CCNA Security – ASA 5505
1, Reset to factory defaults:
enableconfigure terminalconfigure factory-defaultreload save-config noconfirm2, Minimal configuration
a, Configure hostname ‘ASA01’
configure terminalhostname ASA01b, Set password ‘cisco’
enable password ciscoc, Configure SSH
! create user ‘root’ with password ‘toor’
username root password tooraaa authentication ssh console LOCAL! generate RSA key pair
crypto key generate rsa modulus 1024! enable 192.168.10.2 to use ssh on ASA
ssh 192.168.10.2 255.255.255.255 insided, Configure interfaces
Each interface has a security level, between 0 and 100. Traffic is permitted from higher to lower security level. ACL can disable traffic from higher to lower security level, and can permit from lower to higher security level.
interface vlan 100nameif outsidesecurity-level 0ip address 172.16.10.1 255.255.255.0no shutdownexitinterface vlan 200nameif insidesecurity-level 100ip address 192.168.10.1 255.255.255.0no shutdownexitinterface vlan 300nameif dmzsecurity-level 50ip address 10.10.10.1 255.255.255.0no shutdownexitinterface e0/0switchport access vlan 100no shutdownexitinterface e0/1switchport access vlan 200no shutdownexitinterface e0/2switchport access vlan 300no shutdownexitIn case of higher than 5505, use this syntax:
interface g0/0nameif outside
security-level 0
ip address 172.16.10.1 255.255.255.0
no shutdownexite, Configure default route
! default route toward 172.16.10.2, f0/0 interface of R2 router
route outside 0.0.0.0 0.0.0.0 172.16.10.2If the outside interface gets the IP address through DHCP, then the syntax is:
ip address dhcp setroute
In this case setroute configures the given IP address as a default route.
Hint: Configure the routers and test the connectivity with:
telnet <IP_address>3, Configure NAT
Detailed description can be found
here.
a, Static Object NAT
Let us say, that R3 is a web server with IP address 10.1.1.2. NAT will make it accessible from outside as 172.16.10.3.
object network WEB_SERVER host 10.1.1.2 nat (dmz,outside) static 172.16.10.3In this case an ACL is also necessary as dmz has higher security level than outside.
access-list OUTSIDE_ACCESS extended permit tcp any object WEB_SERVER eq www access-group OUTSIDE_ACCESS in interface outside‘Public Server’ option in ASDM can do all these things in one step.
b, Static Object NAT with port translation
This is similar to the previous one, but the inside web server port number is 8080, which can be seen as 80 from outside.
object network WEB_SERVERhost 10.1.1.2nat (dmz,outside) static 172.16.10.3 service tcp 8080 wwwIt is possible to translate another port to the same IP address. 10.1.1.3 is an FTP server:
object network WEB_SERVERhost 10.1.1.3nat (dmz,outside) static 172.16.10.3 service tcp ftp ftpc, Dynamic NAT
Translates the inside subnet into 172.16.10.10-20 range.
object network NATPOOLrange 172.16.10.10 172.16.10.20object network INSIDE_NETsubnet 192.168.10.0 255.255.255.0nat (inside,outside) dynamic NATPOOLd, Dynamic PAT
Translates the inside subnet into 172.16.10.10.
object network INSIDE_NETsubnet 192.168.10.0 255.255.255.0nat (inside,outside) dynamic 172.16.10.10Translates the inside subnet into the outside interface. This is useful if the IP address of the outside interface is given through DHCP.
object network INSIDE_NETsubnet 192.168.10.0 255.255.255.0nat (inside,outside) dynamic interfacee, Identity NAT
Identity NAT maps an IP address to itself. It is useful if we want to exclude an IP from NAT, for example in case of VPN.
object network IDENTITY_NAThost 10.1.1.10nat (inside,outside) static 10.1.1.10f, Monitoring NAT
show nat show nat pool show running-config nat show xlate4, Access Control Lists
ACLs can be standard, extended and global. There are no wildcard masks on ASA, just normal masks.
a, ACLs overwrite the security level restrictions.
access-list ACL1 permit tcp any object WEB_SERVER eq httpaccess-group ACL1 in interface outsideb, Network object groups represent more than one network objects.
object-group network DMZ_SERVERSnetwork-object host 10.1.1.2network-object host 10.1.1.3network-object host 10.1.1.4Service object groups represent more than one service objects.
object-group network DMZ_SERVICES tcpport-object eq httpport-object eq httpsport-object eq smtpACL with network and service object group groups servers together (easier management).
access-list ACL1 extended permit tcp any object-group DMZ_SERVERS object-group DMZ_SERVICESc, Check ACLs
show connshow conn details5, Modular Policy Framework
MPF can be used to configure QoS, send traffic to IPS to inspection, configure application traffic stateful inspection with dynamic port allocation, limit maximum TCP connections to a server, and generally to create more granular configuration of inspection.
Class-map identifies the traffic.
Policy-map identifies the action, that should be taken for the specific traffic (class-map).
Service-policy enables policy on an interface or globally.
a, Configure Class-map
class-map CLASS_MAP1 match access-list ACL_NAME match port [tcp | udp] [eq TCP_PORT_NUM | range PORT1 PORT2] match any match default-inspection-trafficb, Configure Policy-map
The ASA supports only one Policy-map per interface and one global Policy-map. Thus more than one Class-map and the required actions can be assigned to a Policy-map. Actions can be:
- CSC, send the traffic through Content Security and Control module
- IPS, send the traffic through Intrusion Prevention System module
- set connection, enforce connection limits
- inspect, apply protocol inspection
- police, apply rate limit for traffic
- priority, apply priority for voice traffic
Class-map for a web-server (192.168.10.10) can be created the following way:
! ACL for the traffic access-list ACL_WEB_TRAFFIC permit tcp any host 192.168.10.10 eq 80! Class-map which identifies the traffic class-map CLASS_MAP_WEB_TRAFFIC match access-list ACL_WEB_TRAFFICLet us say we have two Class-maps: CLASS_MAP_WEB_TRAFFIC and CLASS_MAP_SMTP_TRAFFIC.
Then this Policy-map will send the traffic trough the CSC module:
policy-map GLOBAL_POLICY_MAP class CLASS_MAP_WEB_TRAFFIC csc [fail-open|fail-close] exit class CLASS_MAP_SMTP_TRAFFIC csc [fail-open|fail-close] exit! set global policy-map service-policy GLOBAL_POLICY_MAP global! set policy-map on an interface (outside) service-policy POLICY_MAP interface outsidefail-open: traffic will be forwarded if the CSC module fails
fail-close: traffic will be dropped if the CSC module fails
c, Check configuration
show run class-mapshow run policy-mapshow run service-policyshow connshow conn detailTransparent mode
In transparent mode ASA works like a switch. The interfaces do not have IP address but they are placed into a bridge-group. ASA inspects the traffic, which goes through the device. By default ICMP, broadcast and multicast are not inspected. BVI (Bridge Virtual Interface) is the management IP address.
! clear all configuration clear config all ! check firewall mode show firewall ! switch into transparent mode firewall transparent! configure BVIinterface BVI 1ip address 192.168.1.1exit! enable managementhttp server enablehttp 0 0 inside! configure vlansinterface vlan 100nameif outsidesecurity-level 0no shutdownexitinterface vlan 200nameif insidesecurity-level 100no shutdownexit! configure interfacesinterface e0/0switchport access vlan 100bridge-group 1no shutdownexitinterface e0/1switchport access vlan 200bridge-group 1no shutdownexit
