One the rules are defined and a connection is being established, the rules are passed to the client via a CSTP handshake during the setup. The agent takes a snapshot of the existing firewall rules and applies the received rules to the native firewall available on the operating system. As of now, this handshake isn't tracked via debugs, any errors are only logged on the client.
What platforms are currently supported?
Windows XP SP2
MAC OS X 10.5
MAC OS X 10.6
Linux, Windows Mobile and other new mobile platforms are not yet supported.
The rules obtained from ASA will be applied to the Windows Firewall present on the supported Operating Systems. For older operating systems on which AnyConnect gets installed (Windows 2000 and XP pre-SP2), the firewall feature will softly fail, logging an error message that the OS is not supported for this feature. Rules are applied to all the windows profiles.
The rules will be applied to ipfw, the legacy firewall present in MAC. The native application firewall present on OSX 10.5 and OSX 10.6 do not have any APIs that we can utilize. However, its presence does not prevent us from configuring ipfw. So, there is no necessity for us to disable the application firewall.
What is the significance of the source and destination port numbers in the access list?
The primarily role of the port numbers is ofcourse to identify what service to permit or allow for a certain protocol. However, the ports numbers, and how they are applied also play another very significant role. Depending on whether the source or/and the destination port is defined in the access-list, the direction in which this rule will be applied to firewall will be determined. To enumerate:
If source port and destination port are specific number, the rule applies to both inbound and outbound traffic.
If source port and destination port are specified as a range or ‘All’ (value of 0), the rule applies to both inbound and outbound traffic.
If the source port is a specific number and the destination port is a range or ‘All’, the rule applies to inbound traffic.
If the source port is a range or ‘All’ and the destination port is a specific number, the rule applies to only outbound traffic.
The ASDM does a poor job of explaining this to users. Bug # http://cdets.cisco.com/apps/dumpcr?&content=summary&format=html&identifier=CSCtg79827CSCtg79827 was filed to enhance this. To configured a source port in the ASDM click on the "more" options when adding an ACE. The thing you need to keep in mind while configuring or modifying the acecss-list from the ASDM is that the way ASDM displays the ACLs it won't display the source port, i.e. if you have the following access-list: access-list acl_client_fw_test extended deny icmp any any access-list acl_client_fw_test extended deny tcp any eq 3389 any access-list acl_client_fw_test extended deny tcp any eq 3340 any access-list acl_client_fw_test extended permit tcp any any eq 3340
http://cdets.cisco.com/apps/dumpcr?&content=summary&format=html&identifier=CSCtg45671CSCtg45671: on XP machines due to limitations of the OS, the client firewall policy on computers running Windows XP is enforced for inbound traffic only. Outbound rules and bidirectional rules are ignored. CSCtx27707: on win 7 if you define an access-list denying a particular source port then all inbound traffic to that port should be blocked. However, currently what happens when you define such an entry is all outbound/inbound internet access gets blocked. I am nost sure if this applies to XP machines as well, however developer viskrish is working on both issues.
What is the difference between Public and Private rules?
The value public/private indicates which interfaces to apply the rules on. Public rules are applied on all interfaces on that client machine. Private rules, on the other hand, are applied only to the virtual adapter so for traffic not being encrypted these rules would have no effect.
When should the public rules not have any effect even if they are pushed down?
The administrator has to explicitly configure split tunneling of some kind for the public firewall rules to take effect. Enabling the firewall feature does not automatically imply opening local LAN. If the agent detects there is no split tunneling configured, the public firewall rules will not be applied and a configuration error will be logged. The connection will proceed. This has no effect on private rules, which will be applied regardless.
What happnes if the client is unable to apply all the rules?
Currently, if for some reason:
applying a public deny firewall rule fails, the agent disables all split tunneling and logs the failure.
applying a private rule fails, the error is logged but no further action is taken.
What happens if the local Firewall service is stopped or disabled before Connection?
If the firewall service is stopped or disabled, AC wILLenable it and start the service before applying our rules. This is done only when there are firewall rules configured on the ASA. On a service shutdown or VPN disconnect, the original state of firewall SHOULD be restored.
When should the fw rules continue to apply, even after disconnecting AC?
Sometimes even after disconnecting from the ASA, the rules continue to apply. This will usually occur if you have Always on enabled and and ApplyLastVPNLocalResourceRules setting implies that failure policy is “Closed”. This is by design. When the agent starts up, it reads the firewall rules that are obtained from ASA and keeps them in memory. On a service shutdown, they are written to the disk for possible offline usage. If on a service restart, the agent is not able to contact the ASA, the agent reads the stored rules and applies them to the native firewall, and deletes the stored copy. However with Always-on disabled or Always on enabled with Fail Open policy, this should not happen.
What happens if a third party software/root user disables the FW after the connection is complete?
Currently there is no easy way of securing the firewall rules that are created or lock down the firewall and disallow others from modifying the rules. On Windows, you can use AD GPOs to prevent adding more rules through the Windows Firewall User Interface and to disable deletion of our rules. However, the group policy can apply restrictions only on the basic firewall UI and not to changes made with Advanced Security UI found in Vista and Windows 7. Similarly on MAC, users with root privileges will always be able to modify the rules. So to get around this the client is designed to constantly poll the state of the FW and the rules, and if it notices any modifications, it logs an appropriate error, disables all split tunneling, and configures tunnel-all.
Hi Guys,I am planning to migrate my old ISE running in my old server to a new ISE 2.7 that will be running in the new SNS server. Both old and new ISE are running in HA.What I planned so far are;1. Configure temp IP address to the ISE 2.7 and form the clu...
Hi All,I am working on Cisco Secure ACS for IOS-XR and I want help from experts out there. I want to globally deny if someone could remove the whole bundle(e.g: no interface Bundle-Ether10) but can do both of the following on the dot interfaces only:a): n...
We have enabled Orbital search feature in Cisco AMP for our workstations in our environment, however after enabing the Orbital features machines have started to download some data over the internet. We would like to know what data it is trying to dow...
Hello We have a requirement to create two VPN Tunnels Site A:Local Subnet : 220.127.116.11/16 : Remote Subnet (DC): 18.104.22.168/8 Site B:Local Subnet : 22.214.171.124/16 : Remote Subnet : 126.96.36.199/16 DC has about 50 sites in that subnet range,&nbs...
Hello, I have an FTD 1140 and I am trying to migrate the config from an ASA 5515. The FTD is managed locally through FDM. There is not an automatic migration process, so I am performing it manually. I am stuck at S2S VPN.&n...