I have looked through a lot of these posts on the Cisco ASA5505 as well as gone online. I am looking for some straight forward step by step instructions to complete the following tasks.

I know how to get it functioning with an inside and outside interface so that's great!

I need some step by step for the following tasks

  1. Configuring the firewall. There will be two servers attached to the inside interface: one is a web server so ports 80, 25, etc... The other is the DC so all standard ports for that need to be opened up. We also need RDP opened to both machines we use a non-standard port. I feel if I saw one example like for port 80 I could replicate that. Are there any other configs I should be aware of to secure the actually firewall or does it come setup pretty well out of the box?

  2. Setup access to the appliance from our main office and my offsite lab. I could also RDP to the DC on the inside interface then connect if that was more secure.

Here is my current status. Right now it is just setup on my work machine for some testing. So the outside interface just goes to the office network.

Result of the command: "show running-config"

: Saved
ASA Version 8.2(1) 
hostname superasa
domain-name somedomainname
enable password /****** encrypted
passwd ******************** encrypted
interface Vlan1
 nameif inside
 security-level 100
 ip address 
interface Vlan2
 nameif outside
 security-level 0
 ip address 
interface Ethernet0/0
 switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 domain-name somedomain
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http inside
http inside
http inside
http outside
http internetip outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd dns
dhcpd domain somedomain
dhcpd auto_config outside
dhcpd address inside
dhcpd dns interface inside
dhcpd auto_config outside interface inside
dhcpd enable inside
dhcpd dns interface outside
dhcpd domain supernova interface outside
dhcprelay timeout 60

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
prompt hostname context 
: end

On your first point, the firewall portion is already setup. Those "security-level" commands that you issued for the interface took care of that. Higher levels are able to communicate with lower levels but lower levels need to be given access to resources at higher levels. To grant access, you create an access-list and assign it to an interface with the access-group command. Since you are NATing as well, you need to create some static mappings so the firewall knows where to send traffic to. I've left the DC out of my instructions because you don't need to expose anything to the DC (it's a security issue to do so). If you have remote offices that need to authenticate, setup a site to site VPN. Here's what it would look like:

access-list outside_access_in extended permit tcp any host eq 80
access-list outside_access_in extended permit tcp any host eq 25
access-group outside_access_in in interface outside
static (inside,outside) netmask

You could, alternatively, use PAT instead of assigning the server its own external IP address. I recommend not doing this if possible as it is more commands to configure and keeping an email server on its own IP address helps you to not get blacklisted. If you'd like to do this, here's what you'd do (note in this configuration you have to create a static mapping for each port):

access-list outside_access_in extended permit tcp any host [external ip address of firewall] eq 80
access-list outside_access_in extended permit tcp any host [external ip address of firewall] eq 25
access-group outside_access_in in interface outside
static (inside,outside) tcp interface 80 [internal ip address of server] 80 netmask
static (inside,outside) tcp interface 25 [internal ip address of server] 25 netmask

In order to enable access you just tell ssh where to listen, how to authenticate (a local database is easiest to setup), and generate a key:

ssh [ip address of main office] outside
ssh [ip address of remote lab network] [subnet mask of remote lab network] outside
ssh [subnet of internal network] [subnet mask of internal network] inside
username companyadmin password [create a good password] privilege 15
aaa authentication ssh console LOCAL
crypto key generate rsa


You cannot do the type of failover you're looking for on the ASA. It can failover ISP's but not hosts. What you might want to look into is Network Load Balancer on Windows or a dedicated hardware load balancer.

The first snippet of code is not about site-to-site VPN. Sorry for the confusion. It is for forwarding ports with a dedicated IP (also known as static NAT) as opposed to an IP address shared with the firewall. When it's a shared IP, it's called port address translation (PAT) because the port number and type dictates which host it's forwarded to. When you have a dedicated IP address it's called static NAT. You are already using NAT and you can use either PAT or static NAT in combination with NAT.

  • Thanks for this and your time.This pretty much covers everything a few questions. I do not need the VPN the DC is there purely as a warm standby of the website as well it runs the DFS replication. I feel I left out some info now... The end idea is if the main server goes down the DC is a warm standby and comes online and takes over. Any way to do an IP fail over on this ASA? Additionally I do not require Site to Site VPN Your first snipit of code seems to talk about access lists but you said it covers VPN can you clarify please? I want to use NAT but feel I am using PAT any way to tell? Thanks – Campo Sep 8 '10 at 19:55
  • Could you clarify the NAT for me please. I am using the ASDM GUI. I would plainly like to have the Server on the inside whcih has an ip of to translate to the outside LAN. for the time being we use but it will eventually go up to the data centre and have to hook into their gateway. I would like to be able to resolve to the server on the inside at so when a user wants to browse the website or we need to RDP we can. – Campo Sep 16 '10 at 16:00
  • 1
    What you want to do is static NAT. Your server will have a different IP address than your firewall. I don't know how to do this in ASDM, but to do it in CLI, follow my first block of code. – Jason Berg Sep 17 '10 at 2:52
  • 1
    @gravyface - No. The big config changes come in at 8.3. – Jason Berg Sep 17 '10 at 5:19
  • 1
    8.3 requires more memory than was standard in the older generation ASA's. Do a 'show memory' to see how much you have. The 8.3 version for 5505 requires at least 512mb. – Jason Berg Sep 20 '10 at 14:22

I accomplished both using ASDM and "Public Servers" How this is not mentioned online anywhere is beyond me. By configuring this one setting it configures all necessary firewall rules! It is simple and straight forward.

I was able to accomplish all my questions with this one section.

Here is a screen shot. alt text


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.