Network Security All-in-one: ASA Firepower WSA Umbrella VPN ISE Layer 2 Security

By Redouane MEDDANE

This book is written for Network engineers working in the Security field and to prepare the CCNP Security exam, it includes Cisco ASA Firewall, ASA with FirePOWER, Firepower Threat Defense FTD, Web Security Appliance, VPN Technologies, Cisco ISE, Cisco Umbrella with practice labs in one book with a simple explanation with more than 70 Scenarios.

• Language: English
• Publisher: Lulu.com
• Release date: Apr 28, 2022
• ISBN: 9781435764019

Book preview

Lab 7: Active/Standby Failover

C:\Users\Administrator\Desktop\Topo ASA\topo2.PNG

To provide device redundancy, we can deploy ASA adaptive security appliances in an active/standby or active/active high-availability failover.

In Active/Standby failover, one unit is the active unit, it passes traffic. The standby unit does not actively pass traffic. When a failover occurs, the active unit fails over to the standby unit, which then becomes active.

We can deploy the active/standby in two different active/standby failovers configurations:

1-Stateless failover: stateless failover only provides hardware redundancy. If the active device fails, the standby device becomes actives. All information on tracked connections through the previously device is lost such connection table, NAT table. Therefore the Host applications must start a new connection to restart communication through the newly device because the previously active device did not pass state information.

2-Stateful failover: The stateful failover features extends the stateless failover functionality by continuously passing state information from the active to the standby unit. If a failover occurs, all relevant state information such as connection table and nat table is already available on the newly active unit.

Configuration of Active/Standby failover:

ON ASA-1:

Specify active and standby IP addresses on the inside and outside interfaces:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture1.PNGC:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture2.PNG

Configure a description for the LAN/LINK failover (optional):

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture3.PNG

Verification of the VLAN interfaces on ASA-1:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture4.PNG

Verification of the physical interfaces:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture5.PNG

The following commands are configured to:

1-enable failover.

2-Specify unit as primary.

3-Specify interface used as the failover interface.

4-Specify interface used as the stateful failover interface.

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture6.PNG

ASA-1(config)# failover lan unit primary

ASA-1(config)# failover lan interface LAN-FAILOVER vlan3

INFO: Non-failover interface config is cleared on Vlan3 and its sub-interfaces

ASA-1(config)# failover interface ip LAN-FAILOVER 192.168.99.1 255.255.255.0 standby 192.168.99.2

On ASA-2 the configuration should be done in the global configuration mode:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture7.PNG

On ASA-2:

ASA-2(config# interface GigabitEthernet2

ASA-2(config-if)# description LAN/STATE Failover Interface

1-enable failover.

2-Specify unit as secondary.

3-Specify interface used as the failover interface.

4-Specify interface used as the stateful failover interface.

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture8.PNG

ASA-2(config)# failover lan unit secondary

ASA-2(config)# failover lan interface LAN-FAILOVER vlan3

INFO: Non-failover interface config is cleared on Vlan3 and its sub-interfaces

ASA-2(config)# failover interface ip LAN-FAILOVER 192.168.99.1 255.255.255.0 standby 192.168.99.2

ASA-2(config)#

Let's configure the physical interface e0/2 in VLAN 3:

You should see the message that the Active unit is detected and the replication is done and as a result the hostname of the ASA-2 is changed to be the same as the unit primary ASA-1.

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture9.PNG

Since after replication both devices have the same hostname, you can use the prompt hostname priority state command to distinguish between the primary/secondary and the active/standby device.

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture10.PNG

Let's do the same with the unit primary:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture12.PNG

Verification of the unit secondary, the configuration of the VLANs and physical interfaces is copied into the unit secondary:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture11.PNGC:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture15.PNG

Let's verify the failover status on the unit primary and unit secondary using the show failover command:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture13.PNGC:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture14.PNG

The show failover interface command displays the IP address of each unit of the LAN failover:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture17.PNGC:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture16.PNG

Let's test the replication:

Configure a username with password and enable telnet using local database for the subnet 192.168.1.0/24 on the unit primary:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture19.PNG

ASA-1/pri/act(config)# username admin password cisco

ASA-1/pri/act(config)# telnet 192.168.1.0 255.255.255.0 inside

ASA-1/pri/act(config)# aaa authentication telnet console LOCAL

ASA-1/pri/act(config)# telnet timeout 5

Let's verify the replication on the unit secondary:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture20.PNG

If we issue the write memory command on the unit primary:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture18.PNG

You will see this on the unit secondary:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture22.PNG

Since the telnet configuration is enabled on the unit secondary after replication, we can manage the unit secondary remotely:

Let's launch telnet connection to 192.168.1.2 the IP address of the unit secondary:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture23.PNGC:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture24.PNG

Let's configure auto-nat on the unit primary:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture25.PNG

ASA-1/pri/act(config)# object network INSIDE-NET

ASA-1/pri/act(config-network-object)# subnet 192.168.1.0 255.255.255.0

ASA-1/pri/act(config-network-object)# nat (inside,outside) dynamic interface

Verify the replication of the NAT on the unit secondary:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture26.PNG

Enable ICMP inspection on the unit primary:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture27.PNG

You will this message on the unit secondary:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture30.PNG

Let's verify the ICMP inspection using the show run policy-map command:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture28.PNGC:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture29.PNG

Let's test the connectivity between PC1 and PC2:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture31.PNG

To test the failover issue a ping 100.100.100.10 -t to PC2 let's disable the port Fa0/1 of the switch connected to the unit primary:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture33.PNG

SW1(config)#int Fa0/1

SW1(config-if)#shutdown

SW1(config-if)#

Now we will see this message on the unit primary, this means that it is becoming the Standby ASA:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture34.PNG

Let's verify that the ASA-1 is now the unit secondary:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture35.PNG

And the unit secondary tells us that it is becoming the Active ASA:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture36.PNG

Let's verify that the ASA-2 is now the unit primary:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture37.PNG

When the port of the Switch is enabled, the old unit primary stays in the standby state, which means there is no preemption, in order to force the old Active ASA to be the unit primary we can use the failover active command on ASA-1:

C:\Users\Administrator\Desktop\Nouveau dossier (3)\Failover\Capture38.PNG

Lab 8: Firewal Transparent mode

C:\Users\Administrator\Desktop\Topo ASA\topo1.PNG

By default, an ASA is in the routed firewall mode. It operates at OSI Layer 3, forwarding decisions are based on IP address.

An ASA can also be configured to operate in transparent firewall mode, in this mode it appears as a Layer 2 device.

To enable transparent firewall mode, use the following command:

Capture1

The ASA’s interfaces have no assigned IP addresses, but they can be mapped into one or more logical bridge groups, the Logical bridge group is configured with an IP address so that it will be used for traffic sourced by the transparent firewall itself or destined for management traffic, such as Telnet and SSH.

Let's configure the AS's interfaces, G0/0 interface will face the outside, while G0/1 will face the inside. Both interfaces will be part of bridge group 1.

Capture2

ciscoasa(config)# int g0/0

ciscoasa(config-if)# nameif outside

ciscoasa(config-if)# security-level 0

ciscoasa(config-if)# bridge-group 1

ciscoasa(config-if)# no shut

Capture3

ciscoasa(config)# int g0/1

ciscoasa(config-if)# nameif inside

ciscoasa(config-if)# security-level 100

ciscoasa(config-if)# bridge-group 1

ciscoasa(config-if)# no shut

Let's assign an IP address to bridge group 1:

Capture4

ciscoasa(config)# int bvI 1

ciscoasa(config-if)# ip add 192.168.1.100 255.255.255.0

Verify the the Firewall mode:

Capture5

Verify the configuration of the ASA's interfaces:

Capture6

Verify the bridge group interface:

Capture7

Dynamic routing protocols are not supported in transparent firewall mode. To allow the ASA to communicate with any host that is located outside the local subnet, we should configure a static route, the next-hop is the router R1:

Capture8

ciscoasa(config)# route outside 0 0 192.168.1.1

In transparent firewall mode IP packets are also inspected by ASA’s inspection engines and MPFconfiguration.

Let's test the MPF by enabling ICMP inspection:

Capture9

ciscoasa(config)# fixup protocol icmp

INFO: converting 'fixup protocol icmp ' to MPF commands

ciscoasa(config)#

Let's test the connectivity from PC1 to FTP server:

Capture10

With 8.0 and later, an ASA can integrate Network Address Translation (NAT) with transparent firewall mode.

Let's configure Auto-nat for inside network 192.168.1.0/24:

Notice that we cannot use the IP address of the Bridge group as a mapped IP address, let's choose the IP address 192.168.1.200:

Capture11

ciscoasa(config)# object network TEST

ciscoasa(config-network-object)# subnet 192.168.1.0 255.255.255.0

ciscoasa(config-network-object)# nat (inside,outside) dynamic 192.168.1.200

Let's execute a ping command from PC1 to FTP server:

Capture13

Let's verify the translation using the show xlate commande, the IP address 192.168.1.10 is translated to the PAT IP address 192.168.1.200:

Capture12Capture14

Let's configure FTP inspection:

Creates two regular expressions that match the files .exe and .doc:

Capture18

ciscoasa(config)# regex EXE \.exe

ciscoasa(config)# regex DOC \.doc

Creates a class-map type regex to incorporate the regular expressions:

Capture19

ciscoasa(config)# class-map type regex match-any TEST-REGEX

ciscoasa(config-cmap)# match regex EXE

ciscoasa(config-cmap)# match regex DOC

Let's creates another class-map type inspect to identify the delete FTP command:

Capture16

ciscoasa(config)# class-map type inspect ftp TEST-CLASS

ciscoasa(config-cmap)# match request-command dele

Creates a policy-map type inspect to match the two class-map named TEST-REGEX and TEST-CLASS and use the reset log as an action to prevent a PC1 to download the files .exe and .doc and the FTP command delete:

Capture20

ciscoasa(config)# policy-map type inspect ftp TEST-POLICY

ciscoasa(config-pmap)# match filename regex class TEST-REGEX

ciscoasa(config-pmap-c)# reset log

ciscoasa(config-pmap-c)# class TEST-CLASS

ciscoasa(config-pmap-c)# reset log

Creates an access-list to identify the FTP traffic:

Capture21

Creates a class-map L3/4 that matches the access-list called TEST:

Capture22

ciscoasa(config)# class-map FTP-CLASS

ciscoasa(config-cmap)# match access-list TEST

Creates a policy-map L3/4 and associates the class-map L3/4 called FTP-CLASS:

Capture23

ciscoasa(config-pmap)# policy-map FTP-POLICY

ciscoasa(config-pmap)# class FTP-CLASS

ciscoasa(config-pmap-c)# inspect ftp strict TEST-POLICY

Apply the policy-map L3/4 called FTP-POLICY to inside interface using service-policy command:

Capture24

ciscoasa(config)# service-policy FTP-POLICY interface inside

Access the FTP files from PC1 to PC2 and try to delete a file:

Capture25

The attempts fails because the FTP inspection as shown by the console message displayed by the ASA:

Capture27

Let's try to download a file .docx:

Capture29

Also the attempts fails because the FTP inspection as shown by the following message:

Capture28

Let's try to download a file .rar:

Capture31

The attempts is successful:

Capture30

Let's verify the service policy and the number of packet allowed, and dropped:

Capture32

Like a Switch, an ASA in transparent mode firewall must maintain a MAC address table of the source address learned in each received packet.

Let's verify the MAC address table of the ASA, two entries are added for PC1 and R1:

Capture33

008c.fa29.b453 is the MAC address of PC1:

C:\Users\user\Desktop\ASA m\Capture34.PNG

6412.2599.e4e0 is the MAC address of R1:

C:\Users\user\Desktop\ASA m\Capture35.PNG

Another useful command is the show bridge-group 1 command, it displays the ASA's interfaces mapped in this group and the number of the dynamic learned mac-address entries:

Capture36

To prevent ARP spoofing, we can configure ARP inspection on the ASA. ARP inspection uses static ARP entries, ASA will examine each ARP reply packet and compare the source IP, MAC addresses and the source interface, to the configured static entries in its own ARP table.

By default the ARP table is built dynamically.

Let's ping from PC1 to R1:

Capture37

The show arp command displays two ARP entries for PC1 and R1:

The number 63 is the aging time of the entries:

Capture38

Since only two valid hosts are the router and the PC1, let's define a static ARP entries for PC1 and R1 for ARP inspection. Each entry will associate an IP address with a MAC address:

Capture39

ciscoasa(config)# arp inside 192.168.1.10 008c.fa29.b453

ciscoasa(config)# arp outside 192.168.1.1 6412.2599.e4e0

Let's verify the the ARP table, the static ARP entries never age out as shown by the dash line at the end of each entry:

Capture40

By default, ARP inspection is disabled on all ASA interfaces, let's enable the ARP inspection on the inside and outside interfaces:

Capture41

ciscoasa(config)# arp-inspection inside enable

ciscoasa(config)# arp-inspection outside enable

Let's verify the ARP inspection status on each interface with the show arp-inspection command:

Capture42

Let's change the MAC address of G0/0's R1:

Capture43

R1(config)#int g0/0

R1(config-if)#mac-address 0000.0000.1111

Let's verify that the MAC address of R1 is changed:

Capture44

Let's test the connectivity from PC1 to R1 and FTP server:

Capture46Capture47

If either the MAC address or the IP address is found in the ARP table, but not both in a single entry, the ARP reply contains invalid or spoofed information. Therefore, it is dropped and not forwarded through the ASA. In this case the ARP reply receive by the ASA contains invalid MAC address 0000.0000.1111, so the ARP inspection drops the packets as shown by the console message:

Capture45

Lab 9: ASA FirePOWER module installation

C:\Users\Administrator\Desktop\Nouveau dossier (2)\ASA Source fire\topo.PNG

Configure an IP address to the management interface (by default the ASA 5506 and above comes with the default ip address in the management interface 192.168.1.1).

C:\Users\user\Desktop\ASA\ASA Source fire\2.PNG

If the ASA has the cxsc and the ips modules installed, shudown and uninstall the modules:

ciscoasa#sw-module module cxsc shutdown

ciscoasa#sw-module module cxsc uninstall

ciscoasa#sw-module module ips shutdown

ciscoasa#sw-module module ips uninstall

ciscoasa#reload

Upload the boot image to the ASA appliance 's flash memory, and make it run, you can use FTP or TFTP to copy the image, i already copied the image so let's verify using the show flash command:

C:\Users\user\Desktop\ASA\ASA Source fire\1.PNG

Execute the following commands:

ciscoasa# sw-module module sfr recover configure image flash:asasfr-5500x-boot-5.4.1-211.img

ciscoasa# sw-module module sfr recover boot

C:\Users\user\Desktop\ASA\ASA Source fire\4.PNG

Verify the SFR module using the show module command, we can see that the SFR is not powered on completely and it is in recover state:

C:\Users\user\Desktop\ASA\ASA Source fire\6.PNG

We can use the show module sfr details to verify if the sfr is ready for console session, in this case the console session is not ready:

C:\Users\user\Desktop\ASA\ASA Source fire\7.PNG

We should wait until the console session become ready as shown below:

C:\Users\user\Desktop\ASA\ASA Source fire\8.PNG

To connect to SFR module, we issue a session sfr console command.

Default Username: admin

Default Password: Admin123

Once the default credentials are entered , we get the SFR prompt and begin the basic setup to configure network settings such as IP address, default gateway, domain name.

C:\Users\user\Desktop\ASA\ASA Source fire\9.PNGC:\Users\user\Desktop\ASA\ASA Source fire\10.PNG

We are now ready to copy the FirePOWER package to the module via ftp, This could take some time .

C:\Users\user\Desktop\ASA\ASA Source fire\11.PNG

Now we log to the sfr module again with session sfr console command, the login credentials now are admin/Sourcefire. We need to accept the EULA and walk through the setup process.

C:\Users\user\Desktop\ASA\ASA Source fire\12.PNGC:\Users\user\Desktop\ASA\ASA Source fire\13.PNGC:\Users\user\Desktop\ASA\ASA Source fire\13-1.PNG

At this point, we have completed the installation of the SFR module. And we are prompted to the SFR console. We can issued somme commands to verify the SFR module operation:

The show ifconfig command displays the IP address of the SFR module