Foreword |
|
xxiii | |
Preface |
|
xxv | |
Acknowledgments |
|
xxvii | |
Introduction |
|
xxix | |
|
Part I Introduction to ASA Security Appliances and Basic Configuration Tasks |
|
|
|
|
3 | (30) |
|
|
4 | (19) |
|
|
5 | (2) |
|
|
7 | (8) |
|
|
15 | (3) |
|
Advanced Features of the Operating System |
|
|
18 | (5) |
|
|
23 | (10) |
|
|
23 | (5) |
|
|
28 | (2) |
|
|
30 | (3) |
|
|
33 | (12) |
|
|
34 | (2) |
|
|
34 | (1) |
|
|
35 | (1) |
|
|
36 | (9) |
|
|
36 | (2) |
|
|
38 | (3) |
|
ASA and Router IOS CLI Comparison |
|
|
41 | (4) |
|
|
45 | (30) |
|
|
46 | (2) |
|
Basic Management Commands |
|
|
48 | (4) |
|
|
48 | (1) |
|
|
49 | (2) |
|
|
51 | (1) |
|
|
51 | (1) |
|
Basic Configuration Commands |
|
|
52 | (13) |
|
|
52 | (1) |
|
|
53 | (1) |
|
|
53 | (1) |
|
|
54 | (1) |
|
|
55 | (7) |
|
|
62 | (3) |
|
|
65 | (5) |
|
|
65 | (3) |
|
|
68 | (2) |
|
Hardware and Software Information |
|
|
70 | (3) |
|
|
71 | (1) |
|
|
72 | (1) |
|
|
72 | (1) |
|
ASA Configuration Example |
|
|
73 | (2) |
|
|
75 | (30) |
|
|
76 | (19) |
|
|
76 | (1) |
|
|
76 | (1) |
|
|
77 | (5) |
|
|
82 | (2) |
|
|
84 | (7) |
|
|
91 | (4) |
|
|
95 | (10) |
|
Multicast Traffic and the Appliances |
|
|
95 | (1) |
|
|
96 | (1) |
|
|
96 | (4) |
|
|
100 | (5) |
|
Part II Controlling Traffic Through the ASA |
|
|
|
|
105 | (46) |
|
|
106 | (7) |
|
|
106 | (2) |
|
|
108 | (1) |
|
|
109 | (1) |
|
|
110 | (1) |
|
Protocol and Application Issues |
|
|
110 | (3) |
|
Translations and Connections |
|
|
113 | (6) |
|
|
113 | (2) |
|
|
115 | (1) |
|
|
115 | (4) |
|
Address Translation Overview |
|
|
119 | (9) |
|
|
119 | (1) |
|
Needs for Address Translation |
|
|
120 | (2) |
|
Examples of Address Translation |
|
|
122 | (6) |
|
Address Translation Configuration |
|
|
128 | (15) |
|
Requiring Address Translation |
|
|
128 | (1) |
|
Configuring Dynamic Address Translation |
|
|
129 | (9) |
|
Configuring Static NAT Translation |
|
|
138 | (2) |
|
Configuring Static PAT Translation |
|
|
140 | (1) |
|
Finding a Matching Translation Policy |
|
|
141 | (2) |
|
|
143 | (1) |
|
The Original TCP Intercept |
|
|
143 | (1) |
|
TCP Intercept with SYN Cookies |
|
|
143 | (1) |
|
Translation and Connection Verification |
|
|
144 | (7) |
|
Viewing Active Translations |
|
|
144 | (2) |
|
Viewing Active Connections |
|
|
146 | (1) |
|
Viewing Local Host Information |
|
|
147 | (1) |
|
Clearing Entries in the Xlate and Conn Tables |
|
|
148 | (3) |
|
|
151 | (38) |
|
Access Control Lists (ACLs) |
|
|
152 | (19) |
|
|
152 | (3) |
|
Creating and Activating ACLs |
|
|
155 | (5) |
|
|
160 | (1) |
|
|
160 | (1) |
|
|
161 | (2) |
|
ACL Configuration Examples |
|
|
163 | (8) |
|
|
171 | (6) |
|
Advantages of Object Groups |
|
|
171 | (1) |
|
|
171 | (3) |
|
Examining Your Object Groups |
|
|
174 | (1) |
|
|
174 | (1) |
|
|
175 | (1) |
|
Object Group Configuration Example |
|
|
176 | (1) |
|
|
177 | (4) |
|
ICMP Traffic Through the Appliances |
|
|
178 | (1) |
|
ICMP Traffic Directed at the Appliances |
|
|
179 | (2) |
|
Connection Troubleshooting |
|
|
181 | (8) |
|
|
181 | (3) |
|
|
184 | (5) |
|
|
189 | (18) |
|
Java and ActiveX Filtering |
|
|
190 | (2) |
|
|
190 | (1) |
|
Java and ActiveX Filtering Solutions |
|
|
191 | (1) |
|
|
191 | (1) |
|
Configuring ActiveX Filters |
|
|
192 | (1) |
|
|
192 | (11) |
|
|
193 | (2) |
|
|
195 | (5) |
|
URL Filtering Verification |
|
|
200 | (2) |
|
|
202 | (1) |
|
|
203 | (4) |
|
|
203 | (1) |
|
|
204 | (1) |
|
|
205 | (1) |
|
WCCP Configuration Example |
|
|
206 | (1) |
|
|
207 | (26) |
|
|
208 | (3) |
|
|
208 | (1) |
|
|
208 | (1) |
|
|
209 | (2) |
|
|
211 | (2) |
|
|
211 | (2) |
|
|
213 | (11) |
|
|
214 | (1) |
|
Appliance Configuration of CTP Authentication |
|
|
215 | (7) |
|
Verifying CTP Authentication |
|
|
222 | (2) |
|
|
224 | (6) |
|
CTP Authorization Options |
|
|
225 | (1) |
|
Classic Authorization Configuration |
|
|
226 | (2) |
|
Downloadable ACL Configuration |
|
|
228 | (2) |
|
|
230 | (3) |
|
Appliance Configuration for Accounting |
|
|
230 | (1) |
|
|
231 | (2) |
|
|
233 | (14) |
|
|
234 | (2) |
|
IPv6 Capabilities of the Appliances |
|
|
234 | (1) |
|
IPv6 Limitations of the Appliances |
|
|
235 | (1) |
|
IPv6 Interface Configuration |
|
|
236 | (2) |
|
Stateless Autoconfiguration |
|
|
236 | (1) |
|
Link-Local Address Configuration |
|
|
237 | (1) |
|
Global Address Configuration |
|
|
237 | (1) |
|
IPv6 Interface Configuration Verification |
|
|
238 | (1) |
|
|
238 | (1) |
|
|
239 | (3) |
|
Neighbor Solicitation Messages |
|
|
240 | (1) |
|
Router Advertisement Messages |
|
|
241 | (1) |
|
|
242 | (5) |
|
|
242 | (2) |
|
|
244 | (3) |
|
Part III Policy Implementation |
|
|
|
|
247 | (30) |
|
|
248 | (4) |
|
|
248 | (1) |
|
|
249 | (3) |
|
|
252 | (1) |
|
|
252 | (8) |
|
|
253 | (3) |
|
Application Layer Class Maps |
|
|
256 | (4) |
|
|
260 | (14) |
|
|
261 | (10) |
|
|
271 | (3) |
|
|
274 | (3) |
|
Activating a Layer 3/4 Policy Map |
|
|
274 | (1) |
|
Service Policy Verification |
|
|
275 | (2) |
|
|
277 | (18) |
|
|
278 | (2) |
|
|
278 | (1) |
|
ICMP Inspection Configuration |
|
|
279 | (1) |
|
DCE/RPC Inspection Policies |
|
|
280 | (1) |
|
DCE/RPC Policy Configuration |
|
|
280 | (1) |
|
DCE/RPC Example Configuration |
|
|
281 | (1) |
|
Sun RPC Inspection Policies |
|
|
281 | (3) |
|
Sun RPC Policy Configuration |
|
|
282 | (1) |
|
Sun RPC Example Configuration |
|
|
283 | (1) |
|
ILS/LDAP Inspection Policies |
|
|
284 | (1) |
|
Mechanics of ILS/LDAP Connections |
|
|
284 | (1) |
|
ILS/LDAP Policy Configuration |
|
|
285 | (1) |
|
ILS/LDAP Example Configuration |
|
|
285 | (1) |
|
NetBIOS Inspection Policies |
|
|
285 | (2) |
|
NetBIOS Policy Configuration |
|
|
286 | (1) |
|
NetBIOS Example Configuration |
|
|
286 | (1) |
|
IPSec Pass-Thru Inspection Policies |
|
|
287 | (1) |
|
IPSec Pass-Thru Policy Configuration |
|
|
287 | (1) |
|
IPSec Pass-Thru Example Configuration |
|
|
288 | (1) |
|
|
288 | (1) |
|
PPTP Policy Configuration |
|
|
289 | (1) |
|
PPTP Example Configuration |
|
|
289 | (1) |
|
XDMCP Inspection Policies |
|
|
289 | (6) |
|
Mechanics of XDMCP Connections |
|
|
290 | (1) |
|
XDMCP Policy Configuration |
|
|
291 | (1) |
|
Established Command Configuration |
|
|
291 | (2) |
|
XDMCP Example Configuration |
|
|
293 | (2) |
|
Data Applications and Policies |
|
|
295 | (32) |
|
|
296 | (6) |
|
|
296 | (3) |
|
|
299 | (2) |
|
DNS Example Configuration |
|
|
301 | (1) |
|
SMTP and ESMTP Inspection |
|
|
302 | (4) |
|
SMTP and ESMTP Inspection Features |
|
|
302 | (1) |
|
SMTP and ESMTP Policy Configuration |
|
|
303 | (2) |
|
SMTP and ESMTP Example Configuration |
|
|
305 | (1) |
|
|
306 | (6) |
|
|
306 | (3) |
|
|
309 | (1) |
|
|
309 | (2) |
|
FTP Example Configuration |
|
|
311 | (1) |
|
|
312 | (1) |
|
|
312 | (1) |
|
TFTP Policy Configuration |
|
|
313 | (1) |
|
|
313 | (5) |
|
|
313 | (1) |
|
HTTP Policy Configuration |
|
|
314 | (3) |
|
HTTP Example Configuration |
|
|
317 | (1) |
|
Instant Messaging Inspection |
|
|
318 | (3) |
|
|
318 | (2) |
|
|
320 | (1) |
|
|
321 | (1) |
|
Mechanics of RSH Connections |
|
|
321 | (1) |
|
|
322 | (1) |
|
|
322 | (1) |
|
SNMP Policy Configuration |
|
|
322 | (1) |
|
SNMP Example Configuration |
|
|
323 | (1) |
|
|
323 | (4) |
|
Mechanics of SQL*Net Connections |
|
|
323 | (2) |
|
SQL*Net Policy Configuration |
|
|
325 | (2) |
|
|
327 | (20) |
|
|
328 | (7) |
|
SIP Connections and Application Inspection |
|
|
328 | (3) |
|
|
331 | (3) |
|
SIP Example Configuration |
|
|
334 | (1) |
|
|
335 | (5) |
|
SCCP Connections and Application Inspection |
|
|
335 | (2) |
|
SCCP Policy Configuration |
|
|
337 | (2) |
|
SCCP Example Configuration |
|
|
339 | (1) |
|
|
340 | (2) |
|
CTIQBE Connections and Application Inspection |
|
|
340 | (1) |
|
CTIQBE Policy Configuration |
|
|
341 | (1) |
|
|
342 | (5) |
|
MGCP Connections and Application Inspection |
|
|
343 | (1) |
|
MGCP Policy Configuration |
|
|
344 | (1) |
|
MGCP Example Configuration |
|
|
345 | (2) |
|
|
347 | (24) |
|
|
348 | (1) |
|
Common Problems with Multimedia Applications and Firewalls |
|
|
348 | (1) |
|
Firewall Solutions for Multimedia Applications |
|
|
348 | (1) |
|
|
349 | (6) |
|
RTSP Connections and Application Inspection |
|
|
350 | (3) |
|
RTSP Policy Configuration |
|
|
353 | (2) |
|
RTSP Example Configuration |
|
|
355 | (1) |
|
|
355 | (16) |
|
|
356 | (1) |
|
H.323 Connections and Application Inspection |
|
|
357 | (7) |
|
H.323 Policy Configuration |
|
|
364 | (2) |
|
H.323 Example Configuration |
|
|
366 | (5) |
|
Part IV Virtual Private Networks (VPNs) |
|
|
|
|
371 | (24) |
|
|
372 | (1) |
|
|
372 | (1) |
|
|
373 | (1) |
|
|
373 | (5) |
|
|
373 | (2) |
|
|
375 | (1) |
|
NAT Traversal and IPSec over TCP |
|
|
375 | (2) |
|
|
377 | (1) |
|
|
378 | (2) |
|
|
378 | (1) |
|
General Tunnel Group Attributes |
|
|
379 | (1) |
|
VPN-Specific Tunnel Group Attributes |
|
|
380 | (1) |
|
|
380 | (15) |
|
|
381 | (1) |
|
|
381 | (11) |
|
|
392 | (3) |
|
|
395 | (14) |
|
|
396 | (3) |
|
ISAKMP Phase 1 Configuration |
|
|
397 | (1) |
|
Tunnel Group Configuration |
|
|
397 | (1) |
|
VPN Traffic and Address Translation |
|
|
398 | (1) |
|
ISAKMP Phase 2 Configuration |
|
|
399 | (5) |
|
|
400 | (1) |
|
|
400 | (1) |
|
|
401 | (1) |
|
|
402 | (2) |
|
Site-to-Site Verification |
|
|
404 | (3) |
|
Viewing and Clearing Connections |
|
|
405 | (2) |
|
Troubleshooting Connections |
|
|
407 | (1) |
|
|
407 | (2) |
|
IPSec Remote Access Server |
|
|
409 | (32) |
|
|
410 | (4) |
|
|
411 | (1) |
|
|
412 | (1) |
|
|
413 | (1) |
|
Remote Access Preparation |
|
|
414 | (2) |
|
|
415 | (1) |
|
VPN Traffic and Address Translation |
|
|
415 | (1) |
|
|
415 | (1) |
|
ISAKMP Phase 1 Configuration |
|
|
416 | (14) |
|
|
416 | (1) |
|
Group Policy Configuration |
|
|
417 | (8) |
|
Tunnel Group Configuration |
|
|
425 | (3) |
|
|
428 | (2) |
|
ISAKMP Phase 2 Configuration |
|
|
430 | (2) |
|
|
430 | (1) |
|
|
431 | (1) |
|
Remote Access Verification |
|
|
432 | (2) |
|
Viewing Remote Access Connections |
|
|
432 | (2) |
|
Disconnecting Remote Access Users |
|
|
434 | (1) |
|
IPSec Remote Access Server Example |
|
|
434 | (2) |
|
|
436 | (5) |
|
|
437 | (1) |
|
|
438 | (1) |
|
|
439 | (2) |
|
IPSec Remote Access Client |
|
|
441 | (10) |
|
|
442 | (3) |
|
|
442 | (2) |
|
|
444 | (1) |
|
Network Extension Plus Mode |
|
|
445 | (1) |
|
|
445 | (4) |
|
Hardware Client XAUTH Authentication Methods |
|
|
445 | (1) |
|
|
446 | (1) |
|
Basic Client Configuration |
|
|
447 | (1) |
|
|
448 | (1) |
|
Easy VPN Configuration Example with a Hardware Remote |
|
|
449 | (2) |
|
ASA 5505 Configuration Example |
|
|
449 | (1) |
|
Example Easy VPN Server Configuration |
|
|
449 | (2) |
|
|
451 | (36) |
|
|
452 | (3) |
|
|
453 | (1) |
|
|
454 | (1) |
|
Basic WebVPN Configuration |
|
|
455 | (5) |
|
Implementing SSL Policies |
|
|
455 | (1) |
|
|
456 | (1) |
|
Supporting Both WebVPN and ASDM |
|
|
456 | (1) |
|
|
457 | (1) |
|
Implementing Web Proxying |
|
|
458 | (2) |
|
Defining General WebVPN Properties |
|
|
460 | (1) |
|
|
460 | (7) |
|
Configuring Group Policies |
|
|
460 | (5) |
|
Overriding Group Policies on a Per-User Basis |
|
|
465 | (2) |
|
|
467 | (3) |
|
Tunnel Group General Attributes |
|
|
467 | (1) |
|
Tunnel Group WebVPN Attributes |
|
|
468 | (1) |
|
|
469 | (1) |
|
WebVPN Clientless Home Portal |
|
|
470 | (5) |
|
|
471 | (1) |
|
|
472 | (1) |
|
|
473 | (2) |
|
|
475 | (10) |
|
|
476 | (4) |
|
|
480 | (1) |
|
|
481 | (4) |
|
WebVPN Verification and Troubleshooting |
|
|
485 | (2) |
|
|
485 | (1) |
|
|
485 | (2) |
|
SSL VPNs: AnyConnect Client |
|
|
487 | (22) |
|
AnyConnect Client Overview |
|
|
488 | (2) |
|
|
488 | (1) |
|
AnyConnect Client Implementation |
|
|
489 | (1) |
|
AnyConnect Client Connections |
|
|
489 | (1) |
|
AnyConnect Client Preparation and Installation |
|
|
490 | (11) |
|
ASA Preparation for the AnyConnect Client |
|
|
491 | (2) |
|
|
493 | (4) |
|
|
497 | (2) |
|
|
499 | (2) |
|
Managing and Troubleshooting AnyConnect Sessions |
|
|
501 | (8) |
|
Connecting to a WebVPN Server |
|
|
501 | (3) |
|
Viewing and Managing Connected Users |
|
|
504 | (5) |
|
Part V Advanced Features of the ASA |
|
|
|
|
509 | (14) |
|
Layer 2 Processing of Traffic |
|
|
510 | (5) |
|
Routed vs. Transparent Mode |
|
|
510 | (1) |
|
Bridges vs. Transparent Mode |
|
|
511 | (2) |
|
Supported and Unsupported Features |
|
|
513 | (2) |
|
|
515 | (1) |
|
Configuring Transparent Mode |
|
|
515 | (3) |
|
Switching to Transparent Mode |
|
|
516 | (1) |
|
|
516 | (1) |
|
MAC Address Table and Learning |
|
|
517 | (1) |
|
Additional Layer 2 Features |
|
|
518 | (2) |
|
Non-IP Traffic and Ether-Type ACLs |
|
|
518 | (1) |
|
|
519 | (1) |
|
Transparent Firewall Example Configuration |
|
|
520 | (3) |
|
|
523 | (18) |
|
|
524 | (4) |
|
|
524 | (1) |
|
|
524 | (1) |
|
|
525 | (1) |
|
|
526 | (1) |
|
|
527 | (1) |
|
|
528 | (7) |
|
Switching to Multiple Mode |
|
|
528 | (1) |
|
System Area Configuration |
|
|
529 | (1) |
|
Designating the Administrative Context |
|
|
529 | (1) |
|
|
530 | (2) |
|
|
532 | (3) |
|
|
535 | (1) |
|
Switching Between Contexts |
|
|
535 | (1) |
|
|
535 | (1) |
|
|
536 | (1) |
|
|
536 | (5) |
|
Example: Changing to Multiple Mode |
|
|
537 | (1) |
|
Example: Setting Up the Interfaces |
|
|
537 | (1) |
|
Example: Creating the Contexts |
|
|
538 | (1) |
|
Example: Configuring the Admin Context |
|
|
538 | (1) |
|
Example: Configuring the ctx Context |
|
|
539 | (1) |
|
Example: Saving the Appliance Configuration |
|
|
540 | (1) |
|
|
541 | (36) |
|
|
542 | (3) |
|
|
542 | (1) |
|
|
543 | (2) |
|
|
545 | (1) |
|
|
545 | (1) |
|
|
545 | (3) |
|
|
546 | (1) |
|
|
546 | (1) |
|
|
547 | (1) |
|
|
548 | (3) |
|
|
548 | (1) |
|
|
549 | (1) |
|
|
550 | (1) |
|
|
550 | (1) |
|
|
551 | (4) |
|
|
551 | (1) |
|
|
552 | (2) |
|
|
554 | (1) |
|
Active/Standby Configuration |
|
|
555 | (11) |
|
Active/Standby: PIXs and the Serial Cable |
|
|
555 | (3) |
|
|
558 | (2) |
|
Active/Standby: Optional Commands |
|
|
560 | (1) |
|
Active/Standby: Example Configuration |
|
|
561 | (5) |
|
Active/Active Configuration |
|
|
566 | (11) |
|
Active/Active: LBF Configuration |
|
|
566 | (3) |
|
Active/Active: Optional Commands |
|
|
569 | (1) |
|
Active/Active: Example Configuration |
|
|
570 | (7) |
|
Network Attack Prevention |
|
|
577 | (20) |
|
|
578 | (9) |
|
|
578 | (4) |
|
Scanning Threat Detection |
|
|
582 | (2) |
|
Threat Detection Statistics |
|
|
584 | (3) |
|
|
587 | (3) |
|
|
587 | (3) |
|
|
590 | (1) |
|
|
590 | (7) |
|
|
590 | (3) |
|
|
593 | (1) |
|
|
594 | (3) |
|
|
597 | (22) |
|
|
598 | (8) |
|
AIP-SSM Card Modes and Failure Options |
|
|
598 | (1) |
|
Traffic and the AIP-SSM Card |
|
|
599 | (1) |
|
Traffic Forwarding to the AIP-SSM Card |
|
|
600 | (1) |
|
AIP-SSM Basic Configuration |
|
|
601 | (5) |
|
|
606 | (6) |
|
|
606 | (1) |
|
Forwarding Traffic to the CSC-SSM Card |
|
|
607 | (2) |
|
Setting Up the CSC-SSM Card |
|
|
609 | (3) |
|
|
612 | (7) |
|
Verifying an SSM Card Operational Status |
|
|
612 | (2) |
|
|
614 | (1) |
|
|
615 | (4) |
|
Part VI Management of the ASA |
|
|
|
Basic Management from the CLI |
|
|
619 | (28) |
|
|
620 | (3) |
|
|
620 | (2) |
|
|
622 | (1) |
|
Remote Management Features |
|
|
623 | (7) |
|
|
623 | (2) |
|
|
625 | (4) |
|
|
629 | (1) |
|
|
630 | (5) |
|
|
630 | (1) |
|
|
631 | (2) |
|
Controlling the Bootup Process |
|
|
633 | (1) |
|
|
634 | (1) |
|
|
635 | (4) |
|
Restricting the Password Recovery Process |
|
|
635 | (1) |
|
Performing the PIX Password Recovery Process |
|
|
636 | (2) |
|
Performing the ASA Password Recovery Process |
|
|
638 | (1) |
|
|
639 | (8) |
|
|
639 | (3) |
|
|
642 | (3) |
|
|
645 | (2) |
|
|
647 | (56) |
|
|
648 | (2) |
|
|
648 | (1) |
|
|
649 | (1) |
|
ASDM Configuration Preparations |
|
|
650 | (1) |
|
|
650 | (1) |
|
Basic Configuration Commands |
|
|
651 | (1) |
|
|
651 | (3) |
|
|
652 | (1) |
|
|
653 | (1) |
|
|
654 | (9) |
|
|
655 | (6) |
|
|
661 | (1) |
|
|
662 | (1) |
|
ASDM Configuration Screens |
|
|
663 | (29) |
|
|
663 | (1) |
|
|
664 | (4) |
|
|
668 | (10) |
|
|
678 | (12) |
|
|
690 | (1) |
|
|
691 | (1) |
|
|
692 | (5) |
|
|
693 | (1) |
|
|
694 | (1) |
|
|
694 | (1) |
|
|
695 | (1) |
|
|
695 | (2) |
|
|
697 | (6) |
|
Initial Access and Context Manipulation |
|
|
698 | (2) |
|
|
700 | (3) |
Index |
|
703 | |