ASA

ASA TFTP Backup

2013-05-19T03:53:00.000-07:00

If you have no backup solution, you can still take backup on your machine by executing single command. But before, there some prerequisite which has be fulfill.
1. TFTP software
2. Configuring ASA
For first requirement you can use any freely available. Second you have to make sure, PC on which you are installing tftp you can ping from ASA simply you have connectivity. Than simple execute following command in config mode of ASA:

tftp-server peceuplink <tftp-server-ip> /<filename>

ASA1(config)#tftp-server inside_.1.1 lan 192.168/ASA001.cfg

In above example inside_lan is nameif on inside interface, 192.168.1.1 is tftp server ip and /ASA001.cfg is the file name.

Now in order to send copy of running file to tftp server you have excute write net.

Make sure on your PC the folder has proper privileges.

VPN Site-to-Site IOS

2011-12-17T10:22:00.000-08:00

In this tutorial I am going to show you how we can configure site to site VPN on two IOS routers. In this example I have used 3750 Router in emulated environment.

VPN stands for Virtual Private Network, in which you extend your corporate network across internet in secure fashion. In VPN it has different types and two main types are as follows:

Site-to-Site VPN
Remote Access VPN

Site-to-Site is manly used to do connectivity between HQ and branches. Whereas, Remote Access is mainly used by mobile user, software is installed and proper credentials provided so that they can connect to Corporate Network from anywhere and can access anything they are authorized for.

Following is diagram with related information we need to start with.

So there are following steps your need to do on both routers in order to make them communicate over the Service Provider Network Securely.

Step 1: IKE Phase 1
Step 2: IKE Phase key
Step 3: IKE Phase 2 (transform-set)
Step 4: Interested traffic (which is going to be encrypted in our case network behind our routers will be encrypted)
Step 5: Crypt map
a) Interested traffic
b) Transform Set
c) Peer Address
Step 6: Apply Crypto map to interface

Note: Prior to start my core configuration for VPN, routers are already configured with IP addresses and default routes are also configured on both HQ and branch. So lets test the connectivity first, as it much important in VPN than any other because with VPN there are a lot of pieces which need to be put in at right place so doing verification along the way is best practice.

HQ
----

HQ#ping 10.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/28/48 ms

It’s reaching to ISP router. Gr8, now we will verify Branch side.

Branch#ping 10.1.1.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 16/28/36 ms

Branch is also reaching to its ISP.

Please also find default routes which are configure on the HQ and Branch routers.

HQ#show running-config | include ip route
ip route 0.0.0.0 0.0.0.0 10.1.1.2

Branch#show running-config | include ip route
ip route 0.0.0.0 0.0.0.0 10.1.1.5

Once last step is agree on what parameter will be used for both sides. In our case I agreed on following attributes

Attributes	HQ	Branch
Authentication	Pre-shared	Pre-shared
Encryption	3des	3des
Hash	Md5	Md5
Group	2	2
Transform Set	esp-3des esp-md5-hmac	esp-3des esp-md5-hmac
Interested Traffic	192.168.1.0/24 -> 192.168.2.0/24	192.168.2.0/24 -> 192.168.1.0/24

HQ
!
hostname HQ
! IKE Phase 1
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
! IKE Phase 1 key
crypto isakmp key cisco123 address 10.1.1.6
!
! IKE Phase 2
crypto ipsec transform-set BRANCH esp-3des esp-md5-hmac
! Crypto Map combining all the parameter here
crypto map MYMAP 1 ipsec-isakmp
set peer 10.1.1.6
set transform-set BRANCH
match address 101
! After assigning crypto map under outgoing interface
interface FastEthernet0/0
ip address 10.1.1.1 255.255.255.252
crypto map MYMAP
!
ip route 0.0.0.0 0.0.0.0 10.1.1.2
! Traffice which going to be encrypted
access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
end

BRANCH
!
hostname BRANCH
! IKE Phase 1
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
! IKE Phase 1 key
crypto isakmp key cisco123 address 10.1.1.1
!
! IKE Phase 2
crypto ipsec transform-set HQ esp-3des esp-md5-hmac
! Crypto Map combining all the parameter here
crypto map MYMAP 1 ipsec-isakmp
set peer 10.1.1.1
set transform-set HQ
match address 101
! After assigning crypto map under outgoing interface
interface FastEthernet0/0
ip address 10.1.1.1 255.255.255.252
crypto map MYMAP
!
ip route 0.0.0.0 0.0.0.0 10.1.1.2
! Traffice which going to be encrypted
access-list 101 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255
end

Verification

HQ#show crypto map
Crypto Map "MYMAP" 1 ipsec-isakmp

Peer = 10.1.1.6

Extended IP access list 101

access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

Current peer: 10.1.1.6

Security association lifetime: 4608000 kilobytes/3600 seconds

PFS (Y/N): N

Transform sets={

BRANCH,

}

Interfaces using crypto map MYMAP:

FastEthernet0/0

Same command on Branch router as well.

Branch#show crypto map

Crypto Map "MYMAP" 1 ipsec-isakmp

Peer = 10.1.1.1

Extended IP access list 101

access-list 101 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255

Current peer: 10.1.1.1

Security association lifetime: 4608000 kilobytes/3600 seconds

PFS (Y/N): N

Transform sets={

BRANCH,

}

Interfaces using crypto map MYMAP:

FastEthernet0/0

Now try to ping from HQ to Branch using their loopback IP which we simulated as LAN.

HQ#ping 192.168.2.1 source 192.168.1.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:

Packet sent with a source address of 192.168.1.1

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 64/84/104 ms

Lets try now from Branch

Branch#ping 192.168.1.1 source 192.168.2.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:

Packet sent with a source address of 192.168.2.1

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 64/72/84 ms

Final verification command which shows that indeed secure session has been established as with QM_IDLE state the same.

HQ#show crypto isakmp sa

IPv4 Crypto ISAKMP SA

dst src state conn-id slot status

10.1.1.6 10.1.1.1 QM_IDLE 1001 0 ACTIVE

IPv6 Crypto ISAKMP SA

Branch#show crypto isakmp sa

IPv4 Crypto ISAKMP SA

dst src state conn-id slot status

10.1.1.6 10.1.1.1 QM_IDLE 1001 0 ACTIVE

IPv6 Crypto ISAKMP SA

To know how many packets are moving around securely execute following command

HQ#show crypto ipsec sa

interface: FastEthernet0/0

Crypto map tag: MYMAP, local addr 10.1.1.1

protected vrf: (none)

local ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)

current_peer 10.1.1.6 port 500

PERMIT, flags={origin_is_acl,}

#pkts encaps: 14, #pkts encrypt: 14, #pkts digest: 14

#pkts decaps: 14, #pkts decrypt: 14, #pkts verify: 14

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 0, #pkts compr. failed: 0

#pkts not decompressed: 0, #pkts decompress failed: 0

#send errors 1, #recv errors 0

local crypto endpt.: 10.1.1.1, remote crypto endpt.: 10.1.1.6

path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0

current outbound spi: 0x8155622(135616034)

inbound esp sas:

spi: 0xD6EC03BE(3605791678)

transform: esp-3des esp-md5-hmac ,

in use settings ={Tunnel, }

conn id: 1, flow_id: SW:1, crypto map: MYMAP

sa timing: remaining key lifetime (k/sec): (4476276/3114)

IV size: 8 bytes

replay detection support: Y

Status: ACTIVE

inbound ah sas:

inbound pcp sas:

outbound esp sas:

spi: 0x8155622(135616034)

transform: esp-3des esp-md5-hmac ,

in use settings ={Tunnel, }

conn id: 2, flow_id: SW:2, crypto map: MYMAP

sa timing: remaining key lifetime (k/sec): (4476276/3114)

IV size: 8 bytes

replay detection support: Y

Status: ACTIVE

outbound ah sas:

outbound pcp sas:

Branch#show crypto ipsec sa

interface: FastEthernet0/0

Crypto map tag: MYMAP, local addr 10.1.1.6

protected vrf: (none)

local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)

remote ident (addr/mask/prot/port): (192.168.1.0/255.255.255.0/0/0)

current_peer 10.1.1.1 port 500

PERMIT, flags={origin_is_acl,}

#pkts encaps: 14, #pkts encrypt: 14, #pkts digest: 14

#pkts decaps: 14, #pkts decrypt: 14, #pkts verify: 14

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 0, #pkts compr. failed: 0

#pkts not decompressed: 0, #pkts decompress failed: 0

#send errors 0, #recv errors 0

local crypto endpt.: 10.1.1.6, remote crypto endpt.: 10.1.1.1

path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/0

current outbound spi: 0xD6EC03BE(3605791678)

inbound esp sas:

spi: 0x8155622(135616034)

transform: esp-3des esp-md5-hmac ,

in use settings ={Tunnel, }

conn id: 1, flow_id: SW:1, crypto map: MYMAP

sa timing: remaining key lifetime (k/sec): (4444279/3095)

IV size: 8 bytes

replay detection support: Y

Status: ACTIVE

inbound ah sas:

inbound pcp sas:

outbound esp sas:

spi: 0xD6EC03BE(3605791678)

transform: esp-3des esp-md5-hmac ,

in use settings ={Tunnel, }

conn id: 2, flow_id: SW:2, crypto map: MYMAP

sa timing: remaining key lifetime (k/sec): (4444279/3095)

IV size: 8 bytes

replay detection support: Y

Status: ACTIVE

outbound ah sas:

outbound pcp sas:

Branch#

This is it to Site to Site VPN hope you understand the basics to configure. In next tutorail we will take same to next level by configuring using PKI. Which provide you more security and scalability in large d

Preview

eployments.

CCIE Security Lab Emulation

2011-08-04T15:54:00.000-07:00

Static Route Monitoring

2011-04-19T17:59:00.000-07:00

Initially there was no mechanism for determining whether a route is up or down on the Cisco ASA security appliance. And routes will stay in routing table even if the link is down. But with Cisco ASA software version 7.2(1) track availability and installing backup routes was added.

In above diagram, two different ISPs, ISP_A and ISP_B respectively are used for failover purposes. And Cisco ASA is configured in such a way that if ISA_A fails ASA will immediately divert all traffic to ISP_B.

Basically, we configure SLA to keep tracking one particular IP in our case 150.1.2.2 in ISP_A and if SLA tracking couldn’t reach this at any point of time it start diverting all traffic to ISP_B.

!
!
hostname ASA1
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 136.1.0.12 255.255.255.0
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 136.1.121.12 255.255.255.0
!
!

! Last step is to add route first with track optoin

!
route outside 0.0.0.0 0.0.0.0 136.1.0.2 1 track 1
route outside 0.0.0.0 0.0.0.0 136.1.0.3 100

! SLA is first to configure

!
sla monitor 1
type echo protocol ipIcmpEcho 150.1.2.2 interface outside
timeout 1000
frequency 1
sla monitor schedule 1 life forever start-time now
no crypto isakmp nat-traversal
!

! Second is track where 1 is identfier and second 1 is assocaiting SLA

!
track 1 rtr 1 reachability
!

Securing Routing updates (Routing Authentication)

2011-04-19T11:12:00.000-07:00

Router	ASA
RIP v2
! key chain RIP key 1 key-string cisco ! router rip version 2 network 136.1.0.0 network 150.1.0.0 no auto-summary ! interface FastEthernet0/0 ip address 136.1.121.1 255.255.255.0 ip rip authentication mode md5 ip rip authentication key-chain RIP end !	! router rip network 10.0.0.0 network 136.1.0.0 version 2 no auto-summary ! interface Ethernet0/1 description Inside Interface nameif inside security-level 100 ip address 136.1.121.12 255.255.255.0 rip authentication mode md5 rip authentication key <removed> key_id 1
OSPF v2
Simple ! router ospf 1 router-id 150.1.3.3 log-adjacency-changes area 0 authentication network 136.1.0.0 0.0.0.255 area 0 network 150.1.3.3 0.0.0.0 area 0 ! interface FastEthernet0/0 ip address 136.1.0.3 255.255.255.0 ip ospf authentication-key cisco end ! MD5-Hash ! interface FastEthernet0/0 ip address 136.1.124.4 255.255.255.0 ip ospf authentication message-digest ip ospf message-digest-key 1 md5 cisco end !	Simple ! router ospf 1 router-id 150.1.12.12 network 136.1.0.0 255.255.255.0 area 0 area 0 authentication log-adj-changes ! ! interface Ethernet0/0 description Outside Interface nameif outside security-level 0 ip address 136.1.0.12 255.255.255.0 ospf authentication-key cisco ! MD5-Hash ! nterface Ethernet0/2 nameif dmz2 security-level 50 ip address 136.1.124.12 255.255.255.0 ospf message-digest-key 1 md5 <removed> ospf authentication message-digest !
EIGRP
! router eigrp 1 network 136.1.0.0 no auto-summary ! ! interface FastEthernet0/0 ip address 136.1.124.4 255.255.255.0 ip authentication mode eigrp 1 md5 ip authentication key-chain eigrp 1 EIGRP duplex auto speed auto end !	! router eigrp 1 no auto-summary network 136.1.0.0 255.255.0.0 ! ! interface Ethernet0/2.124 description DMZ2 VLAN nameif dmz2 security-level 50 ip address 136.1.124.12 255.255.255.0 authentication key eigrp 1 <removed> key-id 1 authentication mode eigrp 1 md5 !

Getting to Internet Through ASA

2011-04-01T20:10:00.000-07:00

Step 1: Setting up hostname
ciscoasa(config)# hostname XYZ01
XYZ01(config)#

Step 2: Configuring IP addresses on the interfaces
XYZ01(config)# interface ethernet 0/0
XYZ01(config-if)# nameif inside
XYZ01(config-if)# security-level 100
XYZ01(config-if)# ip address 192.168.1.1 255.255.255.0
XYZ01(config-if)# no shut
XYZ01(config)# interface ethernet 0/1
XYZ01(config-if)# nameif outside
XYZ01(config-if)# security-level 0
XYZ01(config-if)# ip address 10.1.1.1 255.255.255.252
XYZ01(config-if)# no shut

Step 3: Verifying Interfaces
XYZ01# show interface ip brief
Interface IP-Address OK? Method Status Protocol
Ethernet0/0 192.168.1.1 YES manual up up
Ethernet0/1 10.1.1.1 YES manual up up
Ethernet0/2 unassigned YES unset administratively down up
Ethernet0/3 unassigned YES CONFIG administratively down up
Ethernet0/4 unassigned YES unset administratively down down
Ethernet0/5 unassigned YES unset administratively down down

Step 4: Verifying outside connectivity
XYZ01# ping 10.1.1.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 80/164/360 ms

Step 5: configuring Nat
This setting meant the IPs you want should able to access internet. Usually it always your complete internal IP range. But in our scenario we are using only one subnet range and we want allow then can access internet.

XYZ01(config)# nat (inside) 1 192.168.1.0 255.255.255.0

Notice the command syntax specifically 1 this is always maps to global command. Now when we configure global we will say we want nat id 1 to be mapped with this global command. This make more sense when you have multiple nat ids, which will than give us flexibility to use different Public Ip addresses for different nat ids using global command

XYZ01(config)# global (outside) 1 interface
INFO: outside interface address added to PAT pool
Notice in global command instead of mapping to Public IP address we used interface which will strating doing Port Address Translation (PAT) instead of NAT because we number of private IP addresses required to access internet.

Step 6: Verifying Nat Configuration
XYZ01# sho running-config nat
nat (inside) 1 192.168.1.0 255.255.255.0

XYZ01# sho running-config global
global (outside) 1 interface

Step 7: Configuring default route
XYZ01(config)# route outside 0 0 10.1.1.2
Notice 0 0 = 0.0.0.0 0.0.0.0 = Match All

Step 8: Check your connectivity with internet
XYZ01# ping 4.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.2.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 60/110/130 ms

I will be trying put the same by using ASDM, somtime later in the week.

Cisco ASA: Password Recovery Process

2011-03-31T14:18:00.001-07:00

Image Recovery Using ROMMON mode

2011-03-27T16:30:00.000-07:00

If incase ASA system image is lost or got corrupted we can recover it by booting ASA in ROMMON mode and executing following commands please refer above mentioned diagram.

Step 1: Make sure you have assigned the right IP address to the PC which has ASA system image and tftp installed.

Step 2: Set the following parameters
rommon #0> address 10.1.1.254
rommon #1 > server 10.1.1.1
rommon #2> interface GigabitEthernet0/0
GigabitEthernet0/1
MAC Address: 000f. f775.4b54
rommon #3> file asa801 -k8. bin

Step 3: Verify your configured parameters in ROMON mode
rommon #4> set
ROMMON Variable Settings:
ADDRESS=10.1.1.254
SERVER=10.1.1.1
PORT=GigabitEthernet0/0
VLAN=untagged
IMAGE=asa801-k8. bin
CONFIG=

rommon #12> set
ROMMON Variable Settings:
ADDRESS=10.1.1.50
SERVER=10.1.1.1
------- output omitted for brevity -----

rommon #13> unset ADDRESS
ROMMON Variable Settings:
ADDRESS=0.0.0.0
SERVER=10.1.1.1
GATEWAY=0.0.0.0
------- output omitted for brevity -----

Step4: Check the connectivity from both sides:

rommon #6> ping 10.1.1.1
Sending 20, 100-byte ICMP Echoes to 10.1.1.1, timeout is 4 seconds:
!!!!!!!!!!!!!!!!!!!!

Step 6:

rommon #5> tftpdnld
tftp asa821 -k8. bin@192. 168.10. 250
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Device downloads the system image file in the memory and Boots up. Note it is not stored in flash. So once ASA is up you have to manual upload the ASA system image in the flash.

Step 7:

ASA01(config)# copy tftp: flash:
Address or name of remote host [] ? 10.1.1.1
Source filename] ? [ asa821- k8. bin
Destination filename []?asa821 -k8. bin
Accessing tftp://10.1.1.1/asa821- k8. bin. . .!!
Writing file disk0:/asa821- k8.bin. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
! Output omitted for brevity
51 24096 bytes copied in 1 51. 370 secs ( 33934 bytes/sec)

Step 8: (Optional)
You can execute following command to hardcode the ASA image you want ASA to boot. It is especially useful when you have multiple ASA images in the flash and you want to boot up with specific ASA image.

Chicago(config)# boot system disk0:/asa821- k8. bin