Blog | learnitwithcifelli

May 26

Understanding, Configuring, & Verifying ASA Clustering

"The What?" - In this blog I will be covering ASA clustering. I intend on providing a brief general overview of ASA clustering, as well as how to configure one of the modes & perform verification. "The Why?" - ASA clustering provides several benefits. Some of those benefits include the following: Ease of management: all config changes are done on master and replicated via cluster control link (CCL) to other units. Higher throughput: provides ability to aggregate traffic to

May 19

Installing & Configuring FirePOWER Services Module on ASA - CLI

"The What?" - In this blog I want to cover a general understanding of the FirePOWER service module on the ASA, to include the basics of installation & configuration. Note that the ASA FirePOWER module is also known as SFR module. "The Why?" - The ASA FirePOWER services allow the following capabilities & benefits: Access control: You can achieve a more complete access control policy with enrichment data based on security threat intelligence. You configure simple or complex r

May 19

Debugging IKEv1 on ASA

In the post I want to cover understanding IKEv1 status messages & debugging IKEv1 main mode. It is important as each message has its own unique meaning, and these messages are typically seen when attempting to establish a VPN. The lab/blog that will be referenced in the debugs is this one: Configuring & Verifying ASA Legacy IKEv1 L2L VPN - CLI To establish phase 1 of an IKEv1 VPN using main mode, 6 messages are exchanged between the two identified peers before a successful

May 19

Configuring & Verifying ASA Legacy IKEv1 L2L VPN - CLI

"The What?" - In this post I will cover configuring & verifying a basic site-to-site VPN tunnel between two Cisco ASAs using IKEv1 with pre-shared keys (PSK). These types of VPNs are also known as L2L or lan-to-lan. To see a brief tidbit of comparisons between IKEv1 & IKEv2 see: IKEv1 vs. IKEv2 Tidbit Also, you can see more about ASAs via the asa tag. "The Why?" - It is important to understand the differences between legacy ASA L2L VPNs utilizing IKEv1 & how they are constr

May 6

Configuring & Upgrading ASA HA - Active/Standby

"The What?" - In this post I will cover ASA HA configuration for an Active/Standby deployment & briefly touch on an upgrade approach. Before diving in, if you want to gain a better understanding of ASA HA please see the the following post: Understanding ASA High Availability Remember that the ASA can run in Active/Standby in single context mode only. For Active/Active the ASA must be running in multiple context mode. "The Why?" - High availability is often desired for sever

Apr 27

Configuring ASA NAT

"The What?" - I want to breakdown network access translation (NAT) on the ASA. It is important to understand that NAT is processed by the rule order & section. Note that in both Section 1 & 3 you can manually configure the sequence order, but in Section 2 you cannot. Section 2 sequence order is determined via the following: Type - always static first & then dynamic Amount of IPs contained in the object Object network containing the same amount of IPs For tie breaking purpos

Apr 16

Understanding ASA Access-Lists & Object-Groups

In this blog I want to cover understanding access-control lists (ACLs) on the Cisco ASA & different types of object groups for ACLs. First lets take a brief dive into the different ACL types relating to the ASA: Extended ACL = used by the unit to permit/deny traffic through the device, and can match via many features, including service policies, AAA rules, DAP policies, VPN group, & Botnet traffic filtering. Standard ACL = filter traffic by using the destination address of t

Apr 14

Understanding ASA Basics

I want to cover some of the basics regarding the Cisco ASA. First, the ASA can operate in two modes: Routed/Transparent. Routed mode acts as a L3 bump on the wire, while transparent mode acts as a L2 bump on the wire. See more about Transparent ASAs here: Deploying an ASA in Transparent Mode In this post I want to cover the following ASA basics: Configuring different types of interfaces Enabling ASDM access Enabling SSH access To start, here are a few required components w

Apr 13

Configuring & Verifying ASA Contexts

"The What?" - In this post I want to go over configuring & verifying multicontext mode on Cisco ASA. To understand what security contexts are see: ASA Security Contexts Tidbit "The Why?" - Using multicontext mode on Cisco ASA provides some valuable benefits. This mode allows us to partition the ASA into multiple "virtual" firewalls which could allow you to utilize one firewall for multiple customers. This mode also allows you to deploy different security policies perhaps f

Apr 8

Deploying an ASA in Transparent Mode

"The What?" - In this blog I want to explore 1 of the 2 ASA modes, Transparent mode. In this mode the ASA is no longer in routed mode acting as a L3 routed hop. The ASA actually operates as a L2 bump on the wire. "The Why?" - A major benefit is that you can actually insert a transparent ASA into a network without having to modify IPs on other devices. This can be clutch if wanting to segregate and essentially split a vlan up. Some other benefits include simplicity of conf

Mar 21

Configuring & Verifying Dual Cloud & Dual Hub FlexVPN Failover Scenarios

"The What?" - I want to expand on some of the other FlexVPN related blogs shared earlier. This lab will be expanding from an earlier lab where I utilized a Dual Hub FlexVPN in a single cloud topology. For reference that post is here: Configuring & Verifying FlexVPN Redundancy with Dual Hub & Single Cloud "The Why?" - In this post I will be focusing on FlexVPN redundancy with dual hub & dual cloud. This configuration will be a tad different from the previous FlexVPN redunda

Feb 6

Configuring, Verifying, and Troubleshooting a Point-to-Point FlexVPN with PKI Authentication

In this post I want to demo/breakdown configuring a point-to-point FlexVPN that uses certificate authentication. This lab demo will use PKI VPN authentication between two directly connected peers by utilizing an IOS PKI that has been referenced in other blogs. We will also explore ways to verify it. Lastly, I will share how to understand some valuable debugs. I wont be covering IOS PKI in this post so to see more about understanding/configuring IOS PKI see: Configuring, Ve