Cisco Asa 5505 Serial Number
Today I wanted to configure a site2site VPN on my Cisco ASA in my laboratory. When I tried to configure the transform-set I received the following error message: Firewall(config)# crypto ipsec ikev1 transform-set ESP-AES256-SHA esp-aes-256 esp-sha-hmac The 3DES/AES algorithms require a VPN-3DES-AES activation key.
Cisco Networking: Show Version Command on a Firewall. Issuing the show version command on a Cisco Adaptive Security Appliance (ASA), often called a network firewall displays information unique to that type of hardware. Serial Number: JMX1214Z0LF Running Activation Key: 0xe6135258 0xe84c9b0d 0x6c501544 0x90d4f8d0 0x400ab69d Configuration. The Cisco ASA 5505 Adaptive Security Appliance is a next-generation, full-featured security appliance for small business, branch office, and enterprise teleworker environments that delivers high-performance firewall, SSL and IPsec VPN, and rich networking services in a modular, 'plug-and-play' appliance. Cisco devices have a standard serial number, from the serial number you can work out it's age and the location it was built. To decipher the serial number, here's how it is composed. Cisco S/N format is LLLYYWWXXXX.
I’ve never saw this message before. It was very confusing seeing the 3DES-AES feature disabled: Firewall(config)# show activation-key Serial Number:. Running Permanent Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000 Licensed features for this platform: Maximum Physical Interfaces: 8 perpetual VLANs: 3 DMZ Restricted Dual ISPs: Disabled perpetual VLAN Trunk Ports: 0 perpetual Inside Hosts: 10 perpetual Failover: Disabled perpetual Encryption-DES: Enabled perpetual Encryption-3DES-AES: Disabled perpetual You can request this license for free! Go to the, Login with your Cisco CCO ID and mouseover “Get Other Licenses” and choose “Security Products” and “Cisco ASA 3DES/AES License”: type in the serial number of your device (“show version”) and get the license! You will receive the license by mail or can download it via the portal. To activate the license, go to your Cisco ASA device and type in “activation-key 0x3487fs3” in the configuration level. Save config and restart for glory!
Basic ASA Configuration Before dealing with any specific configuration procedure for the Adaptive Security Appliance (ASA), you need to understand a set of basic concepts. Example 3-1 shows a summary of the boot process for an ASA 5505 appliance whose factory settings have not been changed yet. Following a successful load of the OS image, a prompt offering an interactive preconfiguration of the device using menus is presented. You do not need to analyze this option because it provides little flexibility. The initial prompt after boot completion is ciscoasa, in which ciscoasa is the default hostname for the equipment. The symbol characterizes that the EXEC or nonprivileged mode is in place, meaning that a limited set of tasks can be accomplished.
The use of the question mark (?), as illustrated in Example 3-2, shows the available commands in a given CLI mode. After a command, such as show?, displays the supported parameters for this command. This CLI help is useful, quickly becoming part of everyday life for anyone who works with Cisco equipment. Summary Boot Sequence for ASA Evaluating BIOS Options. Launch BIOS Extension to setup ROMMON Cisco Systems ROMMON Version (1.0(12)6) #0: Mon Aug 21 19:34:06 PDT 2006 Platform ASA5505 Use BREAK or ESC to interrupt boot. Use SPACE to begin boot immediately. Launching BootLoader.
Boot configuration file contains 1 entry. Loading disk0:/asa821-k8.bin. Platform ASA5505 Loading. output suppressed This platform has an ASA 5505Security Plus license.
Encryption hardware device: Cisco ASA-5505 on-board accelerator (revision 0x0) Boot microcode: CN1000-MC-BOOT-2.00 SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03 IPSec microcode: CNlite-MC-IPSECm-MAIN-2.04 Cisco Adaptive Security Appliance Software Version 8.2(1) output suppressed Cryptochecksum (changed): d41d8cd9 8f00b204 e9800998 ecf8427e Pre-configure Firewall now through interactive prompts yes? No Type help or '?' For a list of available commands. Ciscoasa Example 3-2.
Commands Available on ASA exec (Nonprivileged) Mode! Displaying all the commands available on the EXEC mode with a '?' Clear Reset functions enable Turn on privileged commands exit Exit from the EXEC help Interactive help for commands login Log in as a particular user logout Exit from the EXEC no Negate a command or set its defaults ping Send echo messages quit Exit from the EXEC show Show running system information traceroute Trace route to destination!! Viewing available options for the show command (while on EXEC mode) ciscoasa show? Checksum Display configuration information cryptochecksum curpriv Display current privilege level disk0: Display information about disk0: file system flash: Display information about flash: file system history Display the session command history inventory Show all inventory information for all slots power Power attributes version Display system software version Example 3-3 displays summary information obtained with the show version command.
Configure Cisco Asa 5505
The data returned after its execution includes OS version and hardware components, licensed features, the serial number, and even the uptime since the last reboot. The enable command with a BLANK password (for a device with no initial configuration) provides access to the privileged mode, recognized by the symbol # after the device hostname. This is illustrated in Example 3-4, which also shows the access to config mode through the configure terminal command. Some of the specific config modes ( aaa, interface, ip, router, and so on) are included in the example. NOTE It is naturally advisable to use the enable password command (at configuration level) to change the default BLANK password into a new one defined by the device administrator. This simple action restricts access to the privileged mode and consequently the right to issue any configuration command.
Sample show version Command for ASA! NOTE The access to the console port can be controlled with the aaa authentication serial console LOCAL command, in which the keyword LOCAL means that the local user database is used for validation. Local users are defined with the username command, whose usage is exemplified in the 'Remote Management Access to ASA and FWSM' section. Other user databases are analyzed in Chapter 14, 'Identity on Cisco Firewalls.' Example 3-5 illustrates the usage of some CLI output filters (all of them are case-sensitive), which constitutes a useful resource.
The first sample uses the begin filter and instructs the OS to start displaying the line of configuration (or show command) where the keyword being searched ( snmp in this case) first appears. The second exemplified filter uses the include option, which determines that all lines of the command output that include a match for the searched string should be displayed. The show running-configuration command displays the active configuration of the device and typically results in a large amount of data. More recent versions of ASA OS enable the output of this command to be broken in configuration blocks related to a specific topic.
Example 3-5 illustrates how to employ this resource to restrict the output only to the commands related to timeout information. NOTE Another classic filter is the combination exclude, which displays only the lines that do not contain the searched string. Even more complex regular expressions may also be constructed, and a whole chapter could be devoted to this subject, which is not the plan for this book. The book (starting at this chapter) brings numerous examples of practical usage, but an investigative spirit is the main asset that you must possess to benefit from these powerful resources.
Using CLI Output Filters! Establishing the point where the display should begin ciscoasa# show running-config begin snmp no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 telnet timeout 5!! Searching for all matches of a certain string (case sensitive) ciscoasa# show running-config include icmp icmp unreachable rate-limit 1 burst-size 1 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02!! Delimiting the section of the running configuration to be displayed ciscoasa# show running-config timeout timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sipmedia 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00. NOTE A useful feature of the ASA CLI is the completion of a command (as long as it is not ambiguous) that can be achieved using the key. It makes life a lot easier by reducing the time you spend typing commands. For example, although show in produces an ambiguous command and a correspondent ERROR message, show int, followed by the key is enough to unequivocally identify the show interface command.
Ciscoasa# show in ERROR:% Ambiguous command: 'show in' ciscoasa# show int ciscoasa# show interface The suggestion at this point is to practice! (It is certainly worth the investment.) Basic Configuration for ASA Appliances Other Than 5505 Having powered up an ASA appliance and knowing the basics about command execution modes, it is time to examine some of the fundamental interface configuration tasks:. Enter interface configuration mode and enable the interface for transmitting and receiving traffic: This mode is indicated by the prompt (config-if)#. At this phase the no shutdown command needs to be issued to remove the interface from the administratively down state. If logical subinterfaces have been configured, the pertinent VLAN information (to match that of the switch to which the firewall connects to) should be added. You can also change the speed and duplex.
Assign a logical name to the interface: This is accomplished with the nameif command, and the configured name is used in any future reference to the interface. (It is typically easier to remember the logical meaning of an interface than the physical.). Assign a security-level to the interface: To reflect the degree of trustworthiness of a given firewall interface, Cisco introduced in the early days of the PIX Firewalls the concept of Security Level.
The value of the Security Level (or simply sec-lvl) ranges from 0 to 100, in which the highest possible value, 100, is used for the most trusted network under the firewall control, which is, by default, called inside. Conversely, the name outside is reserved for the less trusted network (frequently the connection to the Internet) and, by default, the value 0 is assigned to its sec-lvl. Assign an IP Address to the interface: You can do this either through static or dynamic means using the ip address command. Shows the physical and logical reference topologies for the analysis of an ASA 5510 basic setup. Example 3-6 assembles the typical configuration commands, and Example 3-7 displays some commands to obtain information about the ASA interfaces. Sample Topology Using an ASA 5510 Appliance Example 3-6.
Baseline ASA5510 Configuration! Dedicated Management Interface interface Management0/0 nameif mgmt security-level 100 ip address 192.168.1.11 255.255.255.0 no management-only no shutdown!! Physical Interface interface Ethernet0/1 no nameif no security-level no ip address no shutdown!! Creating Subinterfaces on interface E0/1 (two logical networks) interface Ethernet0/1.1201 vlan 1201 nameif fw1 security-level 50 ip address 172.16.61.1 255.255.255.0! Interface Ethernet0/1.1212 vlan 1212 description.
Direct Access to Services Segment. nameif svcs security-level 99 ip address 172.16.62.171 255.255.255.240 Example 3-7. Viewing Information About ASA Interfaces!
Viewing logical interfaces and correspondent security levels ASA1# show nameif Interface Name Security Ethernet0/1.1201 fw1 50 Ethernet0/1.1212 svcs 99 Management0/0 mgmt 100!! Summary IP Addressing information for the interfaces in use ASA1# show interface ip brief Interface IP-Address OK? Method Status Protocol Ethernet0/1 unassigned YES unset up up Ethernet0/1.1201 172.16.61.1 YES CONFIG up up Ethernet0/1.1212 172.16.62.171 YES CONFIG up up Management0/0 192.168.1.11 YES CONFIG up up!! NOTE An Interface VLAN is also known as a Switched Virtual Interface (SVI) and represents the Layer 3 counterpart of the L2 VLAN. On Catalyst switches, the L2 portion must be defined by means of the Vlan command.
On ASA, this command is not available, and the assignment of a port to a VLAN ( switchport access vlan command) or the VLAN addition to a Dot1Q trunk already creates the L2 definition. Example 3-9 relates to and documents the commands employed to verify the existent VLANs and their assigned ports.
The typical outputs of the show interface options ( physical interface and interface vlan) are registered in this example, which also displays a changed hostname for the appliance ( ASA 5505 instead of the default ciscoasa). Baseline ASA 5505 Configuration!
Physical Interface operating as an Access Port interface Ethernet0/5 switchport access vlan 100 no shutdown!! Physical Interface operating as a 802.1Q (Dot1Q) Trunk Port interface Ethernet0/3 switchport trunk allowed vlan 100,201 switchport mode trunk no shutdown!! Logical Interface associated with VLAN 100 interface Vlan100 description. Management Interface nameif mgmt security-level 100 ip address 192.168.1.2 255.255.255.0 no shutdown!! Logical Interface associated with VLAN 201 interface Vlan201 description. DMZ Network nameif dmz security-level 50 ip address 172.16.201.2 255.255.255.0 no shutdown Example 3-9. Viewing Information About ASA 5505 Interfaces!
VLAN Assignment on ASA5505 internal switch (L2 information) ASA5505# show switch vlan VLAN Name Status Ports - - - - 1 - down Et0/0, Et0/1, Et0/2, Et0/4 Et0/6, Et0/7 100 mgmt up Et0/3, Et0/5 201 dmz up Et0/3!!