How do you set your asa?

[cwhlaw2009]

Dear ALL,

I known ASA is powerful device but normally I only set NAT, access list, VPN, dhcp server, management interfaces, login account NTP and PBR. I think I wasted it.

I known every task has different setting. But I want to known which function you always set on the device.

[Philip D'Ath]

I always set a username and password so I can log into the ASDM.

[Philip D'Ath]

I always enable:

• SSH
• ip verify reverse-path interface ...
• logging, asdm, debug
• icmp and icmp error inspection
• Usually threat detection and statistics
• NTP

[Marvin Rhoads · Accepted solution]

When in doubt, always check for a manufacturer's base practices guide.

Cisco Firewall Best Practices Guide:

http://www.cisco.com/web/about/security/intelligence/firewall-best-practices.html

Not everything there applies in every use case, but it's a very good place to start. I refer to it often when asked to scrub customers' ASA configurations.

Also, for an existing firewall I look for things like unused objects, access-lists and access list entries. The tool at tunnelsup.cm is very good for doing this:

http://www.tunnelsup.com/config-cleanup/ 

[Rolando Valenzuela · Accepted solution]

While ago, I found this hardening guide which is also very good:

https://www.nsa.gov/ia/_files/factsheets/Cisco_ASA_Configuration_Guide.pdf

Rolando Valenzuela

[Samer R. Saleem]

HI,

first of all, ASA is powerful, specially if you have license that allow you to use all of its features, for example IPS over IOS 

so you can begin with the best practice to secure your management plane

also uRPF

NTP is better to be local from your servers, canceling or not for ICMP 

threat detection

IP audit which is basic IPS features for some signatures

checking unused Objects and ACLs

be more specific for opening service ports for your server farm and try not to use [ any to any ] as much as you can.

also always enable your syslog to a remote local server

also you can set service policy to prevent syn attacks 

check your RA policies and prevent the default actions for the VPN accounts

and lots more to do on the Firewall 

HTH

Samer.