Where Networking and Security Collide
Meraki MX is one of the best selling products in Meraki history. Last year my team sold more MX than ASAs.
That said, customers commonly want to know about AnyConnect support for Meraki MX.
It simply isn’t there today….check out my video below on the use case of using Meraki MX + ASAv (Anyconnect VPN concentrator).
Useful Links
COVID 19 Resources – aggregation of useful links, trial licenses, tutorials etc.
Remote Access VPN Resources – all things AnyConnect, COVID-19, licensing, configuration etc.
Remote Access Gateway Resources – selecting a platform, design considerations, virtual or physical gateway
Remote Access VPN (AnyConnect) Design Considerations – tips and tricks AnyConnect design and configuration
I am a big fan of building a separate layer for VPN client services kinda like what we used to do with the old school VPN concentrators. To accomplish this I like to use the ASAv…it’s inexpensive and easy to manage. Check out my videos, configuration and links below to learn more. As always let me know if you have any questions.
Anyconnect + ASAv Design- learn about vpn client design on the ASAv.
ASAv AnyConnect Configuration– learn how to configure AnyConnect on ASAv .
Meraki MX Perimeter Firewall + ASAv VPN Concentrator- In my above videos, I recommend leveraging a separate firewall for VPN client services. You can present your VPN concentrator to the public in a few different ways like one to one nat, port forwarding, etc. In my lab I configured port forwarding (443) to my ASAv. Check out the below video to learn how to configure the MX for this use case.
ASAv Configuration Template
#######################Interface Configuration################
#OUTSIDE configuration
interface GigabitEthernet0/0
nameif OUTSIDE
security-level 0
ip address 192.168.1.252 255.255.255.0
no shut
!
#Inside interface configuration
interface GigabitEthernet0/1
nameif INSIDE
security-level 100
ip address 192.168.30.252 255.255.255.0
no shut
hostname ASAv-VPN
username admin password cisco123
enable password cisco123
########################SSH and Routing##################################
#Setup ssh access
crypto key generate rsa modulus 4096
aaa authentication ssh console LOCAL
ssh 192.168.0.0 255.255.0.0 INSIDE
ssh version 2
#Setup routing configuration
route inside 192.168.5.0 255.255.255.0 192.168.30.1
route inside 192.168.100.0 255.255.255.0 192.168.30.1
route outside 0.0.0.0 0.0.0.0 192.168.1.1
#################VPN CLIENT CONFIGURATION############################
#Copy VPN client package to ASA
copy tftp disk0:anyconnect-win-4.4.01054-webdeploy-k9.pkg
#setup default route for VPN clients, I do not have split tunnel configured for my lab
route inside 0.0.0.0 0.0.0.0 192.168.30.1 tunneled
#Anyconnect network object
object network VPN_CLIENT_VLAN30
subnet 192.168.30.0 255.255.255.0
#Anyconnect VPN client DHCP – you could use your own DHCP server
ip local pool VPN_CLIENT_VLAN30_POOL 192.168.X.50-192.168.X.70 mask 255.255.255.0
#######################ENABLE SSL VPN#######################################
#enable anyconnect webvpn
webvpn
enable outside
tunnel-group-list enable
anyconnect enable
#image for anyconnect – part of webvpn
anyconnect image disk0:/anyconnect-win-4.4.01054-webdeploy-k9.pkg
#################GROUP POLICY##############################################
#group-policy configuration – define VPN attributes (DNS server, domain name etc.)
group-policy GP_VPN internal
group-policy GP_VPN attributes
vpn-tunnel-protocol ssl-client
#DNS server configuration for client, note using my internal Umbrella Virtual Server
dns-server value X.X.X.X
default-domain value ccietim.com
#sub group policy – split tunnel (If split)
#split-tunnel-policy tunnelspecified
#split-tunnel-network-list value SPLIT-TUNNEL
############TUNNEL GROUP##############################
#create tunnel group – Core of VPN configuration, define GP, address pool, etc.
#Pre login requirements connection protocol, aaa authentication etc.
Finally we should create a tunnel group:
tunnel-group VPN_PROFILE type remote-access
tunnel-group VPN_PROFILE general-attributes
default-group-policy GP_VPN
address-pool VPN_CLIENT_VLAN30_POOL
tunnel-group VPN_PROFILE webvpn-attributes
group-alias VPN_PROFILE enable
##########NAT####################################
#NAT exception even if not enable
nat (inside,outside) 2 source static any any destination static VPN_CLIENT_VLAN30 VPN_CLIENT_VLAN30 no-proxy-arp route-lookup
#####################Filtering, if controlling access to what VPN clients can access##################
#access-list vpn-filter permit tcp 192.168.30.0 255.255.255.0 192.168.5.0 255.255.255.0 eq 22
#group-policy VPN-POLICY attributes
#vpn-filter value VPN-FILTER
For clients on-prem, Cisco Umbrella applies protection and reporting based on your public IP address. In a Meraki world, if your public IP changes there is no built-in way for Meraki to update Umbrella. To solve this, I found a really cool python script on GitHub. https://github.com/meraki/dns-o-matic
With this script, you can query your Meraki network for active public IP addresses(via the API). Next, the IP address data is imported to a free cloud service called DNS-O-Matic(https://www.dnsomatic.com/). DNS-O-Matic will then notify Cisco Umbrella of any public IP address changes.
This python script is relatively simple to run, a few things to call out…
1.Your password for DNS-O-Matic must end in a letter or number
2.Your Meraki username must have API access to all organization association with the account.
Check out my video below to learn more and see the script in action.
Skip the overview and learn how make it happen
Experience Cisco Umbrella in action….simple summary of security events, reporting and investigation tools.
To finalize configuration and actually pass traffic through the FTD appliance, an access control policy is needed. This would be similar to an access control list that is applied to an ASA…in the Cisco world.
Access Control Policy is a policy that pulls together rule sets for L3/L4,L7(Application), URL filtering, IPS/IDS, File/AMP (Advanced Malware Protection). This is one of my favorite aspects of FMC, you can create a single policy and apply it to one or multiple devices. When making a policy change, it is pushed to all associated devices. The days of managing each device individually are over 🙂
Cisco’s definition…
“Access control is a hierarchical policy-based feature that allows you to specify, inspect, and log (non-fast-pathed) network traffic. Especially useful in multidomain deployments, you can nest access control policies, where each policy inherits the rules and settings from an ancestor (or base) policy. You can enforce this inheritance, or allow lower-level policies to override their ancestors. Each managed device can be targeted by one access control policy”
Access Control Policy Configuration
In the following videos you will learn how to setup the different components that make up an access control policy. We will build out different rules sets and tie them back to a single Access Control Policy.
*Before we start on access policy, please check out the following note on object management.*
Reusable Objects- You will see in the following videos a reference to a DNS object. An object is simply a pointer or hostname description for a network, host etc. Create these by going to Objects->Object Management.
Access Control Policy( L3/L4 rules) – This video highlights configuration of L3/L4 firewall rules by blocking ICMP traffic.
Access Control Policy (Application rules) – In this video you will see how to configure application based firewall rules.
Access Control Policy (URL Filtering rules)– This video shows how to configure URL Filtering.
Access Control Policy (File Policy/AMP) – This video shows how to configure a policy to block malware . Use the file policy to permit/deny certain file types and/or detect/prevent malicious files(Malware).
Access Control Policy (IPS Policy) – In this video learn how to configure a balanced IPS policy.
Links
Now that we have covered ACP, I wanted to share a cool optional policy that can reduce overhead and increase performance on FTD.
PreFilter Policy – Have you ever run into that traffic that doesn’t need advanced inspection? A few examples could be VPN tunnels, encrypted traffic(that your not decrypting) and blocking IPs/networks.
To implement, create a PreFilter policy and associate it to the an ACP.
Per Cisco.com “Prefiltering is the first phase of access control, before the system performs more resource-intensive evaluation. Prefilter policies deployed to managed devices use limited outer-header criteria to quickly handle traffic.
Contrasted with the rest of access control, which uses inner headers and has more robust inspection capabilities, prefiltering is simple, fast, and early.
Configure prefiltering if you want to:
Links
I hope you have found these blog posts helpful. I will continue to update my page with more details on FirePOWER. Please post any questions or comments in comments section below.
Looking for instructions on how-to deploy FirePOWER Management Center(FMC) and FirePOWER Threat Defense(FTD)? Then you have come to the right place! The following blog post/videos will walk through a start to finish vFMC and vFTD perimeter deployment (many of these principles can apply to physical deployments). If you are not familiar with FMC/FTD check out my previous blog post.
Before you get started…I want to send a shout out to Jason Maynard Cisco Security CSE in Canada, he created the videos below…. Check out his other content here.
Feel free to use the comments section for questions or feedback! Let’s get started!
Links
2. vFTD initial configuration – This video outlines configuration of vFTD interfaces and FMC management ip address (pointer to FMC responsible for managing the FTD appliance).
There is a two step process to manage FTD from FMC.
Links
3. vFMC initial configuration/register vFTD appliance – learn how to apply vFMC management ip address settings, licensing, etc.
Links
4. FTD interface configuration – The following video shows the configuration of FTD routed interfaces. See the link below to learn more interface configuration options.
Links
5. (Optional) Setup TAP interface (i.e. connect to span port)- A potential use case for this configuration is a branch site where I may want to span my internal data vlan(capture east/west traffic) and send it to my FTD appliance. The FTD appliance will then inspect traffic in/out(routed) and east/west(passive interface).
6. FTD Routing Configuration (Static/Dynamic Routing)- This video details inbound/outbound routing configuration.
Links
7. FTD NAT/PAT Configuration – The video highlights PAT (Port Address translation) configuration. PAT is typically used when there are many internal devices that need to share one public IP address . See the link below to learn more about NAT/PAT and configuration options.
Links
8. FTD DHCP Server Configuration – This video shows how to setup a DHCP server for an inside network behind a FTD firewall. This configuration is typically used in a branch site or lab where a DHCP server is unavailable. Check out the link below to learn how to redirect DHCP/DNS request to a remote DHCP server.
Links-
9. FTD Platform Policy -When deploying network devices it is usually a best practice to configure management, time, access control settings etc. The following video highlights how to configure ( ssh access, icmp,smtp, snmp,syslog, time synchronization, timeouts etc. )
With FMC, there is the option to create a single policy and role it out to one or many devices. In my opinion, this greatly simplifies configuration.
Ok we are almost there….before actually routing traffic through the FTD appliance an Access Control Policy must first be created. This policy pulls together rule sets for L3/L4,L7(Application), URL filtering, IPS/IDS , and File/AMP (Advanced Malware Protection).
Before we jump into ACP configuration…Take a break, grab some coffee, and see you over in my next blog post!
Additional Links
In talking to my customers, many are unaware of the new FTD (Full Threat Defense) options/image. I thought I would do a quick write up on FTD. Cisco now offers the ability to run the next generation firewall engine(FirePOWER) natively on your X series ASA with the FTD image.
History
When Cisco acquired SourceFire they brought in SourceFire’s Next Generation security platform FirePOWER that included Layer 7 firewall, URL Filtering, AMP (Advanced Malware Protection) and IPS/IDS. In my opinion, Cisco had L3/L4 and VPN mastered on the ASA but had some catching up to do in the next gen feature space. Personally, being both a customer of Sourcefire and Cisco, I was ecstatic when I saw the news on Twitter. SourceFire provided me deep security visibility and alerted me on what mattered with very little man power needed.
Initially Cisco offered the ability to run FirePOWER code set on top of the ASA like a VM. You could create rules in the ASA code to choose what traffic you wanted to send over to FirePOWER. So, to manage the ASA, you would use tools like CLI, ASDM, and CSM. To manage the FirePOWER component, you would leverage FirePower Management Center (Formerly known as Defense Center).
To simplify the stack, Cisco worked to combine features from ASA and FirePOWER together in a single code FTD. With the introduction of the FTD code you can run a single OS on your ASA-X firewall or leverage one of the new FTD appliances. In addition, Cisco announced several new FTD firewalls. (Note: FTD boxes can only run the FTD code or ASA code not both.)
To be fair, there are a few caveats to what is supported on FTD….not all features have been moved over from ASA to FTD. The biggest feature (for my customers) not yet supported on FTD is AnyConnect VPN, however, site to site is supported. Cisco is working diligently to add new features. (Check release notes for more info)
FirePower Mangement
FirePower Management Center (virtual or physical)– This is the tool used to monitor/manage ALL FirePOWER appliance. I will put together future post on FMC, but it is way more than just a pretty management tool.
ASDM FirePower plugin(FMC Light) – this is for small business and customers who only have a single firewall typically (ie 5506-X). You can manage FirePower policy and gain high level visibility from this plugin. (More Details)
FirePower Implementation options
Useful links
(Image curiosity of cisco.com)
Check out the following articles on the Stegano exploit kit.
http://thehackernews.com/2016/12/image-exploit-hacking.html
My take:
Hackers can go after our systems with advertisements on popular news sites we all visit. To the naked eye, these advertisements look legit, they may even look like security solutions that will protect us online. In reality, if you click on these advertisements they leverage your web browser to run scans against your machine. If the scans detect vulnerable software that can be exploited, your system is fair game.
“In the event of successful exploitation, the vulnerable victims’ systems had been left exposed to further compromise by various malicious payloads including backdoors, spyware and banking Trojans.” (welivesecurity.com)
Reading this quote makes me think of my friends and family who are non-technical. Every day they read something in the news about Cyber Security. When an ad appears on the side of a popular news page they visit, claiming to provide security, they assume this product is safe and will truly protect them. This product is doing the exact opposite; it could be potentially owning your system.
This is a good reminder to me. I need to educate those around me and help them understand basic security best practices. Selfishly, this saves me time too, because then I won’t have compromised systems to troubleshoot.
“The best way to protect yourself against any malvertising campaign is always to make sure you are running updated software and apps. Also use reputed antivirus software that can detect such threats before they infect your system.” (hacknews.com)
TALOS RSS FEED© 2024 Tim Roth Practical Network Security
Theme by Anders Noren — Up ↑
