Networking-Blog

My WordPress Blog

Categories

Connection Flags on Cisco ASA

Below is presented list of flags with short description which you can see on Cisco devices:

 

A – awaiting inside ACK to SYN
a – awaiting outside ACK to SYN
B – initial SYN from outside
b – TCP state-bypass or nailed
C – CTIQBE media
D – DNS
d – dump
E – outside back connection
F – outside FIN
f – inside FIN
G – group
g – MGCP
H – H.323
h – H.225.0
I – inbound data
i – incomplete
J – GTP
j – GTP data
K – GTP t3-response
k – Skinny media
M – SMTP data
m – SIP media
n – GUP
O – outbound data
P – inside back connection
p – Phone-proxy TFTP connection
q – SQL*Net data
R – outside acknowledged FIN
R – UDP SUNRPC
r – inside acknowledged FIN
S – awaiting inside SYN
s – awaiting outside SYN
T – SIP
t – SIP transient
U – up
V – VPN orphan
W – WAAS
X – inspected by service module

Note: When checking flags in connection table on firewall make sure you confirm communication
protocol. It’s displayed in first column. Below is example of two identical flags having different meaning
depending on protocol used:

Example of connection table :

UDP outside 125.209.93.83:0 dmz 94.236.50.225:5060, idle 0:00:00, bytes 0, flags ti
UDP outside 125.209.93.83:0 dmz 94.236.50.225:5060, idle 0:00:00, bytes 0, flags ti
UDP outside 125.209.93.83:0 dmz 94.236.50.225:31825, idle 0:00:00, bytes 0, flags mi
UDP outside 125.209.93.83:0 dmz 94.236.50.225:31824, idle 0:00:00, bytes 0, flags mi
Cisco ASA, FireWalls
No comments yet.

Tags: , ,

by admin

Inter-VLAN routing on a Cisco ASA with same security interfaces

The Problem: You’re setting up inter-VLAN routing on your Cisco ASA firewall  (5510, et al) using sub-interfaces.  There should be no restrictions on what traffic can flow where between the internal VLANs, so you’ve set the same security level on all of the sub-interfaces and have added the configuration command(s) to allow “same security” traffic to move freely.

Should work like a champ, right?  Not so fast!  Things never work quite as planned when we’re talking about Cisco’s powerful but often frustrating line of firewalls.

When you use a separate internal router for inter-VLAN routing, this type of setup is sometimes referred to as a “router on a stick”. Small and mid-sized companies don’t want to spend the money on an extra router (or have an extra point of failure), so they’re just using their ASAs to do the inter-VLAN routing.

The main difference here is that the ASA is also the gateway out to the Internet, which means that it performs NAT. Another difference is that Cisco still hasn’t made the inter-VLAN routing implementation very user-friendly on ASAs. But it does work if you know how to set it up.

The Solution: From a technical standpoint, the main issue here is that the ASA also does NAT whenever inside traffic connects out to anywhere else.  You might think that it would know to keep the same addresses when traffic flows from one VLAN-assigned same-security interface to another, but it doesn’t.  You have to add static commands for every possible subint-to-subint (vlan-to-vlan) interconnection and specifically tell it to use the same addresses before and after NAT.

See below for an actual configuration.

Configuration:  Here’s a typical configuration for setting this up on an ASA 5510, along with some comments.

Let’s say that you are routing for 3 different VLANs via sub-interfaces on the physical E0/0 interface. The base configuration on the ASA looks something like this:

interface Ethernet0/0
 description LAN
 no nameif
 no security-level
 no ip address
!
interface Ethernet0/0.2
 vlan 2
 nameif inside
 security-level 100
 ip address 192.168.2.1 255.255.255.0
!
interface Ethernet0/0.3
 vlan 3
 nameif wireless
 security-level 100
 ip address 192.168.3.1 255.255.255.0
!
interface Ethernet0/0.4
 vlan 4
 nameif servers
 security-level 100
 ip address 192.168.4.1 255.255.255.0
!
interface Ethernet0/1
 description Primary Internet
 nameif outside
 security-level 0
 ip address 209.9.9.16 255.255.255.0
!
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
!
global (outside) 1 interface
nat (inside) 1 192.168.2.0 255.255.255.0
nat (wireless) 1 192.168.3.0 255.255.255.0
nat (servers) 1 192.168.4.0 255.255.255.0

Note the two same-security-traffic statements that allow traffic to flow between and within interfaces and sub-interfaces that have the same security level. This prevents you from having to add access lists, but that’s about it.

Inter-VLAN routing won’t work with the above configuration as is. You might think you could just add some additional globals for the sub-ints, but that also won’t do the job with this setup. What you need are a series of static entries, basically telling it not to NAT traffic between the various sub-ints (actually, it does NAT them, but keeps the same IP address before and after).  You’ll need a separate static for each subint-to-subint (vlan-to-vlan) connection. For each one, the first sub-int specified is the one whose IP network you need to enter twice in the static statement.

For example, to get the above configuration to work, you would add the following:

static (inside,wireless) 192.168.2.0 192.168.2.0 netmask 255.255.255.0
static (inside,servers) 192.168.2.0 192.168.2.0 netmask 255.255.255.0
static (wireless,inside) 192.168.3.0 192.168.3.0 netmask 255.255.255.0
static (wireless,servers) 192.168.3.0 192.168.3.0 netmask 255.255.255.0
static (servers,inside) 192.168.4.0 192.168.4.0 netmask 255.255.255.0
static (servers,wireless) 192.168.4.0 192.168.4.0 netmask 255.255.255.0

Once you get those statics in there, inter-VLAN routing will work just fine. But it’s a bit ugly, isn’t it?!? For N number of VLANs, you need (N-1) x N of these statements, so for just 5 total VLANs you need 20 of them.

Cisco ASA
No comments yet.

Tags: ,

by admin

CISCO ASA VER 8.0 Ipsec Base Configuration

CISCO ASA VER 8.0 Base Configuration :

ASA Version 8.0(2)
!
hostname ciscoasa
domain-name waves.uk.net
enable password 0 globalwave encrypted
names
dns-guard
!
interface Ethernet0/0
description WAN Interface
nameif Outside
security-level 0
ip address <<IP_ADDRESS><SUBNET_MASK>>
!
interface Ethernet0/1
description LAN Interface
nameif Inside
security-level 100
ip address <<IP_ADDRESS><SUBNET_MASK>>
!
interface Ethernet0/2
description COLO Interface
nameif COLO
security-level 100
ip address <<IP_ADDRESS><SUBNET_MASK>>
!
interface Ethernet0/3
nameif DMZ
security-level 100
ip address <<IP_ADDRESS><SUBNET_MASK>>
!
interface Management0/0
nameif management
security-level 100
ip address <<IP_ADDRESS><SUBNET_MASK>>
management-only
!
passwd 0 globalwave encrypted
boot system disk0:/asa802-k8.bin
clock timezone PST -8
clock summer-time PDT recurring 1 Sun Apr 2:00 last Sun Oct 2:00
dns domain-lookup Outside
dns server-group DefaultDNS
name-server 80.16.74.30
name-server 80.16.74.31
!
!
object network obj-local_ipsec_tunnel
subnet <<LOCAL_IP_ADDRESS><SUBNET_MASK>>
!
object network obj-remote_ipsec_tunnel
subnet <<REMOTE_IP_ADDRESS><SUBNET_MASK>>
!
object network obj-private_lan
subnet <<LOCAL_IP_ADDRESS><SUBNET_MASK>>
nat (inside,outside) dynamic <<INTERNET_IP_ADDRESS>
!
nat (inside,COLO) source static obj-local_ipsec_tunnel obj-local_ipsec_tunnel destination static obj-remote_ipsec_tunnel obj-remote_ipsec_tunnel
!
access-list COLO_cryptomap_1 extended permit ip <<LOCAL_IP_ADDRESS><SUBNET_MASK>> <<REMOTE_IP_ADDRESS><SUBNET_MASK>>
!
!
pager lines 24
logging enable
logging asdm informational
!
mtu outside 1500
mtu inside 1500
mtu COLO 1500
mtu management 1500
mtu DMZ 1500
!
!
no asdm history enable
arp timeout 14400
!
!
route outside 0.0.0.0 0.0.0.0 <<PUBLIC_IP_ADDRESS>
!
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
!
no http server enable
!
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
!
 crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
!
crypto map Colo_map 1 match address COLO_cryptomap_1
crypto map Colo_map 1 set peer <<PEER_PUBLIC_IP_ADDRESS>
crypto map Colo_map 1 set transform-set ESP-AES-128-SHA
crypto map Colo_map 1 set security-association lifetime kilobytes 86400
crypto map Colo_map 1 set security-association lifetime kilobytes 9908000
!
crypto map Colo_map interface COLO
crypto isakmp enable COLO
!
!
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash SHA
group 1
lifetime 86400
!
!
no crypto isakmp nat-traversal
!
telnet timeout 5
ssh timeout 5
console timeout 15
!
management-access Inside
!
threat-detection basic-threat
threat-detection statistics
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
!
tunnel-group <PEER_PUBLIC_IP_ADDRESS> type ipsec-l2l
tunnel-group <PEER_PUBLIC_IP_ADDRESS> ipsec-attributes
pre-shared-key globalwave
!
!

Cisco ASA
No comments yet.

Tags:

by admin

Cisco ASA IOS Upgrade

How do I upgrade ASA to the latest version?

Once you’ve downloaded the necessary software, follow these steps :

1. Back up your current configuration file using TFTP. Alternatively,
you can just paste it into Notepad and save it on your hard drive.
Just make sure you have a copy somewhere in case something goes wrong.

2. Determine which version of ASA software you have now. Here’s an example :

ASA5510# sh ver

Cisco Adaptive Security Appliance Software Version 7.0(6)
Device Manager Version 5.0(6)

ASA5510# dir

Directory of disk0:/
5 -rw- 5474304 00:05:00 Jan 01 2003 asa706-k8.bin
675 -rw- 5823980 16:34:26 Nov 07 2006 asdm506.bin

255426560 bytes total (244064256 bytes free)

ASA5510#

3. You can use TFTP to move the image to the ASA. Here’s an example :

ASA5510# copy tftp disk0

Address or name of remote host []? 10.253.15.77
Source filename []? asa802-k8.bin
Destination filename [disk0]? disk0:asa802-k8.bin

Accessing tftp://10.253.15.77/asa802-k8.bin…!!!!!! (truncated)
Writing file disk0:/asa802-k8.bin… !!!!! (truncated)

14524416 bytes copied in 118.210 secs (123088 bytes/sec)

Cisco ASA
No comments yet.

Tags:

by admin

Notes on ASA 8.3 NAT

Cisco ASA 8.3 has introduced major changes in how NAT is configured and operates.

Here are some quick notes that I have gathered for my reference.  Feel free to post any
additional comments and notes you may have to share:

COMMANDS

show run objects

(Displays network and service objects that are in the running confg)

show run object id

(Displays a specific object)

show run nat

(Displays running config NAT configurations)

show nat

(Displays NAT policies and counters)

Use packet-tracer for testing NAT (and other things)

packet-tracer input inside tcp 10.0.0.40 4444 198.133.219.25 80

    Configure Auto-NAT: 

object network inside
   subnet 192.168.1.0 255.255.255.0
   nat (inside,outside) dynamic interface

Note: This will configure PAT onto the outside interface for the inside subnet,
while at the same time configuring the network object for the inside subnet.

    Configure Twice (manual) NAT:
nat (inside,outside) source dynamic inside-net translated-ip destination
static cisco-dot-com cisco-dot-com

Note: You must first define the network objects for the source and destination before configuring
manual NAT.

In this example, the source IP address of the inside host is translated to “translated-ip” only when
the dynamic host is sending a packet that is destined to “cisco-dot-com”. cisco-dot-com is entered
twice because we are not translating the destination. If we wanted to translate the destination,
we would do it here.

    Exempt subnets from NAT because of VPN tunnel :
nat (inside,outside) static inside-net inside-net destination static
vpn-subnets vpn-subnets

This statement will catch traffic on the inside trying to go to the outside. Traffic that matches the
source and destination is operated on but no change is made.

    General Notes :

ASA 8.3 has two types of NAT: Auto-NAT and Twice (manual) NAT. You can use Auto-NAT for
most NAT/PAT operations, except for ones that need to make a decision based upon the
destination address of a packet.

With ASA 8.3, a new change called “Real IP” was introduced. Real IP means that NAT translation
happens BEFORE a ACL is checked. Therefore ACLs must contain the real IP address of the host
that the inbound packet is headed towards. In other words, do not write the ACL to match on the
“mapped” IP address. The real IP address is normally a non-routable IP address.

!
!

Regular Static NAT :

object network srv-172.16.66.100
host 172.16.66.100
nat (inside,outside) static 209.165.xxx.xxx

Static PAT :

object network srv-172.16.66.101
host 172.16.66.101
nat (inside,outside) static interface service tcp 25 25

Regular Dynamic NAT :

object network obj-VLANXX-192.168.100.0
subnet 192.168.100.0 255.255.255.0
nat (inside,outside) dynamic interface

Cisco ASA
No comments yet.

Tags: ,

by admin

ASA – Group Object

Create a Object-Group icmp-type ICMP traffic :

object-group icmp-type INBOUND
description Permit necessary inbound ICMP traffic
icmp-object echo
icmp-object echo-reply
icmp-object unreachable
icmp-object time-exceeded

Create a Object-Group service for TCP traffic :

object-group service INBOUND tcp
description Inbound Access
port-object eq 3389
port-object range 9998 9999

BGP, CheckPoint, Cisco ASA, Cisco MPLS, Cisco Routers, Cisco Switch, FireBrick, FireWalls, Hot Standby, HP, IpTables, Linux, Microsoft, Routing Protocol, VM, xrio, Zyxel Router
No comments yet.

Tags: , , ,

by admin

Troubleshoot Connections through the PIX and ASA

Make sure logging is enabled. The logging level needs to be set to debug. Logging can be sent to various locations.
This example uses the ASA log buffer. You might need an external logging server in production environments.

ciscoasa(config)#logging enable
ciscoasa(config)#logging buffered debugging

The user pings the inside interface of the ASA (ping 192.168.1.1). This output is displayed.

ciscoasa#show logging

!— Output is suppressed.

%ASA-6-302020: Built ICMP connection for faddr 192.168.1.50/512
gaddr 192.168.1.1/0 laddr 192.168.1.1/0
%ASA-6-302021: Teardown ICMP connection for faddr 192.168.1.50/512
gaddr 192.168.1.1/0 laddr 192.168.1.1/0

!— The user IP address is 192.168.1.50.

ASA Capture Feature

The administrator needs to create an access-list that defines what traffic the ASA needs to capture. After the access-list is defined, the capture command incorporates the access-list and applies it to an interface.

ciscoasa(config)#access-list inside_test permit icmp any host 192.168.1.1
ciscoasa(config)#capture inside_interface access-list inside_test interface inside

The user pings the inside interface of the ASA (ping 192.168.1.1). This output is displayed.

ciscoasa#show capture inside_interface
1: 13:04:06.284897 192.168.1.50 > 192.168.1.1: icmp: echo request

!— The user IP address is 192.168.1.50.

Note: In order to download the capture file to a system such as ethereal, you can do it as this output shows.

!— Open an Internet Explorer and browse with this https link format:

https://[<pix_ip>/<asa_ip>]/capture/<capture name>/pcap

Refer to ASA/PIX: Packet Capturing using CLI and ASDM Configuration Example in order to know more about Packet Capturing in ASA.

Debug

The debug icmp trace command is used to capture the ICMP traffic of the user.

ciscoasa#debug icmp trace

The user pings the inside interface of the ASA (ping 192.168.1.1). This output is displayed on the console.

ciscoasa#

!— Output is suppressed.

ICMP echo request from 192.168.1.50 to 192.168.1.1 ID=512 seq=5120 len=32
ICMP echo reply from 192.168.1.1 to 192.168.1.50 ID=512 seq=5120 len=32

!— The user IP address is 192.168.1.50.

In order to disable debug icmp trace, use one of these commands:

no debug icmp trace
undebug icmp trace
undebug all

Monitor syslog messages.

Search for the source IP address of the user that you located in Step 1. The user initiates application X.
The ASA administrator issues the show logging command and views the output.

ciscoasa#show logging

!— Output is suppressed.

%ASA-7-609001: Built local-host inside:192.168.1.50
%ASA-6-305011: Built dynamic TCP translation from inside:192.168.1.50/1107
to outside:172.22.1.254/1025
%ASA-6-302013: Built outbound TCP connection 90 for outside:172.22.1.1/80
(172.22.1.1/80) to inside:192.168.1.50/1107 (172.22.1.254/1025)

The logs reveal that the destination IP address is 172.22.1.1,
the protocol is TCP, the destination port is HTTP/80, and that traffic is sent to the outside interface.

Modify the capture filters.

The access-list inside_test command was previously used and is used here.

ciscoasa(config)#access-list inside_test permit ip host 192.168.1.50 any

!— This ACL line captures all traffic from 192.168.1.50
!— that goes to or through the ASA.

ciscoasa(config)#access-list inside_test permit ip any host 192.168.1.50 any

!— This ACL line captures all traffic that leaves
!— the ASA and goes to 192.168.1.50.

ciscoasa(config)#no access-list inside_test permit icmp any host 192.168.1.1
ciscoasa(config)#clear capture inside_interface

!— Clears the previously logged data.
!— The no capture inside_interface removes/deletes the capture.

The user initiates application X. The ASA administrator then issues the show capture inside_interface command and views the output.

ciscoasa(config)#show capture inside_interface
1: 15:59:42.749152 192.168.1.50.1107 > 172.22.1.1.80:
S 3820777746:3820777746(0) win 65535 <mss 1460,nop,nop,sackOK>
2: 15:59:45.659145 192.168.1.50.1107 > 172.22.1.1.80:
S 3820777746:3820777746(0) win 65535 <mss 1460,nop,nop,sackOK>
3: 15:59:51.668742 192.168.1.50.1107 > 172.22.1.1.80:
S 3820777746:3820777746(0) win 65535 <mss 1460,nop,nop,sackOK>

Cisco ASA
No comments yet.

Tags: ,

by admin

Cisco ASA Object-Group

Object groups on the ASA allow you to group similar types of components within a single heading.  You can use this heading for access-lists, which in turn can be used for access control, NAT, encryption, and traffic classification.

The two main object groups I use are network and service.

The network object group is where you put subnets and hosts, while the service object group is for protocols and ports.

object-group service TCP_PORTS_10038_10046 tcp
port-object eq 10038
port-object eq  10046
!
object-group network TCP_10038_10046_LAN
network-object host 172.18.192.24
network-object host 172.16.0.68
!
object-group network TCP_10038_10046_WAN
network-object host 125.215.194.223
network-object host 125.215.194.252
network-object host 125.215.194.253
network-object host 125.215.194.232
!
access-list MPLS_access_in remark Access to  TCP_PORTS_10038_10046
access-list MPLS_access_in extended permit tcp object-group TCP_10038_10046_LAN object-group TCP_10038_10046_WAN object-group TCP_PORTS_10038_10046
!
!
Configure Inspect Policy:

class-map inspection_default
match default-inspection-traffic

class-map TCP_PORTS_10038
match port tcp eq 10038
!
class-map TCP_PORTS_10046
match port tcp eq 10046
!
!
policy-map type inspect esmtp tls-esmtp
parameters
allow-tls
!
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
inspect esmtp tls-esmtp
class TCP_PORTS_10038
class TCP_PORTS_10046
!
service-policy global_policy global

Verify: 

show access-list | grep 172.18.192.24
show service-policy inspect tcp
show service-policy global
Cisco ASA
No comments yet.

Tags: ,

by admin

Cisco ASA Port Forward

static (inside,outside) 70.167.x.x 192.168.1.200 netmask 255.255.255.255
wan                    lan

Configure access-list to allow incoming Wan traffic :

access-list outside_in extended permit tcp any host 70.167.x.x eq smtp

Assign access-list to Outside Interface :

access-group outside_in in interface outside

eg :

static (MPLS,PublicIP) tcp 85.234.75.65 7870 172.18.192.24 7870 netmask 255.255.255.255
!
access-list MPLS_access_in extended permit tcp host 172.18.192.24 host 85.234.75.65 eq 7870
!
access-list PublicIP_access_in extended permit tcp host 172.18.192.24 host 85.234.75.65 eq 7870
!
!
access-group  MPLS_access_in in interface outside
access-group PublicIP_access_in in interface outside

Allow all traffic from source ip to destination ip address:

access-list PublicIP_access_in extended permit ip host 172.18.192.24 host 125.215.194.223
access-list PublicIP_access_in extended permit ip host 172.18.192.24 host 125.215.194.252
access-list PublicIP_access_in extended permit ip host 172.18.192.24 host 125.215.194.253
access-list PublicIP_access_in extended permit ip host 172.18.192.24 host 125.215.194.232
!
access-list PublicIP_access_in extended permit ip host 172.16.0.68 host 125.215.194.223
access-list PublicIP_access_in extended permit ip host 172.16.0.68 host 125.215.194.252
access-list PublicIP_access_in extended permit ip host 172.16.0.68 host 125.215.194.253
access-list PublicIP_access_in extended permit ip host 172.16.0.68 host 125.215.194.232

Cisco ASA
No comments yet.

Tags: , ,

by admin