ASA Interface High Availability

ASA supports interface high availability and redundancy when operating in routed mode:

-          In active-standby mode, where one interface is actively forwarding traffic and one interface is in standby mode; this is the redundancy feature.

-          In active-active mode, where up to eight interfaces can be actively used for traffic forwarding, sharing the load; this is the etherchannel feature.

A logical redundant interface is a pair of one active and one standby physical interface. When the active interface fails, the standby interface becomes active. From the perspective of the firewall applications, this event is completely transparent, because the interface pair is viewed as a single logical interface.

Notice that this method has a limitation; the detection of interface failure is based on simple physical monitoring. When the primary interface loses a carrier, it is declared as failed.

The logical redundant interface will take the MAC address of the first interface added to the group, because this will also become the active interface. This MAC address is not changed with the member interface failures, but changes when you swap the order of the physical interfaces added to the pair; optionally, a vMAC can be configured for the redundant interface. With redundant interfaces, the nameif, security-level, and IP address configuration is done at the logical interface level. This feature is not preemptive; for example, if the initial active interface failed and the standby interface became active, when the initial active interface became up again, it would remain in standby state. The active interface can be changed at any time using the command redundant-interface

redundant <nr> active-member <interface> .

Starting with code version 8.4(1), LACP/802.3ad support was added to the ASA; this is an enhancement to the redundant interface function, because all interfaces within a group (up to eight) can actively forward traffic. ASA supports both active and passive modes, where active initiates the LACP negotiation, and passive expects to receive LACP negotiations. Optionally, the etherchannel can be configured in on mode, also known as static mode, because there is no negotiation of the etherchannel state between peers. The same restrictions as configuring etherchannels on IOS code apply as well; all interfaces must be of same type and speed and use the same configuration. By default, ASA will load-balance the traffic across etherchannel interfaces based on layer3 information. Optionally, layer2 and layer4 can be taken into consideration, and this is configurable on a per-etherchannel  level. The logical portchannel interface will take the MAC address of the lowest number interface from the group; optionally, a vMAC can be configured for the etherchannel interface.

TASK

-          Configure the above topology which meets the following requirements

-          Configure ASA1 as follows

Hostname	Interface	Interface-mode	Nameif	Security-level	IP Address
ASA1	G1 and G3	Active-standby	inside	100	10.0.0.10/24
ASA1	G2 and G4	Active-Active	outside	0	20.0.0.10/24

-          Allow no more than two interfaces in the bundle and load balance traffic on the ASA based on layer3/layer4 information.

-          Configure the IP addresses as per the topology with Router number in the last octet for example Router-1 IP address is 10.0.0.1/24

-          Enable telnet on all routers so they can be accessible directly into privilege level 15 without any authentication

-          All interfaces on SW1 are in vlan 10 and all interfaces on SW2 are in vlan 20.

-           Router-1 should telnet to Router-2

-          Use only static routing if required

-          Do not use access-list for this task

-          Unnecessary broadcasts are not allowed on any link and network should converge as fast as possible.

Solution

SW1:

!

Spanning-tree mode rstp

!

Vtp mode transparent

Vlan 10

!

Interface range Fa0/1 , Fa0/4

Switchport mode access

Switchport access vlan 10

Spanning-tree portfast

!

Interface Fa0/2

Switchport mode access

Switchport access vlan 10

Spanning-tree portfast

!

SW2:

!

Spanning-tree mode rstp

!

Vtp mode transparent

Vlan 20

!

Interface Fa0/1

Switchport mode access

Switchport access vlan 20

Spanning-tree portfast

!

Interface range fa0/4 , fa0/5

Channel-group 1 mode on

No shutdown

!

Interface port-channel 1

Switchport mode access

Switchport access vlan 20

!

Router1:

interface GigabitEthernet1/0

 ip address 10.0.0.1 255.255.255.0

!

line vty 0 4

 privilege level 15

 no login

!

ip route 20.0.0.0 255.255.255.0 10.0.0.10

!

Router2:

interface GigabitEthernet1/0

 ip address 20.0.0.2 255.255.255.0

!

line vty 0 4

 privilege level 15

 no login

!

ip route 10.0.0.0 255.255.255.0 20.0.0.10

!

Firewall:

interface GigabitEthernet1

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet2

 channel-group 1 mode on

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet3

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet4

 channel-group 1 mode on

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet5

 shutdown

 no nameif

 no security-level

 no ip address

!

interface Redundant1

 member-interface GigabitEthernet1

 member-interface GigabitEthernet3

 nameif inside

 security-level 100

 ip address 10.0.0.10 255.255.255.0

!

interface Port-channel1

 lacp max-bundle 2

 port-channel load-balance src-dst-ip-port

 nameif outside

 security-level 0

 ip address 20.0.0.10 255.255.255.0!

!

Verification

Check nameif and IP addressing on Firewall

Check redundant, ether-channel and ether-channel load-balancing configurations on Firewall

Check connectivity with the redundant interface and check that the assigned MAC is the one of the active interface, the one first attached in the group:

Router1#ping 10.0.0.10

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.0.0.10, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 8/13/20 ms

Router1#sh ip arp

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  10.0.0.10              56   00ab.381d.c501  ARPA   GigabitEthernet1/0

Internet  10.0.0.1                -   ca0b.10bc.001c  ARPA   GigabitEthernet1/0

Router1#

ASA1# sh int g1 | in MAC

        MAC address 00ab.381d.c501, MTU not set

ASA1# sh int g3 | in MAC

        MAC address 00ab.381d.c503, MTU not set

ASA1#

Verify connectivity with the ether-channel interface and that the assigned MAC is the one from the lowest interface in the group:

Router2#ping 20.0.0.10

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 20.0.0.10, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 12/33/56 ms

Router2#sh ip arp

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  20.0.0.2                -   ca0c.10bc.001c  ARPA   GigabitEthernet1/0

Internet  20.0.0.10              54   00ab.381d.c502  ARPA   GigabitEthernet1/0

Router2#

ASA1# sh int g2 | in MAC

        MAC address 00ab.381d.c502, MTU 1500

ASA1# sh int g4 | in MAC

        MAC address 00ab.381d.c504, MTU 1500

ASA1#

ASA Basic Access List

Access-lists are commonly used to implement traffic filtering in the ASA firewalls. By default, ASA permits sessions to be initiated from a higher security level interface to a lower security level interface. When traffic is allowed one way, a session state is created in the state/conn table and return traffic will be automatically allowed back in; thus, access-lists or security-level does not apply to the return traffic:

At a minimum, using access-lists allows you to do the following:

-          Permit access from the lower security level interfaces to higher security level interfaces.

-          Restrict access between interfaces with same security-level if this is allowed (by default, it is not and requires the global command same-security-traffic permit inter-interface).

-          Permit return traffic for sessions that are not inspected by the ASA firewall (such as for ICMP, which is not inspected by default, or for the traceroute command).

-          Permits return traffic for multicast traffic, which cannot be inspected by the firewall because traffic is multicast one-way and unicast for return.

-          Filter routing updates for OSPF and RIP routing processes.

ASA supports both IPv4 and IPv6 access-lists, both standard and extended. Just like on a router, you can apply a maximum of one access-list per protocol, per interface, per direction, so the maximum allowed is:

One IPv4 and one IPv6 ACL applied inbound on an interface; configured with the command access-group <ACL> in interface <nameif> .

One IPv4 and one IPv6 ACL applied outbound on an interface; configured with the command access-group <ACL> out interface <nameif> .

Starting with code 8.3(1), you can also apply one IPv4 and one IPv6 ACL globally, configured with the command access-group <ACL> global; the global access-list is always interpreted as an inbound ACL. When the global ACL is applied, the implicit deny ip any any rule is removed from any ACL applied inbound on any interfaces, so that the global ACL is inspected. Assuming all ACLs are configured, and assuming a packet enters the inside interface and exits the outside interface, the rules are:

-          Traffic is matched against the inbound ACL applied on the inside interface. If there is a match, the action is taken; if not, it will match on the default deny ip any any unless global ACL is configured.

-          Traffic is matched against the global ACL. If there is a match, the action is taken; if not, it will match on the default deny ip any any rule.

-          

     Traffic is matched against the outbound ACL applied on the outside interface. If there is a match, the action is taken; if not, it will match on the default deny ip any any rule.

When an ACL is applied inbound on an interface, all inbound traffic is subject to the ACL rules, and the default security-level rule no longer applies; when an ACL is applied globally, all inbound traffic from all interfaces is subject to the global ACL, and the security-level rules no longer apply.

ASA also supports ethertype and webtype ACLs. Note that MPF engine of the ASA inspects FTP and TFTP by default. But ICMP inspection is not enabled by default. For UNIX style traceroute, you must allow the returning ICMP unreachable and time-exceeded messages.

TASK

Configure Firewall to allow following traffic inbound on its outside interface; use an interface ACL

-          TELNET/SSH/FTP/TFTP/HTTPS from Router2's Loopback0 address.

-          Return traffic for UNIX style traceroute.

Configure Firewall to allow the following traffic inbound on its inside interface; use a global ACL:

-          PING from Router1 to Router2.

-          SYSLOG/HTTP/RDP towards Router2 from Router1

ASA Firewall Overview

Types of software version

-         

      8.2.x and before, lots of features and syntax changes in ASA stating with 8.3 like NAT, Global ACL etc.

-         8.4.x and 8.6.x and later, these are same except that 8.6.x (ASA-X) is for specific hardware release

-         Code 9.x further changes like support of VPNs in multi-context – outside the scope

The firewall connection to the switch is an 802.1q trunk (the ASA supports 802.1q only, not ISL), you can create sub-interfaces, corresponding to the VLANs carried over the trunk. Do not forget to assign a VLAN number to the sub-interface. The native (untagged) VLAN of the trunk connection maps to the physical interface, and it cannot be assigned to a sub-interface. When configuring interfaces on the ASA in routed mode, the following can be configured:

-        

          The command nameif <NAME>; it is mandatory and gives the interface a logical name. Without it, even if the interface is in the UP/UP state, it cannot be used for traffic forwarding.

-          The command ip address <IP> <MASK> secondary <IP> <MASK>; it is mandatory.

-          Enable Interface configured with the command no shutdown; it is mandatory.

-          Security Level configured with the command security level <0-100>; it is optional and assigns the interface a level of trust, based on which there are some implicit firewall rules.

-          

    The commands speed [10|100|1000|auto] and duplex [half|full|auto]; it is optional, and by default all interfaces are set to auto negotiating both speed and duplex.

By default, based on the configured nameif, ASA assigns the following implicit security-levels to interfaces:

-          100 to a nameif of inside. Most trusted and highest security level.

-          0 to a nameif of outside. Least trusted and lowest security level.

-          0 to all other nameifs. Least trusted and lowest security level.

Without any configured access-lists, ASA implicitly allows or restricts traffic flows based on the security-levels:

-          Traffic from high-security level to low-security level is allowed by default (for example, from 100 to 0).

-        Traffic from low-security level to high-security level is denied by default; to allow traffic in this direction, an ACL must be configured and applied (at interface level or global level).

-          Traffic between interfaces with an identical security level is denied by default (for example, from 20 to 20, or in our case from 0 to 0); to allow traffic in this direction, the command same-security-traffic permit inter-interface must be configured.

The Management0/0 interface is used by default only for management purposes; this is because of the default interface-level command management-only under the management interface.

TASK

From the above physical topology, design the below logical topology which meets the following requirements.

-          Configure Firewall interfaces as follows:

Hostname	Interface	Nameif	Security-Level	IP Address
Firewall	G1.10	inside	100	10.0.0.10/24
Firewall	G1.30	dmz	50	30.0.0.10/24
Firewall	G2	Outside-1	0	20.0.0.10/24
Firewall	G4	Outside-2	0	40.0.0.10/24

-          Configure the IP addresses as per the logical topology with Router number in the last octet for example Router-1 IP address is 10.0.0.1/24

-          Enable telnet on all routers so they can be accessible directly into privilege level 15 without any authentication

-           Router-1 and Router-3 both should telnet to Router-2 and Router-4, Router-2 should also telnet to Router-4

-          Use only static routing if required

-          Do not use access-list for this task

-          Unnecessary broadcasts are not allowed on any link and network should converge as fast as possible.

Solution

Configuring SW1 and SW2 as follows

SW1, SW2:

Configure terminal

Vtp mode transparent

Spanning-tree mode rstp

Vlan 10,20,30,40

Exit

F0/3 is connected to other switch so it must be trunk. Allow only trunk which are used in the topology to stop unnecessary broadcast. We are creating manual trunk between the switches so disable DTP using nonegotiate command.

Interface F0/3

switchport trunk encapsulation dotq

switchport mode trunk

switchport trunk allowed vlan 10,20,30,40

switchport nonegotiate

SW1:

The Fa0/1 port of SW1 is connected to Firewall port G1 which is having sub-interfaces so Fa0/1 must be a trunk port. This link only required vlan 10 and vlan30 to be propagated. ASA Firewall does not support DTP so disable DTP on switch using nonegotiate command.

Interface Fa0/1

switchport trunk encapsulation dotq

switchport mode trunk

switchport trunk allowed vlan 10,30

switchport nonegotiate

Interface Fa0/2

Switchport mode access

Switchport access vlan 10

Spanning-tree portfast

SW2:

Interface F0/1

Switchport mode access

Switchport access vlan 20

Spanning-tree portfast

Interface F0/2

Switchport mode access

Switchport access vlan 30

Spanning-tree portfast

Interface F0/4

Switchport mode access

Switchport access vlan 20

Spanning-tree portfast

Interface F0/5

Switchport mode access

Switchport access vlan 40

Spanning-tree portfast

Interface F0/6

Switchport mode access

Switchport access vlan 40

Spanning-tree portfast

Firewall:

interface GigabitEthernet1

 no nameif

 no security-level

 no ip address

!

interface GigabitEthernet1.10

 vlan 10

 nameif inside

 security-level 100

 ip address 10.0.0.10 255.255.255.0

!

interface GigabitEthernet1.30

 vlan 30

 nameif dmz

 security-level 50

 ip address 30.0.0.10 255.255.255.0

!

interface GigabitEthernet2

 nameif outside-1

 security-level 0

 ip address 20.0.0.10 255.255.255.0

!

interface GigabitEthernet4

 nameif outside-2

 security-level 0

 ip address 40.0.0.10 255.255.255.0

!

!!! Permit communication between different interfaces with the same security level!!!! This will allow telnet from Router2 to Router4 because they are in same security one.

!

same-security-traffic permit inter-interface

!

Router1:

interface GigabitEthernet1/0

 ip address 10.0.0.1 255.255.255.0

!

line vty 0 4

 privilege level 15

 no login

!

ip route 20.0.0.0 255.255.255.0 10.0.0.10

ip route 40.0.0.0 255.255.255.0 10.0.0.10

Router2:

interface GigabitEthernet1/0

 ip address 20.0.0.2 255.255.255.0

!

line vty 0 4

 privilege level 15

 no login

!

ip route 10.0.0.0 255.255.255.0 20.0.0.10

ip route 30.0.0.0 255.255.255.0 20.0.0.10

ip route 40.0.0.0 255.255.255.0 20.0.0.10

Router3:

interface GigabitEthernet1/0

 ip address 30.0.0.3 255.255.255.0

!

line vty 0 4

 privilege level 15

 no login

!

ip route 20.0.0.0 255.255.255.0 30.0.0.10

ip route 40.0.0.0 255.255.255.0 30.0.0.10

Router4:

interface GigabitEthernet1/0

 ip address 40.0.0.4 255.255.255.0

!

line vty 0 4

 privilege level 15

 no login

!

ip route 10.0.0.0 255.255.255.0 40.0.0.10

ip route 30.0.0.0 255.255.255.0 40.0.0.10

ip route 40.0.0.0 255.255.255.0 40.0.0.10

Verification

Firewall:

Check the configured nameif, security levels and IP address on the firewall.

Check the basic connectivity to the directly connected devices.

Router1:

Router1#telnet 20.0.0.2

Trying 20.0.0.2 ... Open

Router2#

Now after telnet check the Firewall if there are TCP telnet connections formed.

Firewall# show conn

1 in use, 2 most used

TCP outside-1 20.0.0.2:23 inside 10.0.0.1:15194, idle 0:01:08, bytes 58, flags UIO

Similarly check for the other telnet connections.

Router1#telnet 40.0.0.4

Trying 40.0.0.4 ... Open

Router4#exit

Router3:

Router3#telnet 20.0.0.2

Trying 20.0.0.2 ... Open

Router2#exi

[Connection to 20.0.0.2 closed by foreign host]

Router3#tel

Router3#telnet 40.0.0.4

Trying 40.0.0.4 ... Open

Router4#exi

Router2:

Router2#telnet 40.0.0.4

Trying 40.0.0.4 ... Open

Router4#exi

[Connection to 40.0.0.4 closed by foreign host]

Router2#

Note: Traffic from low security level to high security level is not allowed. Telnet from Router2 which is in security level 0 to Router1 which is in security level 100 is not allowed.

Router2#telnet 10.0.0.1

Trying 10.0.0.1 ...

% Connection timed out; remote host not responding

At this time check on the Firewall, these packets are denied inbound on outside-1 interface as this flow is going from low security level to high security level.

Firewall(config)# logging on

Firewall(config)# logging console 7

%ASA-5-111008: User 'enable_15' executed the 'logging console 7' command.

%ASA-5-111010: User 'enable_15', running 'CLI' from IP 0.0.0.0, executed 'logging console 7'

Firewall(config)# %ASA-2-106001: Inbound TCP connection denied from 20.0.0.2/64947 to 10.0.0.1/23 flags SYN  on interface outside-1

%ASA-2-106001: Inbound TCP connection denied from 20.0.0.2/64947 to 10.0.0.1/23 flags SYN  on interface outside-1