ASA · CAPSTONE

ASA-style capstone: HQ pair, DMZ, branch VPN, AnyConnect and tenant contexts

Build a company’s whole edge on four empty firewalls. HQ has an active/standby pair (HQ1, HQ2) with inside, outside and a DMZ web server. The branch firewall BR joins the branch LAN to HQ over an IKEv2 tunnel. alice works from home on LAP1 with AnyConnect. The hosting firewall DC carries two tenants in security contexts, both using 10.0.0.0/24. R1 is the internet, with 198.18.0.1 behind it. Site-to-site and remote-access VPN run in single context mode, which is why the tenants live on their own firewall.

Cisco ASA-style track · Cisco ASA-style, Cisco router, Cisco switches · 7 objectives

Open in simulator More Cisco ASA-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

HQ1: inside 192.168.1.1, outside 203.0.113.1 and dmz 172.16.1.1 (level 50), each /24 with standby addresses .2. Default route to 203.0.113.254, PAT for the inside, inspect icmp. Publish SRV as 203.0.113.10 with a static NAT and an outside ACL permitting ICMP to it.
Failover: HQ1 primary and HQ2 secondary over Gi0/3 (FOLINK, key LABKEY, 10.255.255.1/30 standby .2). HQ2 gets the failover lines only and copies the rest.
PC1 reaches the internet (198.18.0.1), and R1 reaches the web server at 203.0.113.10.
HQ1 to BR: an IKEv2 tunnel between 192.168.1.0/24 and 192.168.2.0/24, key HQBRKEY, with NAT exemptions. BR: inside 192.168.2.1, outside 198.51.100.1, default route to 198.51.100.254, PAT, inspect icmp, and the mirror of the tunnel. PC1 reaches PCB.
HQ1: AnyConnect on outside, pool VPN-POOL 10.99.0.10 to .50, split tunnel to 192.168.1.0/24, group policy GP, user alice (Lab123), tunnel-group RA, and a NAT exemption for the pool. On LAP1: vpn connect 203.0.113.1 user alice password Lab123, then ping PC1.
DC in multiple context mode: context TENA with Gi0/0 (inside) and Gi0/2 (outside 192.0.2.1), context TENB with Gi0/1 and Gi0/3 (outside 192.0.2.2). In each: inside 10.0.0.1/24, default route to 192.0.2.254, PAT and inspect icmp. TA and TB both reach 198.18.0.1.
Survive a failure: the check fails HQ1 in a copy of the lab. PC1’s internet and tunnel, and alice’s session, must keep working on HQ2.

Start this lab

Before you start

Configure HQ fully on HQ1 before turning failover on, then give HQ2 its failover lines: it copies the rest, and refuses changes as the standby. NAT comes before encryption, so the tunnel and the pool each need their NAT exemption. Opening an empty firewall offers the setup wizard: answer no, or type a command to skip it. Ping reasons name the first fault on the path.

Concept

Active/standby failover

Two firewalls act as one. The active unit forwards traffic on the main addresses, and the standby waits on the standby addresses, with a copy of the configuration that the active unit sends it over the failover link. If the active unit or one of its monitored interfaces fails, the standby takes the role and the main addresses, so hosts keep the same gateway. The unit that recovers does not take the role back.

Concept

Site-to-site IPsec VPN

Two firewalls join their LANs across the internet. Interesting traffic, which the crypto ACL names, is encrypted and sent to the peer. First the firewalls agree in IKE phase 1 (a policy both have, and the same pre-shared key), then in phase 2 (a transform set or proposal both have, and crypto ACLs that mirror each other). NAT comes before encryption, so the VPN traffic needs a NAT exemption.

Concept

Remote access: AnyConnect and a clientless portal

A user logs in to the firewall from outside. With AnyConnect the firewall gives the user an address from a pool and a tunnel, and split tunnelling decides which traffic goes through it. With the clientless portal the user gets no address, only bookmarks that the firewall fetches. Each login lands in a tunnel-group, and a group policy says what that user may do.

Concept

Security contexts: many firewalls in one

In multiple context mode one firewall becomes several. The system execution space owns the hardware: it creates sub-interfaces and VLANs, creates contexts, and gives each context its interfaces. Each context then has its own interfaces, levels, routes, access rules and NAT, so tenants can use the same private addresses without ever meeting.

Concept

Firewall NAT: three sections, applied in order

An ASA checks NAT rules in three sections. Manual (twice) rules come first, in the order you write them. Object (auto) rules come next, static before dynamic and the most specific first. Manual rules marked after-auto come last. Static NAT publishes a server, and the firewall answers ARP for the public address. Access rules name real addresses, because untranslation comes first.