Chapter 10 – Implementing the Cisco Adaptive Security Appliance (ASA)
© 2012 Cisco and/or its affiliates. All rights reserved.
1

• Explain how the ASA is an advanced stateful firewall.
• Describe types of firewalls.
• Describe the default configuration of an ASA 5505.
• Implement an ASA firewall configuration.
• Configure an ASA to provide basic firewall services using ASDM.
• Explain and configure access lists and object groups on an ASA.
• Configure an ASA to provide NAT services.
• Configure access control using the local database and AAA server.
• Describe the configuration of Modular Policy Framework (MPF) on an
ASA.
• Implement an AnyConnect SSL VPN and a clientless SSL VPN on an
ASA.
© 2012 Cisco and/or its affiliates. All rights reserved.
2

3.0 Implementing AAA on Cisco Devices
3.1 Implement AAA (authentication, authorization, and accounting)
3.1.3 AAA on ASA
7.0 Implementing Cisco Firewall Technologies
7.5 Implement the Cisco Adaptive Security Appliance
7.5.1 NAT
7.5.2 ACL
7.5.3 Default MFP
7.5.4 Cisco ASA Security Levels
© 2012 Cisco and/or its affiliates. All rights reserved.
3

9.0 Implementing VPN Technologies
9.2 Describe VPN technologies
9.2.1 IPsec
9.2.2 SSL
9.3 Describe the building blocks of IPsec
9.3.1 IKE
9.3.2 ESP
9.3.3 AH
9.3.4 Tunnel mode
9.3.5 Transport mode
9.6 Implement SSL VPN using ASA Security Device Manager (ASDM)
9.6.1 Clientless
9.6.2 AnyConnect
© 2012 Cisco and/or its affiliates. All rights reserved.
4

• The Adaptive Security Appliance (ASA) is a standalone firewall device that is a primary component of the Cisco SecureX technology.
– It combines firewall, VPN concentrator, and intrusion prevention functionality into one device.
– It can also support advanced features such as virtualization, high availability with failover, identity firewall, and advanced threat control.
– It can be configured in routed mode or in transparent mode.
• The ASA assigns security levels to distinguish between inside and outside networks.
– Security levels define the level of trustworthiness of an interface; the higher the level (up to 100), the more trusted the interface.
– Each operational interface must have a name and a security level from 0
(lowest) to 100 (highest) assigned.
© 2012 Cisco and/or its affiliates. All rights reserved.
5

• The ASA 5505 ships with a default configuration that is sufficient for SOHO deployments.
– The configuration includes two preconfigured VLAN networks, DHCP enabled for inside hosts, and NAT for outside access.
• ASA devices can be configured and managed using either the CLI or the Adaptive Security Device Manager (ASDM) GUI.
– The ASA CLI has a similar look and feel to the router IOS.
– Cisco ASDM facilitates the setup, configuration, monitoring, and troubleshooting of Cisco ASAs.
• ASDM provides several wizards to help simplify the configuration.
– The Startup Wizard guides through the initial configuration of the ASA.
– The VPN wizards guides basic site-to-site and remote access VPN configurations.
© 2012 Cisco and/or its affiliates. All rights reserved.
6

• Like ISR routers, the ASA:
– Provides basic traffic filtering capabilities with ACLs.
– Supports objects and object groups making it easier to maintain configurations.
– Supports NAT and PAT. These addresses can either static or dynamic.
– Can be configured to authenticate using a local user database or an external server.
• The ASA uses the Modular Policy Framework (MPF) to define sets of rules for applying firewall features.
© 2012 Cisco and/or its affiliates. All rights reserved.
7

• The ASA provides support for site-to-site IPsec VPNs and can also support the following remote access VPNs:
– Clientless SSL VPN Remote Access (using a web browser)
– SSL or IPsec (IKEv2) VPN Remote Access (using Cisco AnyConnect client)
– IPsec (IKEv1) VPN Remote Access (using Cisco VPN client)
• With a clientless SSL VPN deployment, remote clients use an
SSL web portal interface.
• Client-based SSL VPN requires a client, such as the Cisco
AnyConnect VPN client, to be pre-installed on the host, or downloaded on-demand via a browser.
© 2012 Cisco and/or its affiliates. All rights reserved.
8

• Chapter 10 Lab A: Configuring ASA Basic Settings and Firewall
Using CLI
– Part 1: Lab Setup
– Part 2: Accessing the ASA Console and Using CLI Setup Mode to Configure
Basic Settings
– Part 3: Configuring Basic ASA Settings and Interface Security Levels Using
CLI
– Part 4: Configuring Routing, Address Translation and Inspection Policy Using
CLI
– Part 5: Configuring DHCP, AAA, and SSH
– Part 6: Configuring a DMZ, Static NAT, and ACLs
© 2012 Cisco and/or its affiliates. All rights reserved.
9

• Chapter 10 Lab B: Configuring ASA Basic Settings and Firewall
Using ASDM
– Part 1: Lab Setup
– Part 2: Accessing the ASA Console and ASDM
– Part 3: Configuring ASA Settings and Firewall Using the ASDM Startup
Wizard
– Part 4: Configuring ASA Settings from the ASDM Configuration Menu
– Part 5: Configuring a DMZ, Static NAT and ACLs
• Chapter 10 Lab C: Configuring Clientless and AnyConnect
Remote Access SSL VPNs Using ASDM
– Part 1: Lab Setup
– Part 2: Access the ASA Console and Prepare for VPN configuration
– Part 3: Configuring Clientless SSL VPN Remote Access Using ASDM
– Part 4: Configuring AnyConnect Client SSL VPN Remote Access Using ASDM
© 2012 Cisco and/or its affiliates. All rights reserved.
10

• Chapter 10 Lab D: Configuring a Site-to-Site IPsec VPN Using
CCP and ASDM
– Part 1: Basic Router/Switch/PC Configuration
– Part 2: Basic ASA Configuration
– Part 3: Configuring the ISR as a Site-to-Site IPsec VPN Endpoint Using CCP
– Part 4: Configuring the ASA as a Site-to-Site IPsec VPN Endpoint Using
ASDM
© 2012 Cisco and/or its affiliates. All rights reserved.
11

Routed mode
Transparent mode inside interface outside interface
SVI
The traditional mode for deploying a firewall where there are two or more interfaces that separate Layer 3 networks.
The ASA is considered to be a router hop in the network and can perform NAT between connected networks.
Routed mode supports multiple interfaces.
Each interface is on a different subnet and requires an IP address on that subnet.
The ASA functions like a Layer 2 device.
Transparent mode is often referred to as a "bump in the wire," or a "stealth firewall."
In transparent mode, the ASA is not considered a router hop.
The ASA requires only one management IP address configured in global configuration mode.
A named interface with security level 100.
A named interface with security level 0.
Switch Virtual Interface
© 2012 Cisco and/or its affiliates. All rights reserved.
12

SSC
AIP-SSC
SSM
AIP-SSM
4GE-SSM
CSC-SSM
Security Services Card
Cisco Advanced Inspection and Prevention Security Services
Card enables the Cisco ASA 5505 to provide advanced intrusion prevention services.
Security Services Module
The Advanced Inspection and Prevention Security Services
Module enables the Cisco ASA 5510 and higher to provide advanced intrusion prevention services. .
4-Port Gigabit Ethernet Security Services Module provides four 10/100/1000 RJ-45 ports and four Small Form-Factor
Pluggable (SFP) ports to support both copper and optical connections on ASA 5510 and higher.
The Series Content Security and Control Security Services
Module provides comprehensive antivirus, anti-spyware, file blocking, anti-spam, anti-phishing, URL blocking and filtering, and content filtering on the ASA 5510 and higher.
Note: Refer to Chapter 8 Terms and Acronyms.
© 2012 Cisco and/or its affiliates. All rights reserved.
13

• This is a new chapter. This chapter was not included in v1.0; therefore all content should be considered new.
© 2012 Cisco and/or its affiliates. All rights reserved.
14

• Use the knowledge gained during Chapter 1 – 9 to help cover the topics in Chapter 10.
© 2012 Cisco and/or its affiliates. All rights reserved.
15

• The ASA 5505 is different from the other 5500 series ASA models.
– With the ASA 5505, the eight integrated switch ports are Layer 2 ports, and therefore cannot be assigned IP addresses directly.
– With other ASAs, the physical port can be assigned a Layer 3 IP address directly, much like a Cisco router.
• On an ASA 5505, Layer 3 parameters are configured on a SVI.
– The SVI requires a name, interface security level, and IP address.
– The Layer 2 switch ports are then assigned to a specific VLAN.
– Switch ports on the same VLAN can communicate with each other using hardware switching.
– But when a switch port on VLAN 1 wants to communicate with a switch port on VLAN 2, then the ASA applies the security policy to the traffic and routes between the two VLANs.
© 2012 Cisco and/or its affiliates. All rights reserved.
16

• The Cisco ASA command set is similar to Cisco IOS routers.
• Like a Cisco IOS router, the ASA also recognizes the following:
– Abbreviation of commands and keywords
– Tab key to complete a partial command
– The help key (?) after the command
• Unlike an ISR, the ASA performs as follows:
– Execute any ASA CLI command regardless of the current configuration mode prompt. The IOS do command is not required or recognized.
– Provide a brief description and command syntax when help is entered followed by the command.
–
Interrupt show command output using Q . The IOS requires Ctrl+C ( ^C ).
© 2012 Cisco and/or its affiliates. All rights reserved.
17

• ASDM is similar to CCP.
• It requires that a router be initially configured.
• ASDM can be run locally on a host or from the ASA flash.
– ASDM can be downloaded on a host from the ASA flash.
• Like CCP, ASDM provides several wizard to help in device configuration.
© 2012 Cisco and/or its affiliates. All rights reserved.
18

• The ASA provides two main deployment modes that are found in
Cisco SSL VPN solutions:
– Clientless SSL VPN is a browser-based VPN option and once authenticated, users access a portal page and can access specific, supported internal resources.
– Client-Based SSL VPN provides full tunnel SSL VPN connection but the
AnyConnect client application to be installed on the remote host.
• AnyConnect can be pre-installed on the host or it can be downloaded on-demand from the ASA.
• AnyConnect is also available for various operating systems and smart devices.
© 2012 Cisco and/or its affiliates. All rights reserved.
19

• The same analogies covered in Chapter 8 can be used here.
© 2012 Cisco and/or its affiliates. All rights reserved.
20

• The same classroom discussions from Chapter 8 can be used.
• Why / When would you use an ASA instead of an ISR router?
© 2012 Cisco and/or its affiliates. All rights reserved.
21

• This chapter is best learned by applying the concepts as much as possible.
– Student must get their own battle scars.
• Encourage students to come up with their own VPN topology scenarios.
–
Have them interconnect an ASA with an ISR router.
© 2012 Cisco and/or its affiliates. All rights reserved.
22

• For more information, go to:
– www.cisco.com/en/US/docs/security/asa/quick_start/5500/inst5500.html
– www.cisco.com/en/US/docs/security/asa/quick_start/5505/5505-poster.html
– www.cisco.com/go/asm
© 2012 Cisco and/or its affiliates. All rights reserved.
23

© 2011 Cisco and/or its affiliates. All rights reserved.
24