In this tidbit I want to cover some high level notes on general trustsec items as well as some good-to-knows. A brief overview of what trustsec is: TrustSec provides scalable access controls by uniquely classifying data traffic for a particular role. Understanding SGT Transport Mechanisms: Inline Tagging (data plane): if device supports SGT in its ASIC SXP (control plane): shared between devices that do not have SGT-capable hardware Multiple options for SGT transport over no

"The What?" - In this blog I want to cover a brief overview of migrating an ISE cluster from 2.7 to 3.0. Note that for this overview the cluster consisted of a 4 node ISE VM cluster from 2.7p5 to 3.0p5 & migrating all licenses from the old licensing model (base/plus/apex) to the new model (essentials/advantage/premier). This overview shared was an inline upgrade & not a backup/restore upgrade on new nodes. "The Why?" - I want to share this with others in hope that it can he

"The What?" - In this post I am going to share how to properly upgrade a pair of 4110 units with FTD acting as an HA pair (Active/Standby). I will cover upgrading FXOS, FTD, FMC, & even firmware. "The Why?" - It took me some time to figure out correct order of operations so I want to share a blueprint for success that has helped me learn & succeed. Plus upgrading software/firmware is critical for compliance & security reasons. "The How?" - Let's start with a high level ove

Preface: I recently encountered an issue when attempting to start an FTD instance from FXOS command line, which sparked my desire to write & share this post. In this post I want to cover how to properly shutdown/startup Firepower Threat Defense (FTD) instances running on a high availability (HA) pair of Cisco's 4110 NGFW chassis. I will also cover how to shutdown/restart a virtual Firepower Management Center (FMC) from the admin UI perspective. Let's start with the shutdown

"The What?" - In this blog I will be covering ASA clustering. I intend on providing a brief general overview of ASA clustering, as well as how to configure one of the modes & perform verification. "The Why?" - ASA clustering provides several benefits. Some of those benefits include the following: Ease of management: all config changes are done on master and replicated via cluster control link (CCL) to other units. Higher throughput: provides ability to aggregate traffic to

"The What?" - In this blog I want to cover a general understanding of the FirePOWER service module on the ASA, to include the basics of installation & configuration. Note that the ASA FirePOWER module is also known as SFR module. "The Why?" - The ASA FirePOWER services allow the following capabilities & benefits: Access control: You can achieve a more complete access control policy with enrichment data based on security threat intelligence. You configure simple or complex r

In the post I want to cover understanding IKEv1 status messages & debugging IKEv1 main mode. It is important as each message has its own unique meaning, and these messages are typically seen when attempting to establish a VPN. The lab/blog that will be referenced in the debugs is this one: Configuring & Verifying ASA Legacy IKEv1 L2L VPN - CLI To establish phase 1 of an IKEv1 VPN using main mode, 6 messages are exchanged between the two identified peers before a successful

"The What?" - In this post I will cover configuring & verifying a basic site-to-site VPN tunnel between two Cisco ASAs using IKEv1 with pre-shared keys (PSK). These types of VPNs are also known as L2L or lan-to-lan. To see a brief tidbit of comparisons between IKEv1 & IKEv2 see: IKEv1 vs. IKEv2 Tidbit Also, you can see more about ASAs via the asa tag. "The Why?" - It is important to understand the differences between legacy ASA L2L VPNs utilizing IKEv1 & how they are constr

"The What?" - In this post I will cover ASA HA configuration for an Active/Standby deployment & briefly touch on an upgrade approach. Before diving in, if you want to gain a better understanding of ASA HA please see the the following post: Understanding ASA High Availability Remember that the ASA can run in Active/Standby in single context mode only. For Active/Active the ASA must be running in multiple context mode. "The Why?" - High availability is often desired for sever

"The What?" - I want to breakdown network access translation (NAT) on the ASA. It is important to understand that NAT is processed by the rule order & section. Note that in both Section 1 & 3 you can manually configure the sequence order, but in Section 2 you cannot. Section 2 sequence order is determined via the following: Type - always static first & then dynamic Amount of IPs contained in the object Object network containing the same amount of IPs For tie breaking purpos

In this blog I want to cover understanding access-control lists (ACLs) on the Cisco ASA & different types of object groups for ACLs. First lets take a brief dive into the different ACL types relating to the ASA: Extended ACL = used by the unit to permit/deny traffic through the device, and can match via many features, including service policies, AAA rules, DAP policies, VPN group, & Botnet traffic filtering. Standard ACL = filter traffic by using the destination address of t

I want to cover some of the basics regarding the Cisco ASA. First, the ASA can operate in two modes: Routed/Transparent. Routed mode acts as a L3 bump on the wire, while transparent mode acts as a L2 bump on the wire. See more about Transparent ASAs here: Deploying an ASA in Transparent Mode In this post I want to cover the following ASA basics: Configuring different types of interfaces Enabling ASDM access Enabling SSH access To start, here are a few required components w