Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA

Tel: 408 526-4000
800 553-NETS (6387)
Fax: 408 527-0883
Cisco ASA 5500 Series
Getting Started Guide
For the Cisco ASA 5510, ASA 5520, ASA 5540, and ASA 5550
Software Version 8.0
Customer Order Number: DOC-78-18002-01
Text Part Number: 78-18002-01
THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT
NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT
ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR
THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE
INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU
ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A
COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as
part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE
PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED
OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL
DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR

ASA 5550
1-5
CHAPTER

2
Maximizing Throughput on the ASA 5550
2-1
Embedded Network Interfaces
2-1
Balancing Traffic to Maximize Throughput
2-2
What to Do Next
2-5
CHAPTER

3
Installing the ASA 5550
3-1
Verifying the Package Contents
3-2
Installing the Chassis
3-3
Rack-Mounting the Chassis
3-4
Installing SFP Modules
3-5
SFP Module
3-6
Installing an SFP Module
3-7

4-9
CHAPTER

5
Installing Optional SSMs
5-1
Cisco 4GE SSM
5-1
4GE SSM Components
5-2
Installing the Cisco 4GE SSM
5-3
Installing the SFP Modules
5-4
SFP Module
5-5
Installing the SFP Module
5-6
Cisco AIP SSM and CSC SSM
5-8
Installing an SSM
5-9
What to Do Next
5-10
CHAPTER

6
Connecting Interface Cables on the ASA 5500, ASA 5510, ASA 5520, and ASA
5540 Platforms
6-1

7-5
Starting ASDM with a Web Browser
7-8
Running the ASDM Startup Wizard
7-9
What to Do Next
7-10
CHAPTER

8
Scenario: DMZ Configuration
8-1
Basic Network Layout for a DMZ Configuration
8-1
Example DMZ Network Topology
8-2
An Inside User Visits a Web Server on the Internet
8-4
An Internet User Visits the DMZ Web Server
8-6
An Inside User Visits the DMZ Web Server
8-8
Configuring the Adaptive Security Appliance for a DMZ Deployment
8-10
Configuration Requirements
8-11
Information to Have Available
8-11
Starting ASDM
8-12

Information to Have Available
9-3
Starting ASDM
9-3
Configuring an IPsec Remote-Access VPN
9-5
Selecting VPN Client Types
9-7
Specifying the VPN Tunnel Group Name and Authentication Method
9-8
Specifying a User Authentication Method
9-9
(Optional) Configuring User Accounts
9-11
Configuring Address Pools
9-12
Configuring Client Attributes
9-13
Configuring the IKE Policy
9-14
Configuring IPsec Encryption and Authentication Parameters
9-16
Specifying Address Translation Exception and Split Tunneling
9-17
Verifying the Remote-Access VPN Configuration
9-18
What to Do Next
9-20
CHAPTER


Verifying the Remote-Access VPN Configuration
10-14
What to Do Next
10-15
CHAPTER

11
Scenario: SSL VPN Clientless Connections
11-1
About Clientless SSL VPN
11-1
Security Considerations for Clientless SSL VPN Connections
11-2
Example Network with Browser-Based SSL VPN Access
11-3
Implementing the Clientless SSL VPN Scenario
11-4
Information to Have Available
11-5
Starting ASDM
11-5
Configuring the Adaptive Security Appliance for Browser-Based SSL VPN
Connections
11-7
Specifying the SSL VPN Interface
11-8
Specifying a User Authentication Method
11-10
Specifying a Group Policy
11-11

12-8
Configuring IPsec Encryption and Authentication Parameters
12-10
Specifying Hosts and Networks
12-11
Viewing VPN Attributes and Completing the Wizard
12-12
Configuring the Other Side of the VPN Connection
12-14
What to Do Next
12-14
CHAPTER

13
Configuring the AIP SSM
13-1
Understanding the AIP SSM
13-2
How the AIP SSM Works with the Adaptive Security Appliance
13-2
Operating Modes
13-3
Using Virtual Sensors
13-4
Configuring the AIP SSM
13-6
AIP SSM Procedure Overview
13-6
Sessioning to the AIP SSM
13-6

14-6
Starting ASDM
14-7
Verify Time Settings
14-9
Run the CSC Setup Wizard
14-10
What to Do Next
14-17
CHAPTER

15
Configuring the 4GE SSM for Fiber
15-1
Cabling 4GE SSM Interfaces
15-2
Setting the 4GE SSM Media Type for Fiber Interfaces (Optional)
15-3
What to Do Next
15-5
APPENDIX

A
Obtaining a 3DES/AES License
A-1
Contents
x
Cisco ASA 5500 Series Getting Started Guide
78-18002-01
1-1

ASA 5500 with AIP SSM
1-2
Cisco ASA 5500 Series Getting Started Guide
78-18002-01
ASA 5500 with AIP SSM
Perform initial setup of the adaptive security
appliance
Chapter 7, “Configuring the
Adaptive Security Appliance”
Configure the adaptive security appliance for
your implementation
Chapter 8, “Scenario: DMZ
Configuration”
Chapter 9, “Scenario: IPsec
Remote-Access VPN Configuration”
Chapter 10, “Scenario: Configuring
Connections for a Cisco AnyConnect
VPN Client”
Chapter 11, “Scenario: SSL VPN
Clientless Connections”
Chapter 12, “Scenario: Site-to-Site
VPN Configuration”
Configure optional and advanced features Cisco Security Appliance Command
Line Configuration Guide
Operate the system on a daily basis Cisco Security Appliance Command
Reference
Cisco Security Appliance Logging
Configuration and System Log
Messages
To Do This ... See ...
1-3
Cisco ASA 5500 Series Getting Started Guide
78-18002-01
Chapter 1 Before You Begin
ASA 5500 with CSC SSM
ASA 5500 with CSC SSM

Connect interface cables Chapter 6, “Connecting Interface
Cables on the ASA 5500, ASA 5510,
ASA 5520, and ASA 5540
Platforms”
Perform initial setup the adaptive security
appliance
Chapter 7, “Configuring the
Adaptive Security Appliance”
Configure the adaptive security appliance for
AIP SSM
Chapter 9, “Scenario: IPsec
Remote-Access VPN Configuration”
Configure IPS software for intrusion
prevention
Configuring the Cisco Intrusion
Prevention System Sensor Using the
Command Line Interface
Chapter 1 Before You Begin
ASA 5500 with 4GE SSM
1-4
Cisco ASA 5500 Series Getting Started Guide
78-18002-01
ASA 5500 with 4GE SSM
Perform initial setup of the adaptive

Chapter 7, “Configuring the
Adaptive Security Appliance”

Refine configuration and configure
optional and advanced features
Cisco Security Appliance Command
Line Configuration Guide
Cisco Security Appliance Command
Reference
Cisco Security Appliance Logging
Configuration and System Log
Messages
Chapter 1 Before You Begin
ASA 5550
1-6
Cisco ASA 5500 Series Getting Started Guide
78-18002-01
2-1
Cisco ASA 5500 Series Getting Started Guide
78-18002-01
CHAPTER
2
Maximizing Throughput on the ASA
5550
Note
This chapter applies only to the Cisco ASA 5550.
The Cisco ASA 5550 adaptive security appliance is designed to deliver maximum
throughput when configured according to the guidelines described in this chapter.
This chapter includes the following sections:

can use only four Slot 1 ports at a time. For example, you could use two Slot 1
copper ports and two fiber ports, but you cannot use fiber ports if you are already
using all four Slot 1 copper ports.
Balancing Traffic to Maximize Throughput
To maximize traffic throughput, configure the adaptive security appliance so that
traffic is distributed equally between the two buses in the device. To achieve this,
lay out the network so that all traffic flows through both Bus 0 (Slot 0) and Bus 1
(Slot 1), entering through one bus and exiting through the other.
153217
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT
USB2
USB1
FLASH
CONSOLE
AUX
POWER
STATUS
FLASH
VPN
ACTIVE
PWR
STATUS

AUX
POWER
STATUS
FLASH
VPN
ACTIVE
PWR
STATUS
LNK
SPD0123
Slot 1
Slot 0
Incoming and
outgoing traffic
Incoming and
outgoing traffic
Maximum
throughput
153305
LINK SPD
2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT
USB2
USB1

2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT
USB2
USB1
FLASH
CONSOLE
AUX
POWER
STATUS
FLASH
VPN
ACTIVE
P
W
R
S
T
A
T
U
S
LNK
SPD0123
LINK SPD

2
LINK SPD
1
LINK SPD
0
LINK SPD
3
MGMT
USB2
USB1
FLASH
CONSOLE
AUX
POWER
STAT US
FLASH
VPN
ACTIVE
P
W
R
S
T
A
T
U
S
LNK
SPD0123
LINK SPD

Slot 0
Incoming and
outgoing traffic
Slot 1
Slot 0
Slot 1
Slot 0
153306
Slot 1
Slot 0
Incoming and
outgoing traffic
Incoming and
outgoing traffic
Incoming and outgoing traffic
2-5
Cisco ASA 5500 Series Getting Started Guide
78-18002-01
Chapter 2 Maximizing Throughput on the ASA 5550
What to Do Next
Note
You can use the show traffic command to see the traffic throughput over each
bus. For more information about using the command, see the Cisco Security
Appliance Command Reference.
What to Do Next
Continue with Chapter 3, “Installing the ASA 5550.”
Chapter 2 Maximizing Throughput on the ASA 5550
What to Do Next
2-6
Cisco ASA 5500 Series Getting Started Guide

What to Do Next, page 3-19
Chapter 3 Installing the ASA 5550
Verifying the Package Contents
3-2
Cisco ASA 5500 Series Getting Started Guide
78-18002-01
Verifying the Package Contents
Verify the contents of the packing box, shown in Figure 3-1, to ensure that you
have received all items necessary to install the Cisco ASA 5550.
Figure 3-1 Contents of ASA 5550 Package
Yellow Ethernet cable
(72-1482-01)
Mounting brackets
(700-18797-01 AO) right
(700-18798-01 AO) left
4 flathead screws
(48-0451-01 AO)
2 long cap screws
(48-0654-01 AO)
4 cap screws
(48-0523-01 AO)
Safety and
Compliance
Guide
Cisco ASA 5550 adaptive
security appliance
Documentation
Cisco ASA
5550 Adaptive
Security Appliance

IN
K
S
P
D
0
MGMT
USB2
USB1
F
L
A
S
H
P
O
W
E
R
S
T
A
T
U
S
F
L
A
S
H

Warning
To prevent bodily injury when mounting or servicing this unit in a rack, you must
take special precautions to ensure that the system remains stable. The
following guidelines are provided to ensure your safety.
The following information can help plan equipment rack installation:
•
Allow clearance around the rack for maintenance.
•
When mounting a device in an enclosed rack ensure adequate ventilation. An
enclosed rack should never be overcrowded.

Make sure that the rack is not
congested, because each unit generates heat.
•
When mounting a device in an open rack, make sure that the rack frame does
not block the intake or exhaust ports.
•
If the rack contains only one unit, mount the unit at the bottom of the rack.
•
If the rack is partially filled, load the rack from the bottom to the top, with the
heaviest component at the bottom of the rack.
•
If the rack contains stabilizing devices, install the stabilizers prior to
mounting or servicing the unit in the rack.
Warning
Before performing any of the following procedures, ensure that the power
source is off. (AC or DC). To ensure that power is removed from the DC circuit,
locate the circuit breaker on the panel board that services the DC circuit,
switch the circuit breaker to the OFF position, and tape the switch handle of the
circuit breaker in the OFF position.