⚙️ Module 21: ASA Firewall Configuration

This module provides comprehensive hands-on configuration of the Cisco ASA 5506-X with FirePOWER Services. Students will learn the ASA CLI, configure management settings, implement object groups, create ACLs, configure NAT services, set up AAA authentication, and implement service policies using the Modular Policy Framework. The module also introduces ASDM as a graphical management alternative.

ASA CLI Characteristics

Command Mode Structure

ciscoasa> enable                    # User EXEC mode
Password:
ciscoasa# configure terminal        # Privileged EXEC mode
ciscoasa(config)#                   # Global configuration mode
ciscoasa(config)# interface g1/1    # Interface configuration mode
ciscoasa(config-if)# exit
ciscoasa(config)#

IOS vs ASA Command Differences

Default Configuration

Factory Reset

ciscoasa(config)# configure factory-default

Initial Setup Process

ciscoasa> enable
Password:                           # Initially blank
ciscoasa# clock set 12:00:00 1 April 2020
ciscoasa# configure terminal

Smart Call Home

Password Encryption

AES Encryption Configuration

ciscoasa(config)# key config-key password-encryption
Enter key: [password]
Re-enter key: [password]
ciscoasa(config)# password encryption aes

Interface Configuration

ASA 5506-X has eight Gigabit Ethernet interfaces for different Layer 3 networks:

• G1/1: Frequently configured as outside interface to ISP
• Basic Configuration: IP addressing, naming, security level
• BVI Support: Bridged Virtual Interfaces for grouping
• Security Levels: 0 (outside) to 100 (inside)

Basic Interface Setup

ciscoasa(config)# interface gigabitethernet1/1
ciscoasa(config-if)# nameif outside
ciscoasa(config-if)# security-level 0
ciscoasa(config-if)# ip address dhcp
ciscoasa(config-if)# no shutdown

Objects Overview

Object Types

object network WEB-SERVER
 host 192.168.1.100

object service WEB-SERVICES
 service tcp destination eq 80

Object Groups

Object groups can contain multiple objects and inline definitions:

• Network Object Groups: Multiple network objects and inline networks/hosts
• Mixed IPv4/IPv6: Support for both address families
• Reusability: Objects can be attached/detached from groups
• Applications: Used in NAT, ACLs, and other policies

Network Object Group Example

object-group network INTERNAL-NETWORKS
 network-object 192.168.1.0 255.255.255.0
 network-object 192.168.2.0 255.255.255.0
 group-object SERVERS

Benefits of Objects

• Centralized Management: Modify once, apply everywhere
• Reduced Errors: Consistent definitions across policies
• Simplified ACLs: Readable and maintainable rules
• NAT Requirements: Required for ASA 8.3+ NAT configuration

ACL Similarities with IOS

• Made up of Access Control Entries (ACEs)
• Processed sequentially from top down
• Criteria match causes ACL exit
• Implicit deny any at bottom
• Remarks can be added per ACE or ACL
• One ACL per interface, per protocol, per direction
• Time-based ACL support

ASA ACL Differences

Types of ACL Filtering

ACL Configuration Examples

# Standard ACL
access-list OUTSIDE-IN extended permit tcp any host 192.168.1.100 eq 80
access-list OUTSIDE-IN extended deny ip any any

# Apply to interface
access-group OUTSIDE-IN in interface outside

# Management ACL
access-list MGMT-ACCESS extended permit tcp 192.168.1.0 255.255.255.0 any eq ssh
management-access MGMT-ACCESS

Security Level Behavior

NAT Deployment Methods

Common NAT Types

NAT Configuration Examples

# Dynamic PAT
object network INSIDE-NET
 subnet 192.168.1.0 255.255.255.0
 nat (inside,outside) dynamic interface

# Static NAT
object network WEB-SERVER
 host 192.168.1.100
 nat (inside,outside) static 203.0.113.10

AAA Overview

AAA Components

Authentication Methods

username admin password P@ssw0rd
username admin attributes
 privilege-level 15

aaa-server RADIUS-GROUP protocol radius
aaa-server RADIUS-GROUP (inside) host 192.168.1.50
 key SharedSecret123

AAA Configuration Example

# Enable AAA for SSH
aaa authentication ssh console LOCAL
ssh 192.168.1.0 255.255.255.0 inside
ssh timeout 10

# Enable AAA for HTTP management
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside

Modular Policy Framework (MPF)

MPF Configuration Objects

class-map VOICE-TRAFFIC
 match port tcp eq 5060

policy-map VOICE-POLICY
 class VOICE-TRAFFIC
  inspect sip

service-policy VOICE-POLICY interface inside

MPF Capabilities

• Application Inspection: Layer 5-7 protocol analysis
• QoS Features: Traffic prioritization and rate limiting
• Hardware Module Integration: Redirect traffic to specialized modules
• Advanced Policies: Richer feature set than ISR Zone-Based Firewall

Complete MPF Example

# Class map to identify HTTP traffic
class-map WEB-TRAFFIC
 match port tcp eq 80

# Policy map to inspect HTTP
policy-map INSPECTION-POLICY
 class WEB-TRAFFIC
  inspect http
 class inspection_default
  inspect icmp

# Apply globally
service-policy INSPECTION-POLICY global

ASDM Benefits

ASDM Features

• Intuitive Interface: Graphical configuration wizards
• SSL Security: Secure communication with ASA
• Quick Configuration: Wizards for common tasks
• Monitoring: Real-time logging and monitoring
• Troubleshooting: Built-in diagnostic tools

ASDM vs CLI

ASDM Prerequisites

ASDM Access Configuration

# Enable HTTP server for ASDM
http server enable
http 192.168.1.0 255.255.255.0 inside

# Create management user
username admin password P@ssw0rd
username admin attributes
 privilege-level 15

FirePOWER Management

This implementation demonstrates how proper ASA configuration provides layered security while maintaining usability, showing the importance of systematic configuration approach and the benefits of using objects and policies for maintainable security infrastructure.

1. What are the main differences between ASA and IOS ACLs?
   ASA uses network masks instead of wildcard masks, ACLs are always named (never numbered), and security levels provide default access control without ACLs.
2. What are the benefits of using object groups in ASA configuration?
   Centralized management (modify once, apply everywhere), reduced errors through consistent definitions, simplified ACLs, and required for NAT in ASA 8.3+.
3. What are the three components of the Modular Policy Framework?
   Class maps (classify traffic), Policy maps (define actions), and Service policies (apply to interfaces).
4. What is the difference between through-traffic and to-the-box traffic filtering?
   Through-traffic filtering controls traffic passing between interfaces, while to-the-box filtering controls traffic destined for the ASA control plane (management access).
5. What are the four common types of NAT supported by ASA?
   Dynamic PAT (many-to-one with overload), Static NAT (one-to-one), Policy NAT (rule-based), and Identity NAT (address translated to itself).

• ASA CLI provides IOS-like interface with proprietary commands and network mask usage
• Object groups enable reusable, maintainable configurations for networks and services
• ASA ACLs use network masks, are always named, and work with security level defaults
• NAT services support dynamic PAT, static NAT, policy NAT, and identity NAT
• AAA provides authentication, authorization, and accounting using local or external databases
• MPF enables granular traffic classification and advanced policy application
• ASDM offers GUI-based management alternative to CLI configuration
• Systematic configuration approach using objects and policies improves maintainability