Cisco ASA 5512-X Cli Configuration Guide

1-22
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring the ASA CX Module
Configuration Examples for the ASA CX Module
Example 1-1 Make sure port 2000 is used consistently:
1.
Check the authentication proxy port:
hostname# show running-config cxsc
cxsc auth-proxy port 2000
2. Check the authentication proxy rules:
hostname# show asp table classify domain cxsc-auth-proxy
Input Table
in id=0x7ffed86cc470, priority=121, domain=cxsc-auth-proxy, deny=false
hits=0, user_data=0x7ffed86ca220, cs_id=0x0, flags=0x0, protocol=6
src ip/id=0.0.0.0, mask=0.0.0.0, port=0
dst ip/id=192.168.0.100, mask=255.255.255.255, port=2000, dscp=0x0
input_ifc=inside, output_ifc=identity
3. In the packet captures, the redirect request should be going to destination port 2000.
Configuration Examples for the ASA CX Module
The following example diverts all HTTP traffic to the ASA CX module, and blocks all HTTP traffic if
the ASA CX module card fails for any reason:
hostname(config)# access-list ASACX permit tcp any any eq port 80
hostname(config)# class-map my-cx-class
hostname(config-cmap)# match access-list ASACX
hostname(config-cmap)# policy-map my-cx-policy
hostname(config-pmap)# class my-cx-class
hostname(config-pmap-c)# cxsc fail-close auth-proxy
hostname(config-pmap-c)# service-policy my-cx-policy global
The following example diverts all IP traffic destined for the 10.1.1.0 network and the 10.2.1.0 network
to the ASA CX module, and allows all traffic through if the ASA CX module fails for any reason.
hostname(config)# access-list my-cx-acl permit ip any 10.1.1.0 255.255.255.0
hostname(config)# access-list my-cx-acl2 permit ip any 10.2.1.0 255.255.255.0
hostname(config)# class-map my-cx-class
hostname(config-cmap)# match access-list my-cx-acl
hostname(config)# class-map my-cx-class2
hostname(config-cmap)# match access-list my-cx-acl2
hostname(config-cmap)# policy-map my-cx-policy
hostname(config-pmap)# class my-cx-class
hostname(config-pmap-c)# cxsc fail-open auth-proxy
hostname(config-pmap)# class my-cx-class2
hostname(config-pmap-c)# cxsc fail-open auth-proxy
hostname(config-pmap-c)# service-policy my-cx-policy interface outside

Cisco ASA 5512-X Specifications

General

Firewall Throughput	1.2 Gbps
VPN Throughput	200 Mbps
Maximum VPN Peers	250
Integrated IPS	Yes
IPS Throughput	250 Mbps
RAM	4 GB
Power Supply	AC, 100-240V
Security Contexts	2 (Standard), 50 (with Security Contexts license)
Interfaces	6 x Gigabit Ethernet
Dimensions (H x W x D)	1.75 x 17.5 x 14.5 inches
Weight	16 lbs