Assign static IP on LAP1131AG

Cisco LAP-1131AG-A's FastEthernet 0 interface receives an IP address from DHCP server.
But to assign a static IP address to this interface, follow this following information:
AP> enable
password: Cisco
AP# debug lwapp con cli
AP# debug lwapp client no-reload
AP# conf t
AP(config)# interface fa0
AP(config-if)# ip address 192.168.2.200 255.255.255.0

For new IOS version:
AP# capwap ap ip address 192.168.2.200 255.255.255.0
AP# capwap ap ip default-gateway 192.168.2.250

Switch Trunk

Configuring Trunk between 2 switches.

Configuration will setup a trunk between 2 switches with dot1q (802.1Q) encapsulation and change the native VLAN from 1 to 100 with allowing only VLAN 100,101, 102, 104 and 105. 

Switch-A(config)# interface gigabitethernet 0/2

Switch-A(config-if)# switchport

Switch-A(config-if)# switchport trunk encapsulation dot1q

Switch-A(config-if)# switchport trunk native vlan 100

Switch-A(config-if)# switchport trunk allowed vlan 100-105
Switch-A(config-if)# switchport mode dynamic desirable

Switch-D(config)# interface gigabitethernet 0/24
Switch-D(config-if)# switchport
Switch-D(config-if)# switchport trunk encapsulation dot1q
Switch-D(config-if)# switchport trunk native vlan 100
Switch-D(config-if)# switchport trunk allowed vlan 100-105
Switch-D(config-if)# switchport trunk allowed vlan remove 103
Switch-D(config-if)# switchport mode dynamic desireable

Switch VLAN and VLAN Trunk Configuration

Switch VLAN syntax:
switch(config)# interface type module/number
switch(config-if)# switchport 
! switchport command configures the port for layer 2 operation
switch(config-if)# switchport mode access
switch(config-if)# switchport access vlan vlan-num

VLAN Trunking Configuration
switch> enable
switch# configure terminal
switch(config)# interface type mod/port
switch(config-if)# switchport!switch port must be in Layer 2 mode before it can supporta trunk
switch(config-if)# switchport trunk encapsulation {isl | dot1q | negotiate}
switch(config-if)# switchport trunk native vlan vlan-id
!native vlan only for dot1q encapsulation
!identifying the untagged or native VLAN number as vlan-id (1 to 4094)
!ISL doesn't support an untagged VLAN
switch(config-if)# switchport trunk allowed vlan {vlan-list | all | <add | except | remove> vlan-list}
switch(config-if)# switchport mode {trunk | dynamic <desirable | auto>}

Configure DHCP on ASA 5505

Here are the CLI to setup DHCP for Inside network on ASA 5505

ciscoasa(config)# dhcpd address 192.168.1.100-192.168.1.200 inside
ciscoasa(config)# dhcpd enable inside

Upgrading ASA 5500 series 8.4

Detailed Steps

---

Step 1 Back up your configuration file. To print the configuration to the terminal, enter the following command:

hostname# show running-config

---

Note If you are upgrading from a pre-8.3 version, then the running configuration is backed up automatically.

---

For other methods of backing up, see the "Managing Software and Configurations" chapter in Cisco ASA 5500 Series Configuration Guide using the CLI.

Step 2 Install the new images using TFTP. Enter this command separately for the OS image and the ASDM image:

hostname# copy tftp://server[/path]/filename {disk0:/ | disk1:/}[path/]filename

For example:

hostname# copy tftp://10.1.1.1/asa840-4-k8.bin disk0:/asa841-k8.bin

...

hostname# copy tftp://10.1.1.1/asdm-64099.bin disk0:/asdm-641.bin

If your ASA does not have enough memory to hold two images, overwrite the old image with the new one by specifying the same destination filename as the existing image.

Step 3 To change the OS boot image to the new image name, enter the following commands:

hostname(config)# clear configure boot

hostname(config)# boot system {disk0:/ | disk1:/}[path/]new_filename

For example:

hostname(config)# clear configure boot

hostname(config)# boot system disk0:/asa841-k8.bin

Step 4 To configure the ASDM image to the new image name, enter the following command:

hostname(config)# asdm image {disk0:/ | disk1:/}[path/]new_filename

Step 5 To save the configuration and reload, enter the following commands:

hostname(config)# write memory

hostname(config)# reload

Basic ASA Configuration

Configure ASA hostname

   ASA# config t
   ASA(config)# hostname TestASA

Configure enable password
   TestASA(config)# enable password THISISPASSWORDTEXT
Configure DNS on ASA
   TestASA(config)# domain-name MyTest.com

Configure uploading ASDM image on ASA and enabling access to ASDM
   TestASA(config)# asdm image disk0:/asdm-524.bin
   TestASA(config)# http server enable

Configure the interfaces

   TestASA# config t
   TestASA(config)# interface Vlan1
   TestASA(config-if)# nameif inside

   TestASA(config-if)# security-level 100

   TestASA(config-if)# ip address 192.168.2.1 255.255.255.0
   TestASA(config-if)# no shutdown
   TestASA(config-if)# exit
   TestASA(config)# interface Vlan2
   TestASA(config-if)# nameif outside

   TestASA(config-if)# security-level 0

   TestASA(config-if)# ip address 192.168.1.254 255.255.255.0
   TestASA(config-if)# no shutdown
   TestASA(config-if)# exit

Assign physical interface ETH0/0 to VLAN2 or Outside interface
   TestASA(config)# interface ethernet 0/0
   TestASA(config-if)# switchport access vlan 2

The rest of the physical interfaces are assigned to VLAN1 by default

Configure access to ASA device, for SSH please read this link.
   TestASA(config)# username USER_1 password PASSWORD_1 privilege 15
   TestASA(config)# username USER_2 password PASSWORD_2 privilege 5
   TestASA(config)# aaa authenticate ssh console LOCAL
   TestASA(config)# aaa authenticate telnet console LOCAL
   TestASA(config)# aaa authenticate http console LOCAL
   TestASA(config)# crypto key generate rsa modulus 1024
   !- generates an RSA key pair which is required for SSH
   TestASA(config)# ssh 192.168.2.0 255.255.255.0 inside
   TestASA(config)# ssh timeout 30
   !- allow putty to connect using SSH
   TestASA(config)# telnet 192.168.2.0 255.255.255.0 inside
  TestASA(config)# telnet timeout 30
   !- allow putty to connect using Telnet
   TestASA(config)# http 192.168.2.0 255.255.255.0 inside
   !- allow user to connect using ASDM

Configure clock
   TestASA(config)# clock set hh:mm:ss {month day} year

--------------------------------------------------------------------------------Good CLI to use:
   # show curpriv


Dynamic NAT configuration on ASA 55XX

Configure using 8.0 ASA

ciscoasa(config)# nat (inside) 1 192.168.2.0 255.255.255.0
ciscoasa(config)# global (outside) 1 10.2.2.1-10.2.2.10 netmask 255.255.255.0

additional note: Running PAT

ciscoasa(config)# nat (inside) 1 0.0.0.0 0.0.0.0
ciscoasa(config)# global (outside) 1 interface

Configure using 8.3 ASA

ciscoasa(config)# object network MyOutsideRangePool

ciscoasa(config-network-object)# range 10.2.2.1 10.2.2.10

ciscoasa(config)# object network MyInsideNetwork

ciscoasa(config-network-object)# subnet 192.168.2.0 255.255.255.0

ciscoasa(config-network-object)# nat (inside,outside) dynamic MyOutsideRangePool  

Additional example of Dynamic NAT of 2 internal networks
Configure using 8.0 ASA
ciscoasa(config)# nat (inside) 1 192.168.2.0 255.255.255.0
ciscoasa(config)# nat (inside) 2 192.168.3.0 255.255.255.0
ciscoasa(config)# global (outside) 1 10.2.2.1-10.2.2.10 netmask 255.255.255.0
ciscoasa(config)# global (outside) 2 10.2.2.11-10.2.2.20 netmask 255.255.255.0

Configure using 8.3 ASA

ciscoasa(config)# object network MyOutsideRangePool_1

ciscoasa(config-network-object)# range 10.2.2.1 10.2.2.10

ciscoasa(config)# object network MyInsideNetwork_1

ciscoasa(config-network-object)# subnet 192.168.2.0 255.255.255.0

ciscoasa(config-network-object)# nat (inside,outside) dynamic MyOutsideRangePool_1 

ciscoasa(config)# object network MyInsideNetwork_2

ciscoasa(config-network-object)# subnet 192.168.3.0 255.255.255.0

ciscoasa(config-network-object)# nat (inside,outside) dynamic MyOutsideRangePool_2 

ciscoasa(config)# object network MyOutsideRangePool_2

ciscoasa(config-network-object)# range 10.2.2.11 10.2.2.20