Category Archives: ASA

ASA, Cisco, Computer, Juniper, Network, Security

i got my first juniper

Leave a comment

It is a Netscreen 5gt. So now commands maybe usefull:

 

Cisco IOS Cisco PIX
Cisco ASA		 Juniper Netscreen Description
show configuration show configuration get config saved get saved configuration
show running-config show running-config get config get device configuration
save to save changes to config
show version show version get system gets system information, Netscreen mode
show ip inspect session get session info shows load on the firewall 85+ implies there will be some latency
show interface
sh ip interface		 get interface shows interfaces, zones
get address trust/unturst shows defined network objects
show arp
sh ip arp <interface>		  show arp get arp shows arp entries
 show ip route show route get route shows firewall routes
get service shows firewall services
get group address network groups
get group service service groups
get policy in/out shows applied firewall policies
get log traffic shows firewall logs – options: based on src/dst/IP/port
no <command> unset to remove a config statement
get user all shows vpn users
get log event shows vpn logs
get mip shows one to one Nat’s
get vip shows configured port forwarding rules
get route ip x.x.x.x finds the specific route for an ip
set policy id xx put you in a specific policy then you can add more objects it instead of creating a group
ASA, Cisco, Computer, Routing, Security, VPN

Cisco ASA AnyConnect VPN

Leave a comment

Some Notes what todo

http://www.block.net.au/blogs/james/pages/active-directory-vpn-authentication-with-a-cisco-asa-5510-series-appliance.aspx

radius authentication für die ASA

ASA 8.X: AnyConnect Start Before Logon Feature Configuration

Configuration Examples and TechNotes

ToDo:

av-pairs ????

certificate selection process

certifate import on cli / asdm  /ios

set the certificate on the interface : ssl trust-point MyTrustPoint Outside

Docu: Backup Gateway

Piuctures: ASDM, CCP

Write complete setup down ….

Reference the Docu. :-)

http://www.cisco.com/en/US/docs/security/asa/asa83/getting_started/5500/guide/getstart.html

http://www.cisco.com/en/US/docs/security/asa/asa83/configuration/guide/svc.html#wp1090595

http://www.cisco.com/en/US/docs/security/asa/asa83/asdm63/configuration_guide/config.html

http://www.cisco.com/en/US/products/ps8411/prod_maintenance_guides_list.html

http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect25/administration/guide/ac03features.html#wp1056494

http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect22/administration/guide/22admin4.html#wp1008975

Flickr : , , , , ,

ASA, Cisco, Computer, Routing, Security, VPN

How to authentication AnyConnect VPN against RADIUS

Leave a comment

AnyConnect and Cisco ACS Radius is a bit more complected because the ASA5500 documentation states that you can not use the Same Radius for
Authentication and Authorization. So things getting more complex by it self 😉 But if i see things in the right light we don’t need authorization at all so we will on monday how things will develope.

How to authentication AnyConnect VPN against RADIUS

The Authentication against RADIUS is quiet easy to configure.

Just add the RADIUS Servers as described here.
Than add following to the configuration:

[sourcecode gutter=”false” autolinks=”false”]
tunnel-group SSLClientProfile general-attributes
authentication-server-group AAA-RADIUS
[/sourcecode]
By debuging the radius authentication is see our freeradius deliver the av-pairs with the authentication request so lets see if the ASA accepts them.
If you feel this helps a bit or may be not ? Please leave a comment.

Flickr : , , , , ,

ASA, Cisco, Computer, Security

How to use RADIUS for Authentication

Leave a comment

How to use RADIUS on Cisco ASA for Shell and Web Authentication

Assume the RADIUS Servers are:

Cisco ACS Server 1 10.120.10.11
Cisco ACS Server 2 10.120.10.12

[sourcecode gutter=”false” autolinks=”false”]
aaa-server AAA-RADIUS protocol radius
!
aaa-server AAA-RADIUS (Management) host 10.120.10.11
key YYYYXXXYYY
!
aaa-server AAA-RADIUS (Management) host 10.120.10.12
key YYYYXXXYYY
!
! Delete the old local only configuration
no aaa authentication http console LOCAL
no aaa authentication ssh console LOCAL
!
aaa authentication http console AAA-RADIUS LOCAL
aaa authentication ssh console AAA-RADIUS LOCAL
aaa authentication enable console AAA-RADIUS LOCAL
aaa authorization command AAA-RADIUS LOCAL
!
[/sourcecode]

If you have allready configured aaa for the ssh you might see something like

[sourcecode autolinks=”false” gutter=”false” highlight=”2″]
asa1(config)# aaa authentication ssh console AAA-RADIUS LOCAL
Range already exists.
[/sourcecode]

Then you must first disable the aaa authentication and than add the new settings.

[sourcecode autolinks=”false” gutter=”false”]
no aaa authentication ssh console LOCAL
aaa authentication ssh console AAA-RADIUS LOCAL
[/sourcecode]

If you feel this helps a bit or may be not ? Please leave a comment.

ASA, Cisco, Computer, Network, Routing, Security, VPN

How to use Radius/Tacacs+ and Certificate based Authentication for AnyConnect VPN

Leave a comment

First you have to add a valid Certificate to the ASA, then change following in the configuration.

[sourcecode]
tunnel-group SSLClientProfile general-attributes
authentication-server-group AAA-TACACS+
!
tunnel-group SSLClientProfile webvpn-attributes
authentication aaa certificate
[/sourcecode]
Then you can connect to the asa only with username and a user certificate.

Flickr : , , , , ,

ASA, Cisco, Computer, Network, Routing, Security, VPN

How to authenticate AnyConnect VPN against Tacacs+

Leave a comment

How to authentication AnyConnect VPN against Tacacs+

The Authentication against Tacacs+ is quiet easy to configure.

Just add the Tacacs+ Servers as described here.
Than add following to the configuration:

[sourcecode]
tunnel-group SSLClientProfile general-attributes
authentication-server-group AAA-TACACS+
[/sourcecode]

If you feel this helps a bit or may be not ? Please leave a comment.

ASA, Cisco, Computer, VPN

Cisco ASA5500 Setup

Leave a comment

Cisco ASA5500 Setup

In my test enviroment i have a ASA5510 with a Basic Configuration. You can use this as a starting point for configuring the ASA5500 Series Firewalls.

The ASA5510 is connected behind the Outside ASA5500 Firewall, this ASA will do the Packet filtering,
because i am a friend of KISS (“keep it simple and straightforward”), things get complicated by it self.
For the same reasons i like diving after the DIR (“Do it right”) Method.

In this post we will begin with a basic Setup of the ASA firewall. In the next posts i will describe other topics based on this setup.

Continue reading Cisco ASA5500 Setup →

ASA, Cisco, Computer, Routing, Security, VPN

How to configure Cisco ASA 5500 for AnyConnect Client

Leave a comment

So i was testing some stuff with the Authentication on the ASA Firewall and the AnyConnect client in the last days. So i feel it is time to write things down a little bit.

First i discovered we have the same problem with Windows 7 Firewall. Windows is not detecting the Interface so the Firewall do not say here we are part of the domain:-( Sad very Sad. But as i described here, there is a workaround but this is not supported by Cisco in any way.
But anyhow, we have to move to the AnyConnect Client to get VPN running with WWAN Cards.

So lets begin with a basic setup, only localusers and connect to the ASA with the AnyConnect Client.
No complex things, just connectivity. So we will start here with the configuration.
In the next posts we will go to the more complex things.

Continue reading How to configure Cisco ASA 5500 for AnyConnect Client →

ASA, Cisco, Computer, Security, VPN

Cisco VPN Clients are not recognized by Windows 7 Firewall

Leave a comment

As i former described we have problems with the Cisco IPSec VPN Client and WWAN Cards. So we are testing the AnyConnect Client. We are now faceing some common problems with both clients.

We discovered that the Network adapter created by the Cisco IPSec VPN Client (Version 5.0.07.0290) and also the Cisco AnyConnect SSL VPN Client (Version 2.5.0217) not recognized by the Windows 7 Advanced Firewall. And therefore the AD Grouppolicy for the Firewall is not applied.

As a Workaround you can drop following lines from the “vpnva.inf” file from the AnyConnect Package:
[sourcecode]
;Vista specific entry — benign on 2K/XP
HKR, , *NdisDeviceType, 0x00010001, 1
[/sourcecode]
or delete the Key for the adapter from the registry.

If you feel this helps a bit or may be not ? Please leave a comment.
Flickr : , , , ,