User – techbloc.net

Testing at the moment identity firewalling with a Cisco ASA for a new office network infrastructure.

From the configuration everything is straight forward and easy to set-up:

1. Configure AAA LDAP Server

aaa-server addomain.net protocol ldap
aaa-server addomain.net (INSIDE) host 10.1.0.1
    ldap-base-dn DC=addomain,DC=net
    ldap-group-base-dn DC=addomin,DC=net
    ldap-scope subtree
    server-type microsoft
    server-port 389 
    ldap-login-dn *username*
    ldap-login-password *password*
    exit

If you use ldap over SSL you need to enable it and change the server port!

2. Configure Windows Cisco AD Agent

Install the Cisco AD Agent on one of your Windows Servers, not the Domain Controller if you also want to use NPS!

adacfg client create –name ASA5515 –ip 10.1.0.250/32 –secret secretpresharedkey 
adacfg dc create -name DC01 -host DC01.addomain.net -domain addomain.net -user Administrator -password *password*

2.1 Check Windows AD Agent Configuration

C:\IBF\CLI\adactrl.exe show running
C:\IBF\CLI\adacfg.exe client list
C:\IBF\CLI\adacfg.exe dc list

3 Configure AG Agent on the ASA

aaa-server adagent protocol radius
    ad-agent-mode

aaa-server adagent (INSIDE) host 10.1.0.2
    key secretpresharedkey
    user-identity ad-agent aaa-server adagent

4. Configure Identity option on the ASA

user-identity domain ADDOMAIN aaa-server addomain.net
user-identity default-domain ADDOMAIN

5. Example Object and Access List Configuration

object-group user USERNAME
    user ADDOMAIN\user1
    exit

object-group user GROUPNAME
    user-group ADDOMAIN\IT-ADMINs
    exit

access-list INSIDE-IN extended permit ip user ADDOMAIN\user1 any host 10.1.1.1
access-list INSIDE-IN extended permit ip user-group ADDOMAIN\\ADMINs any host 10.1.1.1
access-list INSIDE-IN extended permit ip object-group-user GROUPNAME any host 20.1.1.1

More information about how to configure identity firewalling you find here: Configuring the Identity Firewall

I had to create an read-only user account on an Cisco ASA. It was for a company security officer who needed to looks into the configuration on the ASA firewalls.

At first you need to set authorization to local:

aaa authorization command LOCAL

Then you define the priviledge access level, feel free to adjust them:

privilege cmd level 3 mode configure command failover
privilege cmd level 3 mode exec command perfmon
privilege cmd level 5 mode exec command dir
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command vpn-sessiondb
privilege cmd level 3 mode exec command packet-tracer
privilege cmd level 5 mode exec command export
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege show level 3 mode exec command reload
privilege show level 5 mode exec command import
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command asp
privilege show level 3 mode exec command cpu
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command vlan
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command ipv6
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command eigrp
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command wccp
privilege show level 3 mode exec command dynamic-filter
privilege show level 3 mode exec command webvpn
privilege show level 3 mode exec command service-policy
privilege show level 3 mode exec command module
privilege show level 3 mode exec command uauth
privilege show level 3 mode exec command compression
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege clear level 3 mode exec command dynamic-filter
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server

In the end you can create your user accounts where priviledge 3 are for monitor users and priviledge 5 are for read-only users.

(monitor)

username 'user' password 'password' priviledge 3

(read-only)

username 'user' password 'password' priviledge 5

To do it the easy way you can enable it also over the ASDM 😉

1. Go to Configuration > Device Managment > Users/AAA > AAA Access > Authorization
2. Click on the button “Set ASDM Defined Roles”
3. Select “Yes” to let ASDM configure the necessary settings
4. Click on “Apply” to send the configuration on the firewall

Tag: User

Cisco ASA Read-Only User Account