-
Cisco ASA 5500 Series Configuration Guide using the CLI, 8.3
-
About This Guide
-
Glossary
- Getting Started and General Information
- Setting Up the Adaptive Security Appliance
- Configuring Access Lists
- Configuring IP Routing
- Configuring NAT
- Configuring Service Policies Using the Modular Policy Framework
- Configuring Access Control
- Configuring Application Inspection
- Configuring Unified Communications
- Configuring Connection Settings and QoS
- Configuring Advanced Network Protection
- Configuring Applications on SSMs and SSCs
- Configuring High Availability
-
Configuring VPN
-
Configuring IPSec and ISAKMP
-
Configuring L2TP over IPSec
-
Setting General VPN Parameters
-
Configuring Tunnel Groups, Group Policies, and Users
-
Configuring IP Addresses for VPN
-
Configuring Remote Access VPNs
-
Configuring Network Admission Control
-
Configuring Easy VPN on the ASA 5505
-
Configuring the PPPoE Client
-
Configuring LAN-to-LAN VPNs
-
Configuring Clientless SSL VPN
-
Configuring AnyConnect VPN Client Connections
-
- Configuring Logging and SNMP
- System Administration
- Reference
-
Feedback
Table Of Contents
Configuring the Transparent or Routed Firewall
Information About the Firewall Mode
Information About Routed Firewall Mode
Information About Transparent Firewall Mode
Licensing Requirements for the Firewall Mode
Feature History for Firewall Mode
Configuring ARP Inspection for the Transparent Firewall
Information About ARP Inspection
Licensing Requirements for ARP Inspection
Task Flow for Configuring ARP Inspection
Feature History for ARP Inspection
Customizing the MAC Address Table for the Transparent Firewall
Information About the MAC Address Table
Licensing Requirements for the MAC Address Table
Configuring the MAC Address Table
Setting the MAC Address Timeout
Disabling MAC Address Learning
Monitoring the MAC Address Table
Feature History for the MAC Address Table
How Data Moves Through the Security Appliance in Routed Firewall Mode
An Inside User Visits a Web Server
An Outside User Visits a Web Server on the DMZ
An Inside User Visits a Web Server on the DMZ
An Outside User Attempts to Access an Inside Host
A DMZ User Attempts to Access an Inside Host
How Data Moves Through the Transparent Firewall
An Inside User Visits a Web Server
An Inside User Visits a Web Server Using NAT
An Outside User Visits a Web Server on the Inside Network
An Outside User Attempts to Access an Inside Host
Configuring the Transparent or Routed Firewall
This chapter describes how to configure the firewall mode, routed or transparent, and how to customize transparent firewall operation.
Note
In multiple context mode, you cannot set the firewall mode separately for each context; you can only set the firewall mode for the entire adaptive security appliance.
This chapter includes the following sections:
•
•
•
Configuring the Firewall Mode
This section describes routed and transparent firewall mode, and how to set the mode. This section includes the following topics:
•
•
•
Information About the Firewall Mode
This section describes routed and transparent firewall mode and includes the following topics:
•
•
Information About Routed Firewall Mode
In routed mode, the adaptive security appliance is considered to be a router hop in the network. It can use OSPF or RIP (in single context mode). Routed mode supports many interfaces. Each interface is on a different subnet. You can share interfaces between contexts.
The adaptive security appliance acts as a router between connected networks, and each interface requires an IP address on a different subnet. In single context mode, the routed firewall supports OSPF, EIGRP, and RIP. Multiple context mode supports static routes only. We recommend using the advanced routing capabilities of the upstream and downstream routers instead of relying on the adaptive security appliance for extensive routing needs.
Information About Transparent Firewall Mode
Traditionally, a firewall is a routed hop and acts as a default gateway for hosts that connect to one of its screened subnets. A transparent firewall, on the other hand, is a Layer 2 firewall that acts like a "bump in the wire," or a "stealth firewall," and is not seen as a router hop to connected devices.
This section describes transparent firewall mode and includes the following topics:
•
•
•
Transparent Firewall Network
The adaptive security appliance connects the same network on its inside and outside interfaces. Because the firewall is not a routed hop, you can easily introduce a transparent firewall into an existing network.
Allowing Layer 3 Traffic
IPv4 and IPv6 traffic is allowed through the transparent firewall automatically from a higher security interface to a lower security interface, without an access list. ARPs are allowed through the transparent firewall in both directions without an access list. ARP traffic can be controlled by ARP inspection. For Layer 3 traffic travelling from a low to a high security interface, an extended access list is required on the low security interface. See Chapter 13 "Adding an Extended Access List," or Chapter 17 "Adding an IPv6 Access List," for more information.
Allowed MAC Addresses
The following destination MAC addresses are allowed through the transparent firewall. Any MAC address not on this list is dropped.
•
•
•
•
•
Passing Traffic Not Allowed in Routed Mode
In routed mode, some types of traffic cannot pass through the adaptive security appliance even if you allow it in an access list. The transparent firewall, however, can allow almost any traffic through using either an extended access list (for IP traffic) or an EtherType access list (for non-IP traffic).
Note
For example, you can establish routing protocol adjacencies through a transparent firewall; you can allow OSPF, RIP, EIGRP, or BGP traffic through based on an extended access list. Likewise, protocols like HSRP or VRRP can pass through the adaptive security appliance.
Non-IP traffic (for example AppleTalk, IPX, BPDUs, and MPLS) can be configured to go through using an EtherType access list.
For features that are not directly supported on the transparent firewall, you can allow traffic to pass through so that upstream and downstream routers can support the functionality. For example, by using an extended access list, you can allow DHCP traffic (instead of the unsupported DHCP relay feature) or multicast traffic such as that created by IP/TV.
BPDU Handling
To prevent loops using the spanning tree protocol, BPDUs are passed by default. To block BPDUs, you need to configure an EtherType access list to deny them.
MAC Address vs. Route Lookups
When the adaptive security appliance runs in transparent mode, the outgoing interface of a packet is determined by performing a MAC address lookup instead of a route lookup.
Route lookups, however, are necessary for the following traffic types:
•
•
•
Using the Transparent Firewall in Your Network
Figure 4-1 shows a typical transparent firewall network where the outside devices are on the same subnet as the inside devices. The inside router and hosts appear to be directly connected to the outside router.
Figure 4-1 Transparent Firewall Network
Licensing Requirements for the Firewall Mode
The following table shows the licensing requirements for this feature.
Default Settings
The default mode is routed mode.
Guidelines and Limitations
This section includes the guidelines and limitations for this feature.
Context Mode Guidelines
•
•
•
Transparent Firewall Guidelines
Follow these guidelines when planning your transparent firewall network:
•
Unlike routed mode, which requires an IP address for each interface, a transparent firewall has an IP address assigned to the entire device. The adaptive security appliance uses this IP address as the source address for packets originating on the adaptive security appliance, such as system messages or AAA communications.
The management IP address must be on the same subnet as the connected network. You cannot set the subnet to a host subnet (255.255.255.255).
For IPv6, at a minimum you need to configure link-local addresses for each interface for through traffic. For full functionality, including the ability to manage the adaptive security appliance, you need to configure a global IP address for the device.
You can configure an IP address (both IPv4 and IPv6) for the Management 0/0 or Management 0/1 management-only interface. This IP address can be on a separate subnet from the main management IP address.
•
In single mode, you can only use two data interfaces (and the dedicated management interface, if available) even if your security appliance includes more than two interfaces.
Note
•
•
•
•
IPv6 Guidelines
Supports IPv6.
Additional Guidelines and Limitations
•
•
Unsupported Features in Transparent Mode
Table 4-1 lists the features are not supported in transparent mode.
Setting the Firewall Mode
This section describes how to change the firewall mode.
Note
Prerequisites
When you change modes, the adaptive security appliance clears the running configuration (see the "Guidelines and Limitations" section for more information).
•
•
Detailed Steps
Feature History for Firewall Mode
Table 4-2 lists the release history for this feature.
Configuring ARP Inspection for the Transparent Firewall
This section describes ARP inspection and how to enable it and includes the following topics:
•
•
•
Information About ARP Inspection
By default, all ARP packets are allowed through the adaptive security appliance. You can control the flow of ARP packets by enabling ARP inspection.
When you enable ARP inspection, the adaptive security appliance compares the MAC address, IP address, and source interface in all ARP packets to static entries in the ARP table, and takes the following actions:
•
•
•
Note
ARP inspection prevents malicious users from impersonating other hosts or routers (known as ARP spoofing). ARP spoofing can enable a "man-in-the-middle" attack. For example, a host sends an ARP request to the gateway router; the gateway router responds with the gateway router MAC address. The attacker, however, sends another ARP response to the host with the attacker MAC address instead of the router MAC address. The attacker can now intercept all the host traffic before forwarding it on to the router.
ARP inspection ensures that an attacker cannot send an ARP response with the attacker MAC address, so long as the correct MAC address and the associated IP address are in the static ARP table.
Licensing Requirements for ARP Inspection
The following table shows the licensing requirements for this feature.
Default Settings
By default, all ARP packets are allowed through the adaptive security appliance.
If you enable ARP inspection, the default setting is to flood non-matching packets.
Guidelines and Limitations
Context Mode Guidelines
•
•
Firewall Mode Guidelines
Supported only in transparent firewall mode. Routed mode is not supported.
Configuring ARP Inspection
This section describes how to configure ARP inspection and includes the following topics:
•
Task Flow for Configuring ARP Inspection
To configure ARP Inspection, perform the following steps:
Step 1
Step 2
Adding a Static ARP Entry
ARP inspection compares ARP packets with static ARP entries in the ARP table. Although hosts identify a packet destination by an IP address, the actual delivery of the packet on Ethernet relies on the Ethernet MAC address. When a router or host wants to deliver a packet on a directly connected network, it sends an ARP request asking for the MAC address associated with the IP address, and then delivers the packet to the MAC address according to the ARP response. The host or router keeps an ARP table so it does not have to send ARP requests for every packet it needs to deliver. The ARP table is dynamically updated whenever ARP responses are sent on the network, and if an entry is not used for a period of time, it times out. If an entry is incorrect (for example, the MAC address changes for a given IP address), the entry times out before it can be updated.
Note
Detailed Steps
arp interface_name ip_address mac_address
Example:hostname(config)# arp outside 10.1.1.1 0009.7cbe.2100
Adds a static ARP entry.
Examples
For example, to allow ARP responses from the router at 10.1.1.1 with the MAC address 0009.7cbe.2100 on the outside interface, enter the following command:
hostname(config)# arp outside 10.1.1.1 0009.7cbe.2100What to Do Next
Enable ARP inspection according to the "Enabling ARP Inspection" section.
Enabling ARP Inspection
This section describes how to enable ARP inspection.
Detailed Steps
Examples
For example, to enable ARP inspection on the outside interface, and to drop all non-matching ARP packets, enter the following command:
hostname(config)# arp-inspection outside enable no-floodMonitoring ARP Inspection
To monitor ARP inspection, perform the following task:
Shows the current settings for ARP inspection on all interfaces.
Feature History for ARP Inspection
Table 4-3 lists the release history for this feature.
Customizing the MAC Address Table for the Transparent Firewall
This section describes the MAC address table and includes the following topics:
•
•
•
•
•
Information About the MAC Address Table
The adaptive security appliance learns and builds a MAC address table in a similar way as a normal bridge or switch: when a device sends a packet through the adaptive security appliance, the adaptive security appliance adds the MAC address to its table. The table associates the MAC address with the source interface so that the adaptive security appliance knows to send any packets addressed to the device out the correct interface.
The ASA 5505 adaptive security appliance includes a built-in switch; the switch MAC address table maintains the MAC address-to-switch port mapping for traffic within each VLAN. This section discusses the bridge MAC address table, which maintains the MAC address-to-VLAN interface mapping for traffic that passes between VLANs.
Because the adaptive security appliance is a firewall, if the destination MAC address of a packet is not in the table, the adaptive security appliance does not flood the original packet on all interfaces as a normal bridge does. Instead, it generates the following packets for directly connected devices or for remote devices:
•
•
The original packet is dropped.
Licensing Requirements for the MAC Address Table
The following table shows the licensing requirements for this feature.
Default Settings
The default timeout value for dynamic MAC address table entries is 5 minutes.
By default, each interface, including the optional management interface, automatically learns the MAC addresses of entering traffic, and the adaptive security appliance adds corresponding entries to the MAC address table.
Guidelines and Limitations
Context Mode Guidelines
•
•
Firewall Mode Guidelines
Supported only in transparent firewall mode. Routed mode is not supported.
Additional Guidelines
In transparent firewall mode, the management interface updates the MAC address table in the same manner as a data interface; therefore you should not connect both a management and a data interface to the same switch unless you configure one of the switch ports as a routed port (by default Cisco Catalyst switches share a MAC address for all VLAN switch ports). Otherwise, if traffic arrives on the management interface from the physically-connected switch, then the adaptive security appliance updates the MAC address table to use the management interface to access the switch, instead of the data interface. This action causes a temporary traffic interruption; the adaptive security appliance will not re-update the MAC address table for packets from the switch to the data interface for at least 30 seconds for security reasons.
Configuring the MAC Address Table
This section describes how you can customize the MAC address table and includes the following sections:
•
•
Adding a Static MAC Address
Normally, MAC addresses are added to the MAC address table dynamically as traffic from a particular MAC address enters an interface. You can add static MAC addresses to the MAC address table if desired. One benefit to adding static entries is to guard against MAC spoofing. If a client with the same MAC address as a static entry attempts to send traffic to an interface that does not match the static entry, then the adaptive security appliance drops the traffic and generates a system message. When you add a static ARP entry (see the "Adding a Static ARP Entry" section), a static MAC address entry is automatically added to the MAC address table.
To add a static MAC address to the MAC address table, enter the following command:
Setting the MAC Address Timeout
The default timeout value for dynamic MAC address table entries is 5 minutes, but you can change the timeout. To change the timeout, enter the following command:
Disabling MAC Address Learning
By default, each interface automatically learns the MAC addresses of entering traffic, and the adaptive security appliance adds corresponding entries to the MAC address table. You can disable MAC address learning if desired, however, unless you statically add MAC addresses to the table, no traffic can pass through the adaptive security appliance.
To disable MAC address learning, enter the following command:
Monitoring the MAC Address Table
You can view the entire MAC address table (including static and dynamic entries for both interfaces), or you can view the MAC address table for an interface. To view the MAC address table, enter the following command:
Examples
The following is sample output from the show mac-address-table command that shows the entire table:
hostname# show mac-address-tableinterface mac address type Time Left-----------------------------------------------------------------------outside 0009.7cbe.2100 static -inside 0010.7cbe.6101 static -inside 0009.7cbe.5101 dynamic 10The following is sample output from the show mac-address-table command that shows the table for the inside interface:
hostname# show mac-address-table insideinterface mac address type Time Left-----------------------------------------------------------------------inside 0010.7cbe.6101 static -inside 0009.7cbe.5101 dynamic 10Feature History for the MAC Address Table
Table 4-4 lists the release history for this feature.
Firewall Mode Examples
This section includes examples of how traffic moves through the adaptive security appliance and includes the following topics:
•
•
How Data Moves Through the Security Appliance in Routed Firewall Mode
This section describes how data moves through the adaptive security appliance in routed firewall mode and includes the following topics:
•
•
•
•
•
An Inside User Visits a Web Server
Figure 4-2 shows an inside user accessing an outside web server.
Figure 4-2 Inside to Outside
The following steps describe how data moves through the adaptive security appliance (see Figure 4-2):
1.
2.
For multiple context mode, the adaptive security appliance first classifies the packet according to either a unique interface or a unique destination address associated with a context; the destination address is associated by matching an address translation in a context. In this case, the interface would be unique; the www.example.com IP address does not have a current address translation in a context.
3.
The global address could be on any subnet, but routing is simplified when it is on the outside interface subnet.
4.
5.
6.
An Outside User Visits a Web Server on the DMZ
Figure 4-3 shows an outside user accessing the DMZ web server.
Figure 4-3 Outside to DMZ
The following steps describe how data moves through the adaptive security appliance (see Figure 4-3):
1.
2.
For multiple context mode, the adaptive security appliance first classifies the packet according to either a unique interface or a unique destination address associated with a context; the destination address is associated by matching an address translation in a context. In this case, the classifier "knows" that the DMZ web server address belongs to a certain context because of the server address translation.
3.
4.
5.
6.
An Inside User Visits a Web Server on the DMZ
Figure 4-4 shows an inside user accessing the DMZ web server.
Figure 4-4 Inside to DMZ
The following steps describe how data moves through the adaptive security appliance (see Figure 4-4):
1.
2.
For multiple context mode, the adaptive security appliance first classifies the packet according to either a unique interface or a unique destination address associated with a context; the destination address is associated by matching an address translation in a context. In this case, the interface is unique; the web server IP address does not have a current address translation.
3.
4.
5.
An Outside User Attempts to Access an Inside Host
Figure 4-5 shows an outside user attempting to access the inside network.
Figure 4-5 Outside to Inside
The following steps describe how data moves through the adaptive security appliance (see Figure 4-5):
1.
If the inside network uses private addresses, no outside user can reach the inside network without NAT. The outside user might attempt to reach an inside user by using an existing NAT session.
2.
3.
If the outside user is attempting to attack the inside network, the adaptive security appliance employs many technologies to determine if a packet is valid for an already established session.
A DMZ User Attempts to Access an Inside Host
Figure 4-6 shows a user in the DMZ attempting to access the inside network.
Figure 4-6 DMZ to Inside
The following steps describe how data moves through the adaptive security appliance (see Figure 4-6):
1.
2.
The packet is denied, and the adaptive security appliance drops the packet and logs the connection attempt.
How Data Moves Through the Transparent Firewall
Figure 4-7 shows a typical transparent firewall implementation with an inside network that contains a public web server. The adaptive security appliance has an access list so that the inside users can access Internet resources. Another access list lets the outside users access only the web server on the inside network.
Figure 4-7 Typical Transparent Firewall Data Path
This section describes how data moves through the adaptive security appliance and includes the following topics:
•
•
•
•
An Inside User Visits a Web Server
Figure 4-8 shows an inside user accessing an outside web server.
Figure 4-8 Inside to Outside
The following steps describe how data moves through the adaptive security appliance (see Figure 4-8):
1.
2.
For multiple context mode, the adaptive security appliance first classifies the packet according to a unique interface.
3.
4.
If the destination MAC address is not in the adaptive security appliance table, the adaptive security appliance attempts to discover the MAC address by sending an ARP request and a ping. The first packet is dropped.
5.
6.
An Inside User Visits a Web Server Using NAT
Figure 4-8 shows an inside user accessing an outside web server.
Figure 4-9 Inside to Outside with NAT
The following steps describe how data moves through the adaptive security appliance (see Figure 4-8):
1.
2.
For multiple context mode, the adaptive security appliance first classifies the packet according to a unique interface.
3.
Because the mapped address is not on the same network as the outside interface, then be sure the upstream router has a static route to the mapped network that points to the adaptive security appliance.
4.
5.
If the destination MAC address is not in the adaptive security appliance table, the adaptive security appliance attempts to discover the MAC address by sending an ARP request and a ping. The first packet is dropped.
6.
7.
An Outside User Visits a Web Server on the Inside Network
Figure 4-10 shows an outside user accessing the inside web server.
Figure 4-10 Outside to Inside
The following steps describe how data moves through the adaptive security appliance (see Figure 4-10):
1.
2.
For multiple context mode, the adaptive security appliance first classifies the packet according to a unique interface.
3.
4.
If the destination MAC address is not in the adaptive security appliance table, the adaptive security appliance attempts to discover the MAC address by sending an ARP request and a ping. The first packet is dropped.
5.
6.
An Outside User Attempts to Access an Inside Host
Figure 4-11 shows an outside user attempting to access a host on the inside network.
Figure 4-11 Outside to Inside
The following steps describe how data moves through the adaptive security appliance (see Figure 4-11):
1.
2.
For multiple context mode, the adaptive security appliance first classifies the packet according to a unique interface.
3.
4.
