CCIE Security: 08/26/14

Access-lists are commonly used to implement traffic filtering in the ASA firewalls. By default, ASA permits sessions to be initiated from a higher security level interface to a lower security level interface. When traffic is allowed one way, a session state is created in the state/conn table and return traffic will be automatically allowed back in; thus, access-lists or security-level does not apply to the return traffic:

At a minimum, using access-lists allows you to do the following:

- Permit access from the lower security level interfaces to higher security level interfaces.

- Restrict access between interfaces with same security-level if this is allowed (by default, it is not and requires the global command same-security-traffic permit inter-interface).

- Permit return traffic for sessions that are not inspected by the ASA firewall (such as for ICMP, which is not inspected by default, or for the traceroute command).

- Permits return traffic for multicast traffic, which cannot be inspected by the firewall because traffic is multicast one-way and unicast for return.

- Filter routing updates for OSPF and RIP routing processes.

ASA supports both IPv4 and IPv6 access-lists, both standard and extended. Just like on a router, you can apply a maximum of one access-list per protocol, per interface, per direction, so the maximum allowed is:

One IPv4 and one IPv6 ACL applied inbound on an interface; configured with the command access-group <ACL> in interface <nameif> .

One IPv4 and one IPv6 ACL applied outbound on an interface; configured with the command access-group <ACL> out interface <nameif> .

Starting with code 8.3(1), you can also apply one IPv4 and one IPv6 ACL globally, configured with the command access-group <ACL> global; the global access-list is always interpreted as an inbound ACL. When the global ACL is applied, the implicit deny ip any any rule is removed from any ACL applied inbound on any interfaces, so that the global ACL is inspected. Assuming all ACLs are configured, and assuming a packet enters the inside interface and exits the outside interface, the rules are:

- Traffic is matched against the inbound ACL applied on the inside interface. If there is a match, the action is taken; if not, it will match on the default deny ip any any unless global ACL is configured.

- Traffic is matched against the global ACL. If there is a match, the action is taken; if not, it will match on the default deny ip any any rule.

Traffic is matched against the outbound ACL applied on the outside interface. If there is a match, the action is taken; if not, it will match on the default deny ip any any rule.

When an ACL is applied inbound on an interface, all inbound traffic is subject to the ACL rules, and the default security-level rule no longer applies; when an ACL is applied globally, all inbound traffic from all interfaces is subject to the global ACL, and the security-level rules no longer apply.

ASA also supports ethertype and webtype ACLs. Note that MPF engine of the ASA inspects FTP and TFTP by default. But ICMP inspection is not enabled by default. For UNIX style traceroute, you must allow the returning ICMP unreachable and time-exceeded messages.

TASK

Configure Firewall to allow following traffic inbound on its outside interface; use an interface ACL

- TELNET/SSH/FTP/TFTP/HTTPS from Router2's Loopback0 address.

- Return traffic for UNIX style traceroute.

Configure Firewall to allow the following traffic inbound on its inside interface; use a global ACL:

- PING from Router1 to Router2.

- SYSLOG/HTTP/RDP towards Router2 from Router1

Types of software version

8.2.x and before, lots of features and syntax changes in ASA stating with 8.3 like NAT, Global ACL etc.

- 8.4.x and 8.6.x and later, these are same except that 8.6.x (ASA-X) is for specific hardware release

- Code 9.x further changes like support of VPNs in multi-context – outside the scope

The firewall connection to the switch is an 802.1q trunk (the ASA supports 802.1q only, not ISL), you can create sub-interfaces, corresponding to the VLANs carried over the trunk. Do not forget to assign a VLAN number to the sub-interface. The native (untagged) VLAN of the trunk connection maps to the physical interface, and it cannot be assigned to a sub-interface. When configuring interfaces on the ASA in routed mode, the following can be configured:

The command nameif <NAME>; it is mandatory and gives the interface a logical name. Without it, even if the interface is in the UP/UP state, it cannot be used for traffic forwarding.

- The command ip address <IP> <MASK> secondary <IP> <MASK>; it is mandatory.

- Enable Interface configured with the command no shutdown; it is mandatory.

- Security Level configured with the command security level <0-100>; it is optional and assigns the interface a level of trust, based on which there are some implicit firewall rules.

By default, based on the configured nameif, ASA assigns the following implicit security-levels to interfaces:

- 100 to a nameif of inside. Most trusted and highest security level.

- 0 to a nameif of outside. Least trusted and lowest security level.

- 0 to all other nameifs. Least trusted and lowest security level.

Without any configured access-lists, ASA implicitly allows or restricts traffic flows based on the security-levels:

- Traffic from high-security level to low-security level is allowed by default (for example, from 100 to 0).

- Traffic from low-security level to high-security level is denied by default; to allow traffic in this direction, an ACL must be configured and applied (at interface level or global level).

- Traffic between interfaces with an identical security level is denied by default (for example, from 20 to 20, or in our case from 0 to 0); to allow traffic in this direction, the command same-security-traffic permit inter-interface must be configured.

The Management0/0 interface is used by default only for management purposes; this is because of the default interface-level command management-only under the management interface.

TASK

From the above physical topology, design the below logical topology which meets the following requirements.

- Configure Firewall interfaces as follows:

Hostname	Interface	Nameif	Security-Level	IP Address
Firewall	G1.10	inside	100	10.0.0.10/24
Firewall	G1.30	dmz	50	30.0.0.10/24
Firewall	G2	Outside-1	0	20.0.0.10/24
Firewall	G4	Outside-2	0	40.0.0.10/24

- Configure the IP addresses as per the logical topology with Router number in the last octet for example Router-1 IP address is 10.0.0.1/24

- Enable telnet on all routers so they can be accessible directly into privilege level 15 without any authentication

- Router-1 and Router-3 both should telnet to Router-2 and Router-4, Router-2 should also telnet to Router-4

- Use only static routing if required

- Do not use access-list for this task

- Unnecessary broadcasts are not allowed on any link and network should converge as fast as possible.

Solution

Configuring SW1 and SW2 as follows

SW1, SW2:

Configure terminal

Vtp mode transparent

Spanning-tree mode rstp

Vlan 10,20,30,40

Exit

F0/3 is connected to other switch so it must be trunk. Allow only trunk which are used in the topology to stop unnecessary broadcast. We are creating manual trunk between the switches so disable DTP using nonegotiate command.

Interface F0/3

switchport trunk encapsulation dotq

switchport mode trunk

switchport trunk allowed vlan 10,20,30,40

switchport nonegotiate

SW1:

The Fa0/1 port of SW1 is connected to Firewall port G1 which is having sub-interfaces so Fa0/1 must be a trunk port. This link only required vlan 10 and vlan30 to be propagated. ASA Firewall does not support DTP so disable DTP on switch using nonegotiate command.

Interface Fa0/1

switchport trunk encapsulation dotq

switchport mode trunk

switchport trunk allowed vlan 10,30

switchport nonegotiate

Interface Fa0/2

Switchport mode access

Switchport access vlan 10

Spanning-tree portfast

SW2:

Interface F0/1

Switchport mode access

Switchport access vlan 20

Spanning-tree portfast

Interface F0/2

Switchport mode access

Switchport access vlan 30

Spanning-tree portfast

Interface F0/4

Switchport mode access

Switchport access vlan 20

Spanning-tree portfast

Interface F0/5

Switchport mode access

Switchport access vlan 40

Spanning-tree portfast

Interface F0/6

Switchport mode access

Switchport access vlan 40

Spanning-tree portfast

Firewall:

interface GigabitEthernet1

no nameif

no security-level

no ip address

interface GigabitEthernet1.10

vlan 10

nameif inside

security-level 100

ip address 10.0.0.10 255.255.255.0

interface GigabitEthernet1.30

vlan 30

nameif dmz

security-level 50

ip address 30.0.0.10 255.255.255.0

interface GigabitEthernet2

nameif outside-1

security-level 0

ip address 20.0.0.10 255.255.255.0

interface GigabitEthernet4

nameif outside-2

security-level 0

ip address 40.0.0.10 255.255.255.0

!!! Permit communication between different interfaces with the same security level!!!! This will allow telnet from Router2 to Router4 because they are in same security one.

same-security-traffic permit inter-interface

Router1:

interface GigabitEthernet1/0

ip address 10.0.0.1 255.255.255.0

line vty 0 4

privilege level 15

no login

ip route 20.0.0.0 255.255.255.0 10.0.0.10

ip route 40.0.0.0 255.255.255.0 10.0.0.10

Router2:

interface GigabitEthernet1/0

ip address 20.0.0.2 255.255.255.0

line vty 0 4

privilege level 15

no login

ip route 10.0.0.0 255.255.255.0 20.0.0.10

ip route 30.0.0.0 255.255.255.0 20.0.0.10

ip route 40.0.0.0 255.255.255.0 20.0.0.10

Router3:

interface GigabitEthernet1/0

ip address 30.0.0.3 255.255.255.0

line vty 0 4

privilege level 15

no login

ip route 20.0.0.0 255.255.255.0 30.0.0.10

ip route 40.0.0.0 255.255.255.0 30.0.0.10

Router4:

interface GigabitEthernet1/0

ip address 40.0.0.4 255.255.255.0

line vty 0 4

privilege level 15

no login

ip route 10.0.0.0 255.255.255.0 40.0.0.10

ip route 30.0.0.0 255.255.255.0 40.0.0.10

ip route 40.0.0.0 255.255.255.0 40.0.0.10

Verification

Firewall:

Check the configured nameif, security levels and IP address on the firewall.

Check the basic connectivity to the directly connected devices.

Router1:

Router1#telnet 20.0.0.2

Trying 20.0.0.2 ... Open

Router2#

Now after telnet check the Firewall if there are TCP telnet connections formed.

Firewall# show conn

1 in use, 2 most used

TCP outside-1 20.0.0.2:23 inside 10.0.0.1:15194, idle 0:01:08, bytes 58, flags UIO

Similarly check for the other telnet connections.

Router1#telnet 40.0.0.4

Trying 40.0.0.4 ... Open

Router4#exit

Router3:

Router3#telnet 20.0.0.2

Trying 20.0.0.2 ... Open

Router2#exi

[Connection to 20.0.0.2 closed by foreign host]

Router3#tel

Router3#telnet 40.0.0.4

Trying 40.0.0.4 ... Open

Router4#exi

Router2:

Router2#telnet 40.0.0.4

Trying 40.0.0.4 ... Open

Router4#exi

[Connection to 40.0.0.4 closed by foreign host]

Router2#

Note: Traffic from low security level to high security level is not allowed. Telnet from Router2 which is in security level 0 to Router1 which is in security level 100 is not allowed.

Router2#telnet 10.0.0.1

Trying 10.0.0.1 ...

% Connection timed out; remote host not responding

At this time check on the Firewall, these packets are denied inbound on outside-1 interface as this flow is going from low security level to high security level.

Firewall(config)# logging on

Firewall(config)# logging console 7

%ASA-5-111008: User 'enable_15' executed the 'logging console 7' command.

%ASA-5-111010: User 'enable_15', running 'CLI' from IP 0.0.0.0, executed 'logging console 7'

Firewall(config)# %ASA-2-106001: Inbound TCP connection denied from 20.0.0.2/64947 to 10.0.0.1/23 flags SYN on interface outside-1

%ASA-2-106001: Inbound TCP connection denied from 20.0.0.2/64947 to 10.0.0.1/23 flags SYN on interface outside-1

CCIE Security

Tuesday, August 26, 2014

ASA Basic Access List

ASA Firewall Overview