Cisco ASA Adaptive Security Appliance

Performance Analysis CSCvc23568 Cisco Prime Network Change and Configuration Management CSCvc23444 3.1 24-Mar-2017) 3.2 (24-Apr-2017) Cisco Proactive Network Operations Center CSCvc23445 No fixes planned contact Cisco TAC for upgrade information. Cisco Registered Envelope Service CSCvc23448 No fixed release planned. Cisco Service Lifecycle Information Manager (SLIM) CSCvc23455 Cisco Services Provisioning Platform CSCvc23587 Cisco Smart Care CSCvc23532 No further releases planned contact TAC for upgrade instructions. Cisco Unified MeetingPlace - WebEx Node for MCS CSCvc23582 Cisco Universal Small Cell 5000 Series - Running Release 3.4.2.x CSCvc23562 3.5.12.23 (31-Jan-2017) Cisco Universal Small Cell 7000 Series - Running Release 3.4.2.x CSCvc23562 3.5.12.23 (31-Jan-2017) Cisco WebEx Messenger Service CSCvc23454 Cisco has confirmed that this vulnerability does not affect the following Cisco products.Collaboration and Social Media Cisco WebEx Meetings Server Release 1.x Cisco WebEx Meetings Server Release 2.xEndpoint Clients and Client Software Cisco Agent for OpenFlow Cisco IP Communicator Cisco NAC Agent for Mac Cisco NAC Web Agent Cisco UC Integration for Microsoft Lync Cisco Virtualization Experience Client 6215 Cisco WebEx Business Suite Cisco WebEx Meetings Client - Hosted Cisco WebEx Meetings for Android Cisco WebEx Meetings for BlackBerry Cisco WebEx Meetings for Windows Phone 8 Cisco WebEx Productivity ToolsNetwork Application, Service, and Acceleration Cisco Extensible Network Controller (XNC) Cisco Nexus Data BrokerNetwork and Content Security Devices Cisco ASA Next-Generation Firewall Services Cisco Adaptive Security Appliance (ASA) Software Cisco Adaptive Security Device Manager Cisco Content Security Management Appliance (SMA) Cisco Email Security Appliance (ESA) Cisco Web Security Appliance (WSA)Network Management and Provisioning Cisco Access Registrar Appliance Cisco Connected Grid Device Manager Cisco Connected Grid Network Management System Cisco Insight Reporter Cisco Linear Stream Manager Cisco Multicast Manager Cisco Prime Access Registrar Appliance Cisco Prime Access Registrar Cisco Prime Cable Provisioning Cisco Prime Central for Service Providers Cisco Prime Collaboration Assurance Cisco Prime Home Cisco Prime IP Express Cisco Prime Network Registrar IP Address Manager (IPAM) Cisco Prime Network Registrar Virtual Appliance Cisco Prime Network Services Controller Cisco Prime Network Cisco Prime Optical for Service Providers Cisco Prime Performance Manager Cisco Prime Provisioning for Service Providers Cisco Security Manager Cisco Smart Net Total Care - Local Collector

Cisco Alternatives: Similar FirewallsCisco Systems is a major firewall manufacturer that provides network devices such as Cisco UTM and Cisco Next-gen Firewall for any need and has a huge, established track record over the last 30 years. Every network administrator is familiar with the name Cisco Systems, and the brand needs no additional introduction in the network security sector.The Cisco ASA Security Appliance Family secures business networks and data centers of all sizes. It gives consumers extremely secure access to data and network resources at any time, from any location, using any device. With over 1 million security appliances installed worldwide, Cisco ASA devices represent more than 15 years of proven firewall and network security engineering and leadership.The core operating system for the Cisco ASA Family is Cisco Adaptive Security Appliance (ASA) Software. It provides enterprise-class firewall features for ASA devices in a variety of form factors for any distributed network environment, including standalone appliances, blades, and virtual appliances. ASA Software also interfaces with other essential security technologies to provide complete solutions that address ever-changing security requirements.Cisco ASA Software has the following advantages:Provides IPS, VPN, and Unified Communications features all in one.Through high-performance, multi-site, multi-node clustering, companies may expand capacity and enhance performance.Provides high availability for high-reliability applications.Allows physical and virtual devices to collaborate.Provides context awareness with Cisco TrustSec security group tags and identity-based firewall technology to meet the specific demands of both the network and the data center.Per-context dynamic routing and site-to-site VPN are made possible.Next-generation encryption standards, such

Compliance.Cisco Adaptive Security Appliance (Virtual Appliance): The Cisco Adaptive Security Appliance (ASA) is a security appliance that protects corporate networks and data centers. It provides users with highly secure access to data and network resources – anytime, anywhere. The remote users can use Cisco AnyConnect Secure Mobility Client on the endpoints to securely connect to the resources hosted in the Data Center or the Cloud.Cisco Next-Generation Firewall / Firepower Threat Defense (Virtual Appliance): The Cisco Firepower NGFW helps you prevent breaches, get visibility to stop threats fast, and automate operations to save time. A next-generation firewall (NGFW) is a network security device that provides capabilities beyond a traditional, stateful firewall by adding capabilities like application visibility and control, Next-Generation IPS, URL filtering, and Advanced Malware Protection (AMP).Scalable and Resilient Remote VPN architecture for AWS (Single-VPC & Multi-AZ)Due to layer-2 abstraction in the cloud, it not possible to provide native firewall high availability, firewall clustering, and VPN clustering. AWS offers native services like AWS route53, AWS route tables that enable DNS based load balancing.Figure 2: Cisco Remote Access VPN scalable design using AWS Route53Traffic Flow:The remote access VPN user initiates a VPN connection using a hostname (example: answamivpn.com), and the DNS server returns an IP address. AWS route53 monitors all the firewalls using AWS route53 health checksRemote user makes the connection to the firewallAccess the resources hosted in AWSRecommendation for the architecture shown in figure 2:Each availability zone (AZ) should have multiple firewalls (ASAv or NGFWv)Each firewall should have a dedicated

Client and server. A self-sourced TCP connection uses a port that conflicted with an existing listen server's port. Recommendation: If non-zero, this counter indicates a system-consistency check has failed. Please contact the TAC. None 2084 NP_FLOW_SSM_APP_REQUEST Flow terminated by service module. This counter only applies to the ASA 5500 series adaptive security appliance. It is incremented when the application running on the SSM requests the security appliance to terminate a connection. Recommendation: You can obtain more information by querying the incident report or system messages generated by the SSM itself. Please consult the documentation that comes with the SSM for instructions. None 2085 NP_FLOW_SSM_APP_FAIL Service module failed. This counter only applies to the ASA 5500 series adaptive security appliance. It is incremented when a connection that is being inspected by the SSM is terminated because the SSM has failed. Recommendation: The card manager process running in the security appliance control plane issued system messages and CLI warning to inform you of the failure. Please consult the documentation that comes with the SSM to trouble shoot the SSM failure. 421001 2086 NP_FLOW_SSM_APP_INCOMPETENT Service module incompetent. This counter only applies to the ASA 5500 series adaptive security appliance. It is incremented when a connection is supposed to be inspected by the SSM, but the SSM is not able to inspect it. This counter is reserved for future use: it should always be 0. Recommendation: None. None 2087 NP_FLOW_SSL_BAD_RECORD SSL bad record detected. This counter is incremented for each unknown SSL record type received from the remote peer. Any unknown record type received from the peer is treated as a fatal error and the SSL connections that encounter this error must be terminated. Recommendation: It is not normal to see this counter increment at any time. If this counter is incremented, it usually means that the SSL protocol state is out of sync with the client software. The most likely cause of this problem is a software defect in the client software. Contact the Cisco TAC with the client software or web browser version and provide a network trace of the SSL data

The Cisco Adaptive Security Appliance is an integrated security equipment that can perform a variety of functions like firewall, intrusion prevention, VPN, content security, unified communications, and remote access. Among these functions, the ASA can also perform routing using popular routing protocol like Routing Information Protocol (RIP), Enhanced Interior Gateway Routing Protocol (EIGRP), Open Shortest Path First (OSPF) or static routes.In this tutorial, we are going to focus on configuring EIGRP. We will take the steps on how to configure the Adaptive Security Appliance to perform routing functions, exchange routing updates and redistribute a static route.In our example scenario, we will refer to the diagram below.In this particular scenario, the routers R1 and R2 and the ASA all participate in the EIGRP process. R1 is in the internal network and R2 in the DMZ. A static default route to the Internet outside interface of ASA will be configured and redistributed into the EIGRP process.We will start by configuring IP addressing and EIGRP on the two routers R1 and R2.Router R1 Configuration:R1#configure terminal Enter configuration commands, one per line. End with CNTL/Z.R1(config)#interface FastEthernet0/0R1(config-if)#ip address 192.168.1.1 255.255.255.0R1(config-if)#no shutdownR1(config-if)#exitR1(config)#interface FastEthernet1/0R1(config-if)#ip address 10.0.0.1 255.255.255.0R1(config-if)#no shutdownR1(config-if)#exitR1(config)#router eigrp 10R1(config-router)#network 10.0.0.0 0.0.0.255R1(config-router)#network 192.168.1.0 0.0.0.255R1(config-router)#no auto-summaryR1(config-router)#endRouter R2 Configuration:R2#configure terminal Enter configuration commands, one per line. End with CNTL/Z.R2(config)#interface FastEthernet0/0R2(config-if)#ip address 192.168.2.1 255.255.255.0R2(config-if)#no shutdownR2(config-if)#exitR2(config)#interface FastEthernet1/0R2(config-if)#ip address 10.1.1.1 255.255.255.0R2(config-if)#no shutdownR2(config-if)#exitR2(config)#router eigrp 10R2(config-router)# network 10.1.1.0 0.0.0.255R2(config-router)#network 192.168.2.0 0.0.0.255R2(config-router)#no auto-summaryR2(config-router)#endNow, we will configure the ASA, this being the core of our tutorial here. The ASA will be separating the three zones in