Archives

Cisco ASA 5505 Basic Configuration – Step by Step Guide for Dummies

 

Basic Configuration of Cisco ASA (5505)

In this article, I will guide you to basic configuration of Cisco ASA 5505.

Cisco ASA 5505 Firewall

Cisco ASA 5505 Adaptive Security Device

http://www.o2.co.uk/broadband/

  • Open Cisco ASA 5505  from packing box, attach power cord and console cable.
  • Access ASA 5505 console through hyper terminal / putty program and you will see below interface:
ode:
Type help or ‘?’ for a list of available commands.
ciscoasa>

 

  • Type the command “enable” to get in enabled mode.
Code:
Type help or ‘?’ for a list of available commands.
ciscoasa> enable
Password:
ciscoasa#

 

You may see password prompt, just pres “Enter” key as there is no password configured with new appliance. 

  • The 1st thing you want to do is type the command “write erase”. This will delete all the default configuration set by Cisco. You might wonder why but there is a lot of stuff in that configuration that you may not require and you may face some network issues if you connected your ASA 5505 security appliance with your your DHCP enabled network.

 

Code:
ciscoasa# write erase
Erase configuration in flash memory? [confirm]
[OK]
ciscoasa#

 

  • You will be prompted to confirm that you want to erase the default configuration. Press enter to proceed to erase content.
  • Once you erase your startup configuration you are required to reload the ASA to load clean configuration. Type “reload” command to load clean configurations.
Code:
ciscoasa# reload
Proceed with reload? [confirm]
ci
scoasa#

***

*** — START GRACEFUL SHUTDOWN —

Shutting down isakmp

Shutting down File system

***

— SHUTDOWN NOW —–

  • After ASA 5505 reload you will see below prompt to setup firewall through wizard, type “no” to setup ASA 5505 security appliance yourself manually.
Code:
 Pre-configure Firewall now through interactive prompts [yes]?

 

  • Now enter enabled mode (look up if you forgot how to) and issue the command “show running-config”.
 Code:
ciscoasa# show running-config
  •  Looks nice and clean right?
  • Now we can start manual configuration of ASA security appliance. 
  • Load configuration mode. You can do this by issuing the command “configure terminal” 
Code:
ciscoasa# configure terminal
ciscoasa(config)#


  • Notice the (config) behind the device hostname. This means you’re in configuration mode. 
  • Change Cisco ASA hostname. 

 

Code:
ciscoasa(config)# hostname MyASA
MyASA(config)#

 

You can see the hostname changes immediately. 

  • Set a username and password to manage the ASA from your desk with SSH/Telnet/ASDM.
Code:
MyASA(config)# username example password example privilege 15
MyASA(config)#

Setting your privilege to 15 is very important if you’re the one that is going to manage the ASA. Privilege 15 is the highest of the privileges and gives you full control over the device.

  • Configure the inside (LAN) address of the ASA 5505 security appliance.

With the ASA 5505 you work with VLANs instead of assigning IP addresses to actual interfaces. We will use VLAN 1 as our inside VLAN.

Code:
MyASA(config)# interface vlan 1
MyASA(config-if)# ip address 192.168.1.1 255.255.255.0
MyASA(config-if)# nameif inside
INFO: Security level for “inside” set to 100 by default.

All the ASA devices work with security levels that you apply to VLANs/interfaces. With security levels you can always go from high (100) to low (0) but never the other way around unless configured otherwise. This means that no one from the outside can start a session to the inside. 

For the inside VLAN:

  • Configure outside (WAN) interface.

Depending on the provider you might have to do this a little bit different but we are configuring with a static IP address.

 

Code:
MyASA(config)# interface vlan 2
MyASA(config-if)# ip address 212.115.192.193 255.255.255.248
MyASA(config-if)# nameif outside
INFO: Security level for “outside” set to 0 by default.
ExampleASA(config-if)# exit
ExampleASA(config)# route outside 0.0.0.0 0.0.0.0 212.115.192.192


As you can see the ASA sets the security level of the interface called outside to 0. 
You also need to make a static route if your provider supplied you with a static IP address. This is called the default gateway

If your provider gives you a IP address trough DHCP the configuration is a little easier.

ode:
MyASA(config)# interface vlan 2
MyASA(config-if)# ip address dhcp set route
MyASA(config-if)# nameif outside

With this command you’re not required to configure a default gateway as it will provided by ISP and configured automatically with ASA 5505 WAN interface.

Now we need to attach the outside VLAN to one of the interfaces of the ASA. 
By default all the interfaces are attached to VLAN 1 and by default all the interfaces are in the “shutdown” state. In this example I will attach the interface “Ethernet 0″ to the outside VLAN (VLAN 2) and make the port operational.

Code:
MyASA(config)# interface ethernet0/0
MyASA(config-if)# switchport access vlan 2
MyASA(config-if)# no shutdown

 

Now this interface is attached to VLAN 2 and operational. 
You need to make at least one other port operational for your inside network by typing the command “no shutdown”.

Code:
MyASA(config)# interface ethernet0/1
MyASA(config-if)# no shutdown

 

By default all the interfaces are attached to VLAN 1 so you don’t need to assign a VLAN to the interface.

  • Configure NAT to make internet work from your inside network.
  • For NAT fist step: you need to make a global interface to where all the addresses from the inside need to be translated to.
Code:
MyASA(config)# global (outside) 10 interface
INFO: outside interface address added to PAT pool

 

The number 10 in that line of configuration is a identifier. This way you can tell the NAT on the inside to wich outside IP address they should translate to. 
The interface part means that you use your interface IP address to translate to. In this case the outside interface.

  • For NAT second step we need to make a NAT rule for the inside network.
Code:
MyASA(config)# nat (inside) 10 192.168.1.0 255.255.255.0
MyASA(config)#

I use used the number 10 in this NAT rule. This links the inside network to the outside global. The subnet behind that states that the network 192.168.1.0/24 is allowed to be translated to the outside IP address.

Congratulations! You configured your ASA to allow internet for your internal LAN with 192.168.1.0 network.

If you want to manage the ASA security appliance remotely i.e without having access to console.

The ASA supports remote administration trough SSH and Telnet. The ASA also has a good graphical interface called the ASDM (Adaptive Security Device Manager). 
I will guide you  to configure the ASA so you should able to connect with the ASDM (graphical) and with SSH (CLI). 

  • Enable SSH on Cisco ASA 5505 security appliance. To enable SSH you will need to generate a key wich will encrypt the traffic between the user and the ASA.

 

Code:
MyASA(config)# crypto key generate rsa modulus 1024
INFO: The name for the keys will be: <Default-RSA-Key>
Keypair generation process begin. Please wait…
MyASA(config)#

 

  • Now we want to use the username we made earlier to connect to the ASA with SSH.
Code:
MyASA(config)# aaa authentication ssh console LOCAL



The LOCAL means that the ASA uses the local username database to authenticate users. 

  • Setup ACL (access control list) to access ASA with SSH. In this example we only allow users on the inside to access the ASA with SSH.
Code:
MyASA(config)# ssh 192.168.1.0 255.255.255.0 inside

 

Now your ASA is accessible with SSH from any computer from inside network.

  • Enable ASDM GUI interface.  Use below command to enable ASDM on ASA.
Code:
MyASA(config)# http server enable
  • If you want to enable existing username we made earlier for SSH and setup ACL (access control list) to access ASA GUI (ASDM).
Code:
MyASA(config)# aaa authentication http console LOCAL
MyASA(config)# http 192.168.1.0 255.255.255.0 inside
  • Save all changes to make sure ASA 5505 load with new configurations.
Code:
MyASA(config)# write mem
Building configuration…
Cryptochecksum: e5fa3ae9 add2aae4 c0be8847 79cec1ba

2502 bytes copied in 1.190 secs (2502 bytes/sec)

[OK]

MyASA(config)#

Congratulations! You completed your Cisco ASA 5505 security appliance.

http://www.o2.co.uk/broadband/

Wi-Fi on the Command Line

More people than ever are using wireless networks as their primary networking medium. Great programs are available under X11 that give users a graphical interface to their wireless cards. Both GNOME and KDE include network management utilities, and a desktop-environment-agnostic utility called wicd also offers great functionality. But, what if you aren’t running X11 and want to manage your wireless card? I don’t cover how to install and activate your card here (for that, take a look at projects like madwifi or ndiswrapper). I assume your card is installed and configured properly, and that it is called wlan0. Most of the utilities mentioned below need to talk directly to your wireless card (or at least the card driver), so they need to be run with root privileges (just remember to use sudo). The first step is to see what wireless networks are available in your area. A utility called iwlist provides all sorts of information about your wireless environment. To scan your environment for available networks, do the following:

sudo iwlist wlan0 scan

You’ll see output resembling:

Cell 01 – Address: 00:11:22:33:44:55

ESSID:”network-essid”

Mode:Master

Channel:11

Frequency:2.462 GHz (Channel 11)

Quality=100/100 Signal level:-47dBm Noise level=-100dBm

Encryption key:off

The details (address and essid) have been changed to protect the guilty. Also, the … represents extra output that may or may not be available, depending on your hardware. You will get a separate cell entry for each access point within your wireless card’s range. For each access point, you can find the hardware address, the essid and the channel on which it’s operating. Also, you can learn in what mode the access point is operating (whether master or ad hoc). Usually, you will be most interested in the essid and what encryption is being used. Once you know what’s available in your immediate environment, configure your wireless card to use one of these access points using the iwconfig utility to set the parameters for your wireless card. First, set the essid, which identifies the network access point you want:

sudo iwconfig wlan0 essid network-essid

Depending on your card and its driver, you may have the option to set the essid to the special value “any”. In this case, your card will pick the first available access point. This is called promiscuous mode. You also may need to set the mode to be used by your wireless card. This depends on your network topology. You may have a central access point to which all of the other devices connect, or you may have an ad hoc wireless network, where all of the devices communicate as peers. You may want to have your computer act as an access point. If so, you can set the mode to master using iwconfig. Or, you simply may want to sniff what’s happening around you. You can do so by setting the mode to monitor and passively monitor all packets on the frequency to which your card is set. You can set the frequency, or channel, by running:

sudo iwconfig wlan0 freq 2.422G

Or by running:

sudo iwconfig wlan0 channel 3

You can set other parameters, but you should consider doing so only if you have a really good reason. One option is the sensitivity threshold, which defines how sensitive the card is to noise and signal strength, and you can set the behavior of the retry mechanism for the wireless card. You may need to play with this in very noisy environments. Set the maximum number of retries with:

sudo iwconfig wlan0 retry 16

Or, set the maximum lifetime to keep retrying to 300 milliseconds with:

sudo iwconfig wlan0 retry lifetime 300m

In a very noisy environment, you also may need to play with packet fragmentation. If entire packets can’t make it from point to point without corruption, your wireless card may have to break down packets into smaller chunks to avoid this. You can tell the card what to use as a maximum fragment size with:

sudo iwconfig wlan0 frag 512

This value can be anything less than the size of a packet. Some cards may not apply these settings changes immediately. In that case, run this command to flush all pending changes to the card and apply them:

sudo iwconfig wlan0 commit

Two other useful commands are iwspy and iwpriv. If your card supports it, you can collect wireless statistics by using:

sudo iwspy wlan0

The second command gives you access to optional parameters for your particular card. iwconfig is used for the generic options available. If you run it without any parameters (sudo iwpriv wlan0), it lists all available options for the card. If no extra options exist, you will see output like this:

wlan0 no private ioctls

To set one of these private options, run:

sudo iwpriv wlan0 private-command [private parameters]

Now that your card is configured and connected to the wireless network, you need to configure your networking options to use it. If you are using DHCP on the network, you simply can run dhclient to query the DHCP server and get your IP address and other network settings. If you want to set these options manually, use the ifconfig command (see the man page for more information).

Tips:

  • You can also change the MAC address with ifconfig if need be.

    $ ifconfig wlan0 down

    $ ifconfig wlan0 hw ether 00:11:22:33:44:55

    $ ifconfig wlan0 up

    OR

    Use macchanger

  • You will probably want to look into wpa_supplicant for all your WPA etc needs (I typed in the status command):

    —————–8<—————–
    # wpa_cli
    wpa_cli v0.7.3
    Copyright (c) 2004-2010, Jouni Malinen and contributors
    …..
    Selected interface ‘wlan0′

    Interactive mode

    > status
    bssid=00:50:7f:95:c1:e0
    ssid=
    id=0
    mode=station
    pairwise_cipher=CCMP
    group_cipher=CCMP
    key_mgmt=WPA2-PSK
    wpa_state=COMPLETED
    ip_address=
    >
    —————–8<—————–

    On Gentoo, make sure driver is compiled in, emerge wpa_supplicant, add this (or similar) to /etc/conf.d/net:

    wpa_supplicant_wlan0=”-Dwext”
    config_wlan0=”dhcp”

    Then add a stanza like the following to /etc/wpa_supplicant/wpa_supplicant.conf:

    network={
    ssid=”My_SSID”
    psk=”My_WPA(2)_shared_key”
    }

    Add net.wlan0 to default runlevel, start it and forget about it!

    I’m sure that shouldn’t be too hard to replicate on another Linux distro.

    Finally, check the output from:

    #ip a
    #ip r
    (#ifconfig and netstat -r for the old school)
    #dmesg
    #less /var/log/messages (or syslog)

    Of course wpa_cli (type help for some command to use)

Note:

  • You cannot use “iwlist ra0 scan” while your interface is in monitor mode. Try this:

    ifconfig ra0 down

    iwconfig ra0 mode managed

    ifconfig ra0 up

    iwlist ra0 scan

  • You can use wireshark to monitor your outcomming packets and see that none of them is bigger than that


Credits: Joey Bernard, Linux Journal

What is IP v6?

Internet Protocol v6, or IPv6, is an Internet layer protocol developed in the 1990s (RFC2460) as an alternative to IPv4. IPv6 is based on 128-bit addresses, meaning that there are 2128 individual addresses available, which is approximately 3.4×1038, and exactly:

340,282,366,920,938,463,463,374,607,431, 768,211,456
IPv6 pr
ovides enough addresses to allow the Internet to continue to expand and the industry to innovate. It is not, however, directly compatible with IPv4, meaning that a device connected via IPv4 cannot communicate directly with a device connected using IPv6.
Deploying IPv6 on a global scale is vital to the Internet industry, but it requires pro-active steps on the part of industry players: technology must be upgraded, staff trained, business plans developed. Uptake to date has been relatively slow, but this is now changing, and businesses need to be aware of the need to adopt IPv6. To ignore IPv6 is to risk your medium to long term business viability.