Configuring Interfaces

Every firewall has one or more interfaces that can be used to connect to a network. To pass and inspect traffic, each firewall interface must be configured with the following attributes:

• IP address and subnet mask (IPv4; beginning with Adaptive Security Appliance (ASA) 7.0 and Firewall Services Module (FWSM) 3.1(1), IPv6 is also supported).

• Security level (a higher level is considered more secure).

By default, traffic is allowed to flow from a higher-security interface to a lower-security interface ("inside" to "outside," for example) as soon as access list, stateful inspection, and address translation requirements are met. Traffic from a lower-security interface to a higher one must pass additional inspection and filtering checks.

Firewall interfaces can be physical, where actual network media cables connect, or logical, where the interface exists internally to the firewall and is passed to a physical trunk link. Each Cisco firewall platform supports a maximum number of physical and logical interfaces. Starting with PIX OS release 6.3, trunk links are also supported. The trunk itself is a physical interface, and the Virtual LANs (VLAN) carried over the trunk are logical VLAN interfaces. A trunk link has the following attributes:

• Firewall trunk links support only the IEEE 802.1Q trunk encapsulation method.

• As each packet is sent to a trunk link, it is tagged with its source VLAN number. As packets are removed from the trunk, the tag is examined and removed so that the packets can be forwarded to their appropriate VLANs.

• 802.1Q trunks support a native VLAN associated with the trunk link. Packets from the native VLAN are sent across the trunk untagged.

• A firewall does not negotiate trunk status or encapsulation with Dynamic Trunking Protocol (DTP); the trunk is either "on" or "off."

Figure 3-1 shows how a trunk link between a firewall and a switch can encapsulate or carry frames from multiple VLANs. Notice that frames from the native VLAN are sent without a tag, and frames from other VLANs have a tag added while in the trunk.

Figure 3-1. How an IEEE 802.1Q Trunk Works on a Firewall

[View full size image]

Firewall Swi:ch

Frame fram Native VLAN | f-------> ~|-------|_| Ta Native VLAN

Frame fram Native VLAN | f-------> ~|-------|_| Ta Native VLAN

Type/Lenglli

Surveying Firewall Interfaces

You can see a list of the physical firewall interfaces that are available by using the following command:

Firewall# show version

Firewall interfaces are referenced by their hardware index and their physical interface names. For example, the show version command on a PIX 525 running PIX release 6.3 produces the following output:

Firewall# show version

0: ethernet0: address is 0030.8587.546e, irq 10 1: ethernet1: address is 0030.8587.546f, irq 11 2: gb-ethernet0: address is 0003.4725.2f97, irq 5 3: gb-ethernet1: address is 0003.4725.2e32, irq 11

The first number is the hardware index, which indicates the order in which the interfaces were placed in the firewall backplane. Each physical interface has a hardware ID name that indicates its medium; ethernet0 is a 10/100BASE-TX port, and gb-ethernet0 is a Gigabit Ethernet port.

With ASA 7.0 and later, the output is slightly different:

Firewall# show version

Ext: Ethernet0

Ext: Ethernet1

Ext: GigabitEthernet0

Ext: GigabitEthernet1

media index media index media index media index irq 10 irq 11 irq 5 irq 11

On an FWSM, all interfaces are logical and have names beginning with vlan followed by the VLAN number. With a default configuration, the only VLAN interfaces available are the ones that have been configured from the Catalyst switch Supervisor module. These are created with the following Catalyst IOS configuration commands:

Switch(config)# firewall vlan-group group vlan-list Switch(config)# firewall module mod vlan-group group

In the first command, an arbitrary VLAN group number, group, is defined to contain a list of one or more VLANs that will be internally connected to the FWSM. The second command associates the FWSM located in switch chassis slot mod with the VLAN group vlan-group. For example, the following commands can be used to provide VLANs 10, 20, and 30 to the FWSM located in slot 4:

Switch(config)# firewall vlan-group 1 10,20,30 Switch(config)# firewall module 4 vlan-group 1

Logical interfaces have a hardware ID in the form vlan1, vlan55, and so on. These interfaces are not available until you define them with configuration commands, so they are not shown in the show version output.

At this point, you should identify each of the interfaces you will use. At a minimum, you need one interface as the "inside" of the firewall and one as the "outside." By default, the firewall chooses two interfaces for the inside and outside. You can view the interface mappings with the show nameif EXEC command. You also can change the interface-name mappings as needed.

The show interface command lists each interface along with its state, MAC and IP addresses, and many counters. You can use the output to verify an interface's activity and current settings.

The interface state is shown by two values: The configured administrative state (up or administratively down) and the line protocol state (up or down). The line protocol state indicates whether the interface is connected to a live network device.

Configuring Interface Redundancy

By default, each physical firewall interface operates independently of any other interface. The interface can be in one of two operating states: up or down. When an interface is down for some reason, the firewall cannot send or receive any data through it. The switch port where a firewall interface connects might fail, causing the interface to go down, too.

Naturally, you might want to find a way to keep a firewall interface up and active all the time. Beginning with ASA 7.3(1), you can configure physical firewall interfaces as redundant pairs.

As a redundant pair, two interfaces are set aside for the same firewall function (inside, outside, and so on) and connect to the same network. Only one of the interfaces is active; the other interface stays in a standby state. As soon as the active interface loses its link status and goes down, the standby interface becomes active and takes over passing traffic.

Both physical interfaces in a redundant pair are configured as members of a single logical "redundant" interface. In order to join two interfaces as a redundant pair, the interfaces must be of the same type (10, 100, 1000BASE-TX GigabitEthernet, for example).

The redundant interface is configured with a unique interface name, security level, and IP address—the parameters used in firewall operations.

You can use the following configuration steps to define a redundant interface: 1. Define the logical redundant interface:

Firewall(config)# interface redundant number

You can define up to eight redundant interfaces on an ASA. Therefore, the interface number can be 1 through 8.

2. Add physical interfaces as members:

Firewall(config-int)# member-interface physical interface

The physical interface named physical_interface (gigabitethernet0/1, for example) becomes a member of the logical redundant interface. Be aware that the member interface cannot have a security level or IP address configured. In fact, as soon as you enter the member-interface command, the firewall automatically clears those parameters from the interface configuration.

You can repeat this command to add a second physical interface to the redundant pair. Keep in mind that the order in which you configure the interfaces is important.

The first physical interface added to a logical redundant interface becomes the active interface. That interface stays active until it loses its link status, causing the second or standby interface to take over. The standby interface can also take over when the active interface is administratively shut down with the shutdown interface configuration command.

However, the active status does not revert back to the failed interface, even when it comes back up. The two interfaces trade the active role back and forth only when one of them fails.

The redundant interface also takes on the MAC address of the first member interface that you configure. Regardless of which physical interface is active, that same MAC address is used.

As an example, interfaces ethernet0/1 and ethernet0/2 are configured to be used as logical interface redundant 1:

Firewall(config)# interface redundant 1

Firewall(config-if)# member-interface ethernet0/1

INFO: security-level and IP address are cleared on Ethernet0/1.

Firewall(config-if)# member-interface ethernet0/2

INFO: security-level and IP address are cleared on Ethernet0/2.

Firewall(config-if)# no shutdown

The redundant interface is now ready to be configured as a normal firewall. From this point on, you should not configure anything on the two physical interfaces other than the port speed and duplex.

Make sure the logical redundant interface and the two physical interfaces are enabled with the no shutdown command. Even though they are all logically associated, they can be manually shut down or brought up independently.

You can monitor the redundant interface status with the following command:

Firewall# show interface redundant number [ip [brief] | stats | detail]

The ip brief keywords provide a short summary of the redundant interface, its IP address, and its status. All of the other keyword combinations give identical output—a verbose listing of interface parameters and counters, as well as a brief redundancy status. The following example shows the status of interface redundant 1:

Code View: Scroll / Show All

Firewall# show interface redundant 1

Interface Redundant1 "inside", is up, line protocol is up Hardware is i82546GB rev03, BW 100 Mbps, DLY 1000 usec Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps) MAC address 0016.c789.c8a5, MTU 1500 IP address 192.168.100.1, subnet mask 255.255.255.0 1 packets input, 64 bytes, 0 no buffer Received 1 broadcasts, 0 runts, 0 giants

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort

0 L2 decode drops

1 packets output, 64 bytes, 0 underruns

0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collisions, 0 deferred 0 lost carrier, 0 no carrier input queue (curr/max blocks): hardware (5/0) software (0/0) output queue (curr/max blocks): hardware (0/8) software (0/0) Traffic Statistics for "inside":

0 packets input, 0 bytes

1 packets output, 28 bytes 0 packets dropped

1 minute input rate 0 pkts/sec, 1 minute output rate 0 pkts/sec, 1 minute drop rate, 0 pkts/sec 5 minute input rate 0 pkts/sec, 5 minute output rate 0 pkts/sec, 5 minute drop rate, 0 pkts/sec Redundancy Information:

Member Ethernet0/1(Active), Ethernet0/2 Last switchover at 10:32:27 EDT Mar 14 2007 Firewall#

0 bytes/sec 0 bytes/sec

0 bytes/sec 0 bytes/sec

Notice that physical interface Ethernet0/1 is currently the active interface, while Ethernet0/2 is not. The output also reveals the date and time of the last switchover.

When the active interface goes down, the standby interface takes over immediately. That whole process is subsecond and happens rather silently. The only record of the redundant switchover can be found in the syslog output, as in the following example:

Code View: Scroll / Show All

Mar 14 2007 10:41:54: %ASA-4-411002: Line protocol on Interface Ethernet0/1, changed state to down

Mar 14 2007 10:41:54: %ASA-5-425005: Interface Ethernet0/2 become active in redundant interface Redundant1

You can also use the debug redundant {event | error} command to see redundant failover information in real time.

Basic Interface Configuration

You should follow the configuration steps in this section for each firewall interface that you intend to use. By default, interfaces are in the shutdown state and have no IP address assigned.

1. Define the interface as physical (Step a) or logical (Step b): a. Define a physical interface:

Continue reading here: Asa Aha

Was this article helpful?

0 0