Introduction   This document is a quick reference to configure BGP pass through Firewall device.   Prerequisites       Routers and ASA       Concept   As we all know that ASA do port  randomization whenever traffic traverses through ASA, that is why BGP  does not work through the ASA. Hence, we need to do appropriate  configuration on ASA so that bgp traffic can traverse through ASA.     Network   Diagram       Configuration Sample     access-list outside permit tcp host 1.1.1.1 host 2.2.2.2 eq bgp tcp-map bgp tcp-options range 19 19 allow   class-map bgp match port tcp eq bgp   policy-map global_policy class bgp (where bgp is class name ) set connection random-sequence-number disable set connection advanced-options bgp (where bgp is tcp-map name)       Related   Information   http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a008009487d.shtml   https://supportforums.cisco.com/docs/DOC-21347 ... View more

    Introduction This Document discuss about the SSL VPN. SSL VPN Overview:   What is SSL VPN?   SSL VPN (Secure Sockets Layer Virtual Private Network) allows users to remotely access restricted network resources via a secure and authenticated pathway by encrypting all network traffic and giving the appearance that the user is on the local network, regardless of geographic location. This protocol achieves a higher level of compatibility with client platforms and configurations for remote networks and firewalls, providing a more reliable connection.   Who Can Use SSL VPN?   SSL VPN allows access to administrative systems, critical infrastructure, and sensitive information maintained by system administrators. SSL VPN access can be granted to University system administrators as well as vendors and other external collaborators, provided that the user has a valid NetID and password and is in an LDAP (Lightweight Directory Access Protocol) group with SSL VPN access.     OPTIONS   There are two SSL VPN options (Note: Enabled features will be determined by user need and the nature of applications and resources that need to be accessed):   Web Proxy — Users access all available resources through a web-based interface. Resources appear as bookmarks on the SSL VPN start page and secure access is granted as though the user is using an internal IP address. Through this interface, users can access web-based applications, use file sharing, remote desktop/Citrix (Windows Only), and Telnet/SSH. Any computer with a web browser should allow you to access SSL VPN Web Proxy, and because you are working in a web interface.   Network Connect — Users download a local VPN client that uses the SSL protocol and do not need to work through the web interface, providing additional connectivity if necessary. The Network Connect client is assigned a unique IP address from a role-specific pool of addresses, rather than the IP address that is used by Web Proxy connections.     The example is based on the diagram below       Network Diagram         Example:   For this example, the router needs to provide a user on the 192.168.137.x network secure access to R1 through an SSL web portal. HTTP acccess, to R1, is provided through a URL link. HTTPS and SSH access, to R1, is provided by port forwarding. In a real world example, this type of access could allow emergency access for a network administrator from any computer.   The first step is to set up the authentication method for the user. The IOS SSL VPN uses the default AAA method by default. For this example, we will use local authentication with the commands below aaa new-model aaa authentication login default local username cisco password cisco The next step is to setup the IP and port information for connectivity to the SSL VPN. The IOS SSL VPN allows the IP to be based on the interface IP of the router or a virtual IP address. Additionally, the port can be the standard 443/tcp or it can be another manually assigned port. For this example, we will use the fa1/0 interface of the router and port 8000/tcp. This is shown below. webvpn gateway SSL1 hostname SSL1 ip address 192.168.137.100 port 8000 ssl trustpoint TP-self-signed-4294967295 inservice   Notice the "ssl trustpoint" in the configuration. This is automatically created when the "inservice" command is added to active the configuration. The next step is to create the "webvpn context". As stated earlier, this is the container for the VPN parameters. Within the "webvpn context" container, there are number of parameters that are defined and applied. For example:   A URL can be defined The URL can be applied to a policy group The policy group can then be applied to the context   This is all within the "webvpn context" container. An example is shown below   webvpn context SSL url-list "R1" heading "R1" url-text "R1-http" url-value " http://192.168.1.2 " policy group default url-list "R1" default-group-policy default   This shows the URL list, R1, being defined and then applied to the policy group, default. The policy group, default, is then applied to the context with the "default-group-policy" command. In a similar manner, the IOS SSL VPN can support port forwarding. This is shown below.   webvpn context SSL port-forward "R1" local-port 5000 remote-server "192.168.1.2" remote-port 443 description "R1 HTTPS" local-port 5001 remote-server "192.168.1.2" remote-port 22 description "R1 SSH" policy group default port-forward "R1" auto-download default-group-policy default This portion shows how to forward ports. When a user uses a web browser to access https://127.0.0.1:5000 , they are redirected to https://192.168.1.2 through the SSL connection. Similarly, when a users uses an SSH client to access 127.0.0.1 on port 5001, they are redirected to 192.168.1.2 on port 22. In the "port-forward" command, notice the "auto-download" parameter. This causes the port forward connectivity to launch automatically, instead of requiring the user to click on the "thin client" start button shown below         The screenshots below show the GUI experience based on the configuration above.   1. The user accesses the web portal at https://192.168.137.100:8000     2. The user logs in and is presented with the web portal       3. At the same time as step 2, the port forwarding window appears with the setting for port forwarding         Below is the full relevant config for the example above aaa new-model ! ! aaa authentication login default local username cisco password 0 cisco no ip http server no ip http secure-server webvpn gateway SSL1 hostname SSL1 ip address 192.168.137.100 port 8000 ssl trustpoint TP-self-signed-4294967295 inservice ! webvpn context SSL ssl authenticate verify all ! url-list "R1" heading "R1" url-text "R1-http" url-value " http://192.168.1.2 " ! ! port-forward "R1" local-port 5000 remote-server "192.168.1.2" remote-port 443 description "R1 HTTPS" local-port 5001 remote-server "192.168.1.2" remote-port 22 description "R1 SSH" ! policy group default url-list "R1" port-forward "R1" auto-download banner "Welcome to the IOS SSL Lab" default-group-policy default gateway SSL1 inservice         Verify You can use this section to confirm that your configuration works properly. For verify sections, include Show commands and Sample outputs. Related Information Link 1 Link 2 ... View more

[toc:faq] Introduction This document explains the concept of redundant interface on firewall. We will discuss the whole concpet and configuration sample for the same. Requirements There are no specific requirements for this document. Components Used ASA 5500 series running 7.X and above Concept A logical redundant interface is a pair of an active and a standby physical interface. When the active interface fails, the standby interface becomes active.  From firewall perspective this event is completely transparent and can be viewed as a single logical interface. We can use redundant interfaces to increase the security appliance reliability. This feature is separate from device-level failover, but you can configure redundant interfaces as well as failover if desired. We can configure upto 8 redundant interfaces. Redundant interface are number from 1 to 8 and have the name redundant X. When adding physical interfaces to the redundant pair, please make sure there is no configuration on it and interface is also in no shutdown state. This is just a precaution, the firewall will remove these settings when adding the physical interface to a new group. The logical redundant interface will take the MAC address of the first interface added to the group. This MAC address is not changed with the member interface failures, but changes when you swap the order of the physical interfaces to the pair. Once we have configured a redundant interface, we can assign it a name and a security level, followed by an IP address. The procedure is the same as with any interface in the system. Configuration --> interface GigabitEthernet0/0 no nameif no security-level no ip address ! interface GigabitEthernet0/1 no nameif no security-level no ip address interface Redundant1 member-interface GigabitEthernet0/0 member-interface GigabitEthernet0/1 nameif outside security-level 0 ip address 1.1.1.1 255.255.255.0 Verify You can use the following command to verify-- --> ciscoasa(config)# show interface redundant 1 Interface Redundant1 "outside", is up, line protocol is up   Hardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usec         Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)         MAC address 5475.d0d4.9594, MTU 1500         IP address 1.1.1.1, subnet mask 255.255.255.0         27 packets input, 12330 bytes, 0 no buffer         Received 27 broadcasts, 0 runts, 0 giants         0 input errors, 0 CRC, 0 frame, 27 overrun, 0 ignored, 0 abort         10 L2 decode drops         1 packets output, 64 bytes, 0 underruns         0 output errors, 0 collisions, 0 interface resets         0 late collisions, 0 deferred         0 input reset drops, 0 output reset drops         input queue (curr/max packets): hardware (5/25) software (0/0)         output queue (curr/max packets): hardware (0/1) software (0/0)   Traffic Statistics for "outside":         17 packets input, 7478 bytes         1 packets output, 28 bytes         17 packets dropped       1 minute input rate 0 pkts/sec,  92 bytes/sec       1 minute output rate 0 pkts/sec,  0 bytes/sec       1 minute drop rate, 0 pkts/sec       5 minute input rate 0 pkts/sec,  0 bytes/sec       5 minute output rate 0 pkts/sec,  0 bytes/sec       5 minute drop rate, 0 pkts/sec   Redundancy Information:         Member GigabitEthernet0/0(Active), GigabitEthernet0/1         Last switchover at 23:13:03 UTC Dec 15 2011 Related Information http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/int5505.html --> interface GigabitEthernet0/0 no nameif no security-level no ip address ! interface GigabitEthernet0/1 no nameif no security-level no ip address interface Redundant1 member-interface GigabitEthernet0/0 member-interface GigabitEthernet0/1 nameif outside security-level 0 ip address 1.1.1.1 255.255.255.0 ... View more

[toc:faq] Introduction This  document is a quick reference to configure BGP pass through Firewall  device. Concept: As we all  know that ASA do port randomization whenever traffic traverses through  ASA, that is why BGP does not work through the ASA. Hence, we need to do  appropriate configuration on ASA so that bgp traffic can traverse  through ASA. Prequisite: Routers and ASA Network Diagram Configuration access-list outside permit tcp host 1.1.1.1 host  2.2.2.2 eq bgp tcp-map bgp tcp-options  range 19 19 allow class-map  bgp match port tcp eq  bgp policy-map  global_policy class bgp (where bgp  is class name ) set connection  random-sequence-number disable set connection  advanced-options bgp (where bgp is tcp-map name) I  hope this quick document is helpful to you and i want to thank you for  your time. . Verify show service-policy Related Information http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a008009487d.shtml ... View more