CCNA Security 1.1 Instructional Resource

Transcription

2 Explain how the ASA is an advanced stateful firewall. Describe types of firewalls. Describe the default configuration of an ASA Implement an ASA firewall configuration. Configure an ASA to provide basic firewall services using ASDM. Explain and configure access lists and object groups on an ASA. Configure an ASA to provide NAT services. Configure access control using the local database and AAA server. Describe the configuration of Modular Policy Framework (MPF) on an ASA. Implement an AnyConnect SSL VPN and a clientless SSL VPN on an ASA Cisco and/or its affiliates. All rights reserved. 2

3 3.0 Implementing AAA on Cisco Devices 3.1 Implement AAA (authentication, authorization, and accounting) AAA on ASA 7.0 Implementing Cisco Firewall Technologies 7.5 Implement the Cisco Adaptive Security Appliance NAT ACL Default MFP Cisco ASA Security Levels 2012 Cisco and/or its affiliates. All rights reserved. 3

4 9.0 Implementing VPN Technologies 9.2 Describe VPN technologies IPsec SSL 9.3 Describe the building blocks of IPsec IKE ESP AH Tunnel mode Transport mode 9.6 Implement SSL VPN using ASA Security Device Manager (ASDM) Clientless AnyConnect 2012 Cisco and/or its affiliates. All rights reserved. 4

5 The Adaptive Security Appliance (ASA) is a standalone firewall device that is a primary component of the Cisco SecureX technology. It combines firewall, VPN concentrator, and intrusion prevention functionality into one device. It can also support advanced features such as virtualization, high availability with failover, identity firewall, and advanced threat control. It can be configured in routed mode or in transparent mode. The ASA assigns security levels to distinguish between inside and outside networks. Security levels define the level of trustworthiness of an interface; the higher the level (up to 100), the more trusted the interface. Each operational interface must have a name and a security level from 0 (lowest) to 100 (highest) assigned Cisco and/or its affiliates. All rights reserved. 5

6 The ASA 5505 ships with a default configuration that is sufficient for SOHO deployments. The configuration includes two preconfigured VLAN networks, DHCP enabled for inside hosts, and NAT for outside access. ASA devices can be configured and managed using either the CLI or the Adaptive Security Device Manager (ASDM) GUI. The ASA CLI has a similar look and feel to the router IOS. Cisco ASDM facilitates the setup, configuration, monitoring, and troubleshooting of Cisco ASAs. ASDM provides several wizards to help simplify the configuration. The Startup Wizard guides through the initial configuration of the ASA. The VPN wizards guides basic site-to-site and remote access VPN configurations Cisco and/or its affiliates. All rights reserved. 6

7 Like ISR routers, the ASA: Provides basic traffic filtering capabilities with ACLs. Supports objects and object groups making it easier to maintain configurations. Supports NAT and PAT. These addresses can either static or dynamic. Can be configured to authenticate using a local user database or an external server. The ASA uses the Modular Policy Framework (MPF) to define sets of rules for applying firewall features Cisco and/or its affiliates. All rights reserved. 7

8 The ASA provides support for site-to-site IPsec VPNs and can also support the following remote access VPNs: Clientless SSL VPN Remote Access (using a web browser) SSL or IPsec (IKEv2) VPN Remote Access (using Cisco AnyConnect client) IPsec (IKEv1) VPN Remote Access (using Cisco VPN client) With a clientless SSL VPN deployment, remote clients use an SSL web portal interface. Client-based SSL VPN requires a client, such as the Cisco AnyConnect VPN client, to be pre-installed on the host, or downloaded on-demand via a browser Cisco and/or its affiliates. All rights reserved. 8

9 Chapter 10 Lab A: Configuring ASA Basic Settings and Firewall Using CLI Part 1: Lab Setup Part 2: Accessing the ASA Console and Using CLI Setup Mode to Configure Basic Settings Part 3: Configuring Basic ASA Settings and Interface Security Levels Using CLI Part 4: Configuring Routing, Address Translation and Inspection Policy Using CLI Part 5: Configuring DHCP, AAA, and SSH Part 6: Configuring a DMZ, Static NAT, and ACLs 2012 Cisco and/or its affiliates. All rights reserved. 9

10 Chapter 10 Lab B: Configuring ASA Basic Settings and Firewall Using ASDM Part 1: Lab Setup Part 2: Accessing the ASA Console and ASDM Part 3: Configuring ASA Settings and Firewall Using the ASDM Startup Wizard Part 4: Configuring ASA Settings from the ASDM Configuration Menu Part 5: Configuring a DMZ, Static NAT and ACLs Chapter 10 Lab C: Configuring Clientless and AnyConnect Remote Access SSL VPNs Using ASDM Part 1: Lab Setup Part 2: Access the ASA Console and Prepare for VPN configuration Part 3: Configuring Clientless SSL VPN Remote Access Using ASDM Part 4: Configuring AnyConnect Client SSL VPN Remote Access Using ASDM 2012 Cisco and/or its affiliates. All rights reserved. 10

11 Chapter 10 Lab D: Configuring a Site-to-Site IPsec VPN Using CCP and ASDM Part 1: Basic Router/Switch/PC Configuration Part 2: Basic ASA Configuration Part 3: Configuring the ISR as a Site-to-Site IPsec VPN Endpoint Using CCP Part 4: Configuring the ASA as a Site-to-Site IPsec VPN Endpoint Using ASDM 2012 Cisco and/or its affiliates. All rights reserved. 11

12 Routed mode Transparent mode The traditional mode for deploying a firewall where there are two or more interfaces that separate Layer 3 networks. The ASA is considered to be a router hop in the network and can perform NAT between connected networks. Routed mode supports multiple interfaces. Each interface is on a different subnet and requires an IP address on that subnet. The ASA functions like a Layer 2 device. Transparent mode is often referred to as a "bump in the wire," or a "stealth firewall." In transparent mode, the ASA is not considered a router hop. The ASA requires only one management IP address configured in global configuration mode. inside interface A named interface with security level 100. outside interface A named interface with security level 0. SVI Switch Virtual Interface 2012 Cisco and/or its affiliates. All rights reserved. 12

13 SSC AIP-SSC SSM AIP-SSM 4GE-SSM CSC-SSM Security Services Card Cisco Advanced Inspection and Prevention Security Services Card enables the Cisco ASA 5505 to provide advanced intrusion prevention services. Security Services Module The Advanced Inspection and Prevention Security Services Module enables the Cisco ASA 5510 and higher to provide advanced intrusion prevention services.. 4-Port Gigabit Ethernet Security Services Module provides four 10/100/1000 RJ-45 ports and four Small Form-Factor Pluggable (SFP) ports to support both copper and optical connections on ASA 5510 and higher. The Series Content Security and Control Security Services Module provides comprehensive antivirus, anti-spyware, file blocking, anti-spam, anti-phishing, URL blocking and filtering, and content filtering on the ASA 5510 and higher. Note: Refer to Chapter 8 Terms and Acronyms Cisco and/or its affiliates. All rights reserved. 13

16 The ASA 5505 is different from the other 5500 series ASA models. With the ASA 5505, the eight integrated switch ports are Layer 2 ports, and therefore cannot be assigned IP addresses directly. With other ASAs, the physical port can be assigned a Layer 3 IP address directly, much like a Cisco router. On an ASA 5505, Layer 3 parameters are configured on a SVI. The SVI requires a name, interface security level, and IP address. The Layer 2 switch ports are then assigned to a specific VLAN. Switch ports on the same VLAN can communicate with each other using hardware switching. But when a switch port on VLAN 1 wants to communicate with a switch port on VLAN 2, then the ASA applies the security policy to the traffic and routes between the two VLANs Cisco and/or its affiliates. All rights reserved. 16

17 The Cisco ASA command set is similar to Cisco IOS routers. Like a Cisco IOS router, the ASA also recognizes the following: Abbreviation of commands and keywords Tab key to complete a partial command The help key (?) after the command Unlike an ISR, the ASA performs as follows: Execute any ASA CLI command regardless of the current configuration mode prompt. The IOS do command is not required or recognized. Provide a brief description and command syntax when help is entered followed by the command. Interrupt show command output using Q. The IOS requires Ctrl+C (^C) Cisco and/or its affiliates. All rights reserved. 17

18 ASDM is similar to CCP. It requires that a router be initially configured. ASDM can be run locally on a host or from the ASA flash. ASDM can be downloaded on a host from the ASA flash. Like CCP, ASDM provides several wizard to help in device configuration Cisco and/or its affiliates. All rights reserved. 18

19 The ASA provides two main deployment modes that are found in Cisco SSL VPN solutions: Clientless SSL VPN is a browser-based VPN option and once authenticated, users access a portal page and can access specific, supported internal resources. Client-Based SSL VPN provides full tunnel SSL VPN connection but the AnyConnect client application to be installed on the remote host. AnyConnect can be pre-installed on the host or it can be downloaded on-demand from the ASA. AnyConnect is also available for various operating systems and smart devices Cisco and/or its affiliates. All rights reserved. 19

22 This chapter is best learned by applying the concepts as much as possible. Student must get their own battle scars. Encourage students to come up with their own VPN topology scenarios. Have them interconnect an ASA with an ISR router Cisco and/or its affiliates. All rights reserved. 22