WCCP configuration on Cisco ASA

access-list wccp-traffic extended permit ip 192.168.1.0 255.255.255.0 any
!
access-list wccp-destination extended permit ip host 192.168.1.10 any
!
wccp web-cache redirect-list wccp-traffic group-list wccp-servers
wccp interface inside web-cache redirect in

ASA upgrade notes to 8.3

Main differences
Firstly you need to make sure the minimum memory requirements are met for the upgrade
That info can be found over here
Take note of the NATTing changes over here
Access list are now applied to the real address not to the natted address
access-list outside extended permit tcp any host 172.16.1.1
access-group outside in interface outside

Cisco ASA traffic shaping and QoS

priority-queue outside

class-map Shaping-voice-class
match tunnel-group tunnel-grp1
match dscp ef

policy-map priority-policy
class Shaping-voice-class
priority

policy-map shape-priority-policy
class class-default
shape average 800000
service-policy priority-policy

service-policy shape-priority-policy interface outside

Cisco ASA policy Based routing alternative

This feature is not yet available on the Cisco ASA however there are a few tricks of the trade that can be used to achieve the same effect. The below example can be used to send traffic for web over the one link and smtp mail traffic over the other isp link

route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
route outside1 0.0.0.0 0.0.0.0 193.168.1.1 2

nat (inside) 1 0 0
global (outside) 1 interface
global (outside1) 1 interface

static (outside,inside) tcp 0.0.0.0 www 0.0.0.0 www netmask 0.0.0.0
static (outside1,inside) tcp 0.0.0.0 smtp 0.0.0.0 smtp netmask 0.0.0.0

Cisco ASA Etherchanneling

Fast EtherChannel allows multiple physical Fast Ethernet links to combine into one logical channel. This allows load sharing of traffic among the links in the channel as well as redundancy in the event that one or more links in the channel fail. Fast EtherChannel can be used to interconnect LAN switches, routers,and as of February 2011 Cisco ASA via UTP wiring or single-mode and multimode fiber optic links. Cisco release notes notify us of the new commands added on that feature
Namely channel-group, lacp port-priority,interface port-channel, lacp max-bundle, port-channel min-bundle, port-channel load-balance, lacp system-priority, clear lacp counters, show lacp,show port-channel.
This brings the Cisco ASA into a world of unparalleled speeds and performance throughputs rarely seen by another vendor

That configuration is only available as of version 8.4 and the configuration guide can be found over here

Redundant interfaces

What are Cisco ASA redundant interfaces?
Interfaces provide physical link failure combining two physical interfaces on the ASA into a virtual one, then you configure all the Layer 3 parameters on this virtual interface. At the same time only ONE of the interfaces in a group is active, if it fails ASA transparently switches to the next available interface in a group and all traffic passes through it.

Small diagram providing a traffic flow explanation

Adding a Redundant Interface

interface Redundacy
member-interface Ethernet0/1
member-interface Ethernet0/4
no nameif
no security-level
no ip address

LDAP authentication for VPN clients on Cisco ASA

Configure the Ldap server as shown below

aaa-server ldap_1 protocol ldap
hostname(config-aaa-server-group)#aaa-server ldap_1 host 10.1.1.4
hostname(config-aaa-server-host)#server-type sun

you may need to configure authorization for VPN the access. When the LDAP authentication for VPN access has succeeded, the security appliance queries the LDAP server, which returns LDAP attributes. These attributes generally include authorization data that applies to the VPN session.

tunnel-group remote-1 type ipsec-ra
tunnel-group remote-1 general-attributes
authorization-server-group ldap_1

Table of Contents

WCCP configuration on Cisco ASA

ASA upgrade notes to 8.3

Cisco ASA traffic shaping and QoS

Cisco ASA policy Based routing alternative

Cisco ASA Etherchanneling

Redundant interfaces

LDAP authentication for VPN clients on Cisco ASA

Configuring Netflow on cisco ASA

Shunning ip addresses on Cisco ASA

Credits

Recommended Reading