Cisco ASDM predeploy installation from local package

Cisco ASDM is capable of managing a single ASA. But the same shortcut can be used to connect to multiple ASAs.

“When you run Cisco ASDM as a local application, it connects to your security appliance from your desktop using SSL. Running Cisco ASDM as an application has these advantages:

• You can invoke ASDM from a desktop shortcut. No browser is required.
• One desktop shortcut allows you to connect to multiple security appliances.” (These are independent sessions, policy sharing is not possible.)

TLS Experiences with Elliptic Curve Algorithms on Cisco ASA

Elliptic Curve Cryptography (ECC) is a newer approach to public cryptography. EC algorithms were introduced in NSA Suite B. Cisco uses the broad term Next Generation Encryption (NGE) for Suite B. Why are elliptic curve keys and such certificates important? As the use of elliptic curve keys are more efficient than RSA keys, it is expected that elliptic keys will gain popularity. (However, there are some intentions of replacing Suite B with an even newer CNSA Suite which contains even stronger ECDH and ECDSA algorithms.) EC algorithms are capable of providing the same level of cryptographic strength using shorter key length than RSA keys.

Elliptic curve TLS ciphers and certificates are supported from

• ASA version 9.4(1)
• Windows 7
• Windows 2008 Server

Management network topology and asymmetric routing

We all want a management network or at least a management VLAN. Regarding those who say they have none, actually they do have a VLAN for management, it is probably just shared with ordinary users (i. e. it is not dedicated). But most IT people prefer a dedicated VLAN that is not used for other kind of traffic and preferably not reachable for users.

In this article we use this definition:
a management VLAN or management network is a dedicated segment for network management traffic which can be used for:

• administering your network devices (aka device access: switches, routers, firewalls via telnet, ssh, https etc.)
• collecting monitoring information (syslog, SNMP etc.)
• hosting syslog, monitoring and management servers (Nagios, Tivoli, Cisco Prime etc.)
• AAA traffic (RADIUS or TACACS+ to Cisco ACS/ISE)

Using Cisco ISE as a generic RADIUS server

Cisco ISE is an identity-based policy server featuring a wide range of functions from RADIUS CLI authentication to workstation posturing. With just a base license it includes a full-featured RADIUS server and it is capable of performing trivial RADIUS tasks which would not require such a sophisticated product themselves. For the functions described in this article Cisco Secure ACS could have been commonly chosen some years earlier. ISE’s policy logic and web interface is quite different.

The following use cases are described:

• Cisco device access (admin login)

Smart tunnels on Cisco ASA

Sometimes we have to provide secure remote access for users whose computers we don’t have any influence at all on. These computers don’t have AnyConnect or Cisco VPN client and the users may not have administrator rights so browser-based AnyConnect installation is not an option either. We can set up a WebVPN portal for such users on Cisco ASA with the clientless SSL VPN feature.

Clientless SSL VPN provides a web portal with various services such as intenal websites, CIFS links, Outlook Web Access etc. which are all accessed via the browser. The ASA software provides HTTPS service to the client and proxies the internal server’s material. The SSL core rewriter (or content rewriter) does application proxying therefore not all websites are guaranteed to work properly. For example, as of 9.1(3) the ASA software does not support Microsoft Sharepoint 2013 portal and some tricky content is not displayed.

Unreachable network behind TMG

I was asked to troubleshoot Active Directory DC synchronization network issues. Two DC’s are behind TMG, the third is in an ASA DMZ so the path is :

                  DC0  —            ASA   —                          TMG — DC73

Subnets:
                  10.0.0.0/24 — ASA — 10.0.203.0/24 — TMG — 10.0.73.0/24

The TMG performs no NAT for these networks so it’s plain routing. TMG has a default gateway set to ASA and ASA has a static route pointing to TMG’s outside address 10.0.203.100 .

Connectivity was completely broken (no ping, AD sync fail). On the ASA we could see half-open TCP connections:

ASA throughput depends on port location

I can hardly believe my own test results. I’m making performance tests with ASA 5550 (the one with a factory-installed 4GE module) and there is an interface pair where throughput is smaller than on other pairs.