1. Lesson 3b © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-1 Getting Started with Cisco Security Appliances

2. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-2 User Interface

3. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-3 Security Appliance Access Modes firewall> firewall# monitor> A Cisco security appliance has four administrative access modes: Unprivileged Privileged Configuration Monitor

4. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-4 Internet pixfirewall> enable password: pixfirewall# enable [priv_level] firewall > Used to control access to the privileged mode Enables you to enter other access modes Access Privilege Mode

5. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-5 Access Configuration Mode: configure terminal Command configure terminal firewall# Used to start configuration mode to enter configuration commands from a terminal pixfirewall> enable password: pixfirewall# configure terminal pixfirewall(config)# exit pixfirewall# exit pixfirewall> exit firewall# Used to exit from an access mode

6. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-6 pixfirewall > help ? enable Turn on privileged commands exit Exit the current command mode login Log in as a particular user logout Exit from current command mode, and to unprivileged mode quit Exit the current command mode pixfirewall > help enable USAGE: enable [ ] DESCRIPTION: enable Turn on privileged commands help Command

7. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-7 File Management

8. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-8 Viewing and Saving Your Configuration The following commands enable you to view or save your configuration: copy run start –show running-config –show startup-config write memory –write terminal To save configuration changes: copy run start running- config startup- config (saved) Configuration Changes

9. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-9 Clearing Running Configuration firewall(config)# clear configure all Clears the running-configuration fw1(config)# clear config all Clear the running configuration: clear config all running- config startup- config (default)

10. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-10 Clearing Startup Configuration firewall # write erase Clears the startup configuration Fw1# write erase Clear the startup configuration: Write erase running- config startup- config (default)

11. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-11 Reload the Configuration: reload Command Reboots the security appliance and reloads the configuration Reboots can be scheduled fw1# reload Proceed with reload?[confirm] y Rebooting... reload [noconfirm] [cancel] [quick] [save-config] [max-hold-time [hh:]mm [{in [hh:]mm | {at hh:mm [{month day} | {day month}]}] [reason text] firewall(config)#

12. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-12 File System Software Image Configuration file Private data file PDM image Crash information Release 6. and earlier Release 7. and later Software image Configuration file Private data PDM image Backup image* Backup configurationfile* Virtual firewall Configuration file* * Space available 10.0.0.11

13. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-13 Displaying Stored Files: System and Configuration Display the directory contents. firewall(config )# 10.0.0.11 PIX Firewall Flash: ASA Disk0: Disk1: firewall# dir Directory of flash:/ 3 -rw- 4902912 13:37:33 Jul 27 2005 pix-701.bin 4 -rw- 6748932 13:21:13 Jul 28 2005 asdm-501.bin 16128000 bytes total (4472832 bytes free) dir [/recursive] [[{disk0:|disk1:|flash:}][ }]]

14. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-14 Selecting Boot System File Can store more than one system image and configuration file Designates which system image and startup configuration file to boot fw1(config)# boot system flash:/pix-701.bin Boot [system | config} firewall(config )# firewall# dir Directory of flash:/ 3 -rw- 4902912 13:37:33 Jul 27 2005 pix-701.bin 4 -rw- 6748932 13:21:13 Jul 28 2005 asdm-501.bin 16128000 bytes total (4472832 bytes free)

15. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-15 Verifying the Startup System Image Display the system boot image. fw1# show bootvar BOOT variable = flash:/pix-701.bin Current BOOT variable = flash:/pix-701.bin CONFIG_FILE variable = Current CONFIG_FILE variable = show bootvar firewall(config )# 10.0.0.11 Boot Image flash:/pix-701.bin Configured Running

16. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-16 Security Appliance Security Levels

17. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-17 Functions of the Security Appliance: Security Algorithm Implements stateful connection control through the security appliance. Allows one-way (outbound) connections with a minimum number of configuration changes. An outbound connection is a connection originating from a host on a more-protected interface and destined for a host on a less-protected network. Monitors return packets to ensure that they are valid. Randomizes the first TCP sequence number to minimize the risk of attack.

18. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-18 Security Level Example Outside Network Ethernet0 Security level 0 Interface name = outside DMZ Network Ethernet2 Security level 50 Interface name = DMZ Inside Network Ethernet1 Security level 100 Interface name = inside e0 e2 e1 Internet

19. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-19 Basic Security Appliance Configuration

20. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-20 Assigning Hostname to Security Appliance: Changing the CLI Prompt pixfirewall(config)# hostname Boston Boston(config)# hostname newname pixfirewall(config )# Changes the hostname in the PIX Firewall CLI prompt Server Boston Server New_York Server Dallas pixfirewall(config)# hostname Boston Boston(config)# hostname newname

21. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-21 Basic CLI Commands for Security Appliances hostname interface – nameif – ip address – security-level – speed – duplex – no shutdown nat-control nat global route e0 e2 e1 Internet

22. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-22 interface hardware_id firewall(config)# fw1(config)# interface ethernet0 (GigabitEthernet0/0) fw1(config-if)# interface Command and Subcommands Specifies a perimeter interface and its slot location on the firewall Ethernet0 Ethernet2 Ethernet1 e0 e2 e1 Internet

23. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-23 interface vlan_id firewall(config)# fw1(config)# interface vlan 2 fw1(config-if)# interface Commands for Vlans Specifies a perimeter interface and its slot location on the firewall Ethernet0 Ethernet2 Ethernet1 e0 e2 e1 Internet

24. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-24 nameif hardware_id if_name firewall(config-if )# fw1(config)# interface ethernet0 (GigabitEthernet0/0) fw1(config-if)# nameif outside Assign an Interface Name: nameif Subcommand Assigns a name to each perimeter interface on the PIX Firewall Security Appliance. Ethernet0 Interface name = outside Ethernet2 Interface name = dmz Ethernet1 Interface name = inside e0 e2 e1 Internet

25. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-25 ip address ip_address [netmask] firewall(config-if )# Assign Interface IP Address: ip address Subcommand Assigns an IP address to each interface fw1(config)# interface ethernet0 (GigabitEthernet0/0) fw1(config-if)# nameif outside fw1(config-if)# ip address 192.168.1.2 255.255.255.0 Ethernet0 Interface name = outside IP address = 192.168.1.2 e0 e2 e1 Internet

26. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-26 DHCP-Assigned Address fw1(config)# interface ethernet0 (GigabitEthernet0/0) fw1(config-if)# nameif outside fw1(config-if)# ip address dhcp firewall(config-if )# ip address if_name dhcp [setroute] [retry retry_cnt] Enables the DHCP client feature on the outside interface e0 Internet DHCP Assigned Ethernet0 Interface name = outside IP address = DHCP

27. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-27 security-level number firewall(config-if)# Assign a Security Level: security-level SubCommands Assigns a security level to the interface fw1(config)# interface ethernet0 (GigabitEthernet0/0) fw1(config-if)# nameif outside fw1(config-if)# ip address 192.168.1.2 fw1(config-if)# security-level 0 e0 e2 e1 Internet Ethernet0 Interface name = outside IP address = 192.168.1.2 Security level = 0

28. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-28 speed [hardware_speed] duplex [duplex_operation] firewall(config-if)# Assign an Interface Speed and Duplex: speed and duplex SubCommands Enables an interface speed and duplex fw1(config)# interface ethernet0 (GigabitEthernet0/0) fw1(config-if)# nameif outside fw1(config-if)# ip address 192.168.1.2 fw1(config-if)# security-level 0 fw1(config-if)# speed 100 fw1(config-if)# duplex full e0 e2 e1 Internet Ethernet0 Speed =100 Duplex = full

29. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-29 management-only no management-only firewall(config-if)# ASA Management Interface To set an interface to accept management traffic only fw1(config)# interface management 0/0 fw1(config-if)# nameif outside fw1(config-if)# ip address 192.168.1.2 fw1(config-if)# security-level 0 e0 e2 e1 Internet Ethernet0 Management = only

30. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-30 Network Address Translation Inside Local Outside Mapped Pool 10.0.0.11192.168.0.20 10.0.0.11 10.0.0.4 Translation Table 10.0.0.11 192.168.0.20 192.168.10.11 NAT Internet

31. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-31 Enable NAT Control Inside Local Outside Mapped Pool 10.0.0.11192.168.0.20 10.0.0.11 10.0.0.4 Translation Table 10.0.0.11 192.168.0.20 200.200.200.11 NAT Internet fw1(config)# nat-control Enable or disable NAT configuration requirement

32. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-32 nat [(if_name)] nat_id address [netmask] [dns] [[tcp] tcp_max_conns [emb_limit] [norandomseq]]] [udp udp_max_conns] firewall(config)# nat Command Enables IP address translation fw1(config)# nat (inside) 1 0.0.0.0 0.0.0.0 0 0 10.0.0.11 10.0.0.4 10.0.0.11 X.X.X.X NAT Internet

33. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-33 global Command Works with the nat command to assign a registered or public IP address to an internal host when accessing the outside network through the firewall, for example, 192.168.0.20-192.168.0.254 fw1(config)# nat (inside) 1 0.0.0.0 0.0.0.0 fw1(config)# global (outside) 1 192.168.0.20-192.168.0.254 firewall(config)# global[(if_name)] nat_id {mapped_ip[-mapped_ip] [netmask mapped_mask]} | interface 10.0.0.11 10.0.0.4 10.0.0.11 192.168.0.20 NAT Internet

34. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-34 route if_name ip_address netmask gateway_ip [metric] firewall(config)# Configure a Static Route: route Command Defines a static or default route for an interface fw1(config)# route outside 0.0.0.0 0.0.0.0 192.168.0.1 1 fw1(config)# route inside 10.0.1.0 255.255.255.0 10.0.0.102 1 192.168.0.1 10.0.1.11 10.0.1.4 Default Route 10.0.0.102 Static Route Internet

35. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-35 fw1(config)# names fw1(config)# name 172.16.0.2 bastionhost fw1(config)# name 10.0.0.11 insidehost HostName-to-IP-Address Mapping: name Command Configures a list of name-to-IP-address mappings on the security appliance name ip_address name firewall(config)# “bastionhost” 172.16.0.2 172.16.0.0.2.1 10.0.0.0.1.11 “insidehost” 10.0.0.11

36. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-36 Configuration Example write terminal interface ethernet0 nameif outside security-level 0 speed 100 duplex full ip address 192.168.2.2 255.255.255.0 interface ethernet1 nameif inside security-level 100 speed 100 duplex full ip address 10.0.1.1 255.255.255.0 172.16.6.0.1 10.0.6.0.1 192.168.6.0.2 10.1.6.0.1 Ethernet0 Interface name = outside Security level = 0 IP address = 192.168.6.2 Ethernet1 Interface name = inside Security level = 100 IP address = 10.0.6.1 Internet

37. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-37 Configuration Example (Cont.) interface ethernet2 nameif dmz security-level 50 speed 100 duplex full ip address 172.16.2.2 255.255.255.0 passwd 2KFQnbNIdI.2KYOU encrypted hostname fw1 names name 172.16.6.2 bastionhost name 10.1.6.11 insidehost 172.16.6.0.1 10.0.6.0.1 192.168.6.0.2 10.1.6.0.1 Ethernet2 Interface name = dmz Security level = 50 IP address = 172.16.6.1 Internet “insidehost” 10.1.6.11 “bastionhost” 172.16.6.2

38. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-38 Configuration Example (Cont.) nat-control nat (inside) 1 0.0.0.0 0.0.0.0 0 0 global (outside) 1 192.168.6.20-192.168.6.254 route outside 0.0.0.0 0.0.0.0 192.168.6.1 1 route inside 10.1.6.0 255.255.255.0 10.0.6.102 1 10.0.0.0 Mapped Pool 192.168.6.20 - 254 172.16.6.0.2.1.102 “insidehost” 10.1.6.11 “bastionhost” 172.16.6.2 10.0.6.0.1 192.168.6.0.2.1 10.1.6.0.1 Default Route Static Route Internet

39. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-39 Examining Security Appliance Status

40. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-40 fw1# show interface Interface GigabitEthernet0/0 "outside", is up, line protocol is up Detected: Speed 100 Mbps, Full-duplex Requested: Auto MAC address 000b.fcf8.c538, MTU 1500 IP address 192.168.1.2, subnet mask 255.255.255.0 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns input queue (curr/max blocks): hardware (0/0) software (0/0) output queue (curr/max blocks): hardware (0/0) software (0/0) Received 0 VLAN untagged packets, 0 bytes Transmitted 0 VLAN untagged packets, 0 bytes Dropped 0 VLAN untagged packets show Commands fw1# show run interface ! interface Ethernet0 speed 100 duplex full nameif outside security-level 0 ip address 192.168.2.2 255.255.255.0 ! interface Ethernet1 speed 100 duplex full nameif inside security-level 100 ip address 10.0.2.1 255.255.255.0 show run interface show interface

41. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-41 fw1# show memory Free memory: 49046552 bytes Used memory: 18062312 bytes ------------- ---------------- Total memory: 67108864 bytes show memory Command Displays system memory usage information firewall# show memory

42. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-42 fw1# show cpu usage CPU utilization for 5 seconds = 0%; 1 minute: 0%; 5 minutes: 0% show cpu usage Command Displays CPU use firewall# show cpu usage 10.0.0.11 10.0.0.4 Internet

43. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-43 show version Command Displays the security appliance’s software version, operating time since its last reboot, processor type, Flash memory type, interface boards, serial number (BIOS identification), and activation key value. firewall# show version Cisco PIX Security Appliance Software Version 7.0(1) Compiled on Thu 31-Mar-05 14:37 by builders System image file is "flash:/pix-701.bin" Config file at boot was "startup-config" pixfirewall up 12 mins 24 secs Hardware: PIX-515, 128 MB RAM, CPU Pentium 200 MHz Flash i28F640J5 @ 0x300, 16MB……………

44. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-44 fw1# show ip address System IP Addresses: Interface Name IP address Subnet mask Ethernet0 outside 192.168.1.2 255.255.255.0 CONFIG Ethernet1 inside 10.0.1.1 255.255.255.0 CONFIG Ethernet2 dmz 172.16.1.1 255.255.255.0 CONFIG Current IP Addresses: Interface Name IP address Subnet mask Ethernet0 outside 192.168.1.2 255.255.255.0 CONFIG Ethernet1 inside 10.0.1.1 255.255.255.0 CONFIG Ethernet2 dmz 172.16.1.1 255.255.255.0 CONFIG show ip address Command 172.16.6.0.1 10.0.6.0.1 192.168.6.0.2 10.1.6.0.1 Internet

45. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-45 fw1# show interface interface ethernet0 "outside" is up, line protocol is up Hardware is i82559 ethernet, address is 0050.54ff.653a IP address 192.168.0.2, subnet mask 255.255.255.0 MTU 1500 bytes, BW 100000 Kbit full duplex 4 packets input, 282 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 20 packets output, 1242 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier input queue (curr/max blocks): hardware (128/128) software (0 output queue (curr/max blocks): hardware (0/1) software (0/1) show interface Command

46. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-46 show nameif Command fw1# show nameif Interface Name Security Ethernet0 outside 0 Ethernet1 inside 100 Ethernet2 dmz 50 Ethernet0 Interface name = outside Security level = 0 Ethernet2 Interface name = dmz Security level = 50 Ethernet1 Interface name = inside Security level = 100 e0 e2 e1 Internet

47. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-47 show run nat Command fw1# show run nat nat (inside) 1 10.0.0.0 255.255.255.0 0 0 10.0.0.11 10.0.0.4 10.0.0.X X.X.X.X NAT Displays a single host or range of hosts to be translated firewall# show run nat Internet

48. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-48 show run global Command fw1# show run global global (outside) 1 192.168.0.20-192.168.0.254 netmask 255.255.255.0 Mapped Pool 192.168.0.20-192.168.0.254 10.0.0.11 10.0.0.4 10.0.0.X Displays the pool of mapped addresses firewall# show run global Internet

49. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-49 show xlate Command fw1# show xlate 1 in use, 1 most used Global 192.168.0.20 Local 10.0.0.11 192.168.0.20 10.0.0.11 10.0.0.4 10.0.0.11 Displays the contents of the translation slots firewall# show xlate Inside local Outside mapped pool 10.0.0.11192.168.0.20 Xlate Table Internet

50. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-50 ping Command Determines whether other IP addresses are visible from the security appliance fw1# ping 10.0.1.11 Sending 5, 100-byte ICMP Echos to 10.0.1.11, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 10/12/20 ms ping host firewall# 10.0.0.11 10.0.0.4 Internet

51. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-51 show route Command fw1(config)# sh route S 0.0.0.0 0.0.0.0 [1/0] via 192.168.1.1, outside C 10.0.1.0 255.255.255.0 is directly connected, inside C* 127.0.0.0 255.255.0.0 is directly connected, cplane C 172.16.1.0 255.255.255.0 is directly connected, dmz C 192.168.1.0 255.255.255.0 is directly connected, outside e0 e2 e1 Internet * ASA 55X0 only Works only with the ASA 5500 Series Adaptive Security Appliances

52. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-52 Setting Time and Using NTP Support

53. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-53 clock Command Sets the security appliance clock fw1# clock set 21:0:0 jul 23 2003 clock set hh:mm:ss {day month | month day} year firewall# 10.0.0.11 10.0.0.4 Wed 23-Jul-03 21:00 Internet

54. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-54 Setting Daylight Saving Time and Time Zones Specifies that summertime starts on the first Sunday in April at 2 a.m. and ends on the last Sunday in October at 2 a.m. fw1(config)# clock summer-time PDT recurring 1 Sunday April 2:00 last Sunday October 2:00 clock summer-time zone recurring [week weekday month hh:mm week weekday month hh:mm] [offset] firewall(config)# clock timezone zone hours [minutes] firewall(config)# Sets the clock display to the time zone specified Displays summertime hours during the specified summertime date range

55. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-55 ntp Command Synchronizes the security appliance with an NTP server fw1(config)# ntp authentication-key 1234 md5 cisco123 fw1(config)# ntp trusted-key 1234 fw1(config)# ntp server 10.0.0.12 key 1234 source inside prefer fw1(config)# ntp authenticate ntp server ip_address [key number] source if_name [prefer] firewall(config)# 10.0.0.11 10.0.0.12 NTP Server Internet

56. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-56 Syslog Configuration

57. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-57 Configure Syslog Output to a Syslog Server Syslog Server Syslog Messages Internet

58. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-58 Logging Options Console – Output to console Buffered – Output to internal buffer Monitor – Output to Telnet Host – Output to syslog server SNMP – Output to SNMP server Syslog Server Internet Logging Options Console Telnet Internal Buffer SNMP Server

59. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-59 Logging Levels 0 – Emergencies 1 – Alerts 2 – Critical 3 – Errors 4 – Warnings 5 – Notifications 6 – Informational 7 – Debugging Syslog Server Internet Console Telnet Internal Buffer SNMP Server Logging Levels

60. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-60 Configure Message Output to a Syslog Server Designate the syslog host server. Set the logging level. Enable logging time stamp on syslog messages. Specify the logging device identifier. Enable logging. Syslog Server 10.0.1.11 Syslog Messages fw1(config)# logging host inside 10.0.1.11 fw1(config)# logging trap warnings fw1(config)# logging timestamp fw1(config)# logging device-id pix6 fw1(config)# logging on fw1 Internet

61. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-61 Syslog Output Example Message Identifier Logging Device Identifier Logging Date and Time Stamp Logging Device IP Address Logging Level

62. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-62 Customize Syslog Output fw1(config)# logging trap warnings fw1(config)# logging message 302013 level 4 fw1(config)# logging message 302014 level 4 logging message syslog_id level level firewall(config)# Enables you to change the level of specific syslog messages fw1(config)# no logging message 710005 no logging message syslog_id firewall(config)# Disallows unwanted syslog messages

63. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-63 show logging Command Syslog Server 10.0.1.11 Syslog Messages fw1 Internal Buffer fw1(config)# show logging Syslog logging: enabled Facility: 20 Timestamp logging: enabled Standby logging: disabled Ambiguous interface parameters: 97 Console logging: disabled Monitor logging: disabled Buffer logging: level warnings, 0 messages logged Trap logging: level warnings, facility 20, 0 messages logged Logging to inside 10.0.1.11 History logging: disabled Device ID: fw1 Mail logging: disabled PDM logging: disabled Internet

64. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-64 Summary Cisco security appliances have four administrative access modes: unprivileged, privileged, configuration, and monitor. Interfaces with a higher security level can access interfaces with a lower security level, but interfaces with a lower security level cannot access interfaces with a higher security level unless given permission. The security appliance show commands help you manage the security appliance.

65. © 2005 Cisco Systems, Inc. All rights reserved. SNPA v4.0—3-65 Summary (Cont.) The basic commands that are necessary to configure Cisco security appliances are the following: interface, nameif, nat, global, and route. The nat and global commands work together to translate IP addresses. The security appliance can send syslog messages to a syslog server. The security appliance can function as a DHCP client.