http://www.firewall.cx/cisco-technical-knowledgebase/cisco-firewalls/964-cisco-asa5500-startup.

html

CISCO ASA5500 (5505, 5510, 5520, ETC) SERIES

FIREWALL SECURITY APPLIANCE STARTUP
CONFIGURATION & BASIC CONCEPTS
The Cisco ASA 5500 series security appliances have been around for quite some time and are amongst
the most popular hardware firewalls available in the market. Today Firewall.cx takes a look at how to easily
setup a Cisco ASA5500 series firewall to perform basic functions, more than enough to provide secure &
restricted access to the Internet, securely access and manage the ASA Firewall and more.

While many consider the Cisco ASA Firewalls complex and difficult to configure devices, Firewall.cx aims
to break that myth and show how easy you can setup an ASA Firewall to deliver basic and advanced
functionality. We’ve done it with other Cisco technologies and devices, and we’ll do it again :)

The table below provides a brief comparison between the different ASA5500 series security appliances:

Feature Cisco ASA Cisco ASA Cisco ASA Cisco ASA Cisco ASA
5505 5510 5520 5540 5550

Users/Nodes 10, 50, or Unlimited Unlimited Unlimited Unlimited

unlimited

Firewall Throughput Up to 150 Mbps Up to 300 Up to 450 Up to 650 Up to 1.2

Mbps Mbps Mbps Gbps

Maximum Firewall and IPS • Up to 150 • Up to 150 • Up to 225 • Up to 500 Not

Throughput Mbps with AIP- Mbps with Mbps with Mbps with available
SSC-5 AIP-SSM- AIP-SSM-10 AIP-SSM-
10 20
• Up to 375
• Up to 300 Mbps with • Up to 650
Mbps with AIP-SSM-20 Mbps with
AIP-SSM- AIP-SSM-
20 • Up to 450 40
Mbps with
AIP-SSM-40

3DES/AES VPN Up to 100 Mbps Up to 170 Up to 225 Up to 325 Up to 425

Throughput*** Mbps Mbps Mbps Mbps

IPsec VPN Peers 10; 25 250 750 5000 5000

Premium AnyConnect 2/25 2/250 2/750 2/2500 2/5000
VPN
Peers*(Included/Maximum)

Concurrent Connections 10,000; 25,000* 50,000; 280,000 400,000 650,000

130,000*

New Connections/Second 4000 9000 12,000 25,000 33,000

Integrated Network Ports 8-port Fast 5 Fast 4 Gigabit 4 Gigabit 8 Gigabit

Ethernet switch Ethernet Ethernet, Ethernet, Ethernet,
(including 2 ports; 2 1 Fast 1 Fast 4 SFP
PoE ports) Gigabit Ethernet Ethernet Fiber,
Ethernet + 1 Fast
3 Fast Ethernet
Ethernet
ports*

Virtual Interfaces (VLANs) 3 (no trunking 50/100* 150 200 400

support)/20
(with trunking
support)*

Users can also download the complete technical datasheet for the Cisco ASA 5500 series firewalls by
visiting our Cisco Product Datasheet & Guides Download section.

Perhaps one of the most important points, especially for an engineer with limited experience, is that
configuring the smaller ASA 5505 Firewall does not really differ from configuring the larger ASA5520
Firewall. The same steps are required to setup pretty much all ASA 5500 series Firewalls – which is Great
News!

The main differences besides the licenses, which enable or disable features, are the physical interfaces of
each ASA model (mainly between the ASA 5505 and the larger 5510/5520) and possibly modules that
might be installed. In any case, we should keep in mind that if we are able to configure a small ASA5505
then configuring the larger models won’t be an issue.

At the time of writing of this article Firewall.cx came across a Cisco ASA5505, so we decided to put it to
good use for this article, however, do note that all commands and configuration philosophy is the same
across all ASA5500 series security appliances.

Note: ASA software version 8.3.0 and above use different NAT configuration commands. This article
provides both old style (up to v8.2.5) and new style (v8.3 onwards) NAT configuration commands.

Additional reading material: Users seeking nothing but the best security information on ASA Firewalls,
written by leading Cisco Security Engineers, should consider the following highly recommended Cisco
Press titles:
 Cisco ASA: All-in-One Firewall, IPS, Anti-X, and VPN Adaptive Security Appliance, 2nd Edition
 Cisco ASA, PIX, and FWSM Firewall Handbook, 2nd Edition

ASA5500 SERIES CONFIGURATION CHECK-LIST

We’ve created a simple configuration check-list that will help us keep track of the configured services on
our ASA Firewall. Here is the list of items that will be covered in this article:

 Erase existing configuration

 Configure Hostname, Users, Enable password & Disable Anonymous Reporting
 Configure interface IP addresses or Vlan IP addresses (ASA5505) & Descriptions
 Setup Inside (private) & Outside (public) Interfaces
 Configure default route (default Gateway) & static routes
 Configure Network Address Translation (NAT) for Internal Networks
 Configure ASA DHCP Server
 Configure AAA authentication for local database user authentication
 Enable HTTP Management for inside interface
 Enable SSH & Telnet Management for inside and outside interfaces
 Create, configure and apply TCP/UDP Object-Groups to firewall access lists
 Configuration of access-lists for ICMP packets to the Internet
 Apply Firewall access lists to ‘inside’ and ‘outside’ interfaces
 Configure logging/debugging of events and errors

Note: it is highly advisable to frequently save the ASA configuration to ensure no work is lost in the event
of a power failure or accident restart.

Saving the configuration can be easily done using the write memory command:

ASA5505(config)# write memory

Building configuration...
Cryptochecksum: c0aee665 598d7cd3 7fbfe1a5 a2d40ab1
3270 bytes copied in 1.520 secs (3270 bytes/sec)
[OK]

ERASING EXISTING CONFIGURATION

This first step is optional as it will erase the firewall’s configuration. If the firewall has been previously
configured or used it is a good idea to start off with the factory defaults. If we are not certain, we prefer to
wipe it clean and start from scratch. Once the configuration is deleted we need to force a reboot, however,
take note that it’s important not to save the system config to ensure the running-config is not copied to the
startup-config otherwise we’ll have to start this process again:
ciscoasa(config)# write erase
Erase configuration in flash memory? [confirm]
[OK]
ciscoasa(config)# reload
System config has been modified. Save? [Y]es/[N]o: N
Proceed with reload? [confirm]
ciscoasa(config)#
***
*** --- START GRACEFUL SHUTDOWN ---
Shutting down isakmp
Shutting down webvpn
Shutting down File system
***
*** --- SHUTDOWN NOW ---
Process shutdown finished
Rebooting.....

CONFIGURE HOSTNAME, USERS, 'ENABLE' PASSWORD & DISABLE ANONYMOUS

REPORTING
Next, we need to configure the Enable password, required for privileged exec mode access, and then user
accounts that will have access to the firewall.

The ASA Firewall won’t ask for a username/password when logging in next, however, the default enable
password of ‘cisco’, will be required to gain access to privileged mode:

Ciscoasa> enable
Password: cisco
ciscoasa# configure terminal
ciscoasa(config)#
***************************** NOTICE *****************************
Help to improve the ASA platform by enabling anonymous reporting,
which allows Cisco to securely receive minimal error and health
information from the device. To learn more about this feature,
please visit: http://www.cisco.com/go/smartcall

Would you like to enable anonymous error reporting to help improve

the product? [Y]es, [N]o, [A]sk later: N

In the future, if you would like to enable this feature,

issue the command "call-home reporting anonymous".
Please remember to save your configuration.

At this point we need to note that when starting off with the factory default configuration, as soon as we
enter the ‘configure terminal’ command, the system will ask if we would like to enable Cisco’s call-home
reporting feature. We declined the offer and continued with our setup:

ciscoasa(config)# hostname ASA5505

ASA5505(config)# enable password firewall.cx
ASA5505(config)# username admin password s1jw$528ds2 privilege 15

The privilege 15 parameter at the end of the command line ensures the system is aware that this is an
account with full privileges and has access to all configuration commands including erasing the
configuration and files on the device’s flash disk, such as the operating system.
CONFIGURE INTERFACE IP ADDRESSES / VLAN IP ADDRESSES & DESCRIPTIONS
Depending on the ASA appliance we have, we can configure physical interfaces (inside/outside) with IP
addresses, usually done with ASA5510 and larger models, or create VLANs (inside/outside) and configure
them with IP addresses, usually with the smaller ASA5505 models.

In many cases network engineers use VLAN interfaces on the larger ASA5500 models, however, this
depends on the licensing capabilities of the device, existing network setup and more.

In the case of the ASA5505 we must use VLAN interfaces, which are configured with their appropriate IP
addresses and then (next step) characterised as inside (private) or outside (public) interfaces:

ASA5505(config)# interface vlan 1

ASA5505(config)# description Private-Interface
ASA5505(config-if)# ip address 10.71.0.1 255.255.255.0
ASA5505(config-if)# no shutdown
!
ASA5505(config)# interface vlan 2
ASA5505(config)# description Public-Interface
ASA5505(config-if)# ip address 192.168.3.50 255.255.255.0
ASA5505(config-if)# no shutdown
!
ASA5505(config)# interface ethernet 0/0
ASA5505(config-if)# switchport access vlan 2
ASA5505(config-if)# no shutdown

Alternatively, the Public interface (VLAN2) can be configured to obtain its IP address automatically via
DHCP with the following command:
ASA5505(config)# interface vlan 2
ASA5505(config)# description Public-Interface
ASA5505(config-if)# ip address dhcp setroute
ASA5505(config-if)# no shutdown

The setrouteparameter at the end of the command will ensure the ASA Firewall sets its default route
(gateway) using the default gateway parameter the DHCP server provides.

After configuring VLAN1 & VLAN2 with the appropriate IP addresses, we configured ethernet 0/0 as an
access link for VLAN2 so we can use it as a physical public interface. Out of the 8 total Ethernet interfaces
the ASA5505 has, at least one must be set with the switchport access vlan 2 otherwise there won’t be
any physical public interface on the ASA for our frontend router to connect to. Ethernet ports 0/1 to 0/7 must
also be configured with the no shutdown command in order make them operational. All of these ports are,
by default, access links for VLAN1. Provided are the configuration commands for the first two ethernet
interface as the configuration is identical for all:

ASA5505(config)# interface ethernet 0/1

ASA5505(config-if)# no shutdown
ASA5505(config-if)# interface ethernet 0/2
ASA5505(config-if)# no shutdown
SETUP INSIDE (PRIVATE) & OUTSIDE (PUBLIC) INTERFACES

Next, we must designate the Inside (private) and Outside (public) interfaces. This step is essential and will
help the ASA Firewall understand which interface is connected to the trusted (private) and untrusted (public)
network:

ASA5505(config)# interface vlan 1

ASA5505(config-if)# nameif inside
INFO: Security level for "inside" set to 100 by default.
!
ASA5505(config)# interface vlan 2
ASA5505(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.

The ASA Firewall will automatically set the security level to 100 for inside interfaces and 0 to outside
interfaces. Traffic can flow from higher security levels to lower (private to public), but not the other way
around (public to private) unless stated by an access-lists.

To change the security-level of an interface use the security-level xxx command by substituting xxx with
a number from 0 to 100. The higher the number, the higher the security level. DMZ interfaces are usually
configured with a security level of 50.

It is extremely important the necessary caution is taken when selecting and applying the inside/outside
interfaces on any ASA Firewall.

CONFIGURE DEFAULT ROUTE (DEFAULT GATEWAY) & STATIC ROUTES

The default route configuration command is necessary for the ASA Firewall to route packets outside the
network via the next hop, usually a router. In case the public interface (VLAN2) is configured using the ip
address dhcp setroute command, configuration of the default gateway is not required.

ASA5505(config)# route outside 0.0.0.0 0.0.0.0 192.168.3.1

At this point, it’s a good idea to try testing the next-hop router and confirm the ASA Firewall can reach it:
ASA5505(config)# ping 192.168.3.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.3.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

For networks with multiple internal VLANs, it is necessary to configure static routes to ensure the ASA
Firewall knows how to reach them. Usually these networks can be reached via a Layer3 switch or an
internal router. For our example, we’ll assume we have two networks: 10.75.0.0/24 & 10.76.0.0/24 which
we need to provide Internet access to. These additional networks are contactable via a Layer3 device
with IP address 10.71.0.100:

ASA5505(config)# route outside 10.75.0.0 0.0.0.0 10.71.0.100

ASA5505(config)# route outside 10.76.0.0 0.0.0.0 10.71.0.100

CONFIGURE NETWORK ADDRESS TRANSLATION (NAT) FOR INTERNAL NETWORKS

This is the last step required to successfully provide Internet access to our internal networks. Network
Address Translation is essential to masquerade our internal network using the single IP address our
Public interface has been configured with. Network Address Translation, along with all its variations
(Static, Dynamic etc), is covered in great depth in our popular Network Address Translation section.

We should note at this point that NAT configuration has slightly changed with ASA software version 8.3 and
above. We will provide both commands to cover installations with software version up to v8.2.5 and from
v8.3 and above.

The following commands apply to ASA appliances with software version up to 8.2.5:

ASA5505(config)# global (outside) 1 interface

INFO: outside interface address added to PAT pool
ASA5505(config)# nat (inside) 1 10.71.0.0 255.255.255.0
ASA5505(config)# nat (inside) 1 10.75.0.0 255.255.255.0
ASA5505(config)# nat (inside) 1 10.76.0.0 255.255.255.0

In the above configuration, the ASA Firewall is instructed to NAT all internal networks using the NAT
Group 1. The number ‘1’ is used to identify the NAT groups for the NAT process between the inside and
outside interfaces.

The global (outside) 1 interface command instructs the ASA Firewall to perform NAT using the IP address
assigned to the outside interface.

Another method of configuring NAT is with the use of access lists. In this case, we define the internal IP
addresses to be NAT’ed with the use of access lists:

ASA5505(config)# access-list NAT-ACLs extended permit ip 10.71.0.0 255.255.255.0 any

ASA5505(config)# access-list NAT-ACLs extended permit ip 10.75.0.0 255.255.255.0 any
ASA5505(config)# access-list NAT-ACLs extended permit ip 10.76.0.0 255.255.255.0 any
ASA5505(config)# global (outside) 1 interface
INFO: outside interface address added to PAT pool
ASA5505(config)# nat (inside) 1 access-list NAT-ACLs

NAT with the use of access lists provides greater flexibility and control which IP addresses or networks
will use the NAT service.

With software version 8.3 and newer, things have changed dramatically and there are no more access lists
in NAT configuration lines.

The new NAT format now utilizes "object network", "object service" and "object-group network" to define
the parameters of the NAT configuration.

The following commands (software version 8.3 and above) will provide NAT services to our internal
networks so they can access the Internet:

ASA5505(config)# object network network1

ASA5505(config-network-object)# subnet 10.71.0.0 255.255.255.0
ASA5505(config-network-object)# nat (inside,outside) dynamic interface
!
ASA5505(config)# object network network2
ASA5505(config-network-object)# subnet 10.75.0.0 255.255.255.0
ASA5505(config-network-object)# nat (inside,outside) dynamic interface
!
ASA5505(config)# object network network3
ASA5505(config-network-object)# subnet 10.76.0.0 255.255.255.0
ASA5505(config-network-object)# nat (inside,outside) dynamic interface

CONFIGURING THE ASA DHCP SERVER

The existence of a DHCP server is necessary in most cases as it helps manage the assignment of IP
address to our internal hosts. The ASA Firewall can be configured to provide DHCP services to our internal
network, a very handy and welcome feature.

Again, there are some limitations with the DHCP service configuration which vary with the ASA model used.
In our ASA5505, the maximum assigned IP addreses for the DHCP pool was just 128!

Note that the DHCP service can run on all ASA interfaces so it is necessary to specify which interface the
DHCP configuration parameters are for:

ASA5505(config)# dhcpd address 10.71.0.50-10.71.0.200 inside

Warning, DHCP pool range is limited to 128 addresses, set address range as: 10.71.0.50-10.71.0.177
ASA5505(config)# dhcpd address 10.71.0.50-10.71.0.128 inside
ASA5505(config)# dhcpd dns 8.8.8.8 interface inside

Once configured, the DHCP service will begin working and assigning IP addresses to the clients.
The Gateway IP address parameter is automatically provided to client and is not required to be configured
on the ASA Firewall appliance.

We can verify the DHCP service is working using the show dhcpd statistics command:

ASA5505(config)# show dhcpd statistics

DHCP UDP Unreachable Errors: 0
DHCP Other UDP Errors: 0
Address pools 1
Automatic bindings 1
Expired bindings 0
Malformed messages 0

Message Received
BOOTREQUEST 0
DHCPDISCOVER 1
DHCPREQUEST 1
DHCPDECLINE 0
DHCPRELEASE 0
DHCPINFORM 1

If required, we can clear the DHCP bindings (assigned IP addresses) using the clear dhcpd
binding command.

CONFIGURE AAA AUTHENTICATION FOR LOCAL DATABASE USER AUTHENTICATION

Configuring AAA authentication is always a good idea as it instructs the ASA Firewall to use the local user
database for the various services it's running. For example, we can tell the ASA Firewall to use a radius
server for VPN user authentication, but use its local database for telnet, ssh or HTTP (ASDM) management
access to the Firewall appliance.
As mentioned, our example instructs the ASA Firewall to use its local database:

ASA5505(config)# aaa authentication telnet console LOCAL

ASA5505(config)# aaa authentication http console LOCAL
ASA5505(config)# aaa authentication ssh console LOCAL

ENABLE HTTP MANAGEMENT FOR INSIDE INTERFACE (ACCESS BY ASDM)

We now turn to the management settings of our ASA Firewall to enable and configure HTTP management.
This will allow access to the Firewall’s management via the popular ASDM management application:

ASA5505(config)# http 10.71.0.0 255.255.255.0 inside

WARNING: http server is not yet enabled to allow ASDM access.
ASA5505(config)# http server enable

The above commands enable HTTP management on the ASA Firewall only for the network 10.71.0.0/24.

ENABLE SSH & TELNET MANAGEMENT FOR INSIDE AND OUTSIDE INTERFACES

Enabling SSH and Telnet access to the Cisco Firewall is pretty straightforward. While we always
recommend the use of SSH, especially when accessing the Firewall from public IPs, telnet is also an option,
however, we must keep in mind that telnet management methods do not provide any security as all data
(including username, passwords and configurations) are sent in clear text.

Before enabling SSH, we must generate RSA key pairs for identity certificates. Telnet does not require any
such step as it does not provide any encryption or security:

ASA5505(config)# crypto key generate rsa modulus 1024

INFO: The name for the keys will be:
Keypair generation process begin. Please wait...
ASA5505(config)# ssh 10.71.0.0 255.255.255.0 inside
ASA5505(config)# ssh 200.200.90.5 255.255.255.255 outside
ASA5505(config)# telnet 10.71.0.0 255.255.255.0 inside

Note that the ASA Firewall appliance will only accept SSH connections from host 200.200.90.5 arriving on
its public interface, while SSH and telnet connections are permitted from network 10.71.0.0/24 on the
inside interface.

CREATE, CONFIGURE AND APPLY TCP/UDP OBJECT-GROUPS

An essential part of any firewall configure is to define the Internet services our users will have access to.
This is done by either creating a number of lengthy access lists for each protocol/service and then applying
them to the appropriate interfaces, or utilising the ASA Firewall Object-Groups which are then applied to
the interfaces. Using Object-groups is easy and recommended as they provide a great deal of flexibility and
ease of management.
The logic is simple: Create your Object-Groups, insert the protocols and services required, and then
reference them in the firewall access -lists. As a last step, we apply them to the interfaces we need.

Let’s use an example to help visualise the concept. Our needs require us to create two Object-Groups, one
for TCP and one for UDP services:

ASA5505(config)#object-group service Internet-udp udp

ASA5505(config-service)# description UDP Standard Internet Services
ASA5505(config-service)# port-object eq domain
ASA5505(config-service)# port-object eq ntp
ASA5505(config-service)# port-object eq isakmp
ASA5505(config-service)# port-object eq 4500
!
ASA5505(config-service)#object-group service Internet-tcp tcp
ASA5505(config-service)# description TCP Standard Internet Services
ASA5505(config-service)# port-object eq www
ASA5505(config-service)# port-object eq https
ASA5505(config-service)# port-object eq smtp
ASA5505(config-service)# port-object eq 465
ASA5505(config-service)# port-object eq pop3
ASA5505(config-service)# port-object eq 995
ASA5505(config-service)# port-object eq ftp
ASA5505(config-service)# port-object eq ftp-data
ASA5505(config-service)# port-object eq domain
ASA5505(config-service)# port-object eq ssh
ASA5505(config-service)# port-object eq telnet

Now we need to reference our two Object-groups using the firewall access lists. Here we can also define
which networks will have access to the services listed in each Object-group:

ASA5505(config)# access-list inside-in remark -=[Access Lists For Outgoing Packets from Inside
interface]=-
ASA5505(config)# access-list inside-in extended permit udp 10.71.0.0 255.255.255.0 any object-
group Internet-udp
ASA5505(config)# access-list inside-in extended permit tcp 10.71.0.0 255.255.255.0 any object-group
Internet-tcp
ASA5505(config)# access-list inside-in extended permit tcp 10.75.0.0 255.255.255.0 any object-group
Internet-tcp
ASA5505(config)# access-list inside-in extended permit tcp 10.76.0.0 255.255.255.0 any object-group
Internet-tcp

Note that the 10.71.0.0/25 network has access to both Object-groups services, our other networks are
restricted to only the services defined in the TCP Object-group. To understand how Object-groups help
simplify access list management: without them, we would require 37 access lists commands instead of just
4!

CONFIGURATION OF ACCESS-LISTS FOR ICMP PACKETS TO THE INTERNET

To complete our access list configuration we configure our ASA Firewall to allow ICMP echo packets (ping)
to any destination, and their replies (echo-reply):

ASA5505(config)# access-list inside-in extended permit icmp 10.71.0.0 255.255.255.0 any

ASA5505(config)# access-list outside-in remark -=[Access Lists For Incoming Packets on OUTSIDE
interface]=-
ASA5505(config)# access-list outside-in extended permit icmp any any echo-reply

APPLING FIREWALL ACCESS-LISTS TO ‘INSIDE’ AND ‘OUTSIDE’ INTERFACES

The last step in configuring our firewall rules involves applying the two access lists, inside-in & outside-in,
to the appropriate interfaces. Once this step is complete the firewall rules are in effect immediately:

ASA5505(config)# access-group inside-in in interface inside

ASA5505(config)# access-group outside-in in interface outside

CONFIGURE LOGGING/DEBUGGING OF EVENTS & ERRORS

This last step in our ASA Firewall configuration guide will enable logging and debugging so that we can
easily trace events and errors. It is highly recommended to enable logging because it will certainly help
troubleshooting the ASA Firewall when problems occur.

ASA5505(config)# logging buffered 7

ASA5505(config)# logging buffer-size 30000
ASA5505(config)# logging enable

The commands used above enable log in the debugging level (7) and sets the buffer size in RAM
to 30,000 bytes (~30Kbytes).

Issuing the show log command will reveal a number of important logs including any packets that are
processed or denied due to access-lists:

ASA5505(config)# show log

Syslog logging: enabled
Facility: 20
Timestamp logging: disabled
Standby logging: disabled
Debug-trace logging: disabled
Console logging: disabled
Monitor logging: disabled
Buffer logging: level debugging, 39925 messages logged
Trap logging: disabled
History logging: disabled
Device ID: disabled
Mail logging: disabled
ASDM logging: disabled
n" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside:10.71.0.50/54843 dst outside:10.0.0.10/445 by access-group
"inside-in" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside:10.71.0.50/54845 dst outside:10.0.0.10/445 by access-group
"inside-in" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside:10.71.0.50/54844 dst outside:10.0.0.10/445 by access-group
"inside-in" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside:10.71.0.50/54850 dst outside:10.0.0.10/139 by access-group
"inside-in" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside:10.71.0.50/54843 dst outside:10.0.0.10/445 by access-group
"inside-in" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside:10.71.0.50/54845 dst outside:10.0.0.10/445 by access-group
"inside-in" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside:10.71.0.50/54844 dst outside:10.0.0.10/445 by access-group
"inside-in" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside:10.71.0.50/54850 dst outside:10.0.0.10/139 by access-group
"inside-in" [0x0, 0x0]
%ASA-4-106023: Deny udp src inside:10.71.0.50/137 dst outside:10.0.0.10/137 by access-group "inside-
in" [0x0, 0x0]
%ASA-6-302014: Teardown TCP connection 4718 for outside:173.194.40.49/443 to
inside:10.71.0.50/54803 duration 0:02:00 bytes 1554462 TCP FINs

CONCLUSION

This article serves as an introduction configuration guide for the ASA5500 series Firewall appliances. We
covered all necessary commands required to get any ASA5500 Firewall working and servicing network
clients, while also explaining in detail all commands used during the configuration process.