Please enable JavaScript.

Coggle requires JavaScript to display documents.

Modulo 21: ASA Firewall Configuration - Coggle Diagram

- - - - Manually - Commonly used to assign an IP address and mask to the interface.
      - DHCP - Used when an interface is connecting to an upstream device providing DHCP services. The interface can be a DHCP client and discover its IP address and DHCP-related information from the upstream device.
      - PPPoE - Used when an interface is connecting to an upstream DSL device providing point-to-point connectivity over Ethernet services. The interface can be a PPPoE client and discover its IP address from an upstream PPPoE DSL device.
- - - - Network object - A network object can contain a host, a network IP address, a range of IP addresses, or a fully qualified domain name (FQDN). A network object is configured using the object network command.
        Service object - Contains a protocol and optional source and/or destination port. A service object is configured using the object service command.
  - - - host - a host address
      - fqdn - a fully-qualified domain name
      - range - a range of IP addresses
      - subnet - an entire IP network or subnet
  - - - Objects and object groups share the same name space.
      - Object groups must have unique names.
      - An object group cannot be removed or emptied if it is used in a command.
      - The ASA does not support IPv6 nested object groups.
    - - Network - A network-based object group specifies a list of IP host, subnet, or network addresses.
        
        User - Locally created, as well as imported Active Directory user groups can be defined for use in features that support the identity firewall.
        
        Service - A service-based object group is used to group TCP, UDP, or TCP and UDP ports into an object. The ASA enables the creation of a service object group that can contain a mix of TCP services, UDP services, ICMP-type services, and any protocol, such as ESP, GRE, and TCP.
        
        ICMP-Type - The ICMP protocol uses unique types to send control messages (RFC 792). The ICMP-type object group can group the necessary types required to meet an organization’s security needs, such as to create an object group called ECHO to group echo and echo-reply.
        
        Security - A security group object group can be used in features that support Cisco TrustSec by including the group in an extended ACL, which in turn can be used in an access rule.
- - - - ACLs are made up of one or more ACEs. ACEs are applied to a protocol, a source and destination IP address, a network, or the source and destination ports.
      - ACLs are processed sequentially from top down.
      - A criteria match will cause the ACL to be exited.
      - There is an implicit deny any at the bottom.
      - Remarks can be added per ACE or ACL.
      - Only one access list can be applied per interface, per protocol, per direction.
      - ACLs can be enabled/disabled based on time ranges.
    - - The ASA uses a network mask (e.g., 255.255.255.0) and not a wildcard mask (e.g. 0.0.0.255).
      - ACLs are always named instead of numbered.
      - By default, interface security levels apply access control without an ACL configured.
  - - - Through-traffic filtering - Traffic that is passing through the security appliance from one interface to another interface. The configuration is completed in two steps. The first step is to set up an ACL. The second step is to apply that ACL to an interface.
        To-the-box-traffic filtering - Also known as a management access rule, to-the-box-traffic filtering applies to traffic that terminates at the ASA. They are created to filter traffic that is destined for the control plane of the ASA. They are completed in one step but require an additional set of rules to implement access control.
  - - - Extended access list - The most common type of ACL. Contains one or more ACEs to specify source and destination addresses and protocol, ports (for TCP or UDP), or the ICMP type (for ICMP). They are used to filter traffic and to identify traffic that that should be handled by various features.
      - Standard access list - Unlike IOS where a standard ACL identifies the source host/network, ASA standard ACLs are used to identify the destination IP addresses. They are typically only used for OSPF routes and can be used in a route map for OSPF redistribution. Standard access lists cannot be applied to interfaces to control traffic.
      - EtherType access list - An EtherType ACL can be configured only if the security appliance is running in transparent mode.
      - Webtype access list - Used for filtering for clientless SSL VPN traffic. These ACLs can deny access based on URLs or destination addresses.
      - IPv6 access list - Used to determine which IPv6 traffic to block and which traffic to forward at router interfaces.
  - - - ACL allows all hosts on the inside network to go through the ASA.
        By default, all other traffic is denied unless explicitly permitted.
    - - ACL prevents hosts on 192.168.1.0/24 from accessing the 209.165.201.0/27 network.
      - Internal hosts are permitted access to all other addresses.
      - All other traffic is implicitly denied.
    - - ACL allows hosts on 192.168.1.0/24 to access the 209.165.201.0/27 network.
        By default, all other traffic is denied unless explicitly permitted.
    - - ACL prevents all inside hosts from accessing a web service at 209.165.201.29.
      - Internal hosts are permitted to access all other services at 209.165.201.29.
      - Internal hosts are permitted access to all other addresses.
      - All other traffic is implicitly denied.
  - - - Network object group named NET-HOSTS - Identifies two external hosts.
      - Network object group named SERVERS - Identifies servers providing email and web services.
      - Service object group HTTP-SMTP - Identifies SMTP and HTTP protocols.
- - - - Inside NAT - The typical NAT deployment method is when a host from a higher-security interface has traffic destined for a lower-security interface and the ASA translates the internal host address into a global address. The ASA then restores the original inside IP address for return traffic.
      - Outside NAT - This method is used when traffic from a lower-security interface that is destined for a host on the higher-security interface must be translated. This method may be useful to make an enterprise host located on the outside of the internal network appear as one from a known internal IP address.
      - Bidirectional NAT - Indicates that both inside NAT and outside NAT are used together.
    - - Dynamic PAT - This is a many-to-one translation. This is also known as NAT with overload. Usually an inside pool of private addresses overloading an outside interface or outside address.
      - Static NAT - This is a one-to-one translation. Usually an outside address mapping to an internal server.
      - Policy NAT - Policy-based NAT is based on a set of rules. These rules can specify that only certain source addresses that are intended for specific destination addresses and/or specific ports will be translated.
      - Identity NAT - A real address is statically translated to itself, essentially bypassing NAT. You might want to configure NAT this way when you want to translate a large group of addresses, but then want to exempt a smaller subset of addresses.
  - - - A network object identifying the pool of public IP addresses into which internal addresses are translated. These are identified using range or subnet network object commands.
        The second network object identifies the internal addresses to be translated and then binds the two objects together. These are identified using the range or subnet network object commands.
- - - - Class Maps
        
        What are we looking for?
        
        Classify traffic.
        
        Identify traffic on which to perform MPF.
        
        Create layer 3 and 4 class maps that can contain multiple match criteria.
      - Policy Maps
        
        What shall we do with it?
        
        Define actions
        
        Define a policy for the traffic at Layers 3 to 7.
        
        Create a policy map that can contain multiple class maps with associated actions.
      - Service Policy
        
        Where do we do it?
        
        Activate the policy map on interfaces.
        
        Create a service policy that applies a policy map to an interface or all interfaces.
        
        ciscoasa(config)# service-policy serv-name [ global | interface if
  - - - description - Add description text.
        class class-map-name - Identify a specific class map on which to perform actions.
    - - set connection - Sets connection values.
      - inspect - Provides protocol inspection servers.
      - police - Sets rate limits for traffic in this class.
- - - - Selected inside physical port - complete a basic configuration on the port including a management IP address and security level
      - Enable the ASA Web Server - Enable the ASA HTTP server.
      - Permit access to the ASA Web Server - By default, the ASA operates in a closed policy; therefore, all connections to the HTTP server are denied. A network statement that specifies the hosts that are permitted to access the HTTP server must be configured.
  - - - Run Cisco ASDM as a local application - This provides the Install ASDM Launcher option to connect to the ASA from the host’s desktop using SSL. The advantage of doing so is that one application can be used to manage several ASA devices, and a web browser is not required to start ASDM.
        Run Cisco ASDM as a Java Web Start application - This provides the Install Java Web Start option to enable a browser to run launch ASDM. A web browser is required to establish a connection. ASDM is not installed on the local host.