Hot Downloads

Cisco ASA5500 (5505, 5510, 5520, etc) Series Firewall Security Appliance Startup Configuration & Basic Concepts

Written by Administrator. Posted in Cisco Firewalls - ASA & PIX Firewall Configuration

4.66666666667 1 1 1 1 1 Rating 4.67 (24 Votes)
Cisco ASA5500 (5505, 5510, 5520, etc) Series Firewall Security Appliance Startup Configuration & Basic Concepts - 4.7 out of 5 based on 24 votes

Introducing the Cisco ASA 5500 Series Firewall Appliance

cisco-asa5500-basic-config-1The Cisco ASA 5500 series security appliances have been around for quite some time and are amongst the most popular hardware firewalls available in the market. Today takes a look at how to easily setup a Cisco ASA5500 series firewall to perform basic functions, more than enough to provide secure & restricted access to the Internet, securely access and manage the ASA Firewall and more.

While many consider the Cisco ASA Firewalls complex and difficult to configure devices, aims to break that myth and show how easy you can setup an ASA Firewall to deliver basic and advanced functionality. We’ve done it with other Cisco technologies and devices, and we’ll do it again :)

The table below provides a brief comparison between the different ASA5500 series security appliances:


Cisco ASA 5505

Cisco ASA 5510

Cisco ASA 5520

Cisco ASA 5540

Cisco ASA 5550


10, 50, or unlimited





Firewall Throughput

Up to 150 Mbps

Up to 300 Mbps

Up to 450 Mbps

Up to 650 Mbps

Up to 1.2 Gbps

Maximum Firewall and IPS Throughput

• Up to 150 Mbps with AIP-SSC-5

• Up to 150 Mbps with AIP-SSM-10

• Up to 300 Mbps with AIP-SSM-20

• Up to 225 Mbps with AIP-SSM-10

• Up to 375 Mbps with AIP-SSM-20

• Up to 450 Mbps with AIP-SSM-40

• Up to 500 Mbps with AIP-SSM-20

• Up to 650 Mbps with AIP-SSM-40

Not available

3DES/AES VPN Throughput***

Up to 100 Mbps

Up to 170 Mbps

Up to 225 Mbps

Up to 325 Mbps

Up to 425 Mbps

IPsec VPN Peers

10; 25





Premium AnyConnect VPN Peers* (Included/Maximum)






Concurrent Connections

10,000; 25,000*

50,000; 130,000*




New Connections/Second






Integrated Network Ports

8-port Fast Ethernet switch (including 2 PoE ports)

5 Fast Ethernet ports; 2 Gigabit Ethernet + 3 Fast Ethernet ports*

4 Gigabit Ethernet, 1 Fast Ethernet

4 Gigabit Ethernet, 1 Fast Ethernet

8 Gigabit Ethernet, 4 SFP Fiber, 1 Fast Ethernet

Virtual Interfaces (VLANs)

3 (no trunking support)/20 (with trunking support)*





Users can also download the complete technical datasheet for the Cisco ASA 5500 series firewalls by visiting our Cisco Product Datasheet & Guides Download section.

Perhaps one of the most important points, especially for an engineer with limited experience, is that configuring the smaller ASA 5505 Firewall does not really differ from configuring the larger ASA5520 Firewall. The same steps are required to setup pretty much all ASA 5500 series Firewalls – which is Great News!


The main differences besides the licenses, which enable or disable features, are the physical interfaces of each ASA model (mainly between the ASA 5505 and the larger 5510/5520) and possibly modules that might be installed. In any case, we should keep in mind that if we are able to configure a small ASA5505 then configuring the larger models won’t be an issue.

At the time of writing of this article came across a Cisco ASA5505, so we decided to put it to good use for this article, however, do note that all commands and configuration philosophy is the same across all ASA5500 series security appliances.

Note: ASA software version 8.3.0 and above use different NAT configuration commands. This article provides both old style (up to v8.2.5) and new style (v8.3 onwards) NAT configuration commands.

Additional reading material:  Users seeking nothing but the best security information on ASA Firewalls, written by leading Cisco Security Engineers, should consider the following highly recommended Cisco Press titles:


ASA5500 Series Configuration Check-List

We’ve created a simple configuration check-list that will help us keep track of the configured services on our ASA Firewall. Here is the list of items that will be covered in this article:

  • Erase existing configuration
  • Configure Hostname, Users, Enable password & Disable Anonymous Reporting
  • Configure interface IP addresses or Vlan IP addresses (ASA5505) & Descriptions
  • Setup Inside (private) & Outside (public) Interfaces
  • Configure default route (default Gateway) & static routes
  • Configure Network Address Translation (NAT) for Internal Networks
  • Configure ASA DHCP Server
  • Configure AAA authentication for local database user authentication
  • Enable HTTP Management for inside interface
  • Enable SSH & Telnet Management for inside and outside interfaces
  • Create, configure and apply TCP/UDP Object-Groups to firewall access lists
  • Configuration of access-lists for ICMP packets to the Internet
  • Apply Firewall access lists to ‘inside’ and ‘outside’ interfaces
  • Configure logging/debugging of events and errors

Note: it is highly advisable to frequently save the ASA configuration to ensure no work is lost in the event of a power failure or accident restart.

Saving the configuration can be easily done using the write memory command:

ASA5505(config)# write memory
Building configuration...
Cryptochecksum: c0aee665 598d7cd3 7fbfe1a5 a2d40ab1
3270 bytes copied in 1.520 secs (3270 bytes/sec)

Erasing Existing Configuration

This first step is optional as it will erase the firewall’s configuration. If the firewall has been previously configured or used it is a good idea to start off with the factory defaults. If we are not certain, we prefer to wipe it clean and start from scratch. Once the configuration is deleted we need to force a reboot, however, take note that it’s important not to save the system config to ensure the running-config is not copied to the startup-config otherwise we’ll have to start this process again:

ciscoasa(config)# write erase
Erase configuration in flash memory? [confirm]
ciscoasa(config)# reload
System config has been modified. Save? [Y]es/[N]o:  N
Proceed with reload? [confirm]
Shutting down isakmp
Shutting down webvpn
Shutting down File system
*** --- SHUTDOWN NOW ---
Process shutdown finished

Configure Hostname, Users, 'Enable' Password & Disable Anonymous Reporting

Next, we need to configure the Enable password, required for privileged exec mode access, and then user accounts that will have access to the firewall. 

The ASA Firewall won’t ask for a username/password when logging in next, however, the default enable password of ‘cisco’, will be required to gain access to privileged mode:

Ciscoasa> enable
Password: cisco
ciscoasa#  configure terminal
***************************** NOTICE *****************************
Help to improve the ASA platform by enabling anonymous reporting,
which allows Cisco to securely receive minimal error and health
information from the device. To learn more about this feature,
please visit:

Would you like to enable anonymous error reporting to help improve
the product? [Y]es, [N]o, [A]sk later: N

In the future, if you would like to enable this feature,
issue the command "call-home reporting anonymous".
Please remember to save your configuration.

At this point we need to note that when starting off with the factory default configuration, as soon as we enter the ‘configure terminal’ command, the system will ask if we would like to enable Cisco’s call-home reporting feature. We declined the offer and continued with our setup:

ciscoasa(config)# hostname ASA5505
ASA5505(config)# enable password
ASA5505(config)# username admin password s1jw$528ds2 privilege 15

The privilege 15 parameter at the end of the command line ensures the system is aware that this is an account with full privileges and has access to all configuration commands including erasing the configuration and files on the device’s flash disk, such as the operating system.


Configure Interface IP addresses / VLAN IP Addresses & Descriptions

Depending on the ASA appliance we have, we can configure physical interfaces (inside/outside) with IP addresses, usually done with ASA5510 and larger models,  or create VLANs (inside/outside) and configure them with IP addresses, usually with the smaller ASA5505 models.

In many cases network engineers use VLAN interfaces on the larger ASA5500 models, however, this depends on the licensing capabilities of the device, existing network setup and more.

In the case of the ASA5505 we must use VLAN interfaces, which are configured with their appropriate IP addresses and then (next step) characterised as inside (private) or outside (public) interfaces:

ASA5505(config)# interface vlan 1
ASA5505(config)# description Private-Interface
ASA5505(config-if)# ip address
ASA5505(config-if)# no shutdown
ASA5505(config)# interface vlan 2
ASA5505(config)# description Public-Interface
ASA5505(config-if)# ip address
ASA5505(config-if)# no shutdown
ASA5505(config)# interface ethernet 0/0
ASA5505(config-if)# switchport access vlan 2
ASA5505(config-if)# no shutdown


Alternatively, the Public interface  (VLAN2) can be configured to obtain its IP address automatically via DHCP with the following command:
ASA5505(config)# interface vlan 2
ASA5505(config)# description Public-Interface
ASA5505(config-if)# ip address dhcp setroute
ASA5505(config-if)# no shutdown

The setrouteparameter at the end of the command will ensure the ASA Firewall sets its default route (gateway) using the default gateway parameter the DHCP server provides.

After configuring VLAN1 & VLAN2 with the appropriate IP addresses, we configured ethernet 0/0 as an access link for VLAN2 so we can use it as a physical public interface.  Out of the 8 total Ethernet interfaces the ASA5505 has, at least one must be set with the switchport access vlan 2 otherwise there won’t be any physical public interface on the ASA for our frontend router to connect to. Ethernet ports 0/1 to 0/7 must also be configured with the no shutdown command in order make them operational. All of these ports are, by default, access links for VLAN1. Provided are the configuration commands for the first two ethernet interface as the configuration is identical for all:

ASA5505(config)# interface ethernet 0/1
ASA5505(config-if)# no shutdown
ASA5505(config-if)# interface ethernet 0/2
ASA5505(config-if)# no shutdown

Setup Inside (private) & Outside (public) Interfaces

Next, we must designate the Inside (private) and Outside (public) interfaces. This step is essential and will help the ASA Firewall understand which interface is connected to the trusted (private) and untrusted (public) network:

ASA5505(config)# interface vlan 1
ASA5505(config-if)# nameif inside
INFO: Security level for "inside" set to 100 by default.
ASA5505(config)# interface vlan 2
ASA5505(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.

The ASA Firewall will automatically set the security level to 100 for inside interfaces and 0 to outside interfaces.  Traffic can flow from higher security levels to lower (private to public), but not the other way around (public to private) unless stated by an access-lists. 

To change the security-level of an interface use the security-level xxx command by substituting xxx with a number from 0 to 100. The higher the number, the higher the security level.  DMZ interfaces are usually configured with a security level of 50.

It is extremely important the necessary caution is taken when selecting and applying the inside/outside interfaces on any ASA Firewall.


Configure Default Route (default gateway) & Static Routes

The default route configuration command is necessary for the ASA Firewall to route packets outside the network via the next hop, usually a router. In case the public interface (VLAN2) is configured using the ip address dhcp setroute command, configuration of the default gateway is not required.

ASA5505(config)# route outside 
At this point, it’s a good idea to try testing the next-hop router and confirm the ASA Firewall can reach it:
ASA5505(config)# ping
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to, timeout is 2 seconds:
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

For networks with multiple internal VLANs, it is necessary to configure static routes to ensure the ASA Firewall knows how to reach them. Usually these networks can be reached via a Layer3 switch or an internal router.  For our example, we’ll assume we have two networks: & which we need to provide Internet access to. These additional networks are contactable via a Layer3 device with IP address

ASA5505(config)# route outside
ASA5505(config)# route outside

Configure Network Address Translation (NAT) for Internal Networks

This is the last step required to successfully provide Internet access to our internal networks. Network Address Translation is essential to masquerade our internal network using the single IP address our Public interface has been configured with.  Network Address Translation, along with all its variations (Static, Dynamic etc), is covered in great depth in our popular Network Address Translation section.

We should note at this point that NAT configuration has slightly changed with ASA software version 8.3 and above. We will provide both commands to cover installations with software version up to v8.2.5 and from v8.3 and above.

The following commands apply to ASA appliances with software version up to 8.2.5:

ASA5505(config)# global (outside) 1 interface
INFO: outside interface address added to PAT pool
ASA5505(config)# nat (inside) 1
ASA5505(config)# nat (inside) 1
ASA5505(config)# nat (inside) 1

In the above configuration, the ASA Firewall is instructed to NAT all internal networks using the NAT Group 1. The number ‘1’ is used to identify the NAT groups for the NAT process between the inside and outside interfaces.

The global (outside) 1 interface command instructs the ASA Firewall to perform NAT using the IP address assigned to the outside interface.

Another method of configuring NAT is with the use of access lists. In this case, we define the internal IP addresses to be NAT’ed with the use of access lists:

ASA5505(config)# access-list NAT-ACLs extended permit ip any
ASA5505(config)# access-list NAT-ACLs extended permit ip any
ASA5505(config)# access-list NAT-ACLs extended permit ip any
ASA5505(config)# global (outside) 1 interface
INFO: outside interface address added to PAT pool
ASA5505(config)# nat (inside) 1 access-list NAT-ACLs

NAT with the use of access lists provides greater flexibility and control which IP addresses or networks will use the NAT service.

With software version 8.3 and newer, things have changed dramatically and there are no more access lists in NAT configuration lines.

The new NAT format now utilizes "object network", "object service" and "object-group network" to define the parameters of the  NAT  configuration.

The following commands (software version 8.3 and above) will provide NAT services to our internal networks so they can access the Internet:

ASA5505(config)# object network network1
ASA5505(config-network-object)# subnet
ASA5505(config-network-object)# nat (inside,outside) dynamic interface
ASA5505(config)# object network network2
ASA5505(config-network-object)# subnet
ASA5505(config-network-object)# nat (inside,outside) dynamic interface
ASA5505(config)# object network network3
ASA5505(config-network-object)# subnet
ASA5505(config-network-object)# nat (inside,outside) dynamic interface

Configuring the ASA DHCP Server

The existence of a DHCP server is necessary in most cases as it helps manage the assignment of IP address to our internal hosts. The ASA Firewall can be configured to provide DHCP services to our internal network, a very handy and welcome feature.

Again, there are some limitations with the DHCP service configuration which vary with the ASA model used. In our ASA5505, the maximum assigned IP addreses for the DHCP pool was just 128!

Note that the DHCP service can run on all ASA interfaces so it is necessary to specify which interface the DHCP configuration parameters are for:

ASA5505(config)# dhcpd address inside
Warning, DHCP pool range is limited to 128 addresses, set address range as:
ASA5505(config)# dhcpd address inside
ASA5505(config)# dhcpd dns interface inside

Once configured, the DHCP service will begin working and assigning IP addresses to the clients. The Gateway IP address parameter is automatically provided to client and is not required to be configured on the ASA Firewall appliance.

We can verify the DHCP service is working using the show dhcpd statistics command:

ASA5505(config)# show dhcpd statistics
DHCP UDP Unreachable Errors: 0
DHCP Other UDP Errors: 0
Address pools        1
Automatic bindings   1
Expired bindings     0
Malformed messages   0

    Message              Received
    BOOTREQUEST          0
    DHCPDISCOVER        1
    DHCPREQUEST          1
    DHCPDECLINE          0
    DHCPRELEASE          0
    DHCPINFORM           1

If required, we can clear the DHCP bindings (assigned IP addresses) using the clear dhcpd binding command.


Configure AAA Authentication for Local Database User Authentication

Configuring AAA authentication is always a good idea as it instructs the ASA Firewall to use the local user database for the various services it's running. For example, we can tell the ASA Firewall to use a radius server for VPN user authentication, but use its local database for telnet, ssh or HTTP (ASDM) management access to the Firewall appliance.

As mentioned, our example instructs the ASA Firewall to use its local database:

ASA5505(config)# aaa authentication telnet console LOCAL
ASA5505(config)# aaa authentication http console LOCAL
ASA5505(config)# aaa authentication ssh console LOCAL


Enable HTTP Management for Inside Interface

We now turn to the management settings of our ASA Firewall to enable and configure HTTP management. This will allow access to the Firewall’s management via the popular ASDM management application:

ASA5505(config)# http inside
WARNING: http server is not yet enabled to allow ASDM access.
ASA5505(config)# http server enable

The above commands enable HTTP management on the ASA Firewall only for the network


Enable SSH & Telnet Management for Inside and Outside Interfaces

Enabling SSH and Telnet access to the Cisco Firewall is pretty straightforward. While we always recommend the use of SSH, especially when accessing the Firewall from public IPs, telnet is also an option, however, we must keep in mind that telnet management methods do not provide any security as all data (including username, passwords and configurations) are sent in clear text.

Before enabling SSH, we must generate RSA key pairs for identity certificates. Telnet does not require any such step as it does not provide any encryption or security:

ASA5505(config)# crypto key generate rsa modulus 1024
INFO: The name for the keys will be:
Keypair generation process begin. Please wait...
ASA5505(config)# ssh inside
ASA5505(config)# ssh outside
ASA5505(config)# telnet inside

Note that the ASA Firewall appliance will only accept SSH connections from host arriving on its public interface, while SSH and telnet connections are permitted from network on  the inside interface.


Create, Configure and Apply TCP/UDP Object-Groups

An essential part of any firewall configure is to define the Internet services our users will have access to. This is done by either creating a number of lengthy access lists for each protocol/service and then applying them to the appropriate interfaces, or utilising the ASA Firewall Object-Groups which are then applied to the interfaces. Using Object-groups is easy and recommended as they provide a great deal of flexibility and ease of management.

The logic is simple:  Create your Object-Groups, insert the protocols and services required, and then reference them in the firewall access -lists. As a last step, we apply them to the interfaces we need.

Let’s use an example to help visualise the concept. Our needs require us to create two Object-Groups, one for TCP and one for UDP services:

ASA5505(config)#object-group service Internet-udp udp
ASA5505(config-service)# description UDP Standard Internet Services
ASA5505(config-service)# port-object eq domain
ASA5505(config-service)# port-object eq ntp
ASA5505(config-service)# port-object eq isakmp
ASA5505(config-service)# port-object eq 4500
ASA5505(config-service)#object-group service Internet-tcp tcp
ASA5505(config-service)# description TCP Standard Internet Services
ASA5505(config-service)# port-object eq www
ASA5505(config-service)# port-object eq https
ASA5505(config-service)# port-object eq smtp
ASA5505(config-service)# port-object eq 465
ASA5505(config-service)# port-object eq pop3
ASA5505(config-service)# port-object eq 995
ASA5505(config-service)# port-object eq ftp
ASA5505(config-service)# port-object eq ftp-data
ASA5505(config-service)# port-object eq domain
ASA5505(config-service)# port-object eq ssh
ASA5505(config-service)# port-object eq telnet

Now we need to reference our two Object-groups using the firewall access lists. Here we can also define which networks will have access to the services listed in each Object-group:

ASA5505(config)# access-list inside-in remark -=[Access Lists For Outgoing Packets from Inside interface]=-
ASA5505(config)# access-list inside-in extended permit udp any object-group Internet-udp
ASA5505(config)# access-list inside-in extended permit tcp any object-group Internet-tcp
ASA5505(config)# access-list inside-in extended permit tcp any object-group Internet-tcp
ASA5505(config)# access-list inside-in extended permit tcp any object-group Internet-tcp


Note that the network has access to both Object-groups services, our other networks are restricted to only the services defined in the TCP Object-group. To understand how Object-groups help simplify access list management: without them, we would require 37 access lists commands instead of just 4!

Configuration of Access-Lists for ICMP Packets to the Internet

To complete our access list configuration we configure our ASA Firewall to allow ICMP echo packets (ping) to any destination, and their replies (echo-reply):

ASA5505(config)# access-list inside-in extended permit icmp any
ASA5505(config)# access-list outside-in remark -=[Access Lists For Incoming Packets on OUTSIDE interface]=-
ASA5505(config)# access-list outside-in extended permit icmp any any echo-reply

Appling Firewall Access-Lists to ‘inside’ and ‘outside’ Interfaces

The last step in configuring our firewall rules involves applying the two access lists, inside-in & outside-in, to the appropriate interfaces. Once this step is complete the firewall rules are in effect immediately:

ASA5505(config)# access-group inside-in in interface inside
ASA5505(config)# access-group outside-in in interface outside

Configure Logging/Debugging of Events & Errors

This last step in our ASA Firewall configuration guide will enable logging and debugging so that we can easily trace events and errors. It is highly recommended to enable logging because it will certainly help troubleshooting the ASA Firewall when problems occur.

ASA5505(config)# logging buffered 7
ASA5505(config)# logging buffer-size 30000
ASA5505(config)#  logging enable


The commands used above enable log in the debugging level (7) and sets the buffer size in RAM to 30,000 bytes (~30Kbytes).

Issuing the show log command will reveal a number of important logs including any packets that are processed or denied due to access-lists:

ASA5505(config)# show log
Syslog logging: enabled
    Facility: 20
    Timestamp logging: disabled
    Standby logging: disabled
    Debug-trace logging: disabled
    Console logging: disabled
    Monitor logging: disabled
    Buffer logging: level debugging, 39925 messages logged
    Trap logging: disabled
    History logging: disabled
    Device ID: disabled
    Mail logging: disabled
    ASDM logging: disabled
n" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside: dst outside: by access-group "inside-in" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside: dst outside: by access-group "inside-in" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside: dst outside: by access-group "inside-in" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside: dst outside: by access-group "inside-in" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside: dst outside: by access-group "inside-in" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside: dst outside: by access-group "inside-in" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside: dst outside: by access-group "inside-in" [0x0, 0x0]
%ASA-4-106023: Deny tcp src inside: dst outside: by access-group "inside-in" [0x0, 0x0]
%ASA-4-106023: Deny udp src inside: dst outside: by access-group "inside-in" [0x0, 0x0]
%ASA-6-302014: Teardown TCP connection 4718 for outside: to inside: duration 0:02:00 bytes 1554462 TCP FINs


This article serves as an introduction configuration guide for the ASA5500 series Firewall appliances. We covered all necessary commands required to get any ASA5500 Firewall working and servicing network clients, while also explaining in detail all commands used during the configuration process.

Back to Cisco Firewalls Section


Articles To Read Next:


Cisco Routers

  • SSL WebVPN
  • Securing Routers
  • Policy Based Routing
  • Router on-a-Stick

VPN Security

  • Understand DMVPN
  • GRE/IPSec Configuration
  • Site-to-Site IPSec VPN
  • IPSec Modes

Cisco Help

  • VPN Client Windows 8
  • VPN Client Windows 7
  • CCP Display Problem
  • Cisco Support App.

Windows 2012

  • New Features
  • Licensing
  • Hyper-V / VDI
  • Install Hyper-V


  • File Permissions
  • Webmin
  • Groups - Users
  • Samba Setup