CISCO ASA 5505 firewall configuration

i have a ASA 5505 all i want to do is put it in line with my network and use as a firewall and app filter...is that possible with using just one interface and having the device relay dhcp

Dear all,

I am new to Cisco and to Firewall.cs forum. I would appreciate if someone sent me some Firewall configuration basics manual.

I have here output of the show running-config from my ASA. It's been configured by some expert that is not present at the moment, and I cannot ask him.
Could anyone please explain what's this configuration for? What did we ban or permit, or what does this configuration allows us to do?

Thanks very much!

Srdjan

ASA Version 7.2(4)
!
hostname MZ
enable password FpXcexkDoQHH4NFR encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
access-list acl_out extended permit icmp any any echo
access-list acl_out extended permit icmp any any echo-reply
access-list acl_in extended permit icmp any any echo
access-list acl_in extended permit icmp any any echo-reply
access-list acl_in extended permit tcp any any eq domain
access-list acl_in extended permit udp any any eq domain
access-list acl_in extended permit tcp any any eq www
access-list acl_in extended permit tcp any any eq https
access-list acl_in extended permit tcp any any eq 8080
access-list acl_in extended permit tcp any any eq ssh
access-list acl_in extended permit tcp any any eq telnet
access-list acl_in extended permit tcp any any eq smtp
access-list acl_in extended permit tcp any any eq pop3
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
access-group acl_in in interface inside
access-group acl_out in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.100.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd dns 195.66.160.1
dhcpd auto_config outside
!
dhcpd address 192.168.1.2-192.168.1.33 inside
dhcpd enable inside
!

!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:95dd226b69b061a72d9502c39bad5c60
: end
MZ# sh ver

Cisco Adaptive Security Appliance Software Version 7.2(4)

Compiled on Sun 06-Apr-08 13:39 by builders
System image file is "disk0:/asa724-k8.bin"
Config file at boot was "startup-config"

MZ up 56 mins 23 secs

Hardware: ASA5505, 256 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash M50FW080 @ 0xffe00000, 1024KB

Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
Boot microcode : CNlite-MC-Boot-Cisco-1.2
SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.05
0: Int: Internal-Data0/0 : address is 0023.5e66.eeef, irq 11
1: Ext: Ethernet0/0 : address is 0023.5e66.eee7, irq 255
2: Ext: Ethernet0/1 : address is 0023.5e66.eee8, irq 255
3: Ext: Ethernet0/2 : address is 0023.5e66.eee9, irq 255
4: Ext: Ethernet0/3 : address is 0023.5e66.eeea, irq 255
5: Ext: Ethernet0/4 : address is 0023.5e66.eeeb, irq 255
6: Ext: Ethernet0/5 : address is 0023.5e66.eeec, irq 255
7: Ext: Ethernet0/6 : address is 0023.5e66.eeed, irq 255
8: Ext: Ethernet0/7 : address is 0023.5e66.eeee, irq 255
9: Int: Internal-Data0/1 : address is 0000.0003.0002, irq 255
10: Int: Not used : irq 255
11: Int: Not used : irq 255

Licensed features for this platform:
Maximum Physical Interfaces : 8
VLANs : 3, DMZ Restricted
Inside Hosts : 10
Failover : Disabled
VPN-DES : Enabled
VPN-3DES-AES : Enabled
VPN Peers : 10
WebVPN Peers : 2
Dual ISPs : Disabled
VLAN Trunk Ports : 0

This platform has a Base license.

MZ#

If you still need someone to explain configuration, please contact me directly.

Hello, I was wondering if I could get some help. I have been working on getting my asa5505 to work and cant get it. I cant seem to get internet access through it. Here is a copy of my current config.

Result of the command: "show running-config"

: Saved
:
ASA Version 7.2(4)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password ************ encrypted
passwd *********** encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 96.57.239.163 255.255.255.248 (my static ip from isp)
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns domain-lookup outside
dns server-group DefaultDNS
timeout 15
name-server 167.206.112.138
name-server 167.206.7.4
domain-name default.domain.invalid
access-list Internal_nat0_outbound extended permit ip any 192.168.1.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
ip local pool VPNIPs 192.168.1.100-192.168.1.149 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
aaa-server backboneAD protocol ldap
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map Internet_dyn_map 20 set pfs group1
crypto dynamic-map Internet_dyn_map 20 set transform-set ESP-3DES-SHA
crypto map Internet_map 65535 ipsec-isakmp dynamic Internet_dyn_map
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.2-192.168.1.33 inside
!

group-policy backbone internal
group-policy backbone attributes
dns-server value 192.168.1.11 192.168.1.12
vpn-tunnel-protocol IPSec
default-domain value backbone
username walter password jhTqQ1UZhUxBOzKC encrypted
tunnel-group backbone type ipsec-ra
tunnel-group backbone general-attributes
address-pool VPNIPs
authentication-server-group backboneAD
default-group-policy backbone
tunnel-group backbone ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:693acfdb8481e922c886297ce978310e
: end