Configure DHCP on ASA 5505

Here are the CLI to setup DHCP for Inside network on ASA 5505

ciscoasa(config)# dhcpd address 192.168.1.100-192.168.1.200 inside
ciscoasa(config)# dhcpd enable inside

Upgrading ASA 5500 series 8.4

Detailed Steps

---

Step 1 Back up your configuration file. To print the configuration to the terminal, enter the following command:

hostname# show running-config

---

Note If you are upgrading from a pre-8.3 version, then the running configuration is backed up automatically.

---

For other methods of backing up, see the "Managing Software and Configurations" chapter in Cisco ASA 5500 Series Configuration Guide using the CLI.

Step 2 Install the new images using TFTP. Enter this command separately for the OS image and the ASDM image:

hostname# copy tftp://server[/path]/filename {disk0:/ | disk1:/}[path/]filename

For example:

hostname# copy tftp://10.1.1.1/asa840-4-k8.bin disk0:/asa841-k8.bin

...

hostname# copy tftp://10.1.1.1/asdm-64099.bin disk0:/asdm-641.bin

If your ASA does not have enough memory to hold two images, overwrite the old image with the new one by specifying the same destination filename as the existing image.

Step 3 To change the OS boot image to the new image name, enter the following commands:

hostname(config)# clear configure boot

hostname(config)# boot system {disk0:/ | disk1:/}[path/]new_filename

For example:

hostname(config)# clear configure boot

hostname(config)# boot system disk0:/asa841-k8.bin

Step 4 To configure the ASDM image to the new image name, enter the following command:

hostname(config)# asdm image {disk0:/ | disk1:/}[path/]new_filename

Step 5 To save the configuration and reload, enter the following commands:

hostname(config)# write memory

hostname(config)# reload

Basic ASA Configuration

Configure ASA hostname

   ASA# config t
   ASA(config)# hostname TestASA

Configure enable password
   TestASA(config)# enable password THISISPASSWORDTEXT
Configure DNS on ASA
   TestASA(config)# domain-name MyTest.com

Configure uploading ASDM image on ASA and enabling access to ASDM
   TestASA(config)# asdm image disk0:/asdm-524.bin
   TestASA(config)# http server enable

Configure the interfaces

   TestASA# config t
   TestASA(config)# interface Vlan1
   TestASA(config-if)# nameif inside

   TestASA(config-if)# security-level 100

   TestASA(config-if)# ip address 192.168.2.1 255.255.255.0
   TestASA(config-if)# no shutdown
   TestASA(config-if)# exit
   TestASA(config)# interface Vlan2
   TestASA(config-if)# nameif outside

   TestASA(config-if)# security-level 0

   TestASA(config-if)# ip address 192.168.1.254 255.255.255.0
   TestASA(config-if)# no shutdown
   TestASA(config-if)# exit

Assign physical interface ETH0/0 to VLAN2 or Outside interface
   TestASA(config)# interface ethernet 0/0
   TestASA(config-if)# switchport access vlan 2

The rest of the physical interfaces are assigned to VLAN1 by default

Configure access to ASA device, for SSH please read this link.
   TestASA(config)# username USER_1 password PASSWORD_1 privilege 15
   TestASA(config)# username USER_2 password PASSWORD_2 privilege 5
   TestASA(config)# aaa authenticate ssh console LOCAL
   TestASA(config)# aaa authenticate telnet console LOCAL
   TestASA(config)# aaa authenticate http console LOCAL
   TestASA(config)# crypto key generate rsa modulus 1024
   !- generates an RSA key pair which is required for SSH
   TestASA(config)# ssh 192.168.2.0 255.255.255.0 inside
   TestASA(config)# ssh timeout 30
   !- allow putty to connect using SSH
   TestASA(config)# telnet 192.168.2.0 255.255.255.0 inside
  TestASA(config)# telnet timeout 30
   !- allow putty to connect using Telnet
   TestASA(config)# http 192.168.2.0 255.255.255.0 inside
   !- allow user to connect using ASDM

Configure clock
   TestASA(config)# clock set hh:mm:ss {month day} year

--------------------------------------------------------------------------------Good CLI to use:
   # show curpriv


Dynamic NAT configuration on ASA 55XX

Configure using 8.0 ASA

ciscoasa(config)# nat (inside) 1 192.168.2.0 255.255.255.0
ciscoasa(config)# global (outside) 1 10.2.2.1-10.2.2.10 netmask 255.255.255.0

additional note: Running PAT

ciscoasa(config)# nat (inside) 1 0.0.0.0 0.0.0.0
ciscoasa(config)# global (outside) 1 interface

Configure using 8.3 ASA

ciscoasa(config)# object network MyOutsideRangePool

ciscoasa(config-network-object)# range 10.2.2.1 10.2.2.10

ciscoasa(config)# object network MyInsideNetwork

ciscoasa(config-network-object)# subnet 192.168.2.0 255.255.255.0

ciscoasa(config-network-object)# nat (inside,outside) dynamic MyOutsideRangePool  

Additional example of Dynamic NAT of 2 internal networks
Configure using 8.0 ASA
ciscoasa(config)# nat (inside) 1 192.168.2.0 255.255.255.0
ciscoasa(config)# nat (inside) 2 192.168.3.0 255.255.255.0
ciscoasa(config)# global (outside) 1 10.2.2.1-10.2.2.10 netmask 255.255.255.0
ciscoasa(config)# global (outside) 2 10.2.2.11-10.2.2.20 netmask 255.255.255.0

Configure using 8.3 ASA

ciscoasa(config)# object network MyOutsideRangePool_1

ciscoasa(config-network-object)# range 10.2.2.1 10.2.2.10

ciscoasa(config)# object network MyInsideNetwork_1

ciscoasa(config-network-object)# subnet 192.168.2.0 255.255.255.0

ciscoasa(config-network-object)# nat (inside,outside) dynamic MyOutsideRangePool_1 

ciscoasa(config)# object network MyInsideNetwork_2

ciscoasa(config-network-object)# subnet 192.168.3.0 255.255.255.0

ciscoasa(config-network-object)# nat (inside,outside) dynamic MyOutsideRangePool_2 

ciscoasa(config)# object network MyOutsideRangePool_2

ciscoasa(config-network-object)# range 10.2.2.11 10.2.2.20

SSH configuration on ASA 5500

Here is the configuration on how to enable SSH on ASA device.

ASA# config t
ASA(config)# enable password EPICPASSWORD
!--Enable password is necessary to enable ssh access

ASA(config)# username box password boxpasswordonly
!--Username and password for connecting using SSH

ASA(config)# aaa authentication ssh console LOCAL
!--We specified LOCAL authentication with usernamea & password above

ASA(config)# ssh 192.168.x.x 255.255.255.0 inside
!--This line allow the user with the right username and password
!--from this specific subnet (reside locally) to access the ASA
!--ssh (Outside IP) (Outside Subnet) outside
!--This is to allow user from the outside IP to access the ASA

ASA(config)# domain-name WOW.LOCAL
!--Domain name of your company.  RSA key is generated usig DOMAIN NAME
!--plus FIREWALL name combination

ASA(config)# crypto key generate rsa modulus 1024
!--ASA generate RSA key

The firewall is now ready for SSH connection.

Additional reading for ASA 8.3 configuration from Cisco site.