Other VPN License 137

Total VPN Sessions Combined, All Types 138

Encryption License 138

Carrier License 140

Total TLS Proxy Sessions 140

VLANs, Maximum 141

Botnet Traffic Filter License 141

Failover or ASA Cluster Licenses 141

Failover Licenses for the ASAv 141

Failover Licenses for the Firepower 1010 141

Failover Licenses for the Firepower 1100 142

Failover Licenses for the Firepower 2100 143

Failover Licenses for the ASA on the Firepower 4100/9300 Chassis 145

ASA Cluster Licenses for the ASA on the Firepower 4100/9300 Chassis 146

Prerequisites for Smart Software Licensing 147

Regular and Satellite Smart License Prerequisites 147

Permanent License Reservation Prerequisites 147

License PIDs 148

Guidelines for Smart Software Licensing 151

Defaults for Smart Software Licensing 152

ASAv: Configure Smart Software Licensing 152

ASAv: Configure Regular Smart Software Licensing 152

ASAv: Configure Satellite Smart Software Licensing 155

ASAv: Configure Utility Mode and MSLA Smart Software Licensing 156

ASAv: Configure Permanent License Reservation 156

Install the ASAv Permanent License 157

(Optional) Return the ASAv Permanent License 159

(Optional) Deregister the ASAv (Regular and Satellite) 159

(Optional) Renew the ASAv ID Certificate or License Entitlement (Regular and Satellite) 160

Firepower 1000 and 2100: Configure Smart Software Licensing 160

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

Contents

Firepower 1000 or 2100: Configure Regular Smart Software Licensing 161

Firepower 1000 or 2100: Configure Satellite Smart Software Licensing 164

Firepower 1000 or 2100: Configure Permanent License Reservation 165

Install the Firepower 1000 or 2100 Permanent License 166

(Optional) Return the Firepower 1000 or 2100 Permanent License 168

(Optional) Deregister the Firepower 1000 or 2100 (Regular and Satellite) 169

(Optional) Renew the Firepower 1000 or 2100 ID Certificate or License Entitlement (Regular and

Satellite) 169

Firepower 4100/9300: Configure Smart Software Licensing 170

Firepower 4100/9300: Configure Pre-2.3.0 Satellite Smart Software Licensing 170

Firepower 4100/9300: Configure Smart Software Licensing 172

Licenses Per Model 173

ASAv 173

Firepower 1010 176

Firepower 1100 Series 177

Firepower 2100 Series 178

Firepower 4100 Series ASA Application 180

Firepower 9300 ASA Application 181

Monitoring Smart Software Licensing 182

Viewing Your Current License 182

Viewing Smart License Status 182

Viewing the UDI 182

Smart Software Manager Communication 183

Device Registration and Tokens 183

Periodic Communication with the License Authority 183

Out-of-Compliance State 184

Smart Call Home Infrastructure 185

Smart License Certificate Management 185

History for Smart Software Licensing 185

Logical Devices for the Firepower 4100/9300 189

CHAPTER 6

About Firepower Interfaces 189

Chassis Management Interface 189

Interface Types 190

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

Contents

FXOS Interfaces vs. Application Interfaces 191

About Logical Devices 192

Standalone and Clustered Logical Devices 192

Requirements and Prerequisites for Hardware and Software Combinations 192

Guidelines and Limitations for Logical Devices 193

Guidelines and Limitations for Firepower Interfaces 193

General Guidelines and Limitations 194

Requirements and Prerequisites for High Availability 194

Configure Interfaces 194

Enable or Disable an Interface 195

Configure a Physical Interface 195

Add an EtherChannel (Port Channel) 196

Configure Logical Devices 198

Add a Standalone ASA 198

Add a High Availability Pair 200

Change an Interface on an ASA Logical Device 201

Connect to the Console of the Application 202

History for Logical Devices 204

Transparent or Routed Firewall Mode 207

CHAPTER 7

About the Firewall Mode 207

About Routed Firewall Mode 207

About Transparent Firewall Mode 207

Using the Transparent Firewall in Your Network 208

Management Interface 208

Passing Traffic For Routed-Mode Features 208

About Bridge Groups 209

Bridge Virtual Interface (BVI) 209

Bridge Groups in Transparent Firewall Mode 209

Bridge Groups in Routed Firewall Mode 210

Passing Traffic Not Allowed in Routed Mode 211

Allowing Layer 3 Traffic 211

Allowed MAC Addresses 212

BPDU Handling 212

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

Contents

MAC Address vs. Route Lookups 212

Unsupported Features for Bridge Groups in Transparent Mode 214

Unsupported Features for Bridge Groups in Routed Mode 214

Default Settings 216

Guidelines for Firewall Mode 216

Set the Firewall Mode (Single Mode) 217

Examples for Firewall Mode 218

How Data Moves Through the ASA in Routed Firewall Mode 218

An Inside User Visits a Web Server 218

An Outside User Visits a Web Server on the DMZ 219

An Inside User Visits a Web Server on the DMZ 220

An Outside User Attempts to Access an Inside Host 221

A DMZ User Attempts to Access an Inside Host 222

How Data Moves Through the Transparent Firewall 223

An Inside User Visits a Web Server 224

An Inside User Visits a Web Server Using NAT 225

An Outside User Visits a Web Server on the Inside Network 227

An Outside User Attempts to Access an Inside Host 228

History for the Firewall Mode 229

Startup Wizard 233

CHAPTER 8

Access the Startup Wizard 233

Guidelines for the Startup Wizard 233

Startup Wizard Screens 233

Starting Point or Welcome 233

Basic Configuration 234

Interface Screens 234

Outside Interface Configuration (Routed Mode) 234

Outside Interface Configuration - PPPoE (Routed Mode, Single Mode) 234

Management IP Address Configuration (Transparent Mode) 234

Other Interfaces Configuration 234

Static Routes 234

DHCP Server 234

Address Translation (NAT/PAT) 235

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

xii

Contents

Administrative Access 235

IPS Basic Configuration 235

ASA CX Basic Configuration (ASA 5585-X) 235

ASA FirePOWER Basic Configuration 235

Time Zone and Clock Configuration 235

Auto Update Server (Single Mode) 235

Startup Wizard Summary 236

History for the Startup Wizard 236

High Availability and Scalability 239

PART II

Multiple Context Mode 241

CHAPTER 9

About Security Contexts 241

Common Uses for Security Contexts 241

Context Configuration Files 242

Context Configurations 242

System Configuration 242

Admin Context Configuration 242

How the ASA Classifies Packets 242

Valid Classifier Criteria 242

Classification Examples 243

Cascading Security Contexts 245

Management Access to Security Contexts 246

System Administrator Access 246

Context Administrator Access 246

Management Interface Usage 246

About Resource Management 247

Resource Classes 247

Resource Limits 247

Default Class 248

Use Oversubscribed Resources 249

Use Unlimited Resources 249

About MAC Addresses 250

MAC Addresses in Multiple Context Mode 250

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

xiii

Contents

Automatic MAC Addresses 250

VPN Support 251

Licensing for Multiple Context Mode 251

Prerequisites for Multiple Context Mode 252

Guidelines for Multiple Context Mode 253

Defaults for Multiple Context Mode 254

Configure Multiple Contexts 254

Enable or Disable Multiple Context Mode 254

Enable Multiple Context Mode 255

Restore Single Context Mode 256

Configure a Class for Resource Management 256

Configure a Security Context 260

Assign MAC Addresses to Context Interfaces Automatically 262

Change Between Contexts and the System Execution Space 262

Manage Security Contexts 263

Remove a Security Context 263

Change the Admin Context 264

Change the Security Context URL 264

Reload a Security Context 265

Reload by Clearing the Configuration 266

Reload by Removing and Re-adding the Context 266

Monitoring Security Contexts 266

Monitor Context Resource Usage 267

View Assigned MAC Addresses 268

View MAC Addresses in the System Configuration 268

View MAC Addresses Within a Context 269

History for Multiple Context Mode 269

Failover for High Availability 275

CHAPTER 10

About Failover 275

Failover Modes 275

Failover System Requirements 276

Hardware Requirements 276

Software Requirements 276

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

xiv

Contents

License Requirements 277

Failover and Stateful Failover Links 277

Failover Link 277

Stateful Failover Link 278

Avoiding Interrupted Failover and Data Links 279

MAC Addresses and IP Addresses in Failover 281

Stateless and Stateful Failover 283

Stateless Failover 283

Stateful Failover 283

Bridge Group Requirements for Failover 285

Bridge Group Requirements for Appliances, ASAv 285

Failover Health Monitoring 286

Unit Health Monitoring 286

Interface Monitoring 286

Failover Times 288

Configuration Synchronization 289

Running Configuration Replication 289

File Replication 290

Command Replication 290

About Active/Standby Failover 291

Primary/Secondary Roles and Active/Standby Status 291

Active Unit Determination at Startup 291

Failover Events 291

About Active/Active Failover 292

Active/Active Failover Overview 293

Primary/Secondary Roles and Active/Standby Status for a Failover Group 293

Active Unit Determination for Failover Groups at Startup 293

Failover Events 294

Licensing for Failover 295

Guidelines for Failover 297

Defaults for Failover 299

Configure Active/Standby Failover 299

Configure Active/Active Failover 300

Configure Optional Failover Parameters 301

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

Contents

Configure Failover Criteria and Other Settings 301

Configure Interface Monitoring and Standby Addresses 304

Configure Support for Asymmetrically Routed Packets (Active/Active Mode) 305

Manage Failover 307

Modify the Failover Setup 307

Force Failover 309

Disable Failover 310

Restore a Failed Unit 311

Re-Sync the Configuration 311

Monitoring Failover 312

Failover Messages 312

Failover Syslog Messages 312

Failover Debug Messages 312

SNMP Failover Traps 312

Monitoring Failover Status 312

System 313

Failover Group 1 and Failover Group 2 313

History for Failover 314

Failover for High Availability in the Public Cloud 317

CHAPTER 11

About Failover in the Public Cloud 317

About Active/Backup Failover 318

Primary/Secondary Roles and Active/Backup Status 318

Failover Connection 318

Polling and Hello Messages 318

Active Unit Determination at Startup 319

Failover Events 319

Guidelines and Limitations 321

Licensing for Failover in the Public Cloud 322

Defaults for Failover in the Public Cloud 322

About ASAv High Availability in Microsoft Azure 322

About the Azure Service Principal 323

Configuration Requirements for ASAv High Availability in Azure 324

Configure Active/Backup Failover 325

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

xvi

Contents

Configure Optional Failover Parameters 327

Configure Azure Route Tables 327

Manage Failover in the Public Cloud 328

Force Failover 328

Update Routes 328

Validate Azure Authentication 329

Monitor Failover in the Public Cloud 329

Failover Status 330

Failover Messages 330

History for Failover in the Public Cloud 331

ASA Cluster 333

CHAPTER 12

About ASA Clustering 333

How the ASA Cluster Fits into Your Network 333

Cluster Members 334

Bootstrap Configuration 334

Control and Data Unit Roles 334

Cluster Interfaces 334

Cluster Control Link 334

Configuration Replication 335

ASA Cluster Management 335

Management Network 335

Management Interface 335

Control Unit Management Vs. Data Unit Management 335

RSA Key Replication 336

ASDM Connection Certificate IP Address Mismatch 336

Inter-Site Clustering 336

Licenses for ASA Clustering 337

Requirements and Prerequisites for ASA Clustering 337

Guidelines for ASA Clustering 339

Configure ASA Clustering 344

Back Up Your Configurations (Recommended) 345

Cable the Units and Configure Interfaces 345

About Cluster Interfaces 345

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

xvii

Contents

Cable the Cluster Units and Configure Upstream and Downstream Equipment 354

Configure the Cluster Interface Mode on the Control Unit 354

(Recommended; Required in Multiple Context Mode) Configure Interfaces on the Control Unit

357

Create or Join an ASA Cluster 362

Run the High Availability Wizard 362

Customize the Clustering Operation 366

Configure Basic ASA Cluster Parameters 366

Configure Interface Health Monitoring and Auto-Rejoin Settings 370

Configure the Cluster TCP Replication Delay 371

Configure Inter-Site Features 372

Manage Cluster Members 375

Add a New Data Unit from the Control Unit 375

Become an Inactive Member 376

Deactivate a Data Unit from the Control Unit 377

Rejoin the Cluster 377

Leave the Cluster 378

Change the Control Unit 379

Execute a Command Cluster-Wide 380

Monitoring the ASA Cluster 381

Monitoring Cluster Status 381

Capturing Packets Cluster-Wide 381

Monitoring Cluster Resources 381

Monitoring Cluster Traffic 381

Monitoring the Cluster Control Link 382

Monitoring Cluster Routing 382

Configuring Logging for Clustering 382

Examples for ASA Clustering 382

Sample ASA and Switch Configuration 382

ASA Configuration 383

Cisco IOS Switch Configuration 384

Firewall on a Stick 385

Traffic Segregation 388

Spanned EtherChannel with Backup Links (Traditional 8 Active/8 Standby) 390

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

xviii

Contents

OTV Configuration for Routed Mode Inter-Site Clustering 397

Examples for Inter-Site Clustering 399

Individual Interface Routed Mode North-South Inter-Site Example 399

Spanned EtherChannel Routed Mode Example with Site-Specific MAC and IP Addresses 400

Spanned EtherChannel Transparent Mode North-South Inter-Site Example 401

Spanned EtherChannel Transparent Mode East-West Inter-Site Example 402

Reference for Clustering 403

ASA Features and Clustering 403

Unsupported Features with Clustering 403

Centralized Features for Clustering 404

Features Applied to Individual Units 405

AAA for Network Access and Clustering 406

Connection Settings 406

FTP and Clustering 406

Identity Firewall and Clustering 406

Multicast Routing and Clustering 407

NAT and Clustering 407

Dynamic Routing and Clustering 409

SCTP and Clustering 410

SIP Inspection and Clustering 411

SNMP and Clustering 411

STUN and Clustering 411

Syslog and NetFlow and Clustering 411

Cisco TrustSec and Clustering 411

VPN and Clustering 411

Performance Scaling Factor 412

Control Unit Election 412

High Availability Within the ASA Cluster 413

Unit Health Monitoring 413

Interface Monitoring 413

Status After Failure 413

Rejoining the Cluster 414

Data Path Connection State Replication 414

How the ASA Cluster Manages Connections 415

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

xix

Contents

Connection Roles 415

New Connection Ownership 417

Sample Data Flow 417

Rebalancing New TCP Connections Across the Cluster 418

History for ASA Clustering 418

ASA Cluster for the Firepower 4100/9300 Chassis 425

CHAPTER 13

About Clustering on the Firepower 4100/9300 Chassis 425

Bootstrap Configuration 426

Cluster Members 426

Master and Slave Unit Roles 426

Cluster Control Link 427

Size the Cluster Control Link 427

Cluster Control Link Redundancy 428

Cluster Control Link Reliability 428

Cluster Control Link Network 428

Cluster Interfaces 429

Connecting to a VSS or vPC 429

Configuration Replication 429

ASA Cluster Management 429

Management Network 429

Management Interface 429

Control Unit Management Vs. Data Unit Management 430

RSA Key Replication 430

ASDM Connection Certificate IP Address Mismatch 430

Spanned EtherChannels (Recommended) 430

Inter-Site Clustering 431

Requirements and Prerequisites for Clustering on the Firepower 4100/9300 Chassis 432

Licenses for Clustering on the Firepower 4100/9300 Chassis 433

Licenses for Distributed S2S VPN 434

Clustering Guidelines and Limitations 435

Configure Clustering on the Firepower 4100/9300 Chassis 439

FXOS: Add an ASA Cluster 440

Create an ASA Cluster 440

ASDM Book 1: Cisco ASA Series General Operations ASDM Configuration Guide, 7.15

Contents

Page is loading ...

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108
1109
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171
1172
1173
1174
1175
1176
1177
1178

Cisco Adaptive Security Device Manager Configuration Guide

Brand: Cisco

Model: Adaptive Security Device Manager

Category: Software

Type: Configuration Guide

Download PDF

report

Cisco Adaptive Security Device Manager Configuration Guide

Cisco Adaptive Security Device Manager Configuration Guide

Related papers

Other documents