Cisco ASA 5505 Firewall Initial Setup: Cisco ASA Training 101

[@mikeyoung7660]

Could listen to him talk all day. Great tutor. Got his book just learning at the minute.

[@rlmcculley]

One of the easiest listening video's that I have ever listed to in a tutorial. Clear & concise. I have a new Cisco 5506-X that I need to import configuration from my 5505 to and I am getting errors that I don't know how to overcome. I began once again with the basic setup hoping that would help me. Thanks Don - what a great instructor you are!

[@cherriagana]

9 Years later and I got my hands on a 5510 to mess with for my re education and thx god these tutorials are still here :). I added a comment on your how to install asdm-idm video as java webstart no longer works and the asdm needs some tweaking in the java security settings to allow TL1.0 TL1.1 :)

[@soundtraining]

Thanks so much. I appreciate your comment.

[@DavidDiaz-lm2pp]

Would you please share the comment here? I can't seem to find it

[@GTOGregory]

Great video! Loud and clear audio, sharp and simple images and just what is needed to complete the task!

[@islamtoghuj]

and most importantly, not Indian!

[@MartinPurvis]

We've got a Cisco ASA 5510 at our place but previous managers that knew how to use it left the place, just trying to learn a bit from your videos to get a better understanding. Thanks

[@soundtraining]

+Martin Purvis You might want to pick up a separate used 5510 to experiment and practice on. Did the previous managers leave any documentation?

[@MartinPurvis]

+soundtraining.net might have to try and get a good deal. Absolutely none unfortunately.

[@soundtraining]

Derek Yip (Tree), thanks for your comment. Your default gateway should not affect your ability to connect, since you should be trying to connect from a workstation connected to the inside interface on the ASA. Check to ensure that your workstation's IP address is on the same IP subnet as the ASA's inside interface. Also, use a serial connection to the ASA to ensure that the http command enables connections from that same IP subnet. Good luck!

[@theophush8261]

Great video! Loud and clear audio, Could listen to him talk all day. sharp and simple images.

[@388thalpha]

THANK YOU SOOOOOOOOOOooooooooooooo MUCH!!!!! I have been trying to get my PIX 515e working and after watching your video I was able to get it working. My issue was I was able to setup everything but I wasnt able to figure out how to get itto connect to the internet. I have been reading and watching videos and yours was the MAGIC video that helped me. AGAIN TY!!! I THINK.... this time I used the open DNS server that you said to use and everything came alive and started working.

[@soundtraining]

Wow, that's great. I'm glad it was helpful. Thanks for your comment.

[@GoodGameOKC1]

Great vid!! I have a 5505 that my employer has let me use at home and your videos are great tools to assist in working with the device. thank you

[@nimishak4119]

15:57 I am new to Cisco but I did whatever you said step by step but I can not get into the ASA which gives me "Can't reach the page" error message.

[@soundtraining]

Glad you like them. More are coming. Please share them to help spread the word!

[@luvtechharleys4392]

Still relevant....looking at a couple used 5505s and feel good about it and setting it up now. Tx! PS - good tone and pace, etc...makes it easy to focus and follow along.

[@Kulik_realm]

This is my first time watching for Firewall setup video but i completely satisfied and understood very well . My confidence level like i can configure any cisco firewall. Thanks www.soundtraining.net

[@soundtraining]

Artur, the video was recorded in high definition and is available to watch in HD. If you're seeing it in a lower resolution, it's probably due to your Internet connection. For information about why and how this happens, search on "youtube lowers video quality". Thanks for your comment.

[@AugustePlacid]

Spend hours watching your videos. Great instructor!

[@dodonohoe30]

Great videos... do you have any videos on enabling FQDN lookup on ASA policies? Im trying to understand can it be managed via GUI or CLI only?

[@brooklynzoo81]

Fantastic video!! I followed everything step by step with no problems. Thank you!!!!

[@it-expat-china]

Very well made tutorial, thanks very much!

[@soundtraining]

Hi Imran, Thank you for your comment. The username and password statement is not required in a basic setup. Don

[@soundtraining]

Ricardson, I haven't run into that problem, but I'm glad you found a solution. Thanks for posting it.

[@soundtraining]

Hi Tonny, be careful about counterfeit devices when purchasing from auction sites. Software version 7.2(3) is very old. The current version is 9.x. In order to upgrade, you'll need a Cisco SmartNet service contract. A used device purchased from an individual may not be eligible for a contract. A 10-user base license should suffice for most home deployments. Hope that helps.

[@taktik02]

How can you have an ip address for the outside interface at 18:24 if you did a config factory default?

[@soundtraining]

The config factory-default command configures the outside interface to use DHCP for its address.

[@glenntembo2693]

I love this delivery _new subscriber.

[@ImTheMrFoxman]

This is 8 years old, however, my factory default settings did not allow me to access the asdm via https. I, fortunately, have a mentor that was able to go through the arduous process of the command line and setting up config settings that finally allowed me to access the asdm. Even with them, there was a process of trial and error to get it to work.

[@lynxlive555]

curious to know when listing asa on a resume how much would be expected for a ccna. basics of setting up all features including vpn,nat,dmz,bpdu guard and static routes? Or does the asa go in depth like routers dealing with distribution networks, or has configurations for bgp since it sits at the edge of a network?

[@michalbarinka9218]

Can you advice where to position this firewwall 5505, before or after the ISP Router? we have just small office with approximately 5 pc + some small devices. Thank you

[@tedbanana92]

Hello Mr. Crawley, thanks for this excellent tutorial. Is it possible to have a layer 3 switch behind the ASA 5505 with base license? I have a C3750 L3 switch with couple of vlans and I wanted it to be somehow connected to the ASA. Perhaps have the L3 switch handle the routing and just set a static route to the ASA. It's quite different configuring the ASA 5505 compared to a higher model because you cannot set an IP address to it's interface. How would I go about configuring the switch and the ASA?

[@Riya4s]

Thank you so much for your sharing ur knowledge and time

[@sazger]

Is there any way to obtain the ASDM software? I am unable to download on the Cisco website

[@LK-pc4sq]

Don do you offer these classes in the evening? Will you expand these service into south king county?

[@seattlejayde]

This was absolutely awesome! Liked/Subscribed. Thank you, Thank you, Thank you!

[@lukasibanda6730]

Great video. Thumbs up 👍👍👍👍

[@NeworldDesigns]

Hello Mr. Crawley, I've followed Your video for the factory comfiguration and I'm having problems connecting to my ASA trough https. The basic configurations are just like the ones on your video. I've updated IE and Java but cannot see the https page to start ASDM. Do You have any ideas on how to fix this problem? Thank You!!!

[@screwball055]

Raffaele Colleo I am having the same issue and still cant access ASDM via browser. Did you ever find a solution?

[@sword540]

thank you for this efforts but can i ask you an advice if i don't have ASA and i want to have simulator to practice or virtual appliance or any tools that i can use to play with ASA if youhave any idea please let me know . thanks again

[@rendog311rendog2]

You can use the simulator from cisco called Cisco Packet Tracer, in the new version a ASA is included

[@efreneo]

Hi thank you for your video, Im my job they are asking me to upgrade from asa 5510 to asa 5512-x could you tell me some advices on how to accomplish this, since I have no experience with cisco routers. What I was planning to do is to make a copy of the configuration the old firewall has and send it to the new firewall, I could take the copy of the configuration the same way as a router? with a hyperterminal and a ftp server so I can save it and then pass it to the new firewall? Thanks in advance.

[@tonnyhermoyo513]

Oo..may (is in expression). Thanks goodness you told me ahead of time b4 trouble begin...do you have any info of how to buy an adequate device Don? And how do I get SmartNet service contract from Cisco? Any suggestion would have really appreciated. Thanks.

[@staceymarcus9647]

Would be nice to show the initial connection to the computer, how you get to the config screen.

[@soundtraining]

Go to the Cisco website and search on the term "SMARTnet Services". They've got a lot of information about it there. Alternatively, you can ask your Cisco reseller about it. If they're a Cisco-authorized reseller, they can sell you the service. It's not very expensive for a 5505 and well worth it. Good luck!

[@CasiodorusRex]

Do I need to be disconnected from WIFI when trying to connect to the ASDM and also do I need to modify the network adapter ip address?

[@binhduh]

great stuff, very concise and immensely helpful! Thanks!

[@soundtraining]

It's available through Amazon and other online resellers.

[@Cloud816]

Great video thank you for doing this!

[@HuGeek]

You are my hero Dude! good toturial :)

[@shazzeyschannel1953]

Great video, Don. Is the use of ASA as an internal firewall a valid config? No NAT or security levels. The default config being that nothing gets through - like other firewalls (Check Point, for example).

[@DonCrawleyAuthorSpeaker]

That's kind of a hard question to answer. If you run the command "config factory-default" on an ASA, it configures security levels and NAT (PAT). So, I guess the answer to your question is "It depends." It depends on what your objective is with the firewall. Sorry I can't provide a better answer, but that's an honest answer.

[@onefishwonder3366]

What is the CLI command for a DHCP outside route? My ASA was set up for a static outside route and now I want to change it back to DHCP. Thank you

[@xforney]

I have a asa5505 and also windows 10 and 11. The ASDM will not install on either. Is there a way I can install the ASDM software that I may follow your video?

[@soundtraining]

Oh, also, version 9 requires 256MB flash, so you would have to upgrade that, as well.

[@balashazar]

Very informative and you present the information well. Thank you.

[@jasonsarrio6019]

I have a question I just got a ASA5510 I did everything in this video i have an issue with trying to connect with the gui I try conecting the ASA to my router to link 0 an my computer to link 1 an still not able to access it am i doing it wrong or have it connected wrong ?

[@jameschowen9761]

Hi Don, are you able to use ASA 5505 with a dyanmic IP supplied by an ISP or does it need a static IP? Thanks

[@soundtraining]

James Chowen Hi James, my apologies for the delayed response to your message. Just now saw it. Yes, you can use the ASA with a dynamically assigned address. On the outside interface, use the command "ip add dhcp setroute". Thanks for your question.

[@johnmmmm431]

soundtraining, question if my network is on a 10.1.x.x should my inside interface match my 10.1.x.x

[@aaronschmidt4941]

Are there any videos that you have that don't use asdm? I'm trying to learn how to Cisco and I prefer to not at all ever use the asdm.

[@soundtraining]

Aaron, yes, I have lots of videos based on the command line. I haven't actually counted which of my videos are based on the GUI compared to the command line, but I suspect that more use the command line than ASDM. I make the decision about which to use based on which helps me get the job done faster. Like you, I tend to prefer the command line, but have no problem using the GUI if it makes things simpler.

[@BillyBufter]

Hi, I have a question re: firewalls. For Cisco firewall, is this an actual device or is it both where you can configure layer 3 routers as a firewall? Is there training for this within the ccna, ccnp for routing & switch? Thanks

[@gauravdeepsingh507]

Hi Billy, the answer to your question is ZBF (Zone Based Firewall), its a technology where you configure L3 routers as a Firewall. But Cisco Firewall should be specifically used as the major Firewall device.

[@mohammedzldjali6015]

Dear Thanks for you video. From where can I get all your videos. Could you please guide me!!!!

[@tonnyhermoyo513]

Hi Dan, I want to make sure b4 I purchase ASA5505. Can you recommend for me that need it for my own home lab? I found at eBay version 7.2(3) Device Manager ver 5.2(3). The device got 256MB/128MB flash and up to 10 users license. Is this ok? Can I upgrade this device to ver. 9.0, ASDM ver. 7.0? If I can get the right stuff I also interested in buying your ASA Security book at Amazon. But first please advise me do the right thing Don. Thanks a lot for your time.

[@FireLite1001]

Hello. After watching your video and performing the basic steps, I wasn't able to access the Internet. Do I need to add/modify any NAT or Access Rules?

[@FireLite1001]

***** Thanks Don for your quick response. One ASA that I setup using the ASDM Setup Wizard gave me a bad mask error. The ISP provided a static IP on a /30 network. Since it wouldn't accept 255.255.255.252, I tried 255.255.255.248 and it worked. However, I assume this isn't going to work since the outside interface doesn't have the correct netmask. Could this be a bug with the version of the ASDM I'm using? Could I change this via the CLI? I appreciate your time.

[@revadan]

Don, quick question. I want to use ASA 5520 for home use. Do i really need a license for the firewall to work or i can use it without a Lic? i want to use it as a stand alone for my home network rather than using a consumer grade one. Currently am using a Pfsense and wanted to switch to cisco.

[@revadan]

oh. am about to use ASA though .. i want to try it. BUT currently am using the latest Pfsense Firewall with faster PC. works pretty good for decades..

[@lorico1849]

I'd love to ask a question, feeling a little/lot sheepish. Got a 5520 off ebay, management address 192.168.0.215. The video shows an ethernet to the ASA and a console to the computer. I set up the address on the PC to 192.168.0.2/24 , and I can ping the ASA; however cannot access via IE. Do I need a real internet connection for the browser to work? Trying to study for the CCNA Security exam. Thanks. PS, thank you for creating the videos. I am just a few miles away from Seattle.

[@aquadir2830]

You're great sir..excellent your description.

[@jbham]

why would they put in ports for future use? I'd think they'd have at least one USB port dedicated for rescue configuration scenarios. Also, why would Cisco use security levels instead of security zones?

[@twosnjuk]

Really nice. I like the details and the hands ON type of training.

[@bskwaj]

Don, you have a great voice for training. :-) I have a default gateway question. I'm building a home lab network with 2 domain controllers and a dhcp server. I want to connect this all to the internet through my ASA 5505. Following your video and using the PAT configuration you described, would the outside interfce of the ASA 5505 become the default gateway for all servers and hosts in the network? Do I need to put a router between the ASA 5505 and the ISP connection? Is the ASA 5505 basically acting as a router in this case? What other default gateway advice can you reveal when using the ASA 5505? Thanks, bennie

[@soundtraining]

Bennie, the default gateway is the interface through which a device connects to the rest of the world. It must be an interface on a network already known to the device. In your scenario, the default gateway for the servers and hosts in your network will be the inside interface of your 5505. No, it's not necessary to put a router between the ASA and the ISP. Yes, the ASA is acting as a router. Other advice? Well, you normally configure only one default gateway on each device. Since you're using a DHCP server, just configure it to hand out the ASA's inside interface IP address as the default gateway and you should be set. I just wrote a blog post which might be helpful for you. It's at blog.soundtraining.net/2014/02/what-is-default-gateway.html Good luck!

[@bskwaj]

soundtraining.net Oh, I knew that... the Inside interface will be the default gateway, not the outside. D'oh... And, right, I will have the DHCP server hand out that IP. Thanks for the clarification that the ASA will be acting as a router there. And thanks for the quick reply. I'll check out your blog. Have a great day. Oh, and I bought your book sometime ago and, since I've discovered your videos, I'll start actually reading it! ;-)

[@arunkumar-ko4ho]

excellent video and easily understand

[@jcostait]

Thanks for your to the point presentation. JC

[@AlainaD2003]

love the get over it comment. made my night.

[@FerretWithChainsaw]

I am trying to access the ASDM through IE, but come up with "Turn on SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2 in advanced settings". I have made sure that those are enabled, but still no luck.

[@CiZiK22]

Really nice video, thanks for the explanations! Greetings from Paris.

[@mangeshsalunkhejaijaijagan9073]

Nice, video.. where I will see advance and latest video for Cisco ASA firewall

[@IndyAustin]

Solid. Thank you, Don.

[@sunlec]

Very informative! Well done. Thank you for your contribution.

[@ahmedlatif187]

Thank You Don R.. Crawley for get the job

[@shorttreederek]

Hello. I am a newbie to Cisco ASA (ver8.4). The video is great but it seems I cannot enter the ASDM server with the default ip address. Would it be the matter of my default gateway 192.168.1.254 255.255.255.0?

[@dbiswas123]

Awesome training! Thanks a lot.

[@MuhammadKhan-yl7mt]

Nicely explained on all levels.

[@joshjwolff]

I setup a Cisco ASA, and now running a vulnerability scan on my network I'm getting an error of "SSL Certificate Weak Public Key Strength - TCP:443 - (1024)" with the IP of the ASA 10.1.10.1; I don't have an SSL VPN setup on this ASA, do you know how I can resolve this error in my vulnerability scan?

[@JohnJLillie]

What is the best SOHO ASA that uses IPv6?

[@CasiodorusRex]

Can't you load a backup from the usb drive?

[@masterkungfu09]

No internet after applied the "config factory-default". I plugged the cable from the modem to the asa5505 and connected a cable to the wifi. Any suggestion? Needed to see step by step installation guide. Tx

[@masterkungfu09]

when i applied the factory-default things seemed to look fine but when i connected the cable from the modem to the asa5505 and from the asa5505 to the wifi. i have not internet connection when doing that. i also have no public ip address assigned by the dhcp. i was wonder if that something wrong with installation setup?

[@soundtraining]

T Yang Sorry I didn't think of this earlier, but sometimes you have to power cycle the cable modem when you switch firewalls. I'm sure you've probably gotten your system working by now, so this comment is for anyone else who's having a similar problem.

[@Vjoshu87]

Hello, Mr. Crawley, I am familiar with Cisco and I'm more pro on Windows. I want to migrate to network (Cisco) side from system (Windows) side and I need your suggestions about what all should be the mandatory knowledge or skills I should brush up for a Network Admin job. I'm trying to polish my resume with cisco now. I am CCNA and preparing for CCSP. Thank you for the tutorial and wish you " Happy Holidays ".

[@securemaple]

Wonder what's the difference between Cisco asa 5505 v05 and v11? Need to look up but if anyone hand handy answer. Thanks

[@wahidny]

Anything for SNMP? Great job on the videos:)

[@chicobiabia]

Commands start after disclaimer @10:55

[@chicobiabia]

@11:37

[@denniszarda3852]

I am getting "this page cant be displayed" from the IE browser probably because my WiFi default gateway is 192.168.1.1 /24 and my IP is 192.168.1.101. Tried changing some of the ASA config but not luck. Suggest ? Thx mucho. (running 8.2 on ASA)

[@soundtraining]

A couple things: Yes, the 192.168.1.1 address will conflict with the ASA's default inside address. I would suggest disconnecting from the wifi network while you're learning how to configure the ASA. Remember, to use HTTPS when connecting to the ASDM. Also, the video is based on software version 9.0. The steps in the video will not work with version 8.2 and earlier. I recommend you search on Cisco ASA 8.2 initial config and look for a Cisco config guide.

[@afolabisamuel7228]

Nice way to start, Thanks

[@soundtraining]

Thanks. I'm glad you liked it.

[@meischoice]

I'm going to buy the updated version of this book

[@farouk6564]

excellent tutorial! Thank you for sharing.

[@soundtraining]

Farouk, I'm glad you like it. Thanks for your comment.

[@FazeFalcon]

NOTE: Console cables are available that connect direct to a USB port, but show up as a Serial/COM port. I bought this one from Amazon: www.amazon.com/gp/product/B00RY3ELKG Also, I deliberately chose a long one, 12 ft (approx 3.7 m). I believe that I saw shorter ones, too.

[@soundtraining]

Rob, thanks for the link. I was not aware of those cables. I'm sure this information will be very helpful for many people.

[@dbiswas123]

It's very helpful indeed. Thanks Rob & Don. Just ordered one.

[@lahtoilayang2713]

Sir, i would like ask something. i am just new learner. i see a lot you post but i dont know which one i have to study first. Honestly say, i would like to study step by step basic configuration and explanation. So, which topic will you recommand me to study first from your post. could give me link. THank .

[@soundtraining]

+La Htoi It's hard to answer your question, because I don't know how much (or little) you already know. Having said that, if you are brand new to networking, you should start by understanding the OSI reference model, basics of cabled and wireless networks, and different types of network devices. Then, work on understanding IPv4 and IPv6. Maybe other people have ideas, too. Good luck.

[@lahtoilayang2713]

+soundtraining.net Sir, my name is Paul and I really appreciate for your reply. I have finished CCNA routing and switching and studying CCNP routing, switching and Tshoot in Myanmar. But I am just a new student for your training. Since there are a lot , am a bit confuse. So I need your guide line sir.

[@murphybrown32216]

will asa5520 work with 4 1 gig sticks of ram

[@4runnerdiego]

Excellent Presentation

[@nsah44]

How did you access the router ?????????

[@Eagle-pe9pg]

awesome video thank you

[@k84802]

I got stuck, my command is on romon #0> right now and its not allow me to go to privileged mode.

[@ricardsonwilliams]

I just received mine today, and the default configuration I should able to access, but I cannot access from windows 8/Mac OS X the 192.168.1.1/admin, after look about this issue I found a thread in cisco forum about this problem, I have to request a "free" license after apply the license I had to run the below command after add the license. conf t ssl encryption aes256-sha1 aes128-sha1 3des-sha1 des-sha1 exit

[@chrixtopher101]

How did you get to know the default IP address of the Cisco firewall?

[@brandonclarkwilson]

Connect to the console using PUTTY and run "show int ip brief". That will display all of the IP addresses that are assigned to the ASA's interfaces and VLANs. With an ASA5505 that has been set to factory default configuration the IP address of the "inside" interface will be 192.168.1.1

[@younes370]

Thank you for this video !!!

[@NickTheBiz]

Don, I've got about 16/17 minutes in, but when I accept the security issue in the browser (192.168.1.1) I get a 404 error. The requested URL /admin/public/index.html was not found. Can you advise please? (It's an ASA 5505 too)

[@soundtraining]

Nick Higgs Hi Nick, check the usual stuff such as IP addresses on both the computer and the firewall, check to ensure that the firewall is set to accept connections from that particular IP subnet (look for the command "http 192.168.1.0 255.255.255.0 inside").

[@NickTheBiz]

soundtraining.net Thanks Don. Cracked it I think (although obviously I'm new to this). I've taken the word public out of the URL and I can get to it now with a blank username and password. Version 5.2 running of ASDM.

[@emmanueloluwayemisi]

Please i kindly need help for ISE iso image to build my CCNP Security Study lab. thank you in advance.

[@auroremelie]

Is it normal that I don't have access to the Internet once I connected my computer to the Cisco?

[@soundtraining]

It depends. You said your computer is connected to the Cisco. Cisco makes security appliances, routers, switches, and many other devices. Which device are you connected to? The next question is how is the device configured? If you can provide more information, I can give you some troubleshooting steps.

[@auroremelie]

It's the one that I use to setup the Cisco, the one that you're a using in your video.

[@soundtraining]

If you followed the steps in the video, then yes, you should be able to connect to the Internet.

[@auroremelie]

Ok great! Thanks a lot