ASA/PIX

How to turn a Cisco Router into ASA..

Guess what your Routers  support zone-based policies, which really helps with multi-interface restrictions (rather than just one outside & one inside interface with individual access list applications). Likewise, it now supports application inspection to catch those scandalous peer-to-peer programs.  

Courtesy: Cisco

Cisco IOS® Software Release 12.4(6)T introduced Zone-Based Policy Firewall (ZFW), a new configuration model for the Cisco IOS Firewall feature set. This new configuration model offers intuitive policies for multiple-interface routers, increased granularity of firewall policy application, and a default deny-all policy that prohibits traffic between firewall security zones until an explicit policy is applied to allow desirable traffic. For more details do access this document from Cisco.

Show Commands in Cisco Routers and Layer 3 Switches(Most commonly used)Series -1

Some of the widely used commands in Cisco routers are just simple unavoidable, among the most commonly used commands in a Cisco Routers are “show” commands. These commands are essential to Network Administrators. Here is a list of those commands. I will try to cover this in two series. Here is the first series

1. Show running-configuration

The show running-configuration command shows the complete current running configuration in a router, firewall or a switch. Using show running-configuration command a network administrator can troubleshoot almost all issues related routing, filtering secure access, encapsulation, interface mismatch, and many more issues.

2. Show startup-configuration

The show startup-configuration command shows the configuration that is saved on the NVRAM. It is helpful in knowing the configuration that will be applied the next time the routers is reloaded. And also this command is useful in knowing the configuration that was loaded at the start-up of the router before making changes to it.  3. Show Interface

The Show interface command shows the status and statistics of the router interfaces. The show interface command is useful to troubleshoot the routing and link issues. The show interface command output includes interface status, interface IP address and subnet mask, protocol status on an interface, encapsulation type, bandwidth, utilization and much more information related to interface operation.

4. Show ip route

The show ip route command shows the routers routing table.  Routing protocols used and what networks these protocols are advertised. The show ip route command is used to troubleshoot routing problems.

5. Show ip protocols

The show ip protocols displays the routing protocols used in a router and the networks to which these protocols are advertised. It also shows the sources of the routing updates received and very helpful to troubleshoot routing issues.

How to configure ASA/PIX firewall to collect Net flow data from an external router to the netflow collector located in Inside Network.

This article provides an example of Net flow configurations in a Cisco Router, ASA/PIX firewall to collect the Net flow data in the internal network.

Components Uses
The information in this document is based on following hardware and software versions
• Cisco Router 3745 – IOS version 12.3(17b. (Network 192.168.10.0)
• PIX 525 7.0.3 ( ASA can also be used) (Internal 10.0.0.2)
• Manage Engine Net flow Analyzer 6 ( Any net flow collector can be used)(

In this example let’s start by configuring Net flow in a Cisco Router

Cisco Router Configuration
Here the IP address for the interface is 192.168.10.1

Enabling Net flow in an Interface
Enter global configuration mode on the router and issue the following commands for each interface on which you want to enable Net Flow:

interface {interface} {interface_number}
ip route-cache flow
bandwidth
exit

After applying the commands the example will be as follows
router3745#configure terminal
router-3745(config)#interface FastEthernet 0/1
router-3745(config)#ip address 192.198.10.1 255.255.255.240
router-3745(config-if)#ip route-cache flow
router-3745(config-if)Bandwidth 1000
router-3745(config-if)#exit

Exporting NetFlow Data

Issue the following commands to export Net Flow data to the server on which NetFlow Analyzer is running:

ip flow-export destination {hostname|ip_address} 9996 ( Exports the NetFlow cache entries to the specified IP address. Use the IP address of the NetFlow Analyzer server and the configured NetFlow listener port. The default port is 9996. )

ip flow-export source {interface} {interface_number} (Sets the source IP address of the NetFlow exports sent by the device to the specified IP address. NetFlow Analyzer will make SNMP requests of the device on this address.)

ip flow-export version 5 [peer-as | origin-as] (Sets the NetFlow export version to version 5. Version 5,7 & 9 are available)

ip flow-cache timeout active 1 (Breaks up long-lived flows into 1-minute fragments. You can choose any number of minutes between 1 and 60. If you leave it at the default of 30 minutes your traffic reports will have spikes.It is important to set this value to 1 minute in order to generate alerts and view troubleshooting data.)

ip flow-cache timeout inactive 15 (Ensures that flows that have finished are periodically exported. The default value is 15 seconds. You can choose any number of seconds between 10 and 600. )

snmp-server ifindex persist (Enables ifIndex persistence (interface names) globally. This ensures that the ifIndex values are persisted during device reboots.)

The following example shows the above mentioned commands

router-3745(config)#ip flow-export destination 192.168.10.5 9996
router-3745(config)#ip flow-export source FastEthernet 0/1
router-3745(config)#ip flow-export version 5
router-3745(config)#ip flow-cache timeout active 1
router-3745(config)#ip flow-cache timeout inactive 15
router-3745(config)#snmp-server ifindex persist
router-3745(config)#^Z

Issue the following commands in normal (not configuration) mode to verify whether NetFlow export has been configured correctly:

show ip flow export (Shows the current NetFlow configuration)
show ip cache flow (These commands summarize the active flows and give an indication of how much NetFlow data the device is exporting

router-3745#show ip flow export
router-3745#show ip cache flow

The next step is make a Natting in ASA/PIX

pix-525# configure t
pix-525# (config)# static (inside,outside) 192.168.10.5 10.0.0.6 netmask 255.255.255.255 dns

In order to export to the netflow statistics to the netflow analyzer located in the internal network we have configure the following access-list and apply it to outside interface to allow the Netflow traffic

pix-525# configure t
pix-525# (config)#access-list NETFLOW extended permit udp any host 192.168.10.5 eq 9996
pix-525# (config)#access-list NETFLOW extended permit tcp any any

Apply the created access-list to the outside interface
pix-525# (config)#access-group NETFLOW in interface outside

Now install the Netflow Analyzer software and configure it to recieve the netflow statists from the external router.

Troubleshooting tips

Verify Netflow is working in Cisco Router

router-3745#sho ip cache flow
IP packet size distribution (78841980 total packets):
1-32 64 96 128 160 192 224 256 288 320 352 384 416 448 480
.003 .453 .023 .012 .008 .010 .004 .003 .003 .003 .004 .003 .003 .003 .004

512 544 576 1024 1536 2048 2560 3072 3584 4096 4608
.003 .005 .022 .021 .401 .000 .000 .000 .000 .000 .000

IP Flow Switching Cache, 278544 bytes
548 active, 3548 inactive, 4045717 added
84147818 ager polls, 0 flow alloc failures
Active flows timeout in 1 minutes
Inactive flows timeout in 15 seconds
IP Sub Flow Cache, 33416 bytes
548 active, 1500 inactive, 4045717 added, 4045717 added to flow
0 alloc failures, 0 force free
2 chunks, 14 chunks added
last clearing of statistics never
Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec)
——– Flows /Sec /Flow /Pkt /Sec /Flow /Flow
TCP-Telnet 143 0.0 2 52 0.0 0.4 12.7
TCP-FTP 255 0.0 6 100 0.0 9.0 7.2
TCP-FTPD 15010 0.0 1 63 0.0 0.6 15.4
TCP-WWW 1100665 2.5 14 607 37.7 8.2 6.9
TCP-SMTP 171448 0.3 69 633 27.3 35.8 6.2
TCP-X 723 0.0 2 245 0.0 0.4 13.0
TCP-other 1966270 4.5 21 656 95.4 11.7 6.6
UDP-DNS 56825 0.1 12 66 1.5 20.5 11.6
UDP-NTP 8 0.0 1 76 0.0 0.0 15.5
UDP-Frag 1 0.0 1 1476 0.0 0.0 15.0
UDP-other 684203 1.5 11 319 17.9 4.8 14.9
ICMP 48198 0.1 1 78 0.2 1.6 15.4
GRE 1358 0.0 183 182 0.5 50.0 4.2
IP-other 62 0.0 83 108 0.0 53.4 3.2
Total: 4045169 9.2 19 601 180.9 10.6 8.3

SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts
Fa0/1 192.168.10.5 Tu0 69.26.190.118 11 1705 0D96 8
Fa0/1 192.168.10.5 Tu0 65.55.111.92 06 0019 10EC 32
Fa0/1 192.168.10.5 Tu0 206.190.48.113 06 0019 714B 29

Check Nating is working in the Firewall

pix-525# show xlate
2in use, 417 most used
Global 192.168.10.5 Local 10.0.0.6

Check access -list is forwading the netflow traffic

pix-525# sho access-list NETFLOW
access-list NETFLOW; 2 elements
access-list NETFLOW line 1 extended permit udp any host 192.168.10.5 eq 9996 (hitcnt=7)
access-list NETFLOW line 2 extended permit ip any any (hitcnt=140861)

To know more about Netflow Analyzer and its configuration click this link Netflow.