>>> First thing, typing ? at any point will list all the available commands
>>> at that point.
>>
>> So... it's some kind of hierarchical menu system? (I had assumed that
>> all commands are available all the time.)
>
> Yes and no.
>
> there are multiple modes. Normal display mode, "enable" mode, where you
> can make some changes such as clear counters, logs or set certain
> parameters, and "Configure" mode where you make ... configuration changes.
>
> The available commands vary for each mode, however what I meant whas that
>
> ? by itself will list all the commands you can type, while
>
> show ?
>
> will list all the stuff the show command can display, and
>
> show interface ?
>
> will list all the types of interfaces that can be displayed
>
> etc...

Oh, right, I see. Well that seems logical enough...

>> I'm guessing that unless you do this kind of thing all day, you'll
>> quickly forget what the name for each command is, and so you'll need the
>> manual open constantly. (I really hope the manuals contain more than
>> just a reference list of every command name and what it does...)
>
> Configuration guides, command references, hardware installation
> checklists, etc... they're all in there.

That's very reassuring.

>>> Routing for the multiple lans actually comes straigh out of the box. You
>>> confiugre an ip address on all the interfaces and it will know that any
>>> packets it receives whose destination is on another lan interface, it
>>> will forward it (let's disregard security rules, for the moment!).
>>
>> Even though there's only one connection from the firewall to the
>> (multiple) switches?
>
> Then, there are mulitple "VLAN" interfaces created, so the above still
> stands.

I see. (I think...)

>>> On Windows, you'd type:
>>>
>>> route add 192.168.200.0 mask 255.255.255.0 192.168.1.1
>>
>> 1. I didn't know you could do that.
>> 2. What does it do?
>>
>
> It tells your PC that there's a network called 192.168.200.0 somewhere
> voer there, and that to get ot it, you must forward the packets to
> 192.168.1.1 and he'll take care of them.

Interesting. I didn't know Windows was actually capable of doing that. 
Usually when I need a router in a hurry, I load up Linux and read some 
manpages...

Hmm, I wonder... If my VPN client doesn't route all the subnets I want, 
can I get it to dump the packets onto the wrong LAN segment, and then 
trust the router at that end to take it to the correct place?

>> Incidentally, I gather that there's two ways to control the ASA. One
>> involves telnet. The other involves a serial cable...
>
> Serial cable is required to give the machine its initial barebones
> config, after that, it's telnet or preferably ssh. Since anyone could
> sniff the telnet password.

It's neat that you can configure it via IP. Then again, if you configure 
the IP stuff wrong, you need to connect somehow so you can reconfigure 
it. :-}

I wonder what authentication options there are for SSH...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message