ccna security 1.1 instructional...

© 2012 Cisco and/or its affiliates. All rights reserved. 1

CCNA Security 1.1 Instructional Resource Chapter 10 – Implementing the Cisco Adaptive Security Appliance (ASA)


• Explain how the ASA is an advanced stateful firewall.

• Describe types of firewalls.

• Describe the default configuration of an ASA 5505.

• Implement an ASA firewall configuration.

• Configure an ASA to provide basic firewall services using ASDM.

• Explain and configure access lists and object groups on an ASA.

• Configure an ASA to provide NAT services.

• Configure access control using the local database and AAA server.

• Describe the configuration of Modular Policy Framework (MPF) on an ASA.

• Implement an AnyConnect SSL VPN and a clientless SSL VPN on an ASA.


3.0 Implementing AAA on Cisco Devices

3.1 Implement AAA (authentication, authorization, and accounting)

3.1.3 AAA on ASA

7.0 Implementing Cisco Firewall Technologies

7.5 Implement the Cisco Adaptive Security Appliance

7.5.1 NAT

7.5.2 ACL

7.5.3 Default MFP

7.5.4 Cisco ASA Security Levels


9.0 Implementing VPN Technologies

9.2 Describe VPN technologies

9.2.1 IPsec

9.2.2 SSL

9.3 Describe the building blocks of IPsec

9.3.1 IKE

9.3.2 ESP

9.3.3 AH

9.3.4 Tunnel mode

9.3.5 Transport mode

9.6 Implement SSL VPN using ASA Security Device Manager (ASDM)

9.6.1 Clientless

9.6.2 AnyConnect


• The Adaptive Security Appliance (ASA) is a standalone firewall device that is a primary component of the Cisco SecureX technology.

– It combines firewall, VPN concentrator, and intrusion prevention functionality into one device.

– It can also support advanced features such as virtualization, high availability with failover, identity firewall, and advanced threat control.

– It can be configured in routed mode or in transparent mode.

• The ASA assigns security levels to distinguish between inside and outside networks.

– Security levels define the level of trustworthiness of an interface; the higher the level (up to 100), the more trusted the interface.

– Each operational interface must have a name and a security level from 0 (lowest) to 100 (highest) assigned.


• The ASA 5505 ships with a default configuration that is sufficient for SOHO deployments.

– The configuration includes two preconfigured VLAN networks, DHCP enabled for inside hosts, and NAT for outside access.

• ASA devices can be configured and managed using either the CLI or the Adaptive Security Device Manager (ASDM) GUI.

– The ASA CLI has a similar look and feel to the router IOS.

– Cisco ASDM facilitates the setup, configuration, monitoring, and troubleshooting of Cisco ASAs.

• ASDM provides several wizards to help simplify the configuration.

– The Startup Wizard guides through the initial configuration of the ASA.

– The VPN wizards guides basic site-to-site and remote access VPN configurations.


• Like ISR routers, the ASA:

– Provides basic traffic filtering capabilities with ACLs.

– Supports objects and object groups making it easier to maintain configurations.

– Supports NAT and PAT. These addresses can either static or dynamic.

– Can be configured to authenticate using a local user database or an external server.

• The ASA uses the Modular Policy Framework (MPF) to define sets of rules for applying firewall features.


• The ASA provides support for site-to-site IPsec VPNs and can also support the following remote access VPNs:

– Clientless SSL VPN Remote Access (using a web browser)

– SSL or IPsec (IKEv2) VPN Remote Access (using Cisco AnyConnect client)

– IPsec (IKEv1) VPN Remote Access (using Cisco VPN client)

• With a clientless SSL VPN deployment, remote clients use an SSL web portal interface.

• Client-based SSL VPN requires a client, such as the Cisco AnyConnect VPN client, to be pre-installed on the host, or downloaded on-demand via a browser.


• Chapter 10 Lab A: Configuring ASA Basic Settings and Firewall Using CLI

– Part 1: Lab Setup

– Part 2: Accessing the ASA Console and Using CLI Setup Mode to Configure Basic Settings

– Part 3: Configuring Basic ASA Settings and Interface Security Levels Using CLI

– Part 4: Configuring Routing, Address Translation and Inspection Policy Using CLI

– Part 5: Configuring DHCP, AAA, and SSH

– Part 6: Configuring a DMZ, Static NAT, and ACLs


• Chapter 10 Lab B: Configuring ASA Basic Settings and Firewall Using ASDM


– Part 2: Accessing the ASA Console and ASDM

– Part 3: Configuring ASA Settings and Firewall Using the ASDM Startup Wizard

– Part 4: Configuring ASA Settings from the ASDM Configuration Menu

– Part 5: Configuring a DMZ, Static NAT and ACLs

• Chapter 10 Lab C: Configuring Clientless and AnyConnect Remote Access SSL VPNs Using ASDM


– Part 2: Access the ASA Console and Prepare for VPN configuration

– Part 3: Configuring Clientless SSL VPN Remote Access Using ASDM

– Part 4: Configuring AnyConnect Client SSL VPN Remote Access Using ASDM


• Chapter 10 Lab D: Configuring a Site-to-Site IPsec VPN Using CCP and ASDM

– Part 1: Basic Router/Switch/PC Configuration

– Part 2: Basic ASA Configuration

– Part 3: Configuring the ISR as a Site-to-Site IPsec VPN Endpoint Using CCP

– Part 4: Configuring the ASA as a Site-to-Site IPsec VPN Endpoint Using ASDM


Routed mode

The traditional mode for deploying a firewall where there are

two or more interfaces that separate Layer 3 networks.

The ASA is considered to be a router hop in the network and

can perform NAT between connected networks.

Routed mode supports multiple interfaces.

Each interface is on a different subnet and requires an IP

address on that subnet.

Transparent mode

The ASA functions like a Layer 2 device.

Transparent mode is often referred to as a "bump in the wire,"

or a "stealth firewall."

In transparent mode, the ASA is not considered a router hop.

The ASA requires only one management IP address

configured in global configuration mode.

inside interface A named interface with security level 100.

outside interface A named interface with security level 0.

SVI Switch Virtual Interface


SSC Security Services Card

AIP-SSC Cisco Advanced Inspection and Prevention Security Services

Card enables the Cisco ASA 5505 to provide advanced

intrusion prevention services.

SSM Security Services Module

AIP-SSM The Advanced Inspection and Prevention Security Services

Module enables the Cisco ASA 5510 and higher to provide

advanced intrusion prevention services. .

4GE-SSM

4-Port Gigabit Ethernet Security Services Module provides

four 10/100/1000 RJ-45 ports and four Small Form-Factor

Pluggable (SFP) ports to support both copper and optical

connections on ASA 5510 and higher.

CSC-SSM

The Series Content Security and Control Security Services

Module provides comprehensive antivirus, anti-spyware, file

blocking, anti-spam, anti-phishing, URL blocking and filtering,

and content filtering on the ASA 5510 and higher.

Note: Refer to Chapter 8 Terms and Acronyms.


• This is a new chapter. This chapter was not included in v1.0; therefore all content should be considered new.


• Use the knowledge gained during Chapter 1 – 9 to help cover the topics in Chapter 10.


• The ASA 5505 is different from the other 5500 series ASA models.

– With the ASA 5505, the eight integrated switch ports are Layer 2 ports, and therefore cannot be assigned IP addresses directly.

– With other ASAs, the physical port can be assigned a Layer 3 IP address directly, much like a Cisco router.

• On an ASA 5505, Layer 3 parameters are configured on a SVI.

– The SVI requires a name, interface security level, and IP address.

– The Layer 2 switch ports are then assigned to a specific VLAN.

– Switch ports on the same VLAN can communicate with each other using hardware switching.

– But when a switch port on VLAN 1 wants to communicate with a switch port on VLAN 2, then the ASA applies the security policy to the traffic and routes between the two VLANs.


• The Cisco ASA command set is similar to Cisco IOS routers.

• Like a Cisco IOS router, the ASA also recognizes the following:

– Abbreviation of commands and keywords

– Tab key to complete a partial command

– The help key (?) after the command

• Unlike an ISR, the ASA performs as follows:

– Execute any ASA CLI command regardless of the current configuration mode prompt. The IOS do command is not required or recognized.

– Provide a brief description and command syntax when help is entered

followed by the command.

– Interrupt show command output using Q. The IOS requires Ctrl+C (^C).


• ASDM is similar to CCP.

• It requires that a router be initially configured.

• ASDM can be run locally on a host or from the ASA flash.

– ASDM can be downloaded on a host from the ASA flash.

• Like CCP, ASDM provides several wizard to help in device configuration.


• The ASA provides two main deployment modes that are found in Cisco SSL VPN solutions:

– Clientless SSL VPN is a browser-based VPN option and once authenticated, users access a portal page and can access specific, supported internal resources.

– Client-Based SSL VPN provides full tunnel SSL VPN connection but the AnyConnect client application to be installed on the remote host.

• AnyConnect can be pre-installed on the host or it can be downloaded on-demand from the ASA.

• AnyConnect is also available for various operating systems and smart devices.


• The same analogies covered in Chapter 8 can be used here.


• The same classroom discussions from Chapter 8 can be used.

• Why / When would you use an ASA instead of an ISR router?


• This chapter is best learned by applying the concepts as much as possible.

– Student must get their own battle scars.

• Encourage students to come up with their own VPN topology scenarios.

– Have them interconnect an ASA with an ISR router.


• For more information, go to:

– www.cisco.com/en/US/docs/security/asa/quick_start/5500/inst5500.html

– www.cisco.com/en/US/docs/security/asa/quick_start/5505/5505-poster.html

– www.cisco.com/go/asm

http://www.cisco.com/en/US/docs/security/asa/quick_start/5500/inst5500.html

http://www.cisco.com/en/US/docs/security/asa/quick_start/5505/5505-poster.html



http://www.cisco.com/go/asm

ccna security 1.1 instructional...

Documents