Category: Security

Posted on

Cisco ASA TCP Syslog Problem

I ran today into a big problem with configuring an TCP syslog server on an Cisco ASA.

logging host "interface_name" "server_ip" tcp/514

After I put in the configuration and someone from the server administration restarted the syslog server and suddenly the whole communication through the ASA stopped working completely.

I saw the following messages in the ADSM and quickly realised that this could be only caused by the TCP logging configuration.

%ASA-3-201008: Disallowing new connections

I didn’t looked before if the feature is disabled to block new connections when a TCP-connected syslog server is down. This is very important that you disable the feature before you configure TCP syslog servers otherwise you ran into the same problem like me.

Here the command to disable the feature:

logging permit-hostdown

In my case I just forgot to check before and will definitively remember for the next time 😉

Posted on

Bug in Cisco ASA 8.4(4)1 found

I had a new office set-up in Sao Paulo/Brazil and found a bug what should be already fixed but still exists. You cannot access the management interface (inside) of your ASA when you come over an L2L/RemoteAccess VPN and your NAT statements overlaps the management ip address.

It’s an split-tunneling configuration where VPN traffic keeps the original IP address and when you go into the internet you will translated to the outside IP address. Have a look here at the cisco bug CSCtr16184

I used the following config what didn’t work:

nat (inside,outside) source static inside-subs inside-subs destination static vpn-subs vpn-subs

When you use the NAT statements described in the workaround it works fine:

nat (inside,outside) source static inside-subs inside-subs destination static vpn-subs vpn-subs route-lookup
nat (outside,inside) source static vpn-subs vpn-subs destination static inside-subs inside-subs route-lookup

This behavior should be already fixed in version 8.4(2.3) but in my 8.4(4)1 it still exists.

Here the bug details from Cisco:

To-the-box traffic fails from hosts over vpn after upgrade to 8.4.2.

Symptom:

After upgrading the ASA to 8.4.2, all management traffic to-the-box(including icmp/telnet/ssh/ASDM) from hosts over the VPN (L2L or Remote ACcess VPN) may fail when destined to the management-access interface IP address.

Conditions:

1. Issue is observed if ASA is on 8.4.2. Not observed on 8.4.1.
2. Users directly connected to the internal interfaces face no issues with icmp/telnet/ssh/asdm to their respective interfaces.

Workaround:

The problem can be traced to a Manual NAT statement that overlaps with the management-access interface IP address. The NAT statement must have both the source and destination fields. Adding the “route-lookup” keyword at the end of the NAT statement resolves the issue.

Posted on

ASA and PPPoE example

Just a short example what you need to configure when use PPPoE on Cisco ASA…

vpdn group myconnection request dialout pppoe
vpdn group myconnection localname [email protected]
vpdn group myconnection ppp authentication pap
vpdn username [email protected] password aeb1puj43

interface Vlan 2
	nameif outside
	security-level 0
	pppoe client vpdn group myconnection
	ip address pppoe setroute
	no shutdown
	exit
Posted on

ASA Config: Site-to-Site VPN with NAT

Christmas just went by and I had some time to write down an howto with NAT in an Site-to-Site VPN tunnel. In this scenario you have clients in site A who need to access servers in site B. Normally it is not possible to access the servers in site B when you’re using the same IP address space. You can only get this work if you’re using NAT in site A to hide the internal addresses. The only thing what you need to do is to find an address space for the NAT translation and you need to be sure that you’re not using the address space in site B where you want to access the server.

Its just an very easy example how to do that you can also do an configuration where you site A and B access each other so you need todo NAT on both sides and create an transfer network. If you have questions there just ask i will maybe also create an howto for that,

Site A

Internal IP address space: 192.168.0.0/16

Client IP addresses: 192.168.100.0/24

NAT IP address: 172.25.0.1/32

Site B

Internal IP address space: 196.168.0.0/16

Server IP addresses: 192.168.200.0/24

Configuration Site A:

———————————————————————————————

object-group network Site-B-Access
network-object 192.168.100.0 255.255.255.0
exit

object-group network VPN-Site-B
network-object 192.168.200.0 255.255.255.0
exit

access-list nat_outbound-site-b extended permit ip object-group Site-B-Access object-group VPN-Site-B

nat (inside) 2 access-list nat_outbound-site-b

global (outside) 2 172.25.0.1 netmask 255.255.255.255

object-group network VPN-NAT-Site-B
network-object 172.25.0.1 255.255.255.255
exit

access-list acl_inside extended permit icmp any object-group VPN-Site-B
access-list acl_inside extended deny ip any object-group VPN-Site-B

access-list acl_VPN-Site-B extended permit ip object-group VPN-NAT-Site-B object-group VPN-Site-B

tunnel-group 1.1.1.1 type ipsec-l2l
tunnel-group 1.1.1.1 ipsec-attributes
pre-shared-key secretpassword
isakmp keepalive threshold 10 retry 2
exit

crypto map VPN 1 match address acl_VPN-Site-B
crypto map VPN 1 set peer 1.1.1.1
crypto map VPN 1 set pfs group2
crypto map VPN 1 set transform-set ESP-3DES-SHA
crypto map VPN 1 set connection-type bidirectional
crypto map VPN 1 set security-association lifetime seconds 3600 kilobytes 4608000
no crypto map VPN 1 set reverse-route
no crypto map VPN 1 set  nat-t-disable
crypto map VPN 1 set phase1-mode main
crypto map VPN 1 set inheritance rule
crypto map VPN 1 interface outside

Site B:

---------------------------------------------------------------------------------------------

coming soon

so have a look in some days i will complete the post until then

Posted on

Just tested new Cisco ASA 8.3 (Update)

It was a big suprise that Cisco changed so many things in the new IOS version for the ASA. Remember it is only an minor release update i would expect these changes for an major update but anyway they did a good work.

The new group objects what they implementent is very nice. It make the work much easier and you have a better overview about the NAT configuration like before because they move it to the actual network object.

Here an example how nat works in the network object:

object network web-01-external
host 24.0.0.1
exit

object network web-01-frontside
description Web Server Node 1
host 10.1.0.1
nat (inside,outside) static web-01-external
exit