Security Appliance

Cisco ASA 5520 Security Appliance

The Cisco ASA 5520 Security Appliance is a high-availability enterprise firewall and VPN. It is designed as a perimeter security device, as well as a VPN head point for all enterprise connectivity. The ASA 5520 supports a 2.0-GHz Celeron processor, with up to 512 MB of RAM and 64 MB of Flash memory. The availability of security contexts allows the ASA 5520 to support more flexible firewall design than the ASA 5510. In addition, the ASA 5520 allows the use of SSL VPNs (WebVPN) to support up to...

Internet Key Exchange

Internet Key Exchange is the protocol that is responsible for negotiation. IKE is the short name for ISAKMP Oakley, which stands for Internet Security Association and Key Management Protocol (with Oakley distribution). The terms IKE and ISAKMP are used interchangeably throughout this chapter. IKE operates over User Datagram Protocol (UDP) port 500 and negotiates the key exchange between the ISAKMP peers to establish a bidirectional SA. This process requires that the IPSec systems first...

Configuring Transparent Mode

With the release of Security software version 7.0, a Security Appliance can run as a Layer 2 firewall. Standard firewalls act in a similar fashion as a router, routing packets through the firewall instead of switching them. This creates an extra hop in the IP path that a user can detect. With transparent firewall enabled, the Security Appliance will act as a Layer 2 filtering bridge, switching the packets instead of routing them, and the user will not see an additional hop within the IP path....

Step 4 Configuring Crypto Maps

Just as the isakmp policy command configures the parameters for the IKE negotiations, crypto map tells the PIX Firewall how to negotiate the IPSec SA. The crypto map command is the final piece of the puzzle that is used on both peers to establish the SA. Again, it is extremely important that the settings are compatible on both ends. If both peers do not have a compatible configuration, they cannot establish the VPN connection. This does not mean that the configuration must be an exact match...

Configuring the Security Appliance DHCP Client

DHCP client support on the Cisco Security appliance is designed for use in SOHO environments in which digital subscriber line (DSL) and cable modems are used. The DHCP client can be enabled only on the outside interface of the Security Appliance. When the DHCP client is enabled, DHCP servers on the outside provide the outside interface with an IP address. NOTE The DHCP client does not support failover configuration. The DHCP client feature on a Security Appliance is enabled by the ip address...

Aipssm Module

The Cisco ASA Security Appliance series supports the Advanced Inspection and Protection Security Service Module (AIP-SSM). The AIP-SSM comes in two modules the AIP-SSM-10 and the AIP-SSM-20. Both modules function the same way, support the same features, and look identical. The only difference between the two modules is the processor speed and memory size of the AIP-SSM-20, which is faster and larger than that of the AIP-SSM-10. The AIP-SSM uses two physical channels to communicate with the...

Cisco VPN Client Manual Configuration Tasks

When using the Cisco VPN Software Client, the Easy VPN Server can push the VPN policy to help facilitate the management of the client systems. Initially, however, you still need to install the Cisco VPN Software Client on the remote system. This manual process involves the following tasks Installing the Cisco VPN Software Client Creating a new connection entry Modifying VPN Client options (optional) Installing the Cisco VPN Software Client Installation of the Cisco VPN Software Client varies...

Configuring Syslog on a Cisco Security Appliance

The logging command is used to configure logging on the PIX Firewall. Logging is disabled by default. Table 10-3 describes the parameters of the logging command. Table 10-3 logging Command Parameters Table 10-3 logging Command Parameters Enables the transmission of syslog messages to all output locations. You can disable sending syslog messages with the no logging on command. Allows you to disable specific syslog messages. Use the logging message message_number command to resume logging of...

FTP Inspection

The FTP protocol requires some special handling due to its use of two ports per FTP session. The FTP protocol uses two ports when activated for transferring data a control channel and a data channel using ports 21 and 20, respectively. The user, who initiates the FTP session over the control channel, makes all data requests through that channel. The FTP server will then initiate a request to open a port from server port 20 to the user's computer. FTP will always use port 20 for data channel...

Step 1 Creating a Crypto Access List

Crypto access lists are used to identify which IP traffic is to be protected by encryption and which traffic is not. After the access list is defined, the crypto maps reference it to identify the type of traffic that IPSec protects. The permit keyword in the access list causes IPSec to protect all IP traffic that matches the access list criteria. If the deny keyword is used in the access list, the traffic is not encrypted. The crypto access lists specified at the remote peer should be mirror...

Step 3 Configuring IPSec Security Association Lifetimes

To preclude any opportunity to gather sufficient network traffic using a single encryption key, it is important to limit the key lifetime. This forces a key exchange, changing the encryption scheme and greatly reducing the possibility of cracking the key. Technology continues to advance, producing computers that can break code at faster rates. However, these systems require a certain amount of traffic encrypted under a single key. The idea is to change encryption keys before any system can...

Figure 1310 VPN Network Layout

The three locations have all provided their current PIX configurations, but each has a significant amount of information missing. It is your responsibility to complete each of the configurations and ensure that they are correct. Example 13-15 shows the configuration for the corporate headquarters in Los Angeles. Example 13-15 PIX Configuration for Los Angeles 4. nameif ethernet0 outside security0 5. nameif ethernetl inside security100 6. nameif ethernet2 DMZ security70 7. enable password...

Completed PIX Configurations

To reduce confusion, it is a good idea to use a common naming convention when creating access lists, transforms, and crypto maps. Example 13-18 shows the completed configuration for the Los Angeles headquarters. Example 13-18 Completed Configuration for Los Angeles 4. nameif ethernet0 outside security0 5. nameif ethernet1 inside security100 6. nameif ethernet2 DMZ security70 7. enable password HtmvK15kjhtlyfvcl encrypted 8. passwd Kkjhlkf1568Hke encrypted 10. domain-name www.Chapter11.com...

How the Configuration Lines Interact

Figure 13-11 shows the completed configuration for Los Angeles, with a brief explanation for each entry. Note that each entry is connected to one or more other entries on the right. This diagram depicts how the lines of the configuration are dependent on each other. Keep this in mind when trying to troubleshoot a VPN configuration. It might help you to find which line is missing or incorrectly configured. Figure 13-11 LA Configuration with Comments PIX Version 6.2(2) nameif ethernetO outside...

What IsWrong with This Picture

Now that you have successfully gone through the configuration scenarios in the previous sections, this section focuses on problem solving after or during an implementation of Cisco PIX Firewall. Examples 20-9 through 20-11 show the configuration of three PIX Firewalls for this exercise. Example 20-9 Atlanta PIX Firewall Configuration 9. ip address 10.10.3.1 255.255.255.0 15. ip address 192.168.3.1 255.255.255.0 21. ip address 172.16.3.1 255.255.255.0 22. enable password ksjfglkasglc encrypted...

DHCP Debugging Commands

To help debug the operation of your Security Appliance DHCP server and Security Appliance DHCP client, you can use the following two commands debug dhcpd event packet debug dhcpc detail error packet The debug dhcpd command displays information associated with the DHCP server running on the Security Appliance. The event keyword displays information about the events related to the DHCP server, and the packet keyword displays information about the packets received for the DHCP server. The debug...

Cisco PIX 515E

The Cisco PIX 515E Firewall was designed for small- to medium-size businesses. The PIX 515E is the smallest firewall of the PIX family that is designed to be rack-mountable and is a standard 1U (1.75-inch) configuration. It has a 433-MHz processor, 32 MB or 64 MB of RAM, and 16 MB of Flash memory. It has two fixed 10 100 Ethernet interfaces that have a default configuration of outside (Ethernet 0) and inside (Ethernet 1) and contains two PCI slots for the installation of up to four additional...

Sample Security Appliance Configuration

Examples 6-15 and 6-16 show sample output for a Security Appliance configuration in routed and transparent mode. Included are some of the commands discussed in this chapter. Example 6-15 Sample PIX Configuration in Routed Mode Written by deguc at 11 29 39.859 EDT Fri Aug 8 2005 PIX Version 7.0(4) interface Ethernet 0 nameif outside security-level 0 speed 100 duplex full ip address 192.168.1.1 255.255.255.224 interface Ethernet 1 nameif inside security-level 100 speed 100 duplex full interface...

Configuring the Minneapolis PIX Firewall MNPIX for VPN Tunneling

Similar to configuring the VPN characteristics on HQ-PIX, you also must define the VPN characteristics at each of the remote sites. The following steps outline the commands necessary to define the VPN characteristics on MN-PIX at the Minneapolis remote site isakmp policy 10 authentication pre-share isakmp policy 10 encryption des isakmp policy 10 lifetime 1000 Step 2 Configure a preshared key and associate it with the peer (HQ-PIX) isakmp key A1 abc address 192.168.1.2 Step 3 Configure the...

Configuring Multiple Translation Types on the Cisco Security Appliance

It is a good practice to use a combination of NAT and PAT. If you have more internal hosts than external IP addresses, you can configure both NAT and PAT. Your first group of hosts translates to the global addresses that are listed and the remaining hosts use PAT and translate to the single global address. PAT is configured separately from NAT. If NAT is configured without PAT, once the available global IP address range is depleted, additional translation attempts will be refused. If the...

Using the Cisco Security Appliance DHCP Server

The DHCP server is usually used in, but not limited to, SOHO environments. The address pool of a Cisco Security Appliance DHCP server must be within the same subnet of the Security Appliance interface that is enabled, and you must specify the associated Security Appliance interface with if- name. In other words, the client must be physically connected to the subnet of a Security Appliance interface. The size of the pool is limited to 32 addresses with a 10-user license and 128 addresses with a...

Cisco ASA 5540 Security Appliance

The Cisco ASA 5540 is the premiere Security Appliance for the large enterprise environment. The ASA 5540 can support up to 100 VLANs, allowing a security administrator greater flexibility when designing a corporate LAN. The ASA 5540 runs on a 2.0-GHz Pentium 4 processor, with up to 1,024 MB of RAM and 64 MB of Flash memory. The ASA 5540, like the ASA 5520, supports LAN-based failover in either Active Active or Active Standby modes. The ASA 5540 supports up to 50 security contexts with purchase...

Logging Levels

Different severity levels are attached to incoming messages. You can think of these levels as indicating the type of message. A Security Appliance can be configured to send messages at different levels. Table 10-2 lists these levels from highest to lowest importance. Debug message, log FTP commands, and WWW URLs Many of the logging commands require that you specify a severity level threshold to indicate which syslog messages can be sent to the output locations. The lower the level number, the...

Cisco PIX 501

The Cisco PIX 501 Firewall was designed for the SOHO environment. It has a 133-MHz processor, 16 MB of RAM, and 8 MB of Flash memory. It has an outside Ethernet interface and an integrated four-port Ethernet 10 100 switch on the internal side. It has a 9600-baud console port that is used for local device management. The PIX 501 does not support failover. Connection capabilities for the PIX 501 are as follows Maximum clear-text throughput 60 Mbps Maximum throughput (DES) 6 Mbps Maximum...

Cisco PIX 506E

The Cisco PIX 506E Firewall was designed for the ROBO environment. It has a 300-MHz Celeron processor, 32 MB of RAM, and 8 MB of Flash memory. It has a fixed outside Ethernet interface and a fixed inside Ethernet interface. It has a 9600-baud console port that is used for local device management. The PIX 506 does not support failover. Connection capabilities for the PIX 506 are as follows Maximum clear-text throughput 100 Mbps Maximum throughput (DES) 20 Mbps Maximum throughput (3DES) 17 Mbps...

Cisco PIX 525

The Cisco PIX 525 Firewall is an enterprise firewall. It provides perimeter security for large enterprise networks. The PIX 525 is rack-mountable in a 2U (3.5-inch) configuration. It has a 600-MHz processor, up to 256 MB of RAM, and 16 MB of Flash memory. It has two fixed 10 100 Ethernet interfaces. The two fixed interfaces are Ethernet 0, which is the outside interface by default, and Ethernet 1, which is the inside interface by default. The PIX 525 also includes three PCI slots for the...

Cisco PIX 535

The Cisco PIX 535 Firewall is the ultimate enterprise firewall designed for enterprise networks and service providers. The PIX 535 is rack-mountable and fits a 3U configuration. It has a 1-GHz processor, up to 1 GB of RAM, and 16 MB of Flash memory. It has nine PCI slots for the installation of up to ten Ethernet interfaces. It has a 9600-baud console port that is used for local device management. The PIX 535 can be configured for failover using a failover cable connected to the 115-kbps serial...

Cisco ASA 5510 Security Appliance

The Cisco ASA 5510 Security Appliance is an advanced firewall and VPN solution designed for small to medium-size businesses, as well as remote offices. The ASA 5510 is a powerful security device, running on a 1.6-GHz Celeron processor, with up to 256 MB of RAM and 64 MB of Flash memory. The ASA 5510 can be configured for failover only with the Cisco ASA 5510 Security Plus license upgrade. The ASA 5510 does not support the Security Context feature. No VLAN support is available for the ASA 5510...

Server Functions

The Security Appliance version 6.3 VPN Server supports the following functionality Mode Configuration version 6 Extended Authentication (XAUTH) version 6 Internet Key Exchange (IKE) dead peer detection (DPD) Split tunneling control Initial contact Group-based policy control Dead peer detection (DPD) enables two IPSec peers to determine if each other is still alive during the lifetime of the VPN connection. This functionality is useful to clean up valuable VPN resources that are allocated to a...

Installing Cisco Secure ACS Version 33 on Windows Server

You can download a 90-day trial version of Cisco Secure ACS from the Cisco Software Center at Cisco.com. You must register as a user to receive your CCO login. You must have the CCO login to download software from the software center. The installation of Cisco Secure ACS is an easy, step-by-step process. It is a good idea to verify that your Windows server is up to the current patch level. When you are ready to begin the installation, just run setup.exe. Figure 17-3 shows the initial Cisco...

Cisco PIX Firewall Models and Features

Cisco has named its family of security firewalls Security Appliances, encompassing both the PIX and ASA Security Appliances. Currently, six models of the Cisco PIX Firewall are available. Additionally, three models have been introduced in the new series of ASA Security Appliances. All these models provide services for users ranging from the small office home office (SOHO) to the enterprise network and Internet service provider (ISP) Cisco Secure PIX 501 Intended for SOHO use and incorporates an...

Step 5 Assign a NetBIOS Name Server

Microsoft's Common Internet File System (SMB CIFS) requires a NetBIOS Name Server (NBNS) for queries to map a NetBIOS name to IP addresses. WebVPN will use NetBIOS to access or allow file sharing through a WebVPN connection. The initial NBNS server configured will be the primary server, and all subsequent servers will be considered redundant backups. The ASA 55X0 supports three NBNS server entries. NBNS entries are assigned in WebVPN mode nested in global-configuration mode. To assign an NBNS...

Configuring URLFiltering Policy

You must identify and enable the URL-filtering server before you use the following filtering commands. If all URL-filtering servers are removed, any associated filtering commands are also removed. The filter url command enables you to prevent outbound users from accessing URLs that you designate as inadmissible. The syntax for filtering URLs is as follows filter url port except local-ip local-mask foreign-ip foreign-mask allow proxy-block longurl-truncate longurl-deny cgi-truncate With URL...

Accessing a Cisco Security Appliance with Telnet

You can manage Security Appliance by using Telnet from hosts on any internal interface. With Internet Protocol Security (IPSec) configured, you can use Telnet to administer the console of a Cisco Security Appliance remotely from lower-security interfaces. To access the Security Appliance using a Telnet connection, you have to first configure the PIX Firewall for Telnet access Step 1 Enter the PIX Firewall telnet command telnet local-ip mask if-name You can identify a single host or a subnet...

Taking the SNPA Certification Exam

As with any Cisco certification exam, it is best to be thoroughly prepared before taking the exam. There is no way to determine exactly which questions are on the exam, so the best way to prepare is to have a good working knowledge of all subjects covered on the exam. Schedule yourself for the exam and be sure to be rested and ready to focus when taking the exam. You can track your certification progress by checking https www.certmanager.net cisco_s login.html. You will have to create an...

Supported Encryption Algorithms

Both ESP and AH can be configured to use a specific encryption algorithm and hash algorithms. An encryption algorithm is the mathematical algorithm used to encrypt and decrypt the data. The hash algorithm is used to ensure data integrity. NOTE The Cisco Security Appliance requires an activation key (license) to implement the IPSec features. Refer to Chapter 3, Cisco Security Appliance for the specific licenses available for each firewall model. The Security Appliance supports the following...

Optional Firewall Components

Cisco offers five optional components for use with the PIX 515E, 525, or 535 models. These components can increase the performance and functionality of the PIX Firewall. The five optional components include the following VPN Accelerator Card (VAC) The VAC is a card that fits into a PCI slot of the PIX 515E through 535 firewall appliances and increases VPN performance and security by segregating the processing required for the VPN from all other traffic traversing the firewall. The VAC supports...

Stateful Packet Inspection

Stateful packet inspection, also called stateful packet filtering, provides the best combination of security and performance because connections are not only applied to an ACL but also logged in to a small database known as the state table. After a connection is established, all session data is compared to the state table. If the session data does not match the state table information for that connection, the connection is dropped. Figure 2-3 depicts, using the OSI reference model, how traffic...

Creating a Boothelper Disk Using a Windows PC

The boothelper disk, as described earlier in this chapter, provides assistance for Cisco PIX Firewall models 510 and 520 running PIX software version 5.0(x) or version 4.x to be upgraded to a newer version Step 1 Go to the Cisco website and download the rawrite.exe utility, which you use to write the PIX Firewall binary image to a floppy disk (you must have a Cisco.com account to do this). Step 2 Download the PIX Firewall binary image (.bin file) that corresponds to the software version to...

Console Access Authentication

The final type of AAA authentication is for direct connections to the Cisco Security Appliance. It is very important to restrict access to the firewall as much as possible. One way to increase your firewall's security is to require all access to the firewall to be authenticated by an AAA server. Console access is traditionally password protected however, the aaa authentication console command prompts the user to authenticate differently, depending on the method used to access the Security...

Cisco ASA Security Model Capabilities

The following sections describe the characteristics and capabilities of each firewall in the ASA Security Appliance family. The throughput speeds mentioned for each model refer to the speeds at which the firewall can process the data with most services enabled. The addition of an AIP-SSM module will reduce an interface's throughput speeds if enabled. All the ASA Security Appliances feature the same chassis (see Figure 3-14). Figure 3-14 ASA Security Appliance 55X0 Front Panel Figure 3-14 ASA...

Using ASDM to Configure the Cisco Security Appliance

The Cisco Security Appliance ASDM Startup Wizard, shown in Figure 15-4, walks you through the initial configuration of your Cisco Security Appliance. You are prompted to enter information about your Security Appliance. The Startup Wizard applies these settings, so you should be able to start using your Security Appliance right away. Figure 15-4 Cisco Security Appliance Adaptive Security Device Manager Startup Wizard Figure 15-4 Cisco Security Appliance Adaptive Security Device Manager Startup...

Configuring Login Banners on the Cisco Security Appliance

PIX Firewall version 6.3 introduced support for message-of-the-day (MOTD), EXEC, and login banners, similar to the feature included in Cisco IOS Software. Banner size is limited only by available system memory or Flash memory. You can create a message as a warning for unauthorized use of the firewall. In some jurisdictions, civil and or criminal prosecution of crackers who break into your system are made easier if you have incorporated a warning banner that informs unauthorized users that their...

Configuring the Cisco Security Appliance to Send Syslog Messages to a Log Server

Configuring a Security Appliance to send logging information to a server helps you collect and maintain data that can later be used for forensic and data traffic analysis. The Security Appliance syslog messages are usually sent to a syslog server or servers. The Security Appliance uses UDP port 514 by default to send syslog messages to a syslog server. The syntax for configuring the Security Appliance Firewall to send syslog messages to a syslog server is as follows Pixfirewall(config) Logging...

Password Recovery Procedure for a Diskless PIX Firewall PIX 501 506 506E 515E 515 525 and 535

Step 1 Start the terminal-emulation software, and connect your portable computer or PC to the console port of the PIX Firewall. Step 2 After you power on the Cisco PIX Firewall and the startup messages appear, send a BREAK character or press the Esc key. The monitor> prompt is displayed. Step 3 At the monitor> prompt, use the interface command to specify which interface the PIX Firewall traffic should use. Step 4 Use the address command to specify the IP address of the PIX Firewall...

Configuring the ASDM to View Logging

The ASDM Log panel, shown in Figure 10-1, allows you to view syslog messages that are captured in the ASDM Log buffer in the Security Appliance memory. You may select the level of syslog messages you want to view. When you view the ASDM Log, all the buffered syslog messages at and below the logging level you choose are displayed. r-nb < .< * _ > ,> . 1 CKHI> .tMi > -tK . ' J-h -IM J rj MID hirHllipi d 1 J1 .i r 'j i i' d hr1 The ASDM logging panel has the following fields Logging...

ASDM Overview

ASDM is a graphical configuration tool that is designed to help you set up, configure, and monitor your Cisco Security Appliance. It is installed as a separate software image on the Security Appliance and resides in the Flash memory of all firewall units running software version 7.0 and higher. A standalone or browser-based Java applet can be used as a client to access the ASDM graphical user interface (GUI) for configuration. ASDM uses tables, drop-down menus, and task-oriented selection menus...

ASDM Installation

Before installing ASDM, follow these steps Step 1 Save or print your Security Appliance configuration and write down your activation key. Step 2 If you are upgrading from a previous version of Security Appliance software, you must obtain the ASDM software from Cisco in the same way you download the Security Appliance software. Then, use TFTP to download the image to your Security Appliance unit. Step 3 If you upgrade your Cisco Security Appliance Software to version 7.0 and you plan to use...

Identifying the URLFiltering Server

The url-server command designates the server that is running the N2H2 or Websense URL-filtering application. The Security Appliance allows you to configure a maximum of 16 URL servers (with the first one entered being the primary URL server), and you can use only one URL-filtering server at a time, either N2H2 or Websense. Configuration is performed both on the Security Appliance and the URL-filtering server. You can identify more than one URL-filtering server by entering the url-server command...

Cisco Secure Access Control Server

Cisco Secure ACS is an AAA server product developed by Cisco that can run on Windows NT 2000 Server and UNIX, although Cisco has discontinued support for the Windows NT and UNIX platforms. It supports a number of NASs, including the Cisco Security Appliance. Cisco Secure ACS supports both RADIUS and TACACS+. Cisco has replaced the UNIX platform with the Cisco Secure ACS Solution Engine Server. The server is a standalone 1U server with Cisco Secure ACS 3.3 preinstalled. With the release of Cisco...

Using ASDM to Create a Remote Access VPN

With a remote-access VPN, your local Cisco Security Appliance provides secure connectivity between individual remote users and the LAN resources protected by your local Security Appliance. To start the VPN Wizard, go to the wizard's menu on ASDM and select the VPN Wizard option Step 1 From the opening window of the ASDM VPN Wizard, shown in Figure 15-27, select the Remote Access VPN radio button to create a remoteaccess VPN configuration. This configuration enables secure remote access for VPN...

Configuring IPS Through ASDM

The AIP-SSM module can be configured for IPS features through the CLI or on an ASDM window. It is recommended that the administrator configure the IPS features through the ASDM as it removes most of the user error that can come from direct CLI configurations, like typos. To use the ASDM for configuration, the module will require an HTTPS web server to be enabled, as shown in Example 19-8 in the preceding section, as well as for the HTTPS web server to have an IP address that is accessible on...

Sysopt connection permitipsec Command

The sysopt command reconfigures the system options. The command sysopt connection permit-ipsec implicitly permits all packets that arrive from the IPSec tunnel to bypass any checking of access lists, conduits, or access-group command statements for IPSec connections. If the sysopt connection permit-ipsec command is not specified, an explicit rule (conduit or ACL) must be coded to allow the traffic arriving from the IPSec tunnel through the firewall. Example 13-5 shows the current configuration...

Nameif Command

As the name intuitively indicates, the nameif command is used to name an interface. The outside and inside interfaces are named by default and have default security values of 0 and 100, respectively. By default, the interfaces have their hardware ID. Ethernet 0 is the outside interface, and Ethernet 1 is the inside interface. The names that are configured by the nameif command are user-friendly and are easier to use for advanced configuration later. NOTE The nameif command can also be used to...