Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

ASA5505 config

What do the following line mean in the ASA5505 config?

http server enable

http 172.16.1.0 255.255.255.0 inside

dhcpd auto_config outside

!

dhcpd address 172.16.1.10-172.16.1.60 inside

dhcpd enable inside

!

Thanks.

Said

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Blue

Re: ASA5505 config

Said

http server enable

http 172.16.1.0 255.255.255.0 inside

These 2 lines set up ADSM access (ADSM is a GUI interface for configuring the ASA) and allow access to the ASA device with ADSM from clients with an IP address from the 172.16.1.0/24 network.

dhcpd auto_config outside

tells the ASA to obtain an IP address for it's outside interface via DHCP.

dhcpd address 172.16.1.10-172.16.1.60 inside

dhcpd enable inside

These 2 lines setup the ASA device as a DHCP server to clients on the inside of the ASA and the ASA will hand out addresses from 172.16.1.10 -> 172.16.1.60.

Jon

3 REPLIES
New Member

Re: ASA5505 config

http server enable = enables http traffic to ASA (for ASDM access)

http 172.16.1.0 255.255.255.0 inside = what subnet is allowed on what interface to access the http server

dhcpd auto_config outside = automatically assign the DNS server, in your dhcpd scope, to use as specified via ISP DHCP server

dhcpd address 172.16.1.10-.... = dhcpd scope and interface it is running on

dhcpd enable inside = enable dhpcd server for inside interface

Hall of Fame Super Blue

Re: ASA5505 config

Said

http server enable

http 172.16.1.0 255.255.255.0 inside

These 2 lines set up ADSM access (ADSM is a GUI interface for configuring the ASA) and allow access to the ASA device with ADSM from clients with an IP address from the 172.16.1.0/24 network.

dhcpd auto_config outside

tells the ASA to obtain an IP address for it's outside interface via DHCP.

dhcpd address 172.16.1.10-172.16.1.60 inside

dhcpd enable inside

These 2 lines setup the ASA device as a DHCP server to clients on the inside of the ASA and the ASA will hand out addresses from 172.16.1.10 -> 172.16.1.60.

Jon

New Member

Re: ASA5505 config

Jon,

Thanks. So for security, since the outside interface of the ASA has a public IP, is "no dhcpd auto_config outside" required?

Could you take a look at the following config and suggest changes, before connecting the firewall to the internet router.

sh run

Saved

ASA Version 7.2(2)

hostname Rio

enable password xxx

names

interface Vlan1

nameif inside

security-level 100

ip address 172.16.1.1 255.255.255.0

interface Vlan2

nameif outside

security-level 0

ip address 1xx.xx.xx 255.255.255.240 interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2 interface Ethernet0/3

interface Ethernet0/4

interface Ethernet0/5

interface Ethernet0/6 interface Ethernet0/7

passwd 2h/ZvQ5.2iT8mvSq encrypted

ftp mode passive

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-522.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

global (outside) 1 xx.xx.209.xx

nat (inside) 1 172.16.1.0 255.255.255.0

nat (inside) 1 0.0.0.0 0.0.0.0 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout uauth 0:05:00 absolute http server enable http 172.16.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart telnet timeout 5 ssh timeout 5 console timeout 0 dhcpd auto_config outside dhcpd address 172.16.1.10-172.16.1.60 inside

dhcpd enable inside

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

322
Views
5
Helpful
3
Replies
CreatePlease to create content