Cisco ASA CLI Basics: Modes, Interfaces, ACLs and NAT

The Cisco ASA (Secure Firewall ASA) command line looks like IOS but behaves differently in the areas that matter for firewalls: interfaces get names and security levels, traffic is filtered by access-groups attached to interface pairs, and NAT is built from objects. This guide covers the CLI modes and the minimal configuration needed to take a new ASA from console login to a working routed firewall with SSH management access.

Command Modes

The ASA has the same three-level mode structure as IOS, with prompts that reflect the hostname:

ciscoasa>            ! user EXEC
ciscoasa> enable
ciscoasa#            ! privileged EXEC
ciscoasa# configure terminal
ciscoasa(config)#    ! global configuration

From global configuration, interface, object and other commands open command-specific submodes. Commands can be abbreviated to the shortest unique form, and output can be filtered like IOS: show run | include nameif, show xlate | grep -c.

Basic Interface Configuration

Routed-mode interfaces need a name, a security level, an IP address and no shutdown. The name is what every later command references:

ciscoasa(config)# interface gigabitethernet0/0
ciscoasa(config-if)# nameif outside
ciscoasa(config-if)# security-level 0
ciscoasa(config-if)# ip address 203.0.113.1 255.255.255.0
ciscoasa(config-if)# no shutdown
ciscoasa(config-if)# exit
ciscoasa(config)# interface gigabitethernet0/1
ciscoasa(config-if)# nameif inside
ciscoasa(config-if)# security-level 100
ciscoasa(config-if)# ip address 192.168.1.1 255.255.255.0
ciscoasa(config-if)# no shutdown

Security levels default the policy: traffic from a higher level (inside, 100) to a lower level (outside, 0) is allowed unless an ACL denies it, while lower-to-higher traffic needs an explicit permit.

Routes, ACLs and NAT

ciscoasa(config)# route outside 0.0.0.0 0.0.0.0 203.0.113.254
ciscoasa(config)# object network INSIDE-NET
ciscoasa(config-network-object)# subnet 192.168.1.0 255.255.255.0
ciscoasa(config-network-object)# nat (inside,outside) dynamic interface
ciscoasa(config-network-object)# exit
ciscoasa(config)# access-list OUTSIDE-IN extended permit tcp any interface outside eq https
ciscoasa(config)# access-group OUTSIDE-IN in interface outside

The default route points at the ISP gateway; the network object hides the inside subnet behind the outside interface IP (PAT); and the access-group permits inbound HTTPS to the firewall itself. Modern ASA versions default to object NAT, which is why the object carries the nat statement.

Management Access: SSH

ciscoasa(config)# crypto key generate rsa modulus 2048
ciscoasa(config)# ssh 192.168.1.0 255.255.255.0 inside
ciscoasa(config)# ssh timeout 5
ciscoasa(config)# ssh version 2
ciscoasa(config)# username admin password MyPass123 privilege 15
ciscoasa(config)# aaa authentication ssh console LOCAL
ciscoasa(config)# write memory

write memory saves the running config to the startup configuration; the ASA keeps its configuration as a text file, and show running-config is the authoritative view. For a different security platform with the same zone model, compare with our Juniper SRX internet configuration guide, and see the FortiGate CLI troubleshooting cheatsheet for yet another syntax family.

原文链接：https://www.cisco.com/c/en/us/td/docs/security/asa/asa922/configuration/general/asa-922-general-config/intro-start.html