Please enable JavaScript.

Coggle requires JavaScript to display documents.

Module 20. Introduction to the ASA - Coggle Diagram

- - - - The Cisco ASA 5500-X with FirePOWER Services devices are part of the new Cisco NGFWs. Designed for small to medium branch offices, the ASA 5500-X with FirePOWER Services merges the ASA 5500 stateful firewall features with some of the following advanced threat and malware detection capabilities:
        
        Next-generation IPS (NGIPS)
        
        Advanced Malware Protection (AMP)
        
        Application control and URL filtering
  - - - Outside network
      - Inside network
      - DMZ
    - - Traffic originating from the inside network going to the outside network is permitted.
      - Traffic originating from the inside network going to the DMZ network is permitted.
      - Traffic originating from the outside network going to the DMZ network is selectively permitted.
      - Denied Trafic
      - Permited Trafic
  - - - As shown here, two identical ASAs can be paired into an active / standby failover configuration to provide device redundancy. Both platforms must be identical in software, licensing, memory, and interfaces, including the Security Services Module (SSM).
    - - The ASA provides optional, granular access control based on an association of IP addresses to Windows Active Directory login information. For example, in the figure, when a client attempts to access the server resources, it must first be authenticated using the Microsoft Active Directory Identity-based firewall services.
    - - As illustrated, a single ASA can be partitioned into multiple virtual devices. Each virtual device is called a security context. Each context is an independent device, with its own security policy, interfaces, and administrators.
    - - All ASA models support basic IPS features. However, advanced IPS features can only be provided by integrating special hardware modules with the ASA architecture. IPS capability is available using the Advanced Inspection and Prevention (AIP) modules. Antimalware capabilities can be deployed by integrating the Content Security and Control (CSC) module.
  - - - Routed Mode
        
        An ASA in transparent mode is often referred to as a “bump in the wire,” or a “stealth firewall” because the ASA functions like a Layer 2 device and is not considered a router hop. In the figure below, the ASA is only assigned an IP address on the local network for management purposes.
      - Transparent Mode
  - - - Cisco Firepower 2100
        
        These models that are intended for the Internet edge of medium to large businesses.
      - Cisco Firepower 4100
        
        This figure displays a 4100 series ASA that is intended for large campus and data center use.
      - Cisco Firepower 1000
        
        This model is suitable for small office and home office (SOHO) and small business.
      - Cisco Firepower 9300
        
        Designed for service providers and high-performance data centers, the 9300 appliance delivers carrier-grade performance in a modular chassis. It creates separate logical firewalls for deployment flexibility, quickly inspects encrypted traffic, gains application visibility, detects and blocks network intrusions, deploys scalable VPNs, and provides integrated protection against DDoS attacks. Devices can be clustered for performance and high availability.
  - - - Use
        
        show activation-key
        
        show version
- - - - Inspection Engines
        
        Some application inspection engines are dependent on the security level. When interfaces have the same security level, the ASA inspects traffic in either direction.
      - Application Filtering
        
        HTTPS and FTP filtering applies only for outbound connections that are from a higher level to a lower level. If communication is enabled for interfaces with the same security level, traffic can be filtered in either direction.
      - Network Access
        
        By default, there is an implicit permit from a higher security interface to a lower security interface (outbound). Hosts on the higher security interface can access hosts on a lower security interface.
  - - - ASA Deployment in Small Branches
        
        In the small business, as shown below, the ASA 5506-X can be deployed with two different protected network segments. One segment is the inside network, which connects workstations and IP phones. The other segment is the DMZ, which connects a company web server. The outside interface is used to connect to the internet.
      - ASA Deployment in an Enterprise
      - ASA Deployment in a Small Business
        
        In an enterprise deployment, as shown here, the ASA 5506-X can be used by telecommuters and home users to connect to a centralized location using a VPN.
  - - - ASA 5506-X Backplane
        
        12V power connector.
        
        Four status LEDs for Power, Status, Active, and WLAN.
        
        8 - 1 Gigabit Ethernet interfaces. The L indicates link status and the S indicates connection speed.
        
        Gigabit Ethernet management interface.
        
        USB Type A port connection for external storage device.
        
        RJ45 and mini-USB console ports.
        
        Reset pin. When pressed for three seconds, the ASA resets to default new state on reboot. Flash is not erased.
      - ASA 5506-X Inside Components
        
        50GB mSata solid state drive
        
        Crypto accelerator CPU
        
        Multicore 1.25 GHz CPU
        
        4GB DRAM
      - ASA 5506-X Front Panel
        
        The figure below illustrates the back panel of the Cisco ASA 5506-X. The default DRAM memory is 4 GB and the default internal flash memory is 8 GB. In a failover configuration, the two units must be identical models with the same hardware configuration, the same number and types of interfaces, and the same amount of RAM.