 skimpydog.com Forum Index Cisco Notes  ASA's basics
|
Browsing this Thread:
1 Anonymous Users
 Bottom  Previous Topic  Next Topic |
|
|
|
|
|
|---|
Topic options
Threaded
Newest First| Poster | Thread | Rated: 2 Votes |
|---|
|
ASA's basics | #1 |
|||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
Webmaster
 
Joined: 2007/6/10
From Dallas, TX
Posts: 79
Level : 7 HP : 0 / 170
Group:
Webmasters Registered Users  |
Cisco ASABy Reading ANY of this, you agree as follows: I will not provide Firmware, or answers to questions - You are on your own!! I will not provide any softwares!! I will not be held responsible for YOU messing up anything!! This is for MY Personal Reference!! - That is all - This is not intended for You!! Note: There are not a lot of links referenced directly to Cisco's site (specific pages) as Cisco changes their site frequently, and links will likely break If you do not have any Cisco experience; (working with Cisco devices from the command line - asdm, and asm don't count) then likely you will not know the actual basics of networking. If this is the situation, read over the materials for the CCNA as working with upstream equipment will be necessary to properly troubleshoot! The CCNA materials cover the basics of working with Cisco Switches, and Routers, and are the groun basis for using Cisco's products. Adaptive Security ApplianceThis article can also apply to PIX, however it will depend on the firmware on the PIX HardwareThe ASA has been created based on x86 hardware, utilizing Intel, and AMD processors, with Intel, and Geode ChipSets. They will generally ship with 256MB-12GB RAM depending on the model. The ASA comes with a USB port for additional Portable Storage for upgrading firmware, or to copy a configuration. SoftwareThe Cisco ASA does not run IOS technically, although it runs similar to IOS. The software run on the ASA will be known as "PIX code", or "ASA code"[3] The Firmware used with the ASA has been specifically written for working deeper with packet inspections, specified flow analysis to improve security, improve scalability, and VPN services. The ASA has the option to use the available ASDM GUI interface which was developed to compete with Cisco's competitors. The ASA is the next generation of three previously developed technologies knows as "PIX", "IPS 4200", & the "VPN 3000 Series Concentrators"[4], and have developed what is known as the "Self Defending Network"[5]. SimulatorsA Simulator may be used to test what the ASA is capable of, however not all simulators have actual usability such as DoS, and DDoS mitigation, or VPN tunnel negotiations: GNS3 - This can be complex to setup for any practical testing, so do beware - OpenSource ProfSIMs - Closed Source Boson NETSIM - Closed Source A few basic commands as this appears to be necessary for the lazy "RTFM" |
||||||||||
Posted on: 2012/1/9 10:59
  |
 |
||||||||||
skimpydog
Visit Website
|
Re: ASA's basics | #2 |
|||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
Webmaster
Joined: 2007/6/10
From Dallas, TX
Posts: 79
Level : 7 HP : 0 / 170
Group:
Webmasters Registered Users |
ASA Firmware ExplainedThe ASA uses proprietary firmware which entails two segments: Firmware - Actually used to run the security appliance - As enhancements are made, the code structure changes ASDM - GUI interface which may be used to configure the security appliance - As enhancements are made, the ASDM becomes more functional Upgrading FirmwareUpgrading the firmware should include the Hardware Firmware, and the ASDM software. The upgrade process may be completed via USB Flash, ASDM, & TFTP. The following steps may be used to upgrade the firmware on an ASA [Example]: "IP_OF_TFTP_Server" is the TFTP server where the firmware resides "boot system disk0:/asa822-k8.bin" this tells the ASA to boot to this image (you may have a backup image as well if necessary) "asdm image disk0:/asdm-625.bin" This tells the ASA which ASDM image to use The Firmware version, and ASDM image correspond with each other It is possible to have a similar minor-release ASDM image per the firmware's requirements The corresponding versions may be found on Cisco's WebSite For the asa7.* firmwares I will advise to use asdm-524.bin For the ASA Firmware <8.3 (8.0-8.2.X) I will advise to research the ASDM image which Cisco states as stable for the Firmware Image used "Generally", the following combinations will be acceptable for 8.0.X-8.2.X and ASDM combination (this may be somewhat inaccurate, however as stated in the previous line do the research directly from Cisco for the most accurate information): asa8.0.2-asa8.0.5 -> asdm-5.12-asdm-5.2.4 asa8.2.1-asa8.2.2 -> asdm-6.0.3-asdm-6.2.1 asa8.3.1 -> 6.3.1 If you do not know what you are doing with the ASA's I will highly advise to NOT use the 8.3.X branch as the syntax for many operations has changed - this is for all versions starting with >8.3.X!! Incremental Upgrade ProcessWhen performing a Firmware UpGrade from the 7.X branch, be sure to perform the upgrade incrementally. The incremental upgrade does not seen to be pushed in steps in the 7.X branch to the 8.X branch as much as moving from 7.X to 8.2 for example should be preformed as follows: 7.X -> 8.0.X 8.0.X -> 8.2.X |
||||||||||
Posted on: 2012/1/9 16:02
|
|
||||||||||
|
Re: ASA's basics | #3 |
|||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
Webmaster
Joined: 2007/6/10
From Dallas, TX
Posts: 79
Level : 7 HP : 0 / 170
Group:
Webmasters Registered Users |
Backup an ASA/PIXBeware: When making a backup of an ASA, and if you intend on restoring the configuration, you must use the same firmware, or a newer firmware. If you are migrating from major-release to another major-release the configuration may break If you are Migrating from ASA-7.2 to ASA-8.2.(2) the code should apply with no issues If you are Migrating from ASA-8.2.(2) to ASA-7.2 the code will most likely fail Depending on what you are required to backup on the appliance will depend on what should be run to get the information you require This is learned with trial and error as the configuration is complex too much to explain in an article... - You may read a lot more about this by reading Cisco's Documentation on Cisco's website, and books Show the basic running configuration Generally this is what should be copied - however this may not grab all what may be necessary for a complete restore This can be used if the configuration is fairly simple to backup and restore Show the running-configuration excluding pre-shared-keys (for example) This may be too much information for many scenarios Show the entire running-configuration including pre-shared-keys for VPN tunnels (for example) This may be too much information for many scenarios Backing upTo actually make the backup of the configuration, simply "sh run", and copy the output. If the ASA has VPN tunnels, be sure to run "more system:running-config", look for the pre-shared-keys, and put them into the configuration of the "sh run" output ASDM BackUpThe ASDM can be a great tool for backing up a configuration. As previously stated the firmware will need to match up, this is especially true with the ASDM backup and restore options. The ASDM will allow the ENTIRE configuration to be backed up, not only portions of it The ASDM backup will be saved as a *.ZIP file the ASDM may be used to restore the configuration as well Firewall ModesThere are 2 basic modes with the ASA firewall Routed The firewall is able to use resources such as NAT routes VPN Transparent The transparent firewall has limited resources the firewall does not appear as a "hop" NAT is not available Routing on the ASA is not available VPN is not available (unless using Firmware 8.3 or greater)[/code] |
||||||||||
Posted on: 2012/1/9 16:03
|
|
||||||||||
|
Re: ASA's basics | #4 |
|||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
Webmaster
Joined: 2007/6/10
From Dallas, TX
Posts: 79
Level : 7 HP : 0 / 170
Group:
Webmasters Registered Users |
InterfacesAn interface on an ASA has limitations that must be followed in order to allow traffic to traverse the appliance Physical interface Sub-Interface Physical InterfacesThe physical interface is literal per the terminology "Physical Interface". A patch cable is connected, and that is now the interface connection. Typically the "Outside" interface will be connected to the one VLAN, and the "Inside" interface will be on another VLAN. The interfaces will be constructed as follows: Other physical interfaces should be in the "shutdown" status. Sub-InterfaceA "sub-interface" is constructed differently than a physical interface, and will rely on VLAN Trunking. The sub-interface will be created/used when there are not enough physical interfaces to support the environment, therefore the upstream switch will be required to support VLAN Trunking as well; the corresponding uplink switch port will be required to be "mode trunk" instead of an "access" port. This may be necessary for multiple DMZ's - or limited on physical interfaces The interfaces will be constructed as follows: The sub interface is defined with: "interface Ethernet0/1.XXXX" The interfaces are tagged for their corresponding VLAN by using "vlan XXXX" The sub-interface identifier, and the vlan tag do not need to match, this is done for ease of reading in a complex infrastructure access-group'sThe access-group is used to define which direction the traffic is allowed to flow. By default traffic is NOT allowed to traverse the appliance; therefore the access-group is necessary to be created. There may only be one access-group created per direction of flow per interface Do not create excessive access-group's, this can be extremely complex to control access-group's may be constructed as follows: Therefore, since the access-group defines the flow of traffic, the access-list is directly related to the corresponding access-group which then limits what is allowed By default the ASA is in a blocking state An example of using the access-list construct with the access-group: Therefore the interfaces must match up with the "access-group" in order for the traffic to be recognized: Portmap TranslationOnce the traffic is permitted to traverse, you have to create the portmap translation This will allow the WEB, and DataBase interfaces to communicate This is known as creating the "Portmap Translation" Portmap Translation - Related ErrorIf the directive is not set, you will see a similar following error: Translation GroupTraffic outside the scope of the interface specification (IP and Subnet Mask) will not traverse the firewall This means if the interface has specified 2.2.2.0/24, and there are IP's on the VLAN outside of this range, such as 3.3.3.0/24; the 3.3.3.0/24 traffic will not traverse the firewall This is the purpose of using multiple interfaces on the security appliance, and specifying "security-level X" Higher level "security-level's" are allowed to reach lower levels Lower level "security-level's" must be specifically allowed for the traffic to pass to a higher level Interfaces with the same "security-level" may communicate freely IF "same-security-traffic permit inter-interface" is used This is known as creating the "Translation Group" Translation Group - Related ErrorIf the directive is not set, you will see a similar following error: CaveatsIf an interface exists, do not re-apply the interface in it's entirety. Re-applying the interface in it's entirety can bring the device down. This can remove access-group's This can remove global policies This can break existing routes on the appliance Therefore, when needing to make a change to an interface, be sure to only apply what is required, and have a good backup. |
||||||||||
Posted on: 2012/1/9 16:04
|
|
||||||||||
|
Re: ASA's basics | #5 |
|||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
Webmaster
Joined: 2007/6/10
From Dallas, TX
Posts: 79
Level : 7 HP : 0 / 170
Group:
Webmasters Registered Users |
NATThere are several types of NAT and PAT. Static NAT Static PAT Policy NAT Policy PAT Dynamic NAT Dynamic PAT Static NATInside Static NAT (host)Standard 1-to-1 translation Limiting the max simultaneous tcp connection limits to 1000, and embronic connections to 100, and udp to 1000 max simultaneous connections Inside Static NAT (network)Outside Static NATIf the IP 210.185.201.1 attempts to reach the inside interface from the outside world, translate the IP to 192.168.10.100 before it reaches the inside network Policy Static NATThe following will create a NAT rule which will allow traffic from 10.1.2.27 destined toward "209.165.201.0 255.255.255.224", and "209.165.200.224 255.255.255.224" to be mapped to their respective IP (either 209.165.202.129, or 209.165.202.130), depending on the matched rule: Dynamic NATOn the outside interface there is a block of available IP's of 209.165.200.230-209.165.200.237 - This will allow the public IP's to be translated to the pool of 192.168.10.0 255.255.255.0 on the inside network dynamically Static PATThis is basically Port Redirection whereas if the IP 209.165.200.229 is reached via port 33988 it will forward the traffic to 192.168.10.1 port 22 Another example For HTTP traffic initiated from hosts on the 10.1.3.0 network to the ASA's outside interface (10.1.2.14), you can redirect the traffic to the inside host at 10.1.1.15 Dynamic PATFor example: This is basically a type of NAT in which a private IP is translated into a pool of Public IP's Same as Another Example: Have the static translations removed, and instead assign inside hosts 192.168.30.53, and 192.168.30.55 to use PAT but only when the traffic is coming from IP 75.125.82.53. Inbound traffic will not be permitted to 75.125.82.53 an therefore hosts 192.168.30.53, and 192.168.30.55 will not be reachable from the outside. Remove the existing ACL references, in this case the ACL refers to an object-group, if the ACL referred to the IP directly you would need to remove that ACL rule. Be aware if the ACL rule refers to a subnet that includes those IPs you will need to rewrite the ACL to omit them. Remove the existing Static Translations: Add PAT configuration and access list to allow those IPs to communicate. |
||||||||||
Posted on: 2012/1/9 16:10
|
|
||||||||||
|
Re: ASA's basics | #6 |
|||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
Webmaster
Joined: 2007/6/10
From Dallas, TX
Posts: 79
Level : 7 HP : 0 / 170
Group:
Webmasters Registered Users |
Dynamic PAT - 2All hosts from the inside 192.168.10.0/24 network will be translated to 10.1.5.5 when it reaches the outside interface Same as Policy NAT/PATForce host which is sourcing from subnet "174.122.254.128 255.255.255.248" destined toward "192.168.1.0 255.255.255.0" to appear to be sourced from "174.123.3.74" Another example, force host on the inside 192.168.17.5 when reaching out to appear as 74.53.5.201 to the world, and allow port access inbound to the host via IP 74.53.5.201: ByPassing NATIf you enable NAT control, then inside hosts must match a NAT rule when accessing outside hosts. If you do not want to perform NAT for some hosts, then you can bypass NAT for those hosts or you can disable NAT control. Identity NATStatic Identity NATThis example uses static identity NAT for an inside IP address (10.1.1.3) when accessed by the outside This example uses static identity NAT for an outside address (209.165.201.15) when accessed by the inside This example statically maps an entire subnet This example, using "static identity policy NAT", shows a single real address that uses identity NAT when accessing one destination address, and a translation when accessing another |
||||||||||
Posted on: 2012/1/9 16:11
|
|
||||||||||
|
Re: ASA's basics | #7 |
|||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
Webmaster
Joined: 2007/6/10
From Dallas, TX
Posts: 79
Level : 7 HP : 0 / 170
Group:
Webmasters Registered Users |
Policy Static NAT, with NAT exemptionYou may initiate traffic from the real host, however the destination address in the ACL is only used for traffic initiated by the real host. For traffic to the real host from the destination network, the source address is not checked, and the first matching NAT rule for the real host is used, therefore configure "static Policy NAT" Then when hosts on the 10.1.2.0/27 network access 209.165.201.0/24, they are translated to corresponding addresses on the 209.165.202.128/27 network. But any host on the outside can access the mapped addresses 209.165.202.128/27, and not just hosts on the 209.165.201.0/24 network For the same reason (the source address is not checked for traffic to the real host), you cannot use policy static NAT to translate different real addresses to the same mapped address [6] Further elaboration: The following example will allow 209.165.201.2 to connect to 209.165.200.225, it only allows 209.165.200.225 to be translated to 10.1.1.1 This is because the first matching ACE will be the translation CaveatDo be warned different forms of NAT do take precedence over one another[7] - more detailed information may be obtained from Cisco The order of the rules will dictate the actual flow of traffic The order of the rules in the configuration will make a big difference If a static rule is above a PAT rule, the static rule will take precedence If a PAT rule is above a static rule, the PAT rule will take precedence When all else fails, look over the configuration line by line - take your time, and do not rush Allowing traffic between interfacesThe following will be necessary (as an example) to have the interfaces communicate (such as internal and internal1, like a DMZ). This is working with "security-levels" which have different security-levels. The following will only permit host 192.168.30.148 to communicate with host 192.168.10.150 via port tcp/10050 from internal, to internal1. Configuration example: |
||||||||||
Posted on: 2012/1/9 16:12
|
|
||||||||||
|
Re: ASA's basics | #8 |
|||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
Webmaster
Joined: 2007/6/10
From Dallas, TX
Posts: 79
Level : 7 HP : 0 / 170
Group:
Webmasters Registered Users |
ACL'sWriting ACL's can be easy and complex - this truly depends on what you are working to accomplish. Basic ACLThese two rules will permit ICMP traffic from anywhere to any host behind the ASA, and will permit TCP/80 from anywhere to host 192.168.30.2 service-ports & network-objectsAnother example of allowing ports, is using a service-group with network-objects (only available on firmware >8.0): This allows in one ACL the ability to permit ingress TCP, and UDP ports Order of RulesACL's are processed from the top down. By default all traffic is denied unless it is specifically permitted!!! To specify the order of the rules, you may specify the line number. It is not necessary to specify a line number every time an ACL is entered; only when the order of the rule matters within the list Deny Statements: It is necessary to specify a deny statement before the allow The following will block the requested IP(s), but will allow port 80 access to everyone else: Working with deny statements within egress trafficEx: You need to block outbound traffic from specified servers, let's say to block specified ports if a server is constantly attacking others: Example: I would build the access-group, and ACL's as follows: If you do not specify to permit other traffic, the traffic will be blocked as by default the ASA blocks all traffic unless it is specifically specified. If you do not specify all other traffic as allowed, you may not be able to reach your servers, and from the servers, they cannot reach outbound. Inactive RulesTo make a rule inactive, simple perform the following: If the rule is already there such as: And you wish for the Deny rule to become inactive allowing all traffic across the interface, simple add "inactive" at the end: CaveatWhen removing "Line 1" in the ACL list, be sure to specify "line 1", such as:
Failure to specify "line 1" when removing line one will break the "access-group", therefore causing the possibility to clear all of the existing ACL's in the list - this does depend on the firmware, and configuration of the ASA. The access-group will need to be re-applied to the interface!! The access-group specifies the direction the access-list is permitted to pass through the interface, such as: |
||||||||||
Posted on: 2012/1/9 16:13
|
|
||||||||||
|
Re: ASA's basics | #9 |
|||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
Webmaster
Joined: 2007/6/10
From Dallas, TX
Posts: 79
Level : 7 HP : 0 / 170
Group:
Webmasters Registered Users |
VPNThere are a few types of VPN available - however depending on the environment, the requested option may not be available for all apparent reasons - You will need to understand how VPN operated to understand these concepts Routed Firewall - should be no issues Transparent Firewall VPN is not available on a transparent firewall as the transparent firewall does not support routing of any kind unless using firmware greater than 8.3 L2L IPSec VPN (Site-to-Site tunnel) Remote Access (RA) IPSecVPN (Using the Cisco VPN Client) Remote Access (RA) SSL VPN (Using the Cisco AnyConnect VPN Client) - PPTP tunnels are not supported as they are deprecated There are other forms of VPN as well, however you will likely not see them VerbiageEncryption Domain This is the specified traffic allowed to traverse the tunnel known as "Interesting Traffic" (This is not necessarily the entire subnet(s) behind the VPN termination point) Local Encryption Domain This is the local end of the VPN termination point This may also be know as the NAT masquerade for the local peer This is the traffic allowed on the "Local" end of the tunnel known as "Interesting traffic" Remote Encryption Domain This is the remote end of the VPN termination point This may also be known as the NAT masquerade for the Remote peer This is the traffic allowed on the "Remote" end of the tunnel known as "Interesting traffic" Interesting Traffic Interesting traffic is what the VPN concentrator understands it should encrypt through the tunnel Phase I Phase I of the VPN tunnel is known as ISAKMP Phase II Phase II of the VPN tunnel is known as IPSec Site-to-Site Phase1, and Phase 2 questionnaire/VerifierThe following may assist in ensuring you have all necessary information for a Site-to-Site tunnel: (Site-to-Site) L2L VPN - Configuration - examplesThese examples are only for reference Site-to-Site (L2L) IPSec TunnelLocal Peer IP: 79.56.4.61 Local Encryption Domain: 192.168.16.58/255.255.255.255 Remote Peer IP: 196.28.52.15 Remote Encryption Domain: 66.50.210.216/255.255.255.255 66.50.210.215/255.255.255.255 Pre-Shared Key: uH63KKb8s Ike Phase 1: Encryption: 3DES Authentication: SHA1 DH Group: Group 2 Lifetime: 28800 (480 Minutes) Ike Phase 2: Encryption: 3DES Authentication: SHA1 PFS: Off DH Group: PFS Disabled Lifetime: 3600 (60 Minutes) Dynamic L2L VPNA Dynamic L2L VPN may be used for peers on Dynamic IP's, such as a home user Only the remote peer sourcing from the Dynamic IP may negotiate the tunnel as the statically assigned peer will not know the remote peer IP Local Peer IP: 79.56.4.61 Local Encryption Domain: 192.168.16.0/24 Remote Peer IP: DYNAMIC IP - Tunnel Group Name "My_hq2" ("Nickname" AKA "identity" == "My_hq2") Remote Encryption Domain: 192.168.2.0/24 Pre-Shared Key: "!!Ev3nl3s5!!" - (with the quotes) Ike Phase 1: Encryption: AES256 Authentication: SHA1 DH Group: Group 2 Lifetime: 28800 (480 Minutes) Ike Phase 2: Encryption: AES256 Authentication: SHA1 PFS: Off DH Group: PFS Disabled Lifetime: 3600 (60 Minutes) Debugging |
||||||||||
Posted on: 2012/1/9 16:15
|
|
||||||||||
|
Re: ASA's basics | #10 |
|||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
Webmaster
Joined: 2007/6/10
From Dallas, TX
Posts: 79
Level : 7 HP : 0 / 170
Group:
Webmasters Registered Users |
Remote Access VPN - Client - Configuration - exampleIPSec Remote AccessCisco IPSec VPN clientThe IPSec Remote Access VPN will require the Cisco Remote Access VPN Client the client must be obtained directly from cisco, and there are legal restrictions which must be met. IPSec Remote Access Client Configuration ExampleSSL Remote AccessThe SSL remote Access VPN will require the Cisco Any-Connect VPN client which may be obtained directly from the appliance via web-interface You will be required to transfer the necessary Any-Connect images to the appliance manually if they do not already exist on the appliance |
||||||||||
Posted on: 2012/1/9 16:16
|
|
||||||||||
 Top Previous Topic Next Topic |
|
 |
|
You cannot start a new topic.
You can view topic.
