topic ASA5505 config in Network Security

ASA5505 config

saidfrh — Mon, 11 Mar 2019 11:46:27 GMT

What do the following line mean in the ASA5505 config?

http server enable

http 172.16.1.0 255.255.255.0 inside

dhcpd auto_config outside

dhcpd address 172.16.1.10-172.16.1.60 inside

dhcpd enable inside

Thanks.

Said

Re: ASA5505 config

adam.sellhorn — Thu, 10 Jan 2008 22:49:09 GMT

http server enable = enables http traffic to ASA (for ASDM access)

http 172.16.1.0 255.255.255.0 inside = what subnet is allowed on what interface to access the http server

dhcpd auto_config outside = automatically assign the DNS server, in your dhcpd scope, to use as specified via ISP DHCP server

dhcpd address 172.16.1.10-.... = dhcpd scope and interface it is running on

dhcpd enable inside = enable dhpcd server for inside interface

Re: ASA5505 config

Jon Marshall — Thu, 10 Jan 2008 22:51:17 GMT

Said

http server enable

http 172.16.1.0 255.255.255.0 inside

These 2 lines set up ADSM access (ADSM is a GUI interface for configuring the ASA) and allow access to the ASA device with ADSM from clients with an IP address from the 172.16.1.0/24 network.

dhcpd auto_config outside

tells the ASA to obtain an IP address for it's outside interface via DHCP.

dhcpd address 172.16.1.10-172.16.1.60 inside

dhcpd enable inside

These 2 lines setup the ASA device as a DHCP server to clients on the inside of the ASA and the ASA will hand out addresses from 172.16.1.10 -> 172.16.1.60.

Jon

Re: ASA5505 config

saidfrh — Thu, 10 Jan 2008 23:18:46 GMT

Jon,

Thanks. So for security, since the outside interface of the ASA has a public IP, is "no dhcpd auto_config outside" required?

Could you take a look at the following config and suggest changes, before connecting the firewall to the internet router.

sh run

Saved

ASA Version 7.2(2)

hostname Rio

enable password xxx

names

interface Vlan1

nameif inside

security-level 100

ip address 172.16.1.1 255.255.255.0

interface Vlan2

nameif outside

security-level 0

ip address 1xx.xx.xx 255.255.255.240 interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2 interface Ethernet0/3

interface Ethernet0/4

interface Ethernet0/5

interface Ethernet0/6 interface Ethernet0/7

passwd 2h/ZvQ5.2iT8mvSq encrypted

ftp mode passive

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-522.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

global (outside) 1 xx.xx.209.xx

nat (inside) 1 172.16.1.0 255.255.255.0

nat (inside) 1 0.0.0.0 0.0.0.0 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute http server enable http 172.16.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart telnet timeout 5 ssh timeout 5 console timeout 0 dhcpd auto_config outside dhcpd address 172.16.1.10-172.16.1.60 inside

dhcpd enable inside

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc