CISCO ASA Firewall Commands Cheat Sheet [Part 1]

May 12, 2016 | Views: 15949

Begin Learning Cyber Security for FREE Now!

FREE REGISTRATIONAlready a Member Login Here

Let’s begin…

 

Configuring trunk link and sub-interfaces between ASA and Switch

On the outside physical interface of switch1:

            Interface f0/10

            Switchport mode trunk

            No shutdownOn the inside interface of ASA firewall:

            Interface f0/3

            Switchport mode trunk

            Switchport trunk allowed vlan 20,10

            No shutdown

            Interface f0/3.1

            Vlan 20 [ or use encapsulation command]

            No shutdown

            Interface f0/3.2

            Vlan 10 [ or use encapsulation command]

            No shutdown

Note: the command used to create trunk link between two networking devices should be used once between router and switch and must be used twice between firewall and switch on each opposite interface


Configure an ASA interface

Interface eth0/0

Nameif outside [ or inside]

Ip address ip-address [subnet-mask]

Speed [ auto | 10 | 100 | 1000]

Duplex [ auto | full | half]

Ip address dhcp [setroute]

Security-level [level:0-100]

When configuring interfaces with same security level, a command must be explicitly configured to allow traffic between them

            Same-security-traffic permit inter-interface

Configuring and changing MTU size for each interface to carry larger packets

            Mtu if_name bytes

Enabling Jumbo frame processing. This applicable only on ASA 5580

            Jumbo-frame reservation

Verifying the status of an interface

            Show interface if_name

Verifying the status of all interfaces

            Show interface ip brief

The ASA does not forward DHCP requests by default so it needs to be configured to use dhcp relay agent

            Dhcprelay server ip-address interface

            Dhcprelay enable interface

Note that in the first command, the refered interface is the one connected to the DHCP Server or gateway while the second interface in the second command is the one facing the clients

Enabling DHCP Server on ASA to assign IP addresses to clients

            Dhcp enable interface

            Dhcp address ip1-ip2 interface              [address pool]

Delivering DNS addresses to clients

            Dhcp dns ip1 ip2

Delivering the domain name to the clients

            Dhcp domain  your-domain

Configuring default and static routes

            Route [ inside – outside ]  [ dest ] [ dest-subnet mask ] [next hop gateway ]

            Route [ inside – outside ] 0.0.0.0  0.0.0.0  [next hop gateway ]

Configuring RIPV2 to Exchange routing information with other RIPv2 routers.

            Access-list  [Access-list name ] standard [ permi tor deny ] [ network ip ] [ subnet mask ]

            Router rip

            Version 2

            No auto-summary

            Default-information orginiate [ to advertise static routes ]

            Network [ the IP of the  intended network to be advertised ]

            Distribute-list [Access-list name used above ] [ in or out ]] interface [ inside or outside]

            Exit

            İnterface eth0/2

            Rip authentication  mode md5

            Rip authentication key [ your key ] key_id [id]

Configuring EIGRP routing on ASA

          Router eigrp [AS number]

            Network ip-addr [mask]

            İnterface [interface]

            Summary-address eigrp [AS number] [ip-addr] [ mask] [AD]

Redistribute routes that are learned through RIPv2, Static routes or Directly connected routes

          Redistribute [ rip | static | connected ] [metric : bandwidth | delay | reliability | load | mtu ] [ route-map map_name]


Define default metric for redistribution with different routes

          Default-metric bandwidth delay reliability loading mtu


Securing EIGRP routes

          İnterface interface

            Authentication mode eigrp AS number md5

            Authentication key eigrp AS number key-string key_id key_id


Filtering routing updates

          Access-list  [Access-list name ] standard [ permi tor deny ] [ network ip ] [ subnet mask ]

 

          Distribute-list [Access-list name used above ] [ in or out ]] interface [ inside or outside]


Configure OSPF on ASA

          Router ospf pid

            Router-id ip_addr

            Network ip_addr netmask area area_id

            Area area_id authentication md5

            İnterface interface

            Ospf message-digest-key key_id md5 key

            Ospf authentication –message-digest

            Prefix-list list_name [permit | deny ] network_ip ge min_bit le max_bit

            Area area_id filter-list prefix list_name [in | out ]

Share with Friends
FacebookTwitterLinkedInEmail
Use Cybytes and
Tip the Author!
Join
Share with Friends
FacebookTwitterLinkedInEmail
Ready to share your knowledge and expertise?
11 Comments
  1. Thanks mate 🙂 it helps a lot.

  2. Thank you!

  3. Good support.

Page 2 of 2«12
Comment on This

You must be logged in to post a comment.

Our Revolution

We believe Cyber Security training should be free, for everyone, FOREVER. Everyone, everywhere, deserves the OPPORTUNITY to learn, begin and grow a career in this fascinating field. Therefore, Cybrary is a free community where people, companies and training come together to give everyone the ability to collaborate in an open source way that is revolutionizing the cyber security educational experience.

Cybrary On The Go

Get the Cybrary app for Android for online and offline viewing of our lessons.

Get it on Google Play
 

Support Cybrary

Donate Here to Get This Month's Donor Badge

 
Skip to toolbar

We recommend always using caution when following any link

Are you sure you want to continue?

Continue
Cancel