HackingDNA

Pentest Notes: Nikto Commands

2021-05-26T12:50:00.003-07:00

A very short post related on Nikto scan, here we have mentioned few Nikto commands

root@hdna# nikto

root@hdna# nikto -Help //To view nikto help or options

root@hdna# nikto -h http://10.10.10.10 //Scan Target using Nikto

root@hdna# nikto -h http://10.10.10.10/index.php?page=arbitrary-file-inclusion.php -Tuning 5 -Display V

//Check the remote file retrieval in verbose mode

root@hdna# nikto -h http://10.10.10.10/index.php?page=arbitrary-file-inclusion.php -Tuning 5 -o nikto.html -Format htm //Save the scan result in .html format

More commands will added later.

This post is just for educational purpose only.

Pentest Notes: SMBMAP

2021-05-12T01:21:00.007-07:00

Useful commands to recon the SMP (Port 445) protocol.

smbmap -u guest -p "" -d . -H 10.10.10.10 //Running smbmap tool to discover all shared folders and drives with guest account.

smbmap -u administrator -p pass@1233 -d . -H 10.10.10.10 //Running smbmap tool with valid creds

smbmap -H 10.10.10.10 -u administrator -p pass@1233 -x 'ipconfig //Execute commands

smbmap -H 10.10.10.10 -u Administrator -p 'pass@1233' -L //List all drives

smbmap -H 10.10.10.10 -u Administrator -p 'pass@1233' -r 'C$ //List content of C drive

smbmap -H 10.10.10.10 -u Administrator -p 'pass@1233' --upload '/root/testsample.txt' 'C$\testsample.txt' //Upload a test sample file

smbmap -H 10.10.10.10 -u Administrator -p 'pass@1233' --download 'C$\testsample.txt' //Download a testsample file

Reference

GitHub - ShawnDEvans/smbmap: SMBMap is a handy SMB enumeration tool

Pentest Notes: SMB Recon with NMAP

2021-05-12T00:58:00.004-07:00

SMB Protocol [445] - SMB RECON NOTES

nmap -p445 --script smb-protocols 10.0.10.10 //Nmap script to list the supported protocols and dialects of an SMB server

nmap -p445 --script smb-security-mode 10.0.10.10 //Nmap security mode script to return the information about the SMB security level

nmap -p445 --script smb-enum-sessions 10.10.10.10 //Nmap script to enumerating the users logged into a system through an SMB share

nmap -p445 --script smb-enum-shares 10.10.10.10 //Enumerate shares

Enumerate Information using below commands (Required credentials)

nmap -p445 --script smb-enum-sessions --script-args smbusername=administrator,smbpassword=password@1233 10.10.10.10 // //Nmap script to enumerating the users logged into a system through an SMB share

nmap -p445 --script smb-enum-shares --script-args smbusername=administrator,smbpassword=password@1233 10.10.10.10 //Scanning all shares with valid creds to check the permission (Read / Write)

nmap -p445 --script smb-enum-users --script-args smbusername=administrator,smbpassword=password@12333 10.10.10.10 //Enumerate Windows Users

nmap -p445 --script smb-server-stats --script-args smbusername=administrator,smbpassword=password@12333 10.10.10.10 //Enumerate Server statistics

nmap -p445 --script smb-enum-domains --script-args smbusername=administrator,smbpassword=password@12333 10.10.10.10 //Enumerate domains on target machine

nmap -p445 --script smb-enum-groups --script-args smbusername=administrator,smbpassword=password@12333 10.10.10.10 //Enumerate User Groups

nmap -p445 --script smb-enum-services --script-args smbusername=administrator,smbpassword=password@12333 10.10.10.10 //Enumerate Services

nmap -p445 --script smb-enum-shares,smb-ls --script-args smbusername=administrator,smbpassword=password@12333 10.10.10.10 //Enumerate Share folder and drives

Pentest Notes: RDP Bruteforce and Access via xfreerdp client

2021-05-12T00:53:00.003-07:00

Bruteforce RDP using HYDRA

Example 1:

hDNA# hydra -L /usr/share/metasploit-framework/data/wordlists/common_users.txt -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt rdp://10.10.10.10 -s 3389

Example 2:

hydra -L /usr/share/metasploit-framework/data/wordlists/common_users.txt -P /usr/share/metasploit-framework/data/wordlists/unix_passwords.txt rdp://10.10.10.10

Access RDP via xfeerdp Client

xfreerdp /u:administrator /p:$$@#23233kejWE /v:10.10.1010:3389

Checkpoint - Management & Stealth Rule

2021-04-13T10:54:00.006-07:00

Checkpoint - Management & Stealth Rule

This video shows how to:
[+] Create Management Rule
[+] Create Stealth Rule
[+] Create Section Title (Management Rule, Stealth Rule, Internet Rule, Cleanup Rule)

This video is also added to our Checkpoint Series

Link: https://www.gullynetworkers.com/2019/09/checkpoint-lab-on-eve-ng.html

THIS TUTORIAL IS JUST FOR EDUCATIONAL PURPOSE ONLY/-

Check Point Firewall - Secure Configuration Review

2021-04-13T10:52:00.006-07:00

Check Point Firewall - Secure Configuration Review

This video shows how to perform secure configuration audit using Nipper Studio.
For the testing, we have created our scenario, place windows server and installed Nipper to review the Check Point Firewall (R80.10) version (on EVE-NG test environment).

Go through the video for more details:

THIS TUTORIAL IS JUST FOR EDUCATIONAL PURPOSE ONLY/-

Palo Alto Lab on EVE-NG

2021-04-13T10:51:00.001-07:00

Palo Alto Lab on EVE-NG

Introduction

In this video series on Palo Alto firewall. Here we posted multiple videos to cover firewall and its features.

Palo Alto - Setup Palo Alto Lab on EVE-NG
This video shows:
[+] how to create lab on EVE-NG
[+] how to place device on EVE-NG
[+] how to connect devices with each other.
[+] devices details such as version, ram, interface details.

PaloAlto - Start and Configure Palo Alto Network Topology

This video shows:

[+] how to start devices on EVE-NG.

[+] how to assign IP on Windows Machine (Admin_PC and TEST_PC).

[+] Configure Palo Alto Firewall Management Interface [+] Access Palo Alto Firewall using Chrome web browser from management interface [+] Create L3 Zones [+] Create IP address objects [+] Create Virtual Router [+] Configure Interface Management Profile (Optional) [+] Create TAG (LAN, DMZ, WAN). [+] Commit the changes on Palo Alto Firewall [+] Verify Connectivity

PaloAlto - Configure Static Route and NAT

This video shows:

[+] how to configure static route

[+] how to configure NAT

[+] verify the connectivity between PC and Firewall

[+] verify the connectivity between PC to Public Server.

Palo Alto - Add and Delete User

This video shows:

[+] how to add and delete users from Palo Alto Firewall

PaloAlto - Install ADDS Role in Server 2016

This video shows:

[+] how to install ADDS Role in Server 2016

Palo Alto - Install NPS Role in Server 2016

This video shows:

[+] how to install NPS Role in server 2016

Palo Alto - Local Admin With External Authentication

This video shows:

[+] how to authenticate user from external AD server.

Palo Alto - Local Admin With External Authentication

[+] Learn how to block team viewer application on Palo Alto Firewall.

THIS TUTORIAL IS JUST FOR EDUCATIONAL PURPOSE ONLY/-

PaloAlto Firewall - Configuration Audit using Nipper Studio

2021-04-13T10:49:00.004-07:00

PaloAlto Firewall - Configuration Audit using Nipper Studio

This video shows how to perform remote configuration audit using nipper studio. We tested on PanOS 8.1.0 version (on EVE-NG test environment).

Old Post: - Nipper Studio Installation on MACOS

https://www.hackingdna.com/2021/04/nipper-studio-installation-on-macos.html

If you want to create your own environment, you can start with these posts and videos for Palo Alto.

How to configure Palo Alto Firewall
https://www.hackingdna.com/2021/04/httpswwwbloggercomblogpostedit415272019.html
https://www.hackingdna.com/2021/04/palo-alto-configure-static-route-nat.html

New - Palo Alto Lab on EVE-NG
https://www.hackingdna.com/2021/04/palo-alto-lab-on-eve-ng.html

THIS TUTORIAL IS JUST FOR EDUCATIONAL PURPOSE ONLY/-

CheckPoint Lab on EVE-NG

2021-04-13T10:41:00.001-07:00

CheckPoint Lab on EVE-NG

Checkpoint Network Topology

Introduction

In this video series on Checkpoint firewall. From here you will learn:

[+] How to create network topology on EVE-NG

[+] Configuration of Checkpoint Gateway and Security Management Server.

[+] Connect Checkpoint Gateway to Internet using Static Route.

[+] Download and Install Smart console on Admin PC.
[+] How to Add user, reset password, create custom role and assign custom role.
[+] How to shutdown devices on EVE-NG

Checkpoint - Create Lab for CheckPoint Firewall on EVE-NG
In this video, the following task we are going to do:
[+] Create Lab for CheckPoint Firewall on EVE-NG
[+] Add Checkpoint Firewall
[+] Add Switches
[+] Add Windows PC's
[+] Connect all nodes or devices with each other.
[+] Add Text Description which include IP address, Names etc.
[+] Start all the nodes.

Configure the CheckPoint Primary Gateway

[+] Configure the Network Interface (eth0) in CLI.
[+] Take GUI access of firewall from Admin PC (104.0.0.5).
[+] Configure First Time Wizard and access Gaia Portal.

Checkpoint - Configure Security Management Server (SMS)
In this video, we are going to configure Checkpoint Security Management Server on EVE-NG.
[+] Check connectivity from Check Point Primary Gateway to Internet.

CheckPoint - Download & Install Smartconsole

In this video we discuss how to can complete the below tasks:

[+] Configure the Network Interfaces

[+] Download & Install Smart console on ADMIN-PC (104.0.0.5) and connect to Security Management

CheckPoint - User Management
In this video, the task is:
[+] Change admin password and verify
[+] Add new User
[+] Reset New User Password
[+] Create new custom role
[+] Assign custom role to new user and verify

CheckPoint - Configure LAN PC and CheckPoint Firewall to reach Internet

In this video, we are going to do the following tasks:

[+] Configure LAN PC

[+] Check connectivity between TEST-PC and CP-Gateway

[+] Check the role of Clean up rule in Smart Console

[+] Create rule for Management Network

[+] Create rule for access internet from LAN to WAN network

[+] Check connectivity from TEST-PC to Internet (8.8.8.8)

CheckPoint - Management & Stealth Rule on EVE-NG
This video shows how to:
[+] Create Management Rule
[+] Create Stealth Rule
[+] Create Section Title (Management Rule, Stealth Rule, Internet Rule, Cleanup Rule)

CheckPoint - Shutdown Devices on EVE-NG

This video shows how to shutdown devices on EVE-NG

[+] Shutdown CheckPoint Firewall via GUI

[+] Shutdown CheckPoint Firewall via CLI

[+] Shutdown Switch via right click and click on stop option.

[+] Shutdown All Devices together on EVE-NG

THIS TUTORIAL IS JUST FOR EDUCATIONAL PURPOSE ONLY/-

GRE with IPSec Lab on EVE-NG

2021-04-13T10:39:00.003-07:00

GRE with IPSec Lab on EVE-NG

Objective

To configure GRE with IPSec on EVE-NG

To complete the task, we have divided the configuration is divided in two parts. Both the task are uploaded in the YouTube.

Part 1: Basic Lab Configuration which include:

1. Changes Hostname
2. Configure Interfaces (physical, loopback and tunnel)
3. Configure static route
4. Verify Connectivity
5. Configure EIGRP protocol
6. Verify Connectivity between R1 and R3 loopbacks.

See the below video for more details:

Part 2: ISAKMP & IPSSEC Configuration

Step 1: Define ISAKMP Policy on Router R1 & R3
Step 2: Define pre-share key on a per peer basis on Router R1 & R3
Step 3: Configure Transform Sets on Router R1 & R3
Step 4: Create IPSec Profile on Router R1 & R3

Step 5: Assign IPSec Profile on Tunnel Interfaces

THIS TUTORIAL IS JUST FOR EDUCATIONAL PURPOSE ONLY/-

GRE Without IPSEC Lab on EVE-NG

2021-04-13T10:38:00.001-07:00

GRE Without IPSEC Lab on EVE-NG

Configuration Video

GRE Encapsulation on GNS3 Lab

https://www.hackingdna.com/2021/04/generic-routing-encapsulation-gre-lab.html

GRE Encapsulation with IPSec Lab on GNS3

https://www.hackingdna.com/2021/04/generic-routing-encapsulation-gre-with.html

THIS TUTORIAL IS JUST FOR EDUCATIONAL PURPOSE ONLY/-

Policy Based Site to Site VPN Between ASA and Router

2021-04-13T10:35:00.000-07:00

Policy Based Site to Site VPN Between ASA and Router

R1 Router
Router>en
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname R1
R1(config)#
R1(config)#int fa0/0
R1(config-if)#ip add 10.11.11.1 255.255.255.0
R1(config-if)#no shut
R1(config-if)#exit
R1(config)#
R1(config)#
*Sep 17 19:28:12.943: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Sep 17 19:28:13.943: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
R1(config)#
R1(config)#ip route 0.0.0.0 0.0.0.0 10.11.11.10
R1(config)#exit
R1#

ISP Router

Router#config t

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#hostname ISP

ISP(config)#

ISP(config)#int fa0/0

ISP(config-if)#ip add 192.1.12.2 255.255.255.0

ISP(config-if)#no shut

ISP(config-if)#exit

ISP(config)#

*Sep 17 19:30:43.343: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up

*Sep 17 19:30:44.343: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up

ISP(config-if)#exit

ISP(config)#

ISP(config)#int fa1/0

ISP(config-if)#ip add 192.1.23.2 255.255.255.0

ISP(config-if)#no shut

ISP(config-if)#exit

ISP(config)#

*Sep 17 19:31:03.307: %LINK-3-UPDOWN: Interface FastEthernet1/0, changed state to up

*Sep 17 19:31:04.307: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0, changed state to up

ISP(config)#

R3 Router
Router>en
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname R3
R3(config)#int fa0/0
R3(config-if)#ip add 192.1.23.3 255.255.255.0
R3(config-if)#no shut
R3(config-if)#exit
R3(config)#
*Sep 17 19:31:44.739: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Sep 17 19:31:46.035: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
R3(config)#
R3(config)#int loopback 0
R3(config-if)#
*Sep 17 19:32:47.411: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up
R3(config-if)#ip add 10.11.20.3 255.255.255.0
R3(config-if)#exit
R3(config)#
R3(config)#ip route 0.0.0.0 0.0.0.0 192.1.23.2

R3(config)#

ASA Firewall

ASa(config)# hostname ASA

ASA(config)# int g0/0

ASA(config-if)# nameif inside

INFO: Security level for "inside" set to 100 by default.

ASA(config-if)# ip add 10.11.11.10 255.255.255.0

ASA(config-if)# no shut

ASA(config-if)# exit

ASA(config)#

ASA(config)# int g0/1

ASA(config-if)# nameif outside

INFO: Security level for "outside" set to 0 by default.

ASA(config-if)# ip add 192.1.12.10 255.255.255.0

ASA(config-if)# no shut

ASA(config-if)# exit

ASA(config)#

ASA(config)# route outside 0 0 192.1.12.2

ASA(config)#

Verify Reachability

VPN Configuration on router R3

Configure ISAKMP Policy
R3(config)#crypto isakmp policy 10
R3(config-isakmp)#?
ISAKMP commands:
authentication Set authentication method for protection suite
default Set a command to its defaults
encryption Set encryption algorithm for protection suite
exit Exit from ISAKMP protection suite configuration mode
group Set the Diffie-Hellman group
hash Set hash algorithm for protection suite
lifetime Set lifetime for ISAKMP security association
no Negate a command or set its defaults
R3(config-isakmp)#hash md5
R3(config-isakmp)#authentication pre-share
R3(config-isakmp)#group 2
R3(config-isakmp)#lifetime 86400
R3(config-isakmp)#encryption 3des
R3(config-isakmp)#

Define Key and Peer Address

R3(config)#crypto isakmp key 0 cisco123 address 192.1.12.10

R3(config)#

Configure Transform Set

R3(config)#crypto ipsec transform-set TSET esp-3des esp-md5-hmac

R3(cfg-crypto-trans)#

Configure ACL

R3(config)#access-list 101 permit ip host 10.11.20.3 host 10.11.11.1

R3(config)#

Configure Crypto Map

R3(config)#crypto map CMAP 10 ipsec-isakmp

% NOTE: This new crypto map will remain disabled until a peer

and a valid access list have been configured.

R3(config-crypto-map)#

R3(config-crypto-map)#?

Crypto Map configuration commands:

default Set a command to its defaults

description Description of the crypto map statement policy

dialer Dialer related commands

exit Exit from crypto map configuration mode

match Match values.

no Negate a command or set its defaults

qos Quality of Service related commands

reverse-route Reverse Route Injection.

set Set values for encryption/decryption

R3(config-crypto-map)#

R3(config-crypto-map)#set transform-set TSET

R3(config-crypto-map)#set peer 192.1.12.10

R3(config-crypto-map)#match address 101

R3(config-crypto-map)#exit

R3(config)#

R3(config)#int fa0/0

R3(config-if)#crypto map CMAP

R3(config-if)#

*Sep 17 20:00:38.851: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON

R3(config-if)#exit

R3(config)#

Configure VPN on ASA Firewall

ASA(config)# int g0/0

ASA(config-if)# crypto ikev1 ?

configure mode commands/options:

am-disable Disable inbound aggressive mode connections

enable Enable IKEv1 on the specified interface

ipsec-over-tcp Enable and configure IPSec over TCP

limit Enable limits on IKEv1 SAs

policy Set IKEv1 policy suite

ASA(config-if)# crypto ikev1 policy 10

ASA(config-ikev1-policy)#

ASA(config-ikev1-policy)# hash md5

ASA(config-ikev1-policy)# authentication pre-share

ASA(config-ikev1-policy)# group 2

ASA(config-ikev1-policy)# lifetime 86400

ASA(config-ikev1-policy)# encryption 3des

ASA(config-ikev1-policy)#

Configure Tunnel Group

ASA(config)# tunnel-group 192.1.23.3 type ipsec-l2l

ASA(config)# tunnel-group 192.1.23.3 ipsec-attributes

ASA(config-tunnel-ipsec)# ikev1 pre-shared-key 0 cisco123

ASA(config-tunnel-ipsec)#

Configure Transform Set

ASA(config)# crypto ipsec ikev1 transform-set TSET esp-3des esp-md5-hmac

ASA(config)#

Configure ACL

ASA(config)# access-list TUNNEL-ACL permit ip host 10.11.11.1 host 10.11.20.3

ASA(config)#

Configure Crypto MAP and attach to Interface

ASA(config)# crypto map CMAP 10 match address TUNNEL-ACL

ASA(config)# crypto map CMAP 10 set peer 192.1.23.3

ASA(config)# crypto map CMAP 10 set ikev1 transform-set TSET

ASA(config)# crypto map CMAP interface outside

Enable ikev1 on Interface

ASA(config)# crypto ikev1 enable outside

ASA(config)#

Verify Connectivity

Policy Based Site to Site VPN Between ASA and Router Youtube Video.

THIS TUTORIAL IS JUST FOR EDUCATIONAL PURPOSE ONLY/-

Palo Alto - Configure Static Route & NAT

2021-04-13T10:33:00.001-07:00

Palo Alto - Configure Static Route & NAT

Objective

In this post, we are going to configure the static route and network address translation to reach to the internet from LAN to WAN.

We divided the configuration in two parts as follows;

Lab 1: Configure Static Route

Lab 2: Connect LAN network to WAN

For basic Palo Alto configuration, follow our last post;

https://www.gullynetworkers.com/2019/09/configure-palo-alto-firewall.html

Lab 1: Configure Static Route

Add Static Route:

To add static route, Goto > Network > Virtual Routers > Custom_RTR > Static Route > Add the details as mentioned in the below image:

Lab 2: Connect LAN network to WAN

Create Policy

Ping Google.com - Still unable to reach internet because there was no NAT configured on the firewall. Private IP (10.11.11.5) cannot reach to google.com (216.58.196.174) public ip address directly.

To resolve this issue we need to configure NAT.

Configure Dynamic NAT

Verify Connectivity from LAN to WAN

Monitor - Goto monitor tab to see more details about the connection

THIS TUTORIAL IS JUST FOR EDUCATIONAL PURPOSE ONLY/-

Configure Palo Alto Firewall

2021-04-13T10:31:00.001-07:00

Configure Palo Alto Firewall

Objective
The following are the things we going to do in this post:

[+] Setup a basic topology in eve-ng
[+] Configure Palo Alto Firewall Management Interface
[+] Access PA Firewall using Chrome web browser from management interface
[+] Create L3 Zones
[+] Create IP address objects
[+] Create Virtual Router
[+] Configure Interface Management Profile (Optional)
[+] Create TAG (LAN, DMZ, WAN).
[+] Commit the changes
[+] Verify Connectivity

Network Topology

Configure and Access Palo Alto Firewall interface

Login Palo Alto Firewall using default Credentials

Set IP Address

Verify Command

Access Palo Alto firewall using chrome web browser

Create L3 Zones
Create LAN Zone

Create WAN Zone

Create DMZ Zone

Create Object for IP Address
LAN_IP

Object - DMZ_IP

WAN

Create Virtual Routers

Create LAN Profile

WAN Profile

DMZ Profile

Create Tags

Configure Interface
LAN Interface

DMZ Interface

WAN Interface

Commit Changes

Configure IP Address and Verify Connectivity between PC to Firewall

DMZ Router Configuration
DMZ Router
Router>en
Router#
Router#show ip int br
Interface IP-Address OK? Method Status Protocol
FastEthernet0/0 unassigned YES unset administratively down down
FastEthernet0/1 unassigned YES unset administratively down down
Router#
Router#configure t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname dmz
dmz(config)#

Configure Interface

dmz#config t

Enter configuration commands, one per line. End with CNTL/Z.

dmz(config)#int f0/0

dmz(config-if)#ip add 192.168.30.3 255.255.255.0

dmz(config-if)#no shut

dmz(config-if)#exit

dmz(config)#

*Mar 1 02:23:59.707: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up

*Mar 1 02:24:00.707: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up

dmz(config)#

Verify

dmz(config)#do sh ip int br

Interface IP-Address OK? Method Status Protocol

FastEthernet0/0 192.168.30.3 YES manual up up

FastEthernet0/1 unassigned YES unset administratively down down

dmz(config)#

Connectivity Between WAN_PC and Palo Alto Firewall Interface

THIS TUTORIAL IS JUST FOR EDUCATIONAL PURPOSE ONLY/-

Configure RIPv2, OSPF and Redistribution on Cisco Firepower Threat Defense

2021-04-13T10:28:00.001-07:00

Configure RIPv2, OSPF and Redistribution on Cisco Firepower Threat Defense

Network Topology

For Basic Device Configuration, follow our last posts:
1. https://www.gullynetworkers.com/2019/08/how-to-integrate-cisco-ftd-and-fmc-on.html
2. https://www.gullynetworkers.com/2019/08/configure-ftd-security-zones-csr-router.html

Check Connectivity Between all the devices
Before starting further configuration, very important step is to check all the devices are up and running especially CSR Routers.

CSR_Inside Router
CSR_Inside#ping 10.11.11.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.11.11.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/21/79 ms
CSR_Inside#

CSR_DMZ Router
CSR_Dmz#ping 192.168.1.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/15/59 ms
CSR_Dmz#

CSR_Outside Router
CSR_Outside#ping 172.16.3.48
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.3.48, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/3/9 ms
CSR_Outside#

Remove Default Route

Because of default static route, we able to reach other devices in a different zones. Before configuring RIP and OSPF, lets remove the default static route.

Command to check Default Route configured or not

CSR_Inside#show running-config | sec ip route

ip route 0.0.0.0 0.0.0.0 10.11.11.10

CSR_Inside#

CSR_Inside#config t

Enter configuration commands, one per line. End with CNTL/Z.

Command to remove Default Route

CSR_Inside(config)#no ip route 0.0.0.0 0.0.0.0 10.11.11.10

CSR_Inside(config)#exit

CSR_Inside#

Verify Default Route (Removed now)

CSR_Inside#show running-config | sec ip route

CSR_Inside#

CSR_DMZ Router

Command to check Default Route configured or not

CSR_Dmz#show running-config | sec ip route

ip route 0.0.0.0 0.0.0.0 192.168.1.10

CSR_Dmz#

CSR_Dmz#config t

Enter configuration commands, one per line. End with CNTL/Z.

Command to remove Default Route

CSR_Dmz(config)#no ip route 0.0.0.0 0.0.0.0 192.168.1.10

CSR_Dmz(config)#exit

CSR_Dmz#

Verify Default Route (Removed now)

CSR_Dmz#show running-config | sec ip route

CSR_Dmz#

Verify connectivity (Not able to ping because we removed default route)

CSR_Inside#ping 192.168.1.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

CSR_Inside#

Routing Table (No Default Route)

CSR_Inside#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

a - application route

+ - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks

C 10.1.1.0/24 is directly connected, Loopback1

L 10.1.1.1/32 is directly connected, Loopback1

C 10.11.11.0/24 is directly connected, GigabitEthernet1

L 10.11.11.7/32 is directly connected, GigabitEthernet1

CSR_Inside#

CSR_Dmz#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

a - application route

+ - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

192.1.1.0/24 is variably subnetted, 2 subnets, 2 masks

C 192.1.1.0/24 is directly connected, Loopback1

L 192.1.1.2/32 is directly connected, Loopback1

192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks

C 192.168.1.0/24 is directly connected, GigabitEthernet1

L 192.168.1.2/32 is directly connected, GigabitEthernet1

CSR_Dmz#

RIPv2 Configuration

Configure Router RIPv2 on CSR_Inside Router

Before configuring RIPv2, let see how many networks we have that we need to advertise.

CSR_Inside#show ip int br

Interface IP-Address OK? Method Status Protocol

GigabitEthernet1 10.11.11.7 YES NVRAM up up

GigabitEthernet2 unassigned YES NVRAM administratively down down

GigabitEthernet3 unassigned YES NVRAM administratively down down

GigabitEthernet4 unassigned YES NVRAM administratively down down

Loopback1 10.1.1.1 YES NVRAM up up

CSR_Inside#

Command to configure Router RIP

CSR_Inside#config t

Enter configuration commands, one per line. End with CNTL/Z.

CSR_Inside(config)#router rip

CSR_Inside(config-router)#version 2

CSR_Inside(config-router)#network 10.0.0.0

CSR_Inside(config-router)#end

CSR_Inside#

FTD (Firepower Threat Defense) Firewall

Below image shows the directly connected routes only when we give the command "show route" on firewall.

Configure RIPv2 on FMC

Save & Deploy from FMC to FTD

Deploy to FTD

Deployed Successfully

Verify Routes - use "show ip route" command to verify the routes om CSR_Inside router.

On FTD

Internal routes are available on Routing Table

Configure OSPF

On CSR_DMZ Router

CSR_Dmz#config t

Enter configuration commands, one per line. End with CNTL/Z.

Before configuring OSPF, let see how many networks we have that we need to advertise.

CSR_Dmz(config-router)#do sh ip int br

Interface IP-Address OK? Method Status Protocol

GigabitEthernet1 192.168.1.2 YES NVRAM up up

GigabitEthernet2 unassigned YES NVRAM administratively down down

GigabitEthernet3 unassigned YES NVRAM administratively down down

GigabitEthernet4 unassigned YES NVRAM administratively down down

Loopback1 192.1.1.2 YES NVRAM up up

CSR_Dmz(config-router)#

CSR_Dmz(config)#router ospf 100

CSR_Dmz(config-router)#network 192.0.0.0 0.255.255.255 area 0

CSR_Dmz(config-router)#end

CSR_Dmz#

On FTD

Configure OSPF On FTD

Navigate to Devices> Device Management > FTDv1 > edit > Routing >OSPF

[+] Click on Process 1

[+] Select OSPF Role ASBR

[+] Click on Add button.

Add Area and configure as shows below:

Add New Network Object

Add Network (DMZ_Subnet) to Selected Network

Select ASBR and configure advanced tab as shown below:

Save and Deploy the changes to FTD through FMC.

OSPF Routes on FTD Firewall

Checking Reachability

Check Connectivity

On CSR_Inside Router

Routing Table

CSR_Inside#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

a - application route

+ - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 10.11.11.10 to network 0.0.0.0

R* 0.0.0.0/0 [120/1] via 10.11.11.10, 00:00:09, GigabitEthernet1

10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks

C 10.1.1.0/24 is directly connected, Loopback1

L 10.1.1.1/32 is directly connected, Loopback1

C 10.11.11.0/24 is directly connected, GigabitEthernet1

L 10.11.11.7/32 is directly connected, GigabitEthernet1

CSR_Inside#

Ping CSR_DMZ (192.168.1.2) physical and loopback (192.1.1.2) address

CSR_Inside#ping 192.168.1.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 14/21/41 ms

CSR_Inside#

CSR_Inside#ping 192.1.1.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.1.1.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 14/32/49 ms

CSR_Inside#

On CSR_DMZ Router

Routing Table

CSR_Dmz#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

a - application route

+ - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 192.168.1.10 to network 0.0.0.0

O*E2 0.0.0.0/0 [110/1] via 192.168.1.10, 00:07:19, GigabitEthernet1

192.1.1.0/24 is variably subnetted, 2 subnets, 2 masks

C 192.1.1.0/24 is directly connected, Loopback1

L 192.1.1.2/32 is directly connected, Loopback1

192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks

C 192.168.1.0/24 is directly connected, GigabitEthernet1

L 192.168.1.2/32 is directly connected, GigabitEthernet1

CSR_Dmz#

Redistribution

Remove Static Route

Goto to RIP and uncheck "Generate Default Route" option and click on save and deploy the change to FTD through FMC.

Deployed Successfully

Default routes removed

Verify Connectivity (Unable to ping because we have removed the default route)

CSR_Inside#ping 192.168.1.2

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

CSR_Inside#

Configure Redistribution

Deploy

Verification on CSR_Inside

CSR_Inside#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

a - application route

+ - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks

C 10.1.1.0/24 is directly connected, Loopback1

L 10.1.1.1/32 is directly connected, Loopback1

C 10.11.11.0/24 is directly connected, GigabitEthernet1

L 10.11.11.7/32 is directly connected, GigabitEthernet1

R 192.1.1.0/24 [120/1] via 10.11.11.10, 00:00:15, GigabitEthernet1

R 192.168.1.0/24 [120/1] via 10.11.11.10, 00:00:15, GigabitEthernet1

CSR_Inside#

Verification on CSR_DMZ Router

CSR_Dmz#show ip route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP

a - application route

+ - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is 192.168.1.10 to network 0.0.0.0

O*E2 0.0.0.0/0 [110/1] via 192.168.1.10, 00:44:11, GigabitEthernet1

10.0.0.0/24 is subnetted, 2 subnets

O E1 10.1.1.0 [110/21] via 192.168.1.10, 00:05:03, GigabitEthernet1

O E1 10.11.11.0 [110/21] via 192.168.1.10, 00:05:03, GigabitEthernet1

192.1.1.0/24 is variably subnetted, 2 subnets, 2 masks

C 192.1.1.0/24 is directly connected, Loopback1

L 192.1.1.2/32 is directly connected, Loopback1

192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks

C 192.168.1.0/24 is directly connected, GigabitEthernet1

L 192.168.1.2/32 is directly connected, GigabitEthernet1

CSR_Dmz#

Ping

THIS TUTORIAL IS JUST FOR EDUCATIONAL PURPOSE ONLY/-

Configure FTD Security Zones & CSR Router Interfaces

2021-04-13T10:25:00.001-07:00

Configure FTD Security Zones & CSR Router Interfaces

Firepower Threat Defence - Network Topology

Devices Details:
Below are the device details that we have used in this post:
[+] Main System: Windows 10 with 32 GB Ram
[+] VM Ware Workstation: 14
[+] EVE-NG Community Edition

IOS Image and Ram Details
[+] Firepower Management Center (FMC) Details

[+] 1 Windows 7
RAM - 600 MB

[ +] 1 Windows Server (DNS)
RAM - 1000 MB

[ +] 3 Switches (3 x 512 = 1536 MB)

[+] Firepower Firepower Threat Defence (FTD) Details

[+] CSR Routers (3 x 3012 = 9036 MB)

Things to Do
Below are the things that we are going to do in this post:
1. Login FTD and FMC Devices
2. Check Connectivity from FTD (150.1.7.10) to FMC (150.1.7.20) and AdminPC (150.1.7.5)
3. On AdminPC, Access FMC ( using Chrome Web Browser)
4. Check Managers are Registers or not
5. Create Security Zone
6. Deploy Changes to FTD
7. On FTD, command to see Interfaces and network details
8. Configure CSR Router Interfaces
[+] CSR_Inside Router
[+] CSR_Outside Router
[+] CSR_DMZ Router

9. Ping all CSR routers from FTD Device
10. Create Loopback interfaces on CSR Routers
[+] Creating loopback interface on CSR_Inside Router
[+] Creating loopback interface on CSR_DMZ Router
[+] Creating loopback interface on CSR_Outside Router

11. Configure Telnet on CSR_DMZ Router
12. Ping and Telnet from CSR_Inside Router to CSR_DMZ Router
13. Add New Policy (INTRUSION PREVENTION) Policy
14. Deploy Policy
15. Telnet & Ping CSR_DMZ Router (192.168.1.2) from CSR_Inside_Router
16. Save and Deploy Changes to FTD

Let's Start
Login FTD and FMC Devices

Check Connectivity from FTD (150.1.7.10) to FMC (150.1.7.20) and AdminPC (150.1.7.5)

On AdminPC, Access FMC ( using Chrome Web Browser)

Check Managers are Registers or not

Network Topology

Create Security Zone
[+] Create Inside Zone

Create Outside and DMZ Security Zone (same way as mentioned above)
[+] Creating Outside and DMZ Security Zone. See the below image for more details.

Configure Interface

Edit Interface IP

Edit Physical Interface for Security Zones (same as above mentioned)

Deploy Changes to FTD

Deploy Changes

On FTD
Interfaces Details
Commands to see interfaces on Firepower Threat Defense Firewall
#show interface ip brief

Network Details
Command to see network details
#show network

Configure CSR Routers
CSR_Inside Router
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname CSR_Inside

CSR_Inside(config)#

CSR_Inside(config)#int g1
CSR_Inside(config-if)#ip add 10.11.11.7 255.255.255.0
CSR_Inside(config-if)#no shutdown
CSR_Inside(config-if)#exit
CSR_Inside(config)#end
CSR_Inside#
*Aug 18 03:41:29.017: %SYS-5-CONFIG_I: Configured from console by console

CSR_Inside(config)#ip route 0.0.0.0 0.0.0.0 10.11.11.10

CSR_Inside(config)#

CSR_Inside#show ip int br

Interface IP-Address OK? Method Status Protocol

GigabitEthernet1 10.11.11.7 YES NVRAM up up

GigabitEthernet2 unassigned YES NVRAM administratively down down

GigabitEthernet3 unassigned YES NVRAM administratively down down

GigabitEthernet4 unassigned YES NVRAM administratively down down

CSR_Inside#

CSR_Inside#ping 10.11.11.10

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.11.11.10, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 2/11/49 ms

CSR_Inside#

Note: In case if device is not coming up then save the changes using write command and reload the CSR_Inside Router.

CSR_Outside Router
Router>en
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname CSR_Outside

CSR_Outside(config)#

CSR_Outside(config)#int g1
CSR_Outside(config-if)#ip add 172.16.3.48 255.255.255.0
CSR_Outside(config-if)#no shut
CSR_Outside(config-if)#exit
CSR_Outside(config)#end
CSR_Outside#
*Aug 18 03:35:52.560: %SYS-5-CONFIG_I: Configured from console by console
CSR_Outside#
CSR_Outside#show ip int br
Interface IP-Address OK? Method Status Protocol
GigabitEthernet1 172.16.3.48 YES manual down down
GigabitEthernet2 unassigned YES unset administratively down down
GigabitEthernet3 unassigned YES unset administratively down down
GigabitEthernet4 unassigned YES unset administratively down down
CSR_Outside#

Note: In case if device is not coming up then save the changes using write command and reload the CSR_Inside Router.

Command to Reload Router

CSR_Outside#reload

Proceed with reload? [confirm]

*Aug 18 03:56:41.544: %SYS-5-RELOAD: Reload requested by console. Reload Reason: Reload Command.

CSR_Outside#show ip int br

Interface IP-Address OK? Method Status Protocol

GigabitEthernet1 172.16.3.180 YES NVRAM up up

GigabitEthernet2 unassigned YES NVRAM administratively down down

GigabitEthernet3 unassigned YES NVRAM administratively down down

GigabitEthernet4 unassigned YES NVRAM administratively down down

CSR_Outside#

CSR_Outside#ping 172.16.3.48

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.3.48, timeout is 2 seconds:

.!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 2/5/14 ms

CSR_Outside#

CSR_DMZ Router
Router>
Router>en
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#hostname CSR_Dmz
CSR_Dmz(config)#
CSR_Dmz(config)#int g1
CSR_Dmz(config-if)#ip add 192.168.1.2 255.255.255.0
CSR_Dmz(config-if)#no shut
CSR_Dmz(config-if)#exit
CSR_Dmz(config)#end
CSR_Dmz#

*Aug 18 04:09:18.775: %SYS-5-CONFIG_I: Configured from console by console
CSR_Dmz#
*Aug 18 04:09:24.752: %LINK-3-UPDOWN: Interface GigabitEthernet1, changed state to up
*Aug 18 04:09:25.752: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1, changed state to up
CSR_Dmz#
CSR_Dmz#show ip int br
Interface IP-Address OK? Method Status Protocol
GigabitEthernet1 192.168.1.2 YES manual up up
GigabitEthernet2 unassigned YES unset administratively down down
GigabitEthernet3 unassigned YES unset administratively down down
GigabitEthernet4 unassigned YES unset administratively down down
CSR_Dmz#

CSR_Dmz(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.10

CSR_Dmz(config)#

CSR_Dmz(config)#exit

CSR_Dmz#

CSR_Dmz#ping

*Aug 18 04:11:52.467: %SYS-5-CONFIG_I: Configured from console by console

CSR_Dmz#

CSR_Dmz#ping 192.168.1.10

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.10, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/19/91 ms

CSR_Dmz#

Ping all CSR routers from FTD device

Create Loopback on CSR Routers

Creating loopback interface on CSR_Inside Router
CSR_Inside#config t
Enter configuration commands, one per line. End with CNTL/Z.
CSR_Inside(config)#interface loopback 1
CSR_Inside(config-if)#
*Aug 18 04:24:14.893: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to up
CSR_Inside(config-if)#ip add 10.1.1.1 255.255.255.0
CSR_Inside(config-if)#end
CSR_Inside#
*Aug 18 04:24:31.093: %SYS-5-CONFIG_I: Configured from console by console
CSR_Inside#show ip int br
Interface IP-Address OK? Method Status Protocol
GigabitEthernet1 10.11.11.7 YES NVRAM up up
GigabitEthernet2 unassigned YES NVRAM administratively down down
GigabitEthernet3 unassigned YES NVRAM administratively down down
GigabitEthernet4 unassigned YES NVRAM administratively down down
Loopback1 10.1.1.1 YES manual up up

CSR_Inside#

Create loopback interface on CSR_DMZ Router
CSR_Dmz(config)#int loopback 1
CSR_Dmz(config-if)#
*Aug 18 04:27:21.401: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to up
CSR_Dmz(config-if)#ip add 192.1.1.2 255.255.255.0
CSR_Dmz(config-if)#end
CSR_Dmz#
CSR_Dmz#show ip int br
Interface IP-Address OK? Method Status Protocol
GigabitEthernet1 192.168.1.2 YES manual up up
GigabitEthernet2 unassigned YES unset administratively down down
GigabitEthernet3 unassigned YES unset administratively down down
GigabitEthernet4 unassigned YES unset administratively down down
Loopback1 192.1.1.2 YES manual up up

CSR_Dmz#

Create loopback interface on CSR_Outside Router

CSR_Outside(config)#int loopback 1
CSR_Outside(config-if)#
*Aug 18 04:29:54.728: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to up
CSR_Outside(config-if)#ip add 172.1.1.3 255.255.255.0
CSR_Outside(config-if)#end
CSR_Outside#
CSR_Outside#
*Aug 18 04:30:09.025: %SYS-5-CONFIG_I: Configured from console by console
CSR_Outside#show ip int br
Interface IP-Address OK? Method Status Protocol
GigabitEthernet1 172.16.3.180 YES NVRAM up up
GigabitEthernet2 unassigned YES NVRAM administratively down down
GigabitEthernet3 unassigned YES NVRAM administratively down down
GigabitEthernet4 unassigned YES NVRAM administratively down down
Loopback1 172.1.1.3 YES manual up up

CSR_Outside#

Configure Telnet on CSR_DMZ Router

CSR_Dmz(config)#line vty 0 4

CSR_Dmz(config-line)#password cisco

CSR_Dmz(config-line)#transport input all

CSR_Dmz(config-line)#end

CSR_Dmz#

Ping and Telnet from CSR_Inside Router to CSR_DMZ Router

Ping 192.168.1.2 (CSR_DMZ) Router from 10.11.11.7 (CSR_Inside) Router

Telnet 192.168.1.2 (CSR_DMZ) Router from 10.11.11.7 (CSR_Inside) Router

On FMC

Here is the reason why telnet and ping are not working because we have configured policy "BLOCK_ALL_TRAFFIC" which will not allow any interzone traffic.

FTD Policies - BLOCK_ALL_TRAFFIC

Add New Policy (INTRUSION PREVENTION) Policy

Goto Policies > Access Control > New Policy

Enter Details as mentioned in the screenshot

Click "Yes" button to create policy on FMC

Policy "INTRUSION_PREV" created successfully

Observe "BLOCK_ALL_TRAFFIC" Policy have 0 target device and "INTRUSION_PREV" have 1 target device

Deploy Policy

Click "Deploy" button to deploy on FTD Firewall

FTD Deployment in progress (15%)

FTD Deployment in progress (95%)

FTD Deployment Completed

Telnet CSR_DMZ Router

Telnet CSR_DMZ Router (192.168.1.2) from CSR_Inside Router (10.11.11.7)

Ping

Ping CSR_DMZ to CSR_Inside Router

CSR_Dmz#ping 10.11.11.7

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.11.11.7, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 2/14/26 ms

CSR_Dmz#

How to Block all traffic Again

If want to Block_all_traffic again, below are the steps as follows:

Goto FMC > Policies > Access Control > click edit icon of "BLOCK_ALL_TRAFFIC".

Click on edit icon of "BLOCK_ALL_TRAFFIC"

Click "Yes" button

Save and Deploy Changes to FTD

Click Deploy button to apply policies on FTD Firewall

Policy Deployed Successfully

Telnet Blocked

At the End

we will see how to shutdown FTD and FMC using command line:

Note: This is just for learning purpose, use this post for knowledge only. Don't run directly on Production devices ;D

THIS TUTORIAL IS JUST FOR EDUCATIONAL PURPOSE ONLY/-

How to Integrate Cisco FTD and FMC on EVE-NG

2021-04-13T10:19:00.003-07:00

How to Integrate Cisco FTD and FMC on EVE-NG

Objective
In this post we are going to do following activities:
1. Deploy FTD (Firepower Threat Defense v6.3) on eve-ng.
2. Deploy FMC (Firepower Management Center v6.3) on eve-ng.
3. Integrate FTD in FMC.

Network Topology
Below is the basic topology we are going to configure.

FTD v6.3.0

Login Firepower FMC

Configure FMC
Below image shows how to configure FMC:
Step 1: Login with default username (admin) and Default password: Admin123
Step 2: Enter command: #sudo configure-network
Step 3: Enter password: Admin123
Step 4: Enter "y" key and press enter button.

Step 5: Enter Management IP address: 150.1.7.20
Step 6: Enter Management netmask: 255.255.255.0
Step 7: Enter default gateway: 150.1.7.10
Step 8: Confirm the settings are correct by pressing "y" and press enter key
Step 9: For IPv6 press "n" key.

Check connectivity with Cisco FTD and FMC
Below image shows that, we have connectivity between FMC and FTD from AdminPC (150.1.7.5).

Login FMC on web browser
Step 1: Enter url https://150.1.7.20 and press the "Proceed to 150.1.7.20".

Step 2: Enter Username (admin) and Password (Admin123) and click on Login button.

Change FMC Default Password
Enter New Password: Cisc0123
Confirm: Cisc0123

Network Settings
Enter Network Settings
Hostname: firepower
Domain: gullynetworkers.com
Primary DNS Server: 150.1.7.75

Configure Time Settings:

Set My clock: Manually

Set display Time Zone: Asia/Kolkata

Accept End User License Agreement and click on apply

Summary Dashboard
Once all details are configured, FMC device takes few minutes and Summary Dashboard will appear on AdminPC.

System > Configuration > Information

Time

Configure Banner on FMC
System > Login Banner > Enter the text banner and click on save button and logout.

Banner Configured on FMC Successfully

Firepower Threat Defence (FTD) Configuration
Login FTD using default username and password (Username: admin, Password: Admin123)

Accept End User License Agreement (EULA)
Enter "YES" to accept the EULA.

Configure Firepower Threat Defence (FTD)
Step 1: Enter new password: Cisc0123
Step 2: Confirm new password: Cisc0123
Step 3: Press "y" key to configure IPv4 address.
Step 4: Press "n" key to not configure IPv6 address.
Step 5: Enter "manual" and press enter key to configure IPv4 address manually.
Step 6: Enter IPv4 address for the management interface: 150.1.7.10
Step 7: Enter netmask: 255.255.255.0
Step 8: Enter IPv4 default gateway address: 150.1.7.1
Step 9: Enter hostname: ftd
Step 10: Enter DNS Server address: 150.1.7.75

Configure DNS

Command to see Information
#show network

Checking Connectivity Between Cisco FTD and other devices (FMC, AdminPC and Win Server 2016)

Connection between AdminPC and FMC are working

Connection between AdminPC and DNS Server are working

Connection between Cisco AdminPC and FTD are working

Add Manager
Step 1: Command to see manager on Cisco FTD: #show managers
Step 2: Configure manager using following command:
#configure manager add 150.1.7.20 cisco

Check FTD is reachable from AdminPC after configuring manager

Enable Evaluation Mode

Click on "evaluation Mode" button to activate.

Click "Yes" button

Evaluation Mode Enabled Successfully

Integrate FTD with FMC

Step 1: Goto FMC > Devices > Add > Devices

Enter device details and create a new policy ("BLOCL_ALL_TRAFFIC).

Click on "Register" button

Integration in progress

FTD Deployed Successfully

THIS TUTORIAL IS JUST FOR EDUCATIONAL PURPOSE ONLY/-

Configure Dynamic PAT on Cisco ASA Firewall

2021-04-13T10:17:00.002-07:00

Configure Dynamic PAT on Cisco ASA Firewall

For the initial configuration, follow our last post.

https://www.hackingdna.com/2021/04/configure-dynamic-nat-on-cisco-asa.html

Please note: Here initial configuration are as follows;

Configuration of Interfaces on Cisco routers and Cisco ASA Firewall.

EIGRP configuration on router and Cisco ASA Firewall.

SSH Telnet and HTTP/HTTPS configuration on Cisco Routers.

Lets check few output before starting "Dynamic PAT" configuration:

Ensure that no object, nat rule access-list is defined before starting Dynamic PAT configuration.

Commands to verify object, nat and access list are mentioned below:

ASA1(config)# show running-config object

ASA1(config)#

ASA1(config)# show running-config nat

ASA1(config)#

ASA1(config)# show running-config access-list

ASA1(config)#

ASA1(config)# show xlate

0 in use, 1 most used

ASA1(config)#

Check the reachability before starting between firewall routers and PC's.

Firewall to Router R1

ASA1(config)# ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 10/10/10 ms

ASA1(config)#

Inside Network

Firewall to PC1

ASA1(config)# ping 192.168.101.100

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.101.100, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/22/30 ms

ASA1(config)#

Outside Network

Firewall to Router R3

ASA1(config)# ping 101.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 101.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 10/12/20 ms

ASA1(config)#

Firewall to PC2

ASA1(config)# ping 102.1.1.100

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 102.1.1.100, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/26/40 ms

ASA1(config)#

DMZ1 Network

ASA1(config)# ping 102.1.1.100

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 102.1.1.100, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/26/40 ms

DMZ2 Network

ASA1(config)# ping 192.168.10.100

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.10.100, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 10/14/30 ms

ASA1(config)#

ASA1(config)# ping 192.168.20.100

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.20.100, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 10/18/40 ms

ASA1(config)#

Network Topology

Here network topology is same we used in out last post:

Link: https://www.gullynetworkers.com/2019/08/configure-dynamic-nat-on-cisco-asa.html

Lets start Dynamic PAT configuration on Cisco ASA Firewall

Cisco ASA Firewall

Create Objects

ASA1(config)# object network R1-inside

ASA1(config-network-object)# subnet 192.168.1.0 255.255.255.0

ASA1(config-network-object)#

ASA1(config-network-object)# object network R1-inside-lan

ASA1(config-network-object)# subnet 192.168.101.0 255.255.255.0

ASA1(config-network-object)#

ASA1(config-network-object)# object network R2-dmz1

ASA1(config-network-object)# subnet 192.168.10.0 255.255.255.0

ASA1(config-network-object)#

ASA1(config-network-object)# object network R4-dmz2

ASA1(config-network-object)# subnet 192.168.20.0 255.255.255.0

ASA1(config-network-object)#

Verify Objects

ASA1(config)# show running-config object

object network R1-inside

subnet 192.168.1.0 255.255.255.0

object network R1-inside-lan

subnet 192.168.101.0 255.255.255.0

object network R2-dmz1

subnet 192.168.10.0 255.255.255.0

object network R4-dmz2

subnet 192.168.20.0 255.255.255.0

ASA1(config)#

Create NAT Rule

ASA1(config)# object network R1-inside

ASA1(config-network-object)# nat (inside,outside) dynamic interface

ASA1(config-network-object)#

ASA1(config-network-object)# object network R1-inside-lan

ASA1(config-network-object)# nat (inside,outside) dynamic interface

ASA1(config-network-object)#

ASA1(config-network-object)# object network R2-dmz1

ASA1(config-network-object)# nat (inside,outside) dynamic interface

ASA1(config-network-object)#

ASA1(config-network-object)# object network R4-dmz2

ASA1(config-network-object)# nat (inside,outside) dynamic interface

ASA1(config-network-object)#

Verify NAT Rule

ASA1(config)# show running-config nat

object network R1-inside

nat (inside,outside) dynamic interface

object network R1-inside-lan

nat (inside,outside) dynamic interface

object network R2-dmz1

nat (inside,outside) dynamic interface

object network R4-dmz2

nat (inside,outside) dynamic interface

ASA1(config)#

Verify connectivity after configure NAT Rule

Translation Table

Command to see translation table: #show xlate

Ping Not Work

ICMP is blocked, so whenever if we try to ping the destination router (101.1.1.1), firewall will blocked.

Configure ACL to Allow PC1 to ping Router R3

ASA1(config)# access-list 11 permit icmp any object R1-inside-lan

ASA1(config)#access-list 11 permit icmp any object R1-inside

ASA1(config)# access-group 11 in interface outside

ASA1(config)#

Verify using ping utility

R1#ping 102.1.1.100

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 102.1.1.100, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 28/34/48 ms

R1#

Cisco ASA Firewall running config file for references

ASA1# show running-config

: Saved

: Serial Number: 9ABCX4AL3KJ

: Hardware: ASAv, 2048 MB RAM, CPU Pentium II 3191 MHz

ASA Version 9.6(1)

hostname ASA1

enable password 8Ry2YjIyt7RRXU24 encrypted

names

interface GigabitEthernet0/0

nameif inside

security-level 100

ip address 192.168.1.2 255.255.255.0

interface GigabitEthernet0/1

nameif dmz1

security-level 60

ip address 192.168.10.1 255.255.255.0

interface GigabitEthernet0/2

nameif outside

security-level 0

ip address 101.1.1.100 255.255.255.0

interface GigabitEthernet0/3

nameif dmz2

security-level 50

ip address 192.168.20.1 255.255.255.0

interface GigabitEthernet0/4

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet0/5

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet0/6

shutdown

no nameif

no security-level

no ip address

interface Management0/0

management-only

shutdown

no nameif

no security-level

no ip address

ftp mode passive

object network R1-inside

subnet 192.168.1.0 255.255.255.0

object network R1-inside-lan

subnet 192.168.101.0 255.255.255.0

object network R2-dmz1

subnet 192.168.10.0 255.255.255.0

object network R4-dmz2

subnet 192.168.20.0 255.255.255.0

access-list 11 extended permit icmp any object R1-inside

access-list 11 extended permit icmp any object R1-inside-lan

pager lines 23

mtu inside 1500

mtu dmz1 1500

mtu outside 1500

mtu dmz2 1500

no failover

no monitor-interface service-module

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

object network R1-inside

nat (inside,outside) dynamic interface

object network R1-inside-lan

nat (inside,outside) dynamic interface

object network R2-dmz1

nat (inside,outside) dynamic interface

object network R4-dmz2

nat (inside,outside) dynamic interface

router eigrp 101

network 192.168.1.0 255.255.255.0

network 192.168.10.0 255.255.255.0

network 192.168.20.0 255.255.255.0

redistribute static metric 1 1 1 1 1

route outside 0.0.0.0 0.0.0.0 101.1.1.1 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

user-identity default-domain LOCAL

no snmp-server location

no snmp-server contact

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpoint _SmartCallHome_ServerCA

no validation-usage

crl configure

crypto ca trustpool policy

auto-import

crypto ca certificate chain _SmartCallHome_ServerCA

certificate ca 6ecc7aa5a7032009b8cebcf4e952d491

308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130

0d06092a 864886f7 0d010105 05003081 ca310b30 09060355 04061302 55533117

30150603 55040a13 0e566572 69536967 6e2c2049 6e632e31 1f301d06 0355040b

13165665 72695369 676e2054 72757374 204e6574 776f726b 313a3038 06035504

0b133128 63292032 30303620 56657269 5369676e 2c20496e 632e202d 20466f72

20617574 686f7269 7a656420 75736520 6f6e6c79 31453043 06035504 03133c56

65726953 69676e20 436c6173 73203320 5075626c 69632050 72696d61 72792043

65727469 66696361 74696f6e 20417574 686f7269 7479202d 20473530 1e170d31

30303230 38303030 3030305a 170d3230 30323037 32333539 35395a30 81b5310b

30090603 55040613 02555331 17301506 0355040a 130e5665 72695369 676e2c20

496e632e 311f301d 06035504 0b131656 65726953 69676e20 54727573 74204e65

74776f72 6b313b30 39060355 040b1332 5465726d 73206f66 20757365 20617420

68747470 733a2f2f 7777772e 76657269 7369676e 2e636f6d 2f727061 20286329

3130312f 302d0603 55040313 26566572 69536967 6e20436c 61737320 33205365

63757265 20536572 76657220 4341202d 20473330 82012230 0d06092a 864886f7

0d010101 05000382 010f0030 82010a02 82010100 b187841f c20c45f5 bcab2597

a7ada23e 9cbaf6c1 39b88bca c2ac56c6 e5bb658e 444f4dce 6fed094a d4af4e10

9c688b2e 957b899b 13cae234 34c1f35b f3497b62 83488174 d188786c 0253f9bc

7f432657 5833833b 330a17b0 d04e9124 ad867d64 12dc744a 34a11d0a ea961d0b

15fca34b 3bce6388 d0f82d0c 948610ca b69a3dca eb379c00 48358629 5078e845

63cd1941 4ff595ec 7b98d4c4 71b350be 28b38fa0 b9539cf5 ca2c23a9 fd1406e8

18b49ae8 3c6e81fd e4cd3536 b351d369 ec12ba56 6e6f9b57 c58b14e7 0ec79ced

4a546ac9 4dc5bf11 b1ae1c67 81cb4455 33997f24 9b3f5345 7f861af3 3cfa6d7f

81f5b84a d3f58537 1cb5a6d0 09e4187b 384efa0f 02030100 01a38201 df308201

db303406 082b0601 05050701 01042830 26302406 082b0601 05050730 01861868

7474703a 2f2f6f63 73702e76 65726973 69676e2e 636f6d30 12060355 1d130101

ff040830 060101ff 02010030 70060355 1d200469 30673065 060b6086 480186f8

45010717 03305630 2806082b 06010505 07020116 1c687474 70733a2f 2f777777

2e766572 69736967 6e2e636f 6d2f6370 73302a06 082b0601 05050702 02301e1a

1c687474 70733a2f 2f777777 2e766572 69736967 6e2e636f 6d2f7270 61303406

03551d1f 042d302b 3029a027 a0258623 68747470 3a2f2f63 726c2e76 65726973

69676e2e 636f6d2f 70636133 2d67352e 63726c30 0e060355 1d0f0101 ff040403

02010630 6d06082b 06010505 07010c04 61305fa1 5da05b30 59305730 55160969

6d616765 2f676966 3021301f 30070605 2b0e0302 1a04148f e5d31a86 ac8d8e6b

c3cf806a d448182c 7b192e30 25162368 7474703a 2f2f6c6f 676f2e76 65726973

69676e2e 636f6d2f 76736c6f 676f2e67 69663028 0603551d 11042130 1fa41d30

1b311930 17060355 04031310 56657269 5369676e 4d504b49 2d322d36 301d0603

551d0e04 1604140d 445c1653 44c1827e 1d20ab25 f40163d8 be79a530 1f060355

1d230418 30168014 7fd365a7 c2ddecbb f03009f3 4339fa02 af333133 300d0609

2a864886 f70d0101 05050003 82010100 0c8324ef ddc30cd9 589cfe36 b6eb8a80

4bd1a3f7 9df3cc53 ef829ea3 a1e697c1 589d756c e01d1b4c fad1c12d 05c0ea6e

b2227055 d9203340 3307c265 83fa8f43 379bea0e 9a6c70ee f69c803b d937f47a

6decd018 7d494aca 99c71928 a2bed877 24f78526 866d8705 404167d1 273aeddc

481d22cd 0b0b8bbc f4b17bfd b499a8e9 762ae11a 2d876e74 d388dd1e 22c6df16

b62b8214 0a945cf2 50ecafce ff62370d ad65d306 4153ed02 14c8b558 28a1ace0

5becb37f 954afb03 c8ad26db e6667812 4ad99f42 fbe198e6 42839b8f 8f6724e8

6119b5dd cdb50b26 058ec36e c4c875b8 46cfe218 065ea9ae a8819a47 16de0c28

6c2527b9 deb78458 c61f381e a4c4cb66

quit

telnet timeout 5

ssh stricthostkeycheck

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

dynamic-access-policy-record DfltAccessPolicy

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns migrated_dns_map_1

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns migrated_dns_map_1

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

service-policy global_policy global

prompt hostname context

call-home reporting anonymous prompt 1

call-home

profile CiscoTAC-1

no active

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

profile License

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

destination transport-method http

Cryptochecksum:a30e7fa5d04fe84c72f6b924a60bab70

: end

ASA1#

Method II: To configure Dynamic PAT on Cisco ASA Firewall

Another way to configure Dynamic PAT is below:

First clear the access-list, nat, object and xlate
ASA1(config)# clear configure access-list
ASA1(config)# clear configure nat
ASA1(config)# clear configure object
ASA1(config)# clear configure xlate
ASA1(config)#

Create Objects

ASA1(config)# object network R1-inside

ASA1(config-network-object)# subnet 192.168.1.0 255.255.255.0

ASA1(config-network-object)#

ASA1(config-network-object)# object network R1-inside-lan

ASA1(config-network-object)# subnet 192.168.101.0 255.255.255.0

ASA1(config-network-object)#

ASA1(config-network-object)# object network R2-dmz1

ASA1(config-network-object)# subnet 192.168.10.0 255.255.255.0

ASA1(config-network-object)#

ASA1(config-network-object)# object network R4-dmz2

ASA1(config-network-object)# subnet 192.168.20.0 255.255.255.0

ASA1(config-network-object)# exit

ASA1(config)#

Define NAT Rules

ASA1(config)# nat (inside,outside) source dynamic R1-inside interface

ASA1(config)#

ASA1(config)# nat (inside,outside) source dynamic R1-inside-lan interface

ASA1(config)#

ASA1(config)# nat (inside,outside) source dynamic dmz1 interface

ASA1(config)#

ASA1(config)# nat (inside,outside) source dynamic R2-dmz1 interface

ASA1(config)#

ASA1(config)# nat (inside,outside) source dynamic R4-dmz2 interface

ASA1(config)#

ASA1(config)# show running-config object

object network R1-inside

subnet 192.168.1.0 255.255.255.0

object network R1-inside-lan

subnet 192.168.101.0 255.255.255.0

object network R2-dmz1

subnet 192.168.10.0 255.255.255.0

object network R4-dmz2

subnet 192.168.20.0 255.255.255.0

ASA1(config)#

ASA1(config)# show running-config nat

nat (inside,outside) source dynamic R1-inside interface

nat (inside,outside) source dynamic R1-inside-lan interface

nat (inside,outside) source dynamic R2-dmz1 interface

nat (inside,outside) source dynamic R4-dmz2 interface

ASA1(config)#

Configure ACL to allow ICMP

ASA1(config)# access-list 11 permit icmp any object R1-inside

ASA1(config)# access-list 11 permit icmp any object R1-inside-lan

ASA1(config)# access-list 11 permit icmp any object R2-dmz1

ASA1(config)# access-list 11 permit icmp any object R4-dmz2

ASA1(config)#

ASA1(config)# access-group 11 in interface outside

ASA1(config)#

R1#ping 101.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 101.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 4/11/16 ms

R1#

Method III: Configure Dynamic PAT without Object

Command to clear access-list, NAT rule, and objects

ASA1(config)# clear configure access-list

ASA1(config)# clear configure nat

ASA1(config)# clear configure object

Re-check to verify no old NAT rule, access-list and groups are there in the configuration:

ASA1(config)# show running-config object

ASA1(config)#

ASA1(config)# show running-config nat

ASA1(config)#

ASA1(config)# show running-config access-list

ASA1(config)#

ASA1(config)# show running-config access-group

ASA1(config)#

Define NAT Rule

ASA1(config)# nat (inside,outside) source dynamic any interface

ASA1(config)# nat (dmz1,outside) source dynamic any interface

ASA1(config)# nat (dmz2,outside) source dynamic any interface

ASA1(config)#

Command to Verify

R1#ping 101.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 101.1.1.1, timeout is 2 seconds:

.....

Success rate is 0 percent (0/5)

R1#

R1#telnet 101.1.1.1

Trying 101.1.1.1 ... Open

User Access Verification

Username: user1

Password:

R3#

Create access list to allow ICMP

ASA1(config)# access-list 11 permit icmp any 192.168.0.0 255.255.0.0

ASA1(config)# access-group 11 in interface outside

ASA1(config)#

Ping Router R3 (101.1.1.1) from Router R1 (192.168.1.1)

Ping Router R3 (101.1.1.1) from Router R2 (192.168.10.100)

Translation Table

THIS TUTORIAL IS JUST FOR EDUCATIONAL PURPOSE ONLY/-

Configure Dynamic NAT on Cisco ASA Firewall

2021-04-13T10:14:00.000-07:00

Configure Dynamic NAT on Cisco ASA Firewall

Dynamic NAT Network Topology

Things to Know:

[+] NAT stands for Network Address Translation.

[+] Designed for IP address conservation.
[+] It enabled private IP address that use inregistered IP addresses (For example: Class C internal IP address) to connect to the internet.
[+] NAT provides security (hide entire internal network) and IP address conservation.
[+] In dynamic NAT, private IP addresses are mapped to the pool of public IP addresses.

Objective:

[+] To configure dynamic NAT on Cisco ASA Firewall.

[+] Above screenshot is the network topology which we are going to configure in this post.

[+] This post is for those who want to know how to configure dynamic NAT

Let's Start with Router Configuration

Router R1
Router#config t
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#
Router(config)#hostname R1
R1(config)#

R1(config)#exit
R1#

R1#config t
Enter configuration commands, one per line. End with CNTL/Z.
R1(config)#int f0/0
R1(config-if)#ip add 192.168.1.1 255.255.255.0
R1(config-if)#no shut
R1(config-if)#
*Mar 1 00:10:01.999: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Mar 1 00:10:02.999: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
R1(config-if)#exit
R1(config)#
R1(config)#int f0/1
R1(config-if)#ip add 192.168.101.1 255.255.255.0
R1(config-if)#no shut
R1(config-if)#
*Mar 1 00:10:27.395: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up
*Mar 1 00:10:28.395: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up
R1(config-if)#exit
R1(config)#
R1(config)#int loopback 0
R1(config-if)#
*Mar 1 00:10:42.423: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up
R1(config-if)#ip add 192.168.111.1 255.255.255.0
R1(config-if)#
R1(config-if)#int loopback 1
R1(config-if)#
*Mar 1 00:11:05.451: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback1, changed state to up
R1(config-if)#ip add 192.168.222.1 255.255.255.0
R1(config-if)#

Configure IP Address in Windows PC1

Router R2

Router>

Router>en

Router#config t

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#hostname R2

R2(config)#

R2(config)#int f0/0

R2(config-if)#ip add 192.168.10.100 255.255.255.0

R2(config-if)#no shut

R2(config-if)#exit

R2(config)#

*Mar 1 00:26:38.203: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up

*Mar 1 00:26:39.203: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up

R2(config)#

R2(config)#ip route 0.0.0.0 0.0.0.0 192.168.10.1

R2(config)#

Configure SSH and Telnet on R2

R2(config)#ip domain-name gullynetworkers.com

R2(config)#crypto key generate rsa

The name for the keys will be: R2.gullynetworkers.com

Choose the size of the key modulus in the range of 360 to 2048 for your

General Purpose Keys. Choosing a key modulus greater than 512 may take

a few minutes.

How many bits in the modulus [512]: 1024

% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

R2(config)#

*Mar 1 00:29:48.975: %SSH-5-ENABLED: SSH 1.99 has been enabled

R2(config)#

R2(config)#line vty 0 4

R2(config-line)#transport input ssh telnet

R2(config-line)#login local

R2(config-line)#exit

R2(config)#

Configure Local User

R2(config)#username user1 privilege 15 secret cisco

R2(config)#

Router R3

Router>en

Router#config t

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#hostname R3

R3(config)#

R3(config)#int f0/0

R3(config-if)#ip add 101.1.1.1 255.255.255.0

R3(config-if)#no shut

R3(config-if)#

*Mar 1 00:34:12.751: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up

*Mar 1 00:34:13.751: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up

R3(config-if)#

R3(config-if)#int f0/1

R3(config-if)#ip add 102.1.1.1 255.255.255.0

R3(config-if)#no shut

R3(config-if)#

*Mar 1 00:34:33.867: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up

*Mar 1 00:34:34.867: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up

R3(config-if)#

R3(config-if)#exit

R3(config)#

Configure SSH, Telnet, HTTP and HTTPS Server on R3

R3(config)#ip domain-name hackingdna.com

R3(config)#

R3(config)#crypto key generate rsa

The name for the keys will be: R3.hackingdna.com

Choose the size of the key modulus in the range of 360 to 2048 for your

General Purpose Keys. Choosing a key modulus greater than 512 may take

a few minutes.

How many bits in the modulus [512]: 1024

% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

R3(config)#

*Mar 1 00:37:44.419: %SSH-5-ENABLED: SSH 1.99 has been enabled

R3(config)#

R3(config)#line vty 0 4

R3(config-line)#transport input ssh telnet

R3(config-line)#login local

R3(config-line)#exit

R3(config)#

R3(config)#ip http server

R3(config)#ip http secure-server

% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

R3(config)#

*Mar 1 00:38:33.843: %PKI-4-NOAUTOSAVE: Configuration was modified. Issue "write memory" to save new cert

R3#config t

Enter configuration commands, one per line. End with CNTL/Z.

R3(config)#ip http auth

R3(config)#ip http authentication local

R3(config)#

R3(config)#username user1 privilege 15 secret cisco

R3(config)#exit

R3#

Configure IP Address in Windows PC2

Router R4

Router#config t

Enter configuration commands, one per line. End with CNTL/Z.

Router(config)#hostname R4

R4(config)#

R4(config)#int f0/0

R4(config-if)#ip add 192.168.20.100 255.255.255.0

R4(config-if)#no shut

R4(config-if)#exit

R4(config)#

*Mar 1 00:45:36.343: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up

*Mar 1 00:45:37.343: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up

R4(config)#

R4(config)#ip http server

R4(config)#ip http secure-server

% Generating 1024 bit RSA keys, keys will be non-exportable...[OK]

R4(config)#

*Mar 1 00:55:47.827: %SSH-5-ENABLED: SSH 1.99 has been enabled

*Mar 1 00:55:47.963: %PKI-4-NOAUTOSAVE: Configuration was modified. Issue "write memory" to save new certificate

R4(config)#

R4(config)#ip http authentication local

R4(config)#

Create local user

R4(config)#username user1 privilege 15 secret cisco

R4(config)#exit

R4#

Cisco ASA Firewall

ciscoasa# config t

ciscoasa(config)# hostname ASA1

ASA1(config)#

Inside

ASA1(config)# int g0/0

ASA1(config-if)# nameif inside

INFO: Security level for "inside" set to 100 by default.

ASA1(config-if)# ip add 192.168.1.2 255.255.255.0

ASA1(config-if)# no shut

ASA1(config-if)# exit

ASA1(config)#

DMZ1

ASA1(config)# int g0/1

ASA1(config-if)# no shut

ASA1(config-if)# nameif dmz1

INFO: Security level for "dmz1" set to 0 by default.

ASA1(config-if)# security-level 60

ASA1(config-if)# ip add 192.168.10.1 255.255.255.0

ASA1(config-if)# exit

ASA1(config)#

Outside

ASA1(config)# int g0/2

ASA1(config-if)# no shut

ASA1(config-if)# nameif outside

INFO: Security level for "outside" set to 0 by default.

ASA1(config-if)# ip add 101.1.1.100 255.255.255.0

ASA1(config-if)# route outside 0 0 101.1.1.1

ASA1(config-if)# exit

ASA1(config)#

DMZ2

ASA1(config)# int g0/3

ASA1(config-if)# no shut

ASA1(config-if)# nameif dmz2

INFO: Security level for "dmz2" set to 0 by default.

ASA1(config-if)# security-level 50

ASA1(config-if)# ip add 192.168.20.1 255.255.255.0

ASA1(config-if)# exit

ASA1(config)#

Check Interfaces

All the interfaces are up and running.

ASA1(config)# show int ip brief

Interface IP-Address OK? Method Status Protocol

GigabitEthernet0/0 192.168.1.2 YES manual up up

GigabitEthernet0/1 192.168.10.1 YES manual up up

GigabitEthernet0/2 101.1.1.100 YES manual up up

GigabitEthernet0/3 192.168.20.1 YES manual up up

GigabitEthernet0/4 unassigned YES unset administratively down up

GigabitEthernet0/5 unassigned YES unset administratively down up

GigabitEthernet0/6 unassigned YES unset administratively down up

Management0/0 unassigned YES unset administratively down up

ASA1(config)#

ASA1# show route outside

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route, + - replicated route

Gateway of last resort is 101.1.1.1 to network 0.0.0.0

S* 0.0.0.0 0.0.0.0 [1/0] via 101.1.1.1, outside

C 101.1.1.0 255.255.255.0 is directly connected, outside

L 101.1.1.100 255.255.255.255 is directly connected, outside

ASA1#

Configure EIGRP

Router R1

R1(config)#router eigrp 101

R1(config-router)#no auto-summary

R1(config-router)#network 0.0.0.0

R1(config-router)#exit

R1(config)#

Cisco ASA Firewall

ASA1(config)# router eigrp 101

ASA1(config-router)# no auto-summary

ASA1(config-router)# network 192.168.1.0

ASA1(config-router)# network 192.168.10.0

ASA1(config-router)# network 192.168.20.0

ASA1(config-router)# redistribute static metric 1 1 1 1 1

ASA1(config-router)#

ASA1(config-router)# show route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

ia - IS-IS inter area, * - candidate default, U - per-user static route

o - ODR, P - periodic downloaded static route, + - replicated route

Gateway of last resort is 101.1.1.1 to network 0.0.0.0

S* 0.0.0.0 0.0.0.0 [1/0] via 101.1.1.1, outside

C 101.1.1.0 255.255.255.0 is directly connected, outside

L 101.1.1.100 255.255.255.255 is directly connected, outside

C 192.168.1.0 255.255.255.0 is directly connected, inside

L 192.168.1.2 255.255.255.255 is directly connected, inside

C 192.168.10.0 255.255.255.0 is directly connected, dmz1

L 192.168.10.1 255.255.255.255 is directly connected, dmz1

C 192.168.20.0 255.255.255.0 is directly connected, dmz2

L 192.168.20.1 255.255.255.255 is directly connected, dmz2

D 192.168.101.0 255.255.255.0

[90/281856] via 192.168.1.1, 00:02:52, inside

D 192.168.111.0 255.255.255.0

[90/130816] via 192.168.1.1, 00:02:52, inside

D 192.168.222.0 255.255.255.0

[90/130816] via 192.168.1.1, 00:02:52, inside

ASA1(config-router)#

Check Connectivity Between Routers and both Windows PC

ASA1(config)# ping 192.168.101.100

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.101.100, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/20/20 ms

ASA1(config)#

ASA1(config)# ping 102.1.1.100

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 102.1.1.100, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 20/24/30 ms

ASA1(config)#

ASA1(config)# ping 192.168.10.100

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.10.100, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 10/18/50 ms

ASA1(config)#

ASA1(config)# ping 192.168.20.100

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.20.100, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 10/16/40 ms

ASA1(config)#

ASA1(config)# ping 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 10/10/10 ms

ASA1(config)#

ASA1(config)# ping 101.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 101.1.1.1, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 10/10/10 ms

ASA1(config)#

Configure NAT

Create Objects

ASA1(config)# object network R1-inside

ASA1(config-network-object)# subnet 192.168.1.0 255.255.255.0

ASA1(config-network-object)#

ASA1(config)# object network R1-inside-lan

ASA1(config-network-object)# subnet 192.168.101.0 255.255.255.0

ASA1(config-network-object)#

ASA1(config)# object network R2-dmz1

ASA1(config-network-object)# subnet 192.168.10.0 255.255.255.0

ASA1(config-network-object)#

ASA1(config-network-object)# object network R4-dmz2

ASA1(config-network-object)# subnet 192.168.20.0 255.255.255.0

ASA1(config-network-object)#

Create Object Pool

ASA1(config)# object network ip-pool

ASA1(config-network-object)# range 101.1.1.101 101.1.1.105

ASA1(config-network-object)# exit

ASA1(config)#

Create NAT Rule

ASA1(config)# object network R1-inside

ASA1(config-network-object)# nat (inside,outside) dynamic ip-pool

ASA1(config-network-object)#

ASA1(config-network-object)# object network R1-inside-lan

ASA1(config-network-object)# nat (inside,outside) dynamic ip-pool

ASA1(config-network-object)#

ASA1(config-network-object)# object network R2-dmz1

ASA1(config-network-object)# nat (dmz1,outside) dynamic ip-pool

ASA1(config-network-object)#

ASA1(config-network-object)# object network R4-dmz2

ASA1(config-network-object)# nat (dmz2,outside) dynamic ip-pool

ASA1(config-network-object)# exit

ASA1(config)#

Verification Commands

Commands to see objects configured on Cisco ASA Firewall

#show running-config object

Command to see NAT configuration on Cisco ASA Firewall

#show running-config nat

Enable ICMP using Access List

ASA1(config)# access-list 11 permit icmp any object R1-inside

ASA1(config)# access-list 11 permit icmp any object R1-inside-lan

ASA1(config)# access-list 11 permit icmp any object R2-dmz

ASA1(config)# access-list 11 permit icmp any object R2-dmz1

ASA1(config)# access-list 11 permit icmp any object R4-dmz2

ASA1(config)#

ASA1(config)# access-group 11 in interface outside

ASA1(config)#

Verify Connectivity Between

PC1 (192.168.101.100) to PC2 (102.1.1.100)

Ping R1 (192.168.1.1) to R3 (101.1.1.1)

R1#ping 101.1.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 101.1.1.1, timeout is 2 seconds:

.!!!!

Success rate is 80 percent (4/5), round-trip min/avg/max = 12/14/20 ms

R1#

Command to check Translation Table

Note: In the above xlate table, 2 out of 2 connection is used, so it means we cannot create a another connection.

For Example: See the below screenshot, when we ping again, we are not able to ping because all translation table is in use.

So, the solution is to clear the xlate or Translation table. (please note we are creating example just to understand the concept.)

Command to clear xlate table

ASA1(config)# clear xlate

INFO: 2 xlates deleted

ASA1(config)#

ASA1(config)# show xlate

0 in use, 2 most used

Verify Connectivity after clearing xlate table

Successfully ping 102.1.1.100

Cisco ASA Firewall Running Configuration for References

ASA1# show running-config

: Saved

: Serial Number: 9ABCX4AL3KJ

: Hardware: ASAv, 2048 MB RAM, CPU Pentium II 3191 MHz

ASA Version 9.6(1)

hostname ASA1

enable password 8Ry2YjIyt7RRXU24 encrypted

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

names

interface GigabitEthernet0/0

nameif inside

security-level 100

ip address 192.168.1.2 255.255.255.0

interface GigabitEthernet0/1

nameif dmz1

security-level 60

ip address 192.168.10.1 255.255.255.0

interface GigabitEthernet0/2

nameif outside

security-level 0

ip address 101.1.1.100 255.255.255.0

interface GigabitEthernet0/3

nameif dmz2

security-level 50

ip address 192.168.20.1 255.255.255.0

interface GigabitEthernet0/4

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet0/5

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet0/6

shutdown

no nameif

no security-level

no ip address

interface Management0/0

management-only

shutdown

no nameif

no security-level

no ip address

ftp mode passive

object network R1-inside

subnet 192.168.1.0 255.255.255.0

object network R1-inside-lan

subnet 192.168.101.0 255.255.255.0

object network R2-dmz1

subnet 192.168.10.0 255.255.255.0

object network R4-dmz2

subnet 192.168.20.0 255.255.255.0

object network ip-pool

range 101.1.1.101 101.1.1.105

access-list 11 extended permit icmp any object R1-inside

access-list 11 extended permit icmp any object R1-inside-lan

access-list 11 extended permit icmp any object R2-dmz1

access-list 11 extended permit icmp any object R4-dmz2

pager lines 23

mtu inside 1500

mtu dmz1 1500

mtu outside 1500

mtu dmz2 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

object network R1-inside

nat (inside,outside) dynamic ip-pool

object network R1-inside-lan

nat (inside,outside) dynamic ip-pool

object network R2-dmz1

nat (dmz1,outside) dynamic ip-pool

object network R4-dmz2

nat (dmz2,outside) dynamic ip-pool

access-group 11 in interface outside