Cisco ASA Tips and Tricks – 5500-X Series Software 9.x Configuration Notes

interface Management0/0

 management-only
 nameif management
 security-level 100
 ip address 10.9.200.31 255.255.255.0 
 no shutdown

http server enable
http 10.9.200.0 255.255.255.128 management

ssh 10.9.200.0 255.255.255.128 management

Browse to webpage https://10.9.200.31/admin , then install ASDM launcher.

4. Basic Setup and Examples

• nameif
• ciscoasa(config)# interface vlan1
  ciscoasa(config-if)# nameif inside
  INFO: Security level for “inside” set to 100 by default.
• security-level
• ciscoasa(config-if)# interface vlan3
  ciscoasa(config-if)# nameif dmz
  ciscoasa(config-if)# security-level 50
• interface or vlan ip address
• ciscoasa(config-if)# interface vlan 1
  ciscoasa(config-if)# ip address 192.168.106.1
• ciscoasa(config-if)# interface ethernet 0/1
  ciscoasa(config-if)# switchport access vlan 1
  ciscoasa(config-if)# no shutdown
• Route
• ciscoasa(config-if)# route outside 0 0 1.1.1.1
• Test Configuration with Packet Tracer Feature
• Simulate a TCP packet coming in the inside interface from ip address 192.168.0.125 on source port 12345 destined to an ip address of 203.0.113.1 on port 80  
• ciscoasa# packet-tracer input inside tcp 192.168.0.125 12345 203.0.113.1 8
•   Simulate a TCP packet coming in the outside interface from ip address 192.0.2.123 on source port 12345 destined to an ip address of 198.51.100.101 on port 80
• ciscoasa# packet-tracer input outside tcp 192.0.2.123 12345 98.51.100.101 80

5. Transparent or Routed Firewall 

Broadcast and multicast traffic can be passed using access rules.

The following destination MAC addresses are allowed through the transparent firewall. Any
MAC address not on this list is dropped.
• TRUE broadcast destination MAC address equal to FFFF.FFFF.FFFF
• IPv4 multicast MAC addresses from 0100.5E00.0000 to 0100.5EFE.FFFF
• IPv6 multicast MAC addresses from 3333.0000.0000 to 3333.FFFF.FFFF
• BPDU multicast address equal to 0100.0CCC.CCCD
• AppleTalk multicast MAC addresses from 0900.0700.0000 to 0900.07FF.FFFF

The transparent mode ASA does not pass CDP packets packets, or any packets that do not have a valid EtherType greater than or equal to 0x600. An exception is made for BPDUs and IS-IS, which are supported.

To prevent loops using the Spanning Tree Protocol, BPDUs are passed by default. To block BPDUs, you need to configure an EtherType ACL to deny them. If you are using failover, you might want to block BPDUs to prevent the switch port from going into a blocking state when the topology changes.

When the ASA runs in transparent mode, the outgoing interface of a packet is determined by performing a MAC address lookup instead of a route lookup. Route lookups, however, are necessary for the following traffic types:
• Traffic originating on the ASA
• Traffic that is at least one hop away from the ASA with NAT enabled
Voice over IP (VoIP) and DNS traffic with inspection enabled, and the endpoint is at least one hop
away from the ASA.

By default, all ARP packets are allowed through the ASA. You can control the flow of ARP packets by enabling ARP inspection.

Because the ASA is a firewall, if the destination MAC address of a packet is not in the table, the ASA
does not flood the original packet on all interfaces as a normal bridge does. Instead, it generates the
following packets for directly connected devices or for remote devices:
• Packets for directly connected devices—
• Packets for remote devices—

Transparent Mode Default Settings – The default mode is routed mode.
• By default, all ARP packets are allowed through the ASA.
• If you enable ARP inspection, the default setting is to flood non-matching packets.
• The default timeout value for dynamic MAC address table entries is 5 minutes.
• By default, each interface automatically learns the MAC addresses of entering traffic, and the ASA
adds corresponding entries to the MAC address table.

6. Multiple Context Mode

7. Ping from ASA Internal Interface to outside

Note: 11.11.11.11 is local LAN interface, and 1.1.1.2 is another ASA’s WAN Interface. The ping from local ASA LAN Interface to Outside is faild, because the ASA by default maintains a state table for TCP & UDP connections only. It’s not that the pings aren’t successful, its just the ASA does not allow the echo reply from an interface with a lower configured security-level. Solution will be in this post with using ASDM turn on your icmp inspect in your global policy.

For the icmp traffic to ASA itself, the command is in the following:

Note: If there is NAT enabled from Internal to External, you may need to add a access-list to allow icmp echo-reply packet in to external interface.

8. Enable Logging

9. NAT 

• Auto NAT – Only the source is used as a match criteria when NAT`ing.
• Manual NAT – The source and destination is used as a match criteria when NAT`ing.

Auto NAT

Manual NAT

• Section 1 – Manual NAT
• Section 2 – Auto NAT
• Section 3 – Manual Nat After-Auto

10. Access Rules

Inbound and Outbound Rules
You can configure access rules based on the direction of traffic:
• Inbound—Inbound access rules apply to traffic as it enters an interface. Global and management access
rules are always inbound.
• Outbound—Outbound rules apply to traffic as it exits an interface.
“Inbound” and “outbound” refer to the application of an ACL on an interface, either to traffic entering the
ASA on an interface or traffic exiting the ASA on an interface. These terms do not refer to the movement of traffic from a lower security interface to a higher security interface, commonly known as inbound, or from a higher to lower interface, commonly known as outbound.
Note
An outbound ACL is useful, for example, if you want to allow only certain hosts on the inside networks to access a web server on the outside network. Rather than creating multiple inbound ACLs to restrict access,

• access-list (ACLs)
• Traffic going from a lower security interface is denied when going to a higher security interface
• Traffic going from a higher security interface is allowed when going to a lower security interface
•  Examples 1:

  access-list outside_acl extended permit tcp any object webserver eq www
  !
  access-group outside_acl in interface outside

•  Examples 2:

• object network dns-server
   host 192.168.0.53
  !
  access-list dmz_acl extended permit udp any object dns-server eq domain
  access-list dmz_acl extended deny ip any object inside-subnet
  access-list dmz_acl extended permit ip any any
  !
  access-group dmz_acl in interface dmz

11. Access Rules Examples

ASA Example Topology

12. Backup and Restore Configuration

Backup configuration to local disk.

Restore Configuration

13. ICMP/SSH/ASDM to another interface behind one interface

I met same issue as the post “Failed to locate egress interface…“.
Topology:

Symptom:
IP Computer 1 is able to reach IP computer 2 , but not firewall ASA’s IP inside2, even it is in same segment as IP Computer2.

Solution from the post:

“

http server enable

http 10.50.2.0 255.255.255.0 Mgmt
http 172.17.0.0 255.255.255.0 MGMT

ssh 10.50.2.0 255.255.255.0 MGMT
ssh 172.17.0.0 255.255.255.0 MGMT

management-access MGMT