runk Inside Web layer Outside Trunk Inside Application layer Outside Trunk Inside Database layer Figure 27-5. Ecommerce website Alternate Designs CHAPTER 28 ASA Firewall Configuration In this chapter, I will explain how to configure the most common features of an ASA firewall. Examples will be based on the ASA 5540, which uses the same commands as the entire ASA line. Most commands are the same on the PIX firewalls, but since they are no longer sold-with the exception of the Firewall Service Module (FWSM)-this chapter focuses on ASAs. There are slight differences among models. For example, the ASA 5505 base model cannot be run in failover or multicontext mode. The FWSM also operates differently in that it is a module and has no configurable physical interfaces. ASA stands for Adaptive Security Appliance. This name indicates that these devices are capable of being a firewall, a VPN device, and an IPS/IDS device. In this chapter, I will concentrate on the basics of firewall services. Configuring an ASA can be a bit confusing for people whose experience is with IOS- based devices. While there are similarities in the way the command-line interpreter works, there are some pretty interesting differences, too. One of my favorite features of the ASA and even the PIX firewalls is the fact that you can execute the show running- config command from within configuration mode. Recent versions of IOS allow similar functionality using the do command (do show run, for example) from within configu- ration mode, but using the command in the ASA is, in my opinion, more natural. NX- OS, the operating system for Cisco Nexus switches, implements this feature as well. Around the time the ASAs were released, Cisco revamped the Adaptive Security Device Manager (ASDM) software used to control its PIX firewalls and ASA appliances. For the first time, this software became a viable tool for configuring and managing a Cisco firewall. While many of the examples in this chapter can also be accomplished with the ASDM, I tend to be an old-school 