topic Re: Cisco ASA Practice Lab Material or Books in Network Security

Cisco ASA Practice Lab Material or Books

Carlton Patterson — Mon, 11 Mar 2019 23:12:12 GMT

Hello All,

I'm in the process of learning how to configure Cisco ASA. I've got the ASA simulated on GNS3.

Can some tell me where I can find books or material that has actual labs included in the book.

The books I have found seem to be handbook type of material. I need something that steps through a lab.

Cheers

Carlton

Cisco ASA Practice Lab Material or Books

Julio Carvajal — Sat, 26 May 2012 21:13:50 GMT

Hello Carlton,

You can always use the certifications books from Cisco, one each chapter they explain a feature and you can see a lab recreation ( configuration part) so you can implemented by yourself following the book and understanding the logic,

That is my opinion and what I have used so far.

Regards,

Julio

Cisco Security Engineer

Re: Cisco ASA Practice Lab Material or Books

Carlton Patterson — Sat, 26 May 2012 21:50:52 GMT

Hi Julio, thanks for responding.

I have found a site with many ASA lab samples. The problem is I don't know how to test the lab... Attached is one of the labs I'm about to build. Can someone describe how I can test the lab?

Cheers

Carlton

Re: Cisco ASA Practice Lab Material or Books

Julio Carvajal — Sat, 26 May 2012 22:18:36 GMT

Hello Carlton,

You can use a VMware machine as the internal host or another router, then configure the ASA as properly and just try to give to that host connectivity to a host on the outside interface of the ASA ( via ICMP,etc).

This lab is real simple to build on GNS. ( You can do it with 2 routers and one ASA, Just make the inside router able to ping the Outside router)

Regards

Julio

Re: Cisco ASA Practice Lab Material or Books

Carlton Patterson — Sat, 26 May 2012 22:24:21 GMT

Julio, thanks again for responding.

I have already built this on GNS. My problem is I don't know how to actually test it - how to determine if its working?

Re: Cisco ASA Practice Lab Material or Books

Julio Carvajal — Sat, 26 May 2012 22:29:32 GMT

Hello Carlton,

You would need to be able to ping from the inside router to the external router (or SSH or telnet)

Do you follow me?

Regards,

Re: Cisco ASA Practice Lab Material or Books

Carlton Patterson — Sat, 26 May 2012 22:31:38 GMT

Julio,

I don't understand

Re: Cisco ASA Practice Lab Material or Books

Carlton Patterson — Sat, 26 May 2012 22:34:52 GMT

Julio,

I don't think a simple ping will fully test this lab ....

Re: Cisco ASA Practice Lab Material or Books

Julio Carvajal — Sat, 26 May 2012 22:40:57 GMT

Hello Carlton,

I checked the document again to see if I got wrong but nop I am right.

The whole purpose of the lab setup you have there is to be able to configure Dynamic Nat for the internal network when they go to the outside world using a 8.3 or higher version.

A Ping will fully showed you if its working or not. Now if you want to do it with another service.. Just use a packet-tracer and the result should be allowed and of course you will need to check a the NAT stage.

Edit: I sent you a private message, please check it

Regards,

Julio

Security Engineer

Re: Cisco ASA Practice Lab Material or Books

Carlton Patterson — Sat, 26 May 2012 22:46:06 GMT

Julio,

I have replied.....

Re: Cisco ASA Practice Lab Material or Books

Julio Carvajal — Sat, 26 May 2012 22:47:36 GMT

Hello,

Good but do you understand the purpose of the Lab now?

Regards,

Re: Cisco ASA Practice Lab Material or Books

Carlton Patterson — Sat, 26 May 2012 22:52:38 GMT

Julio,

I will build the lab, however I still don't see how a simple ping will fully test this scenario...

What is the point with all the following commands on the ASA

object network OBJ_GENERIC_ALL 
 subnet 0.0.0.0 0.0.0.0

nat (inside,outside) source dynamic OBJ_GENERIC_ALL interface

route outside 0.0.0.0 0.0.0.0 10.165.200.225
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.0.0 255.255.254.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
!
service-policy global_policy global
prompt hostname context 
Cryptochecksum:6fffbd3dc9cb863fd71c71244a0ecc5f

Re: Cisco ASA Practice Lab Material or Books

Carlton Patterson — Sat, 26 May 2012 22:53:11 GMT

Julio,

I guess I still don't understand the purpose of the lab.....

Re: Cisco ASA Practice Lab Material or Books

Julio Carvajal — Sat, 26 May 2012 22:59:06 GMT

Hello Carlton,

The purpose of the lab is do NAT on 8.3 version ( because as you will need to know from 8.2 to 8.3 or higher versions this changes a lot).

So as on the PDF is marked as important that is what you need to focus on ( NAT), that's it bro!!

The other stuff in that configuration is there by default.

So what you will need to do in this lab:

1-Interface configuration

2-Nat configuration

3-Routing configuration

Now to make it more interesting after you configure all that, try to ping from the inside host to the outside host

Let me know the result of the lab as soon as you have it!

Regards,

Do rate all the helpful post

Julio

Re: Cisco ASA Practice Lab Material or Books

Carlton Patterson — Sat, 26 May 2012 23:05:18 GMT

I'll be sure to let you know..

Cheers mate.

Dear Sir, Would you mind

Ram Bista — Tue, 03 Feb 2015 22:42:37 GMT

Dear Sir,

Would you mind sharing some of your PDF Labs, I'd like to practice them heavily. Thanks

ramkrista@gmail.com

Cheers!

-Ram