| KB | 0000173 | |
| Dated | 26/01/10 | |
| Revision | 0.01 | |
Cisco ASA - Allow Remote Management |
||
Also See "Connecting to and Manageing Cisco Firewalls" |
||
| Problem | ||
Quite a while ago I wrote the "Connecting to and managing Cisco firewalls" article, which is still pretty complete, but I've been asked on a few occasions, "How do I actually configure the firewall to allow remote administration via Telnet, SSH, or HTTPS/ASDM? If you have no connection to the firewall, then you need to connect via console cable (CLICK HERE). |
||
| Solution | ||
Allow Telnet - Via Command Line |
||
| 1. Log on to the firewall > Go to enable mode > Go to configure terminal mode. | ||
User Access Verification Password: |
||
| 2. Now you can either allow access for one machine, or a whole network, the syntax is "telnet {ip address} {subnet mask} {interface that its connected to}. | ||
The following will just allow one host (192.168.1.10). PetesASA(config)# The following will just allow a whole network 192.168.1.1 to 254 PetesASA(config)# |
||
| 3. To set the password you use the "passwd" command (yes that's spelled correctly). | ||
| PetesASA(config)# PetesASA(config)#passwd PASSWORD123 PetesASA(config)# |
||
| 4. By default the telnet session times out after 5 mins, I prefer to change this to 45 minutes. | ||
| PetesASA(config)# PetesASA(config)#telnet timeout45 PetesASA(config)# |
||
| 5. Lastly, save the changes with a "write mem" command. | ||
PetesASA# write mem 7424 bytes copied in 1.710 secs (7424 bytes/sec) |
||
Allow Telnet - Via ASDM version v8.2(1) |
||
| 1. Connect via ASDM > Navigate to Configuration > Device Management > Management Access > ASDM/HTTPS/Telnet/SSH > Add > Select Telnet > Supply the IP and subnet > OK. (Note you can set the timeout on this page also). | ||
 |
||
Allow SSH - Via Command Line |
||
| 1. Log on to the firewall > Go to enable mode > Go to configure terminal mode. | ||
User Access Verification Password: |
||
| 2. Now you can either allow access for one machine, or a whole network, the syntax is "ssh {ip address} {subnet mask} {interface that its connected to}. | ||
The following will just allow one external host (123.123.123.123). PetesASA(config)# The following will just allow a whole internal network 192.168.1.1 to 254 PetesASA(config)# |
||
| 3. To set the password you use the "passwd" command (yes that's spelled correctly). | ||
| PetesASA(config)# PetesASA(config)#passwd PASSWORD123 PetesASA(config)# |
||
| 4. By default the SSH session times out after 5 mins, I prefer to change this to 45 minutes. | ||
| PetesASA(config)# PetesASA(config)#ssh timeout45 PetesASA(config)# |
||
| 5. To encrypt the SSH access you need to have a certificate on the firewall, (Note: this certificate is made from the firewall's host name and its domain, if you ever change either, the certificate will break, and SSH access will cease untill the certificate is re-created). To create a key issue a "crypto key generate rsa" command. | ||
| PetesASA(config)# crypto key generate rsa INFO: The name for the keys will be: <Default-RSA-Key> Keypair generation process begin. Please wait... PetesASA(config)# |
||
| 6. Lastly, save the changes with a "write mem" command. | ||
PetesASA# write mem 7424 bytes copied in 1.710 secs (7424 bytes/sec) |
||
Allow SSH - Via ASDM version v8.2(1) |
||
| 1. Connect via ASDM > Navigate to Configuration > Device Management > Management Access > ASDM/HTTPS/Telnet/SSH > Add > Select SSH > Supply the IP and subnet > OK. (Note you can set both the timeout, and the SSH versions you will accept, on this page also). Note you still need to generate the RSA Key (See step 5 above, good luck finding that in the ASDM - drop to command line and do it). | ||
 |
||
Allow HTTPS/ASDM - Via Command Line |
||
| 1. Log on to the firewall > Go to enable mode > Go to configure terminal mode. | ||
User Access Verification Password: |
||
| 2. Now you can either allow access for one machine or a whole network, the syntax is "http {ip address} {subnet mask} {interface that it's connected to}. | ||
The following will just allow one host (192.168.1.10). PetesASA(config)# The following will just allow a whole network 192.168.1.1 to 254 PetesASA(config)# |
||
| 3. Unlike telnet and ssh, HTTPS/ADSM access is via the firewalls enable password (Unless you have enabled AAA logon). this password is set with the "enable password {password}" command. (Note: You will already have entered this password in step 1, only do this if you wish to change it). | ||
| PetesASA(config)# PetesASA(config)#enable password PASSWORD123 PetesASA(config)# |
||
4. You need to make sure that HTTPS access is enabled with a "http server enable" command. |
||
PetesASA(config)# Note: if your port forwarding https on your firewall you will NOT be able to get access externally unless you put it on a different port (i.e.1234). PetesASA(config)# |
||
| 5. Lastly, save the changes with a "write mem" command. | ||
PetesASA# write mem 7424 bytes copied in 1.710 secs (7424 bytes/sec) |
||
Allow HTTPS/ASDM - Via ASDM version v8.2(1) |
||
| OK, the title of this might raise an eyebrow, but if you have access to the ASDM and you want to grant access to another IP/Network them you might want to do this. Connect via ASDM > Navigate to Configuration > Device Management > Management Access > ASDM/HTTPS/Telnet/SSH > Add > Select ASDM/HTTPS > Supply the IP and subnet > OK. (Note: You can also enable and disable the http Server here and change its port number). | ||
 |
||
| References - Credits - Or External Links | ||
| KB0000075 | ||
PeteNetLive ©2010
