In some cases, the CLI can provide more precise control over the desired configuration. However, have a gateway of last resort defined. Enter the username admin01 and the password admin01pass. CONFIGURACION BASICA Use a terminal emulation program, such as TeraTerm or PuTTy to access the CLI. Instructor Notes: Configuring the ASA as a DHCP client (informational only). this lab. d. Display the information for the Layer 3 VLAN interfaces using the show ip address command. a. Part 4: Configure ASA Settings from the ASDM Configuration Menu. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device. The VLAN 3 (dmz) interface will be configured in Part 6 of the lab. Disk0: b. Cisco MPF uses three configuration objects to define modular, object-oriented, and hierarchical policies: Policy maps Associate actions to the match criteria. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device. Cable the network and clear previous device settings. , and others, can be issued from within any configuration mode prompt without the, ASDM provides an intuitive, GUI-based tool for configuring the ASA, : If you or your instructor have already installed the. Make sure, have been erased and have no startup configuration, : To avoid using the switches, use a cross-over cable to connect the end devices. Note: If you are working with the ASA 5505 Base license, you are allowed to create up to three named interfaces. Part 2: Access the ASA Console and Use CLI Setup Mode to Configure Basic Settings, Part 3: Configure Basic ASA Settings and Interface Security Levels. CCNA Security Exam Answers - Cisco CCNA Security Exams Answers. It may be necessary to issue the ipconfig /renewcommand on PC-B to force it to obtain a new IP address from the ASA. The ASA 5506-X is commonly used as an edge security device that connects a small business or teleworker to an ISP device, such as a DSL or cable modem, for access to the internet. In Part 1 of this lab, you will configure the topology and non-ASA devices. In the Browse Private Service window, double-click to select the following services: tcp/ftp, tcp/http, icmp/echo, and icmp/echo-reply (scroll down to see all services). d. Click OK > Apply to send the commands to the ASA. The final running configs for all devices are found at the end of the lab. Configuration was performed using the nat, global, and static commands. The ping should fail because the ASA does not have a route to 10.1.1.1. Service policies Attach the policy map to an interface, or globally to all interfaces of the appliance. In Part 5, you will configure ASA features, such as DHCP and enhanced login security, using AAA and SSH. Note: This time the flag is s, which indicates a static translation. b. If the password has been changed to what is specified in this lab, enter the word class. Select Packet Countsand click Add to add the graph. Optional Lab Configure ASA Basic Settings Using CLI. b. Click Show Graphs to display the graph. Use the serial port settings of 9600 baud, 8 data bits, no parity, one stop bit, and no flow control. C.E, Clasificacin de las universidades del mundo de Studocu de 2021. In the Block Traffic area, select vlan1 (inside) from the drop-down list. PC-B should be able to ping the INSIDE interface for the ASA. ____________________________________________________________________________________ This lab uses the ASA CLI, which is similar to the IOS CLI, to configure basic device and security settings. While in object definition mode, use the nat command to specify that this object is used to translate a DMZ address to an outside address using static NAT , and specify a public translated address of 209.165.200.227. Note: To avoid repetitive logins during this lab, the exec-timeout command can be set to 0 0, which prevents it from expiring. For additional security, configurethe lines to log out after five minutes of inactivity. translate_hits = 17, untranslate_hits = 4, TCP PAT from INSIDE:192.168.1.3/49503 to OUTSIDE:209.165.200.226/49503 flags ri idle 0:01:24 timeout 0:00:30, TCP PAT from INSIDE:192.168.1.3/49502 to OUTSIDE:209.165.200.226/49502 flags ri idle 0:01:24 timeout 0:00:30, TCP PAT from INSIDE:192.168.1.3/49501 to OUTSIDE:209.165.200.226/49501 flags ri idle 0:01:25 timeout 0:00:30, TCP PAT from INSIDE:192.168.1.3/49500 to OUTSIDE:209.165.200.226/49500 flags ri idle 0:01:25 timeout 0:00:30. . In part 5 you will configure the ASA for additional services, such as DHCP, AAA, and SSH. Note: If you can ping from PC-C to R1 G0/0 and S0/0/0, you have demonstrated that addressing has been configured properly, and static routing is configured and functioning correctly. 5) Verify that the IP address has been added. a. The ASA splits the configuration into the object portion that defines the network to be translated and the actual nat command parameters. Tip: Many ASA CLI commands are similar to, if not the same, as those used with the Cisco IOS CLI. The ASA now has a default route to unknown networks. Practice Final Exam Answers c. Click Clear to reset the entries. Note: Unlike IOS ACLs, the ASA ACL permit statement must permit access to the internal private DMZ address. Use the security passwords command to set a minimum password length of 10 characters. Click Close to continue. 9.3.1.2 Lab - Configure ASA Basic Settings and Firewall Using CLI - GNS3 8,279 views Jan 25, 2018 73 Dislike Share Save Christian Augusto Romero Goyzueta 48.4K subscribers CCNA Security 2.0 -. Make sure, have been erased and have no startup configuration, : To avoid using the switches, use a cross-over cable to connect the end devices. Configure an ACL to allow access to the DMZ for Internet users. NETSEC-ASA(config)# domain-name netsec.com, NETSEC-ASA(config)# enable password class. This will provide web and SSH targets for testing later in the lab. The pings should not be successful. Set the date and time. Click Apply to send the commands to the ASA. b. Configure the inside and outside VLAN interfaces. The table does not include any other type of interface, even though a specific router may contain one. ___________________________ No. Before clicking OK to add the interface, click the Advanced tab and specify this interface as VLAN ID 3. By default, it is set to cisco, but since the default startup configuration was erased you have the option to configure the login password using the passwd or password command. Other devices will receive minimal configuration to support the ASA portion of the lab. If these pings are not successful, troubleshoot the basic device configurations before continuing. This presents a series of interactive prompts to configure basic ASA settings. In Part 1 of this lab, you will configure the topology and non-ASA devices. Test access to the DMZ server from the outside network. a. c. If prompted to enter Interactive Firewall configuration (Setup mode), answer no. Note: To avoid using the switches, use a cross-over cable to connect the end devices Step 2:Configure the ASA. This lab uses the ASA CLI, which is similar to the IOS CLI, to configure basic device and security settings. In Part 1 of this lab, you will configure the topology and non-ASA devices. Layer 3 VLAN interfaces provide access to the three areas created in the lab: Inside, Outside, and DMZ. Make sure the router and ASA have been erased and have no startup configuration. How does the ASA 5505 use logical and physical interfaces to manage security and how does th is differ from other ASA models? On the other ASAs, like a Cisco router, the physical port can be directly assigned a Layer 3 IP address. Access the ASA console and view hardware, software, and configuration settings. Enter a Starting IP Address of 192.168.1.31 and an Ending IP Address of 192.168.1.39. Configure SSH access to the ASA. View 21.7.6 Optional Lab - Configure ASA Network Services Routing and DMZ with ACLs Using CLI.docx from IT 030 at Technological Institute of the Philippines. The ASA 5505 is commonly used as an edge security device that connects a small business or teleworker to an ISP device, such as a DSL or cable modem, for access to the Internet. If any of the physical or logical interfaces previously configured are not up/up, troubleshoot as necessary before continuing. extend your current configuration adding a DMZ, routing, NAT, DHCP, AAA, and SSH. Enter the name DMZ-Server, select Host from the Type pull-down menu, enter the IP Address 192.168.2.3, and a Description of PC-A. However, PC-C should be able to ping the. Step 1: Configure the ASA DMZ VLAN 3 interface. ####### issue the command "call-home reporting anonymous". [confirm]. Click Nextto continue. The default is to use the IP address of the outside interface. In Part 2, you will configure routing, NAT, and the firewall between the inside and outside networks. By default, inside users can access the outside with an access list and outside users are prevented from accessing the inside. For application layer inspection, as well as other advanced options, the Cisco. What are some of the benefits of using the CLI over ASDM? Study Resources. After entering the URL above, you should see a security warning about the website security certificate. Step 3: Configure static routing on the routers. Try to ping from the DMZ server PC-A to PC-B at the IP address 192.168.1.X. Configure the hostname, domain name, and enable the password. Sending 5, 100-byte ICMP Echos to 209.165.200.227, timeout is 2 seconds: Packet sent with a source address of 172.16.3.1, Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms, 1 (DMZ) to (OUTSIDE) source static DMZ-server 209.165.200.227, 2 (INSIDE) to (OUTSIDE) source dynamic INSIDE-NET interface. Note: The next action you attempt within ASDM will require that you log in as admin01 with the password The ASDM Welcome page will display. o Interface Status You can also go directly to the CLI to configure the ASA settings, as described in Part 3. a. If you see the message: System config has been modified. The packet should be permitted. Executing command: same-security-traffic permit inter-interface, Factory-default configuration is completed, Erase configuration in flash memory? Note: Before you begin, ensure that the devices have been erased and have no startup configurations. Note: An access list can be applied to the INSIDE interface to control the type of access to be permitted or denied to the DMZ server from inside hosts. ####### The first image found in disk0:/ will be used to boot the, ####### Verify there is a valid image on disk0:/ or the system will. What version of, The ASA in this lab uses ASDM version 7.1. Were you able to do this on this ASA? Display the current running configuration using the show running-config command. Select your Time Zone from the drop-down list and enter the current date and time in the fields provided. The ASA now has a default route to unknown networks. Note: To avoid using the switches, use a cross-over cable to connect the end devices Step 2:Configure R1 and the end devices. The focus of this lab is on the configuration of the ASA as a basic firewall. Objectives Verify Connectivity and Explore the ASA Configure Basic ASA Settings and Interface Security Levels Using CLI Configure Routing, Address Translation, and Inspection Policy Using CLI Configure DHCP, AAA, and SSH Configure a DMZ, Static NAT, and ACLs Scenario Your company has one location connected to an ISP. Enable HTTP access to R1 using the ip http server command in global config mode. Step 3:Set the date and time. PDF - Complete Book (11.16 MB) PDF - This Chapter (1.12 MB) . b. interface is configured with a static address. You. c. Enter privileged mode with the enable command and password (if a password has been set). CCNA Cybersecurity Operations (Version 1.1) CyberOps 6 In this part, you will create a DMZ on the ASA, configure static NAT to a DMZ server, and apply an ACL to control access to the server. Do NOT check the box to Enable auto-configuration from interface. The Cisco Adaptive Security Appliance ASA is an advanced network security device that integrates a statefull firewall as well as VPN and other capabilities. b. This table includes identifiers for the possible combinations of Ethernet and Serial interfaces in the device. This lab uses the ASA GUI interface ASDM to configure basic device and security settings. Other routers and Cisco IOS versions can be used. This lab employs an ASA 5506-X to create a firewall and protect an internal corporate network from external intruders while allowing internal hosts access to the Internet. three configuration objects to define modular, object-oriented, ttach the policy map to an interface, or globally to all interfaces of the. Note: Save your configuration so that the password persists across reboots. By, the ASA sets its own IP address as the DHCP default. Note: If the ASA OUTSIDE interface was configured as a DHCP client, it could obtain a default gateway IP address from the ISP. Step 1:Configure the hostname and domain name. Tip: Many ASA CLI commands are similar to, if not the same, as those used with the Cisco IOS CLI. This is the range of addresses to be assigned to inside DHCP clients. NETSEC-ASA(config-if)# show interface ip brief, InterfaceIP-AddressOK? Set the console and VTY passwords to cisco. Cable the network and clear previous device settings. Determine the ASA version, interfaces, and license. What type of license does this ASA have? The focus of this lab is on the configuration of the ASA as a basic firewall. When the ASA completes the reload process, it should detect that the startup-config file is missing and present a series of interactive prompts to configure basic ASA settings. ____________________________________________________________________________________ You should see the Cisco ASDM Welcome screen that allows you to: Install ASDM Launcher and Run ASDM, Run ASDM, or Run Startup Wizard. enable secret algorithm-type scrypt cisco12345, username admin01 algorithm-type scrypt secret cisco12345, ip address 209.165.200.225 255.255.255.248, crypto key generate rsa general-keys modulus 1024. Ports G1/1 to G1/8 are normal GigabitEthernet ports. 21.2.10 Optional Lab - Configure ASA Basic Settings Using the CLI - ILM | PDF | Command Line Interface | Ip Address 21.2.10 Optional Lab - Configure ASA Basic Settings Using the CLI - ILM - Read online for free. Both the PAT (inside to outside) and static NAT (dmz to outside) policies are shown. To accommodate the addition of a DMZ and a web server, you will use another address from the ISP range, 209.165.200.224/29 (.224-.231). d. Issue the show nat and show xlate commands on the ASA to see the effect of the pings. Issue the show run command to display the current configuration that you have created using ASDM. b. Beginning with ASA version 8.3, network objects are used to configure all forms of NAT. The ASA creates three security interfaces: Outside, Inside, and DMZ. Note: Be sure to specify the HTTPS protocol in the URL. INFO: Security level for DMZ set to 0 by default. _______________________________________________________________________________________ Add the inspection of ICMP traffic to the policy map list using the following commands: c. Display the default MPF polich map to verify ICMP is now listed in the inspection rules. To accommodate the addition of a DMZ and a web server, you will use another address from the ISP range assigned 209.165.200.224/29 (.224-.231). d. You should see the results of the pings from R2 on the graph as an Input Packet Count. ASDM provides an intuitive, GUI-based tool for configuring the ASA. Other devices will receive minimal configuration to support the ASA portion of . The ASA used with this lab is a Cisco model 5506-X with an 8-port integrated switch, running OS version 9.15(1), Adaptive Security Device Manager (ASDM) version 7.15(1). a. Click Apply to send the commands to the ASA. In the Interface Name box, name the interface dmz, assign it a security level of 70, and make sure the Enable Interface checkbox is checked. ____________________________________________________________________________________ e. Ping from PC-B to R1 again and quickly issue the show xlate command to see the addresses being translated. Delete filename [upgrade_startup_errors*]? Enable AAA user authentication to access the ASA using SSH. Click AAA Access. Configuring the VLAN management IP address for the switches is optional. the ASA as a basic firewall. On the Configuration screen > Device Setup menu, click System Time > Clock. Using the ASA CLI, add the security-level 70 command to VLAN 3. It provides outside users limited access to the DMZ and no access to inside resources. Click Continue to this website. Other than the host name, the switches can be left in their default configuration state. Note: To stop the output from a command using the CLI, press Q. The following command configures the ASA OUTSIDE interface to receive its IP address information via a DHCP server and sets the default route using the default gateway parameter provided by the ISP DHCP server. In this part of the lab, you will create a DMZ on the ASA, configure static NAT to a DMZ server, and apply ACLs to control access to the server. The default ASA hostname and prompt is ciscoasa>. How much RAM does this ASA have? [Y]es/[N]o:n. When the ASA completes the reload process, it should detect that the startup-config file is missing and prompt you to pre-configure the firewall using interactive prompts. Note: The response from the PC is relatively slow, and it may take a while to show up on the graph as Output Packet Count. R1 is shown here as an example. You can no longer connect to the ASA using SSH with the default username and the login password. Step 3: View the DMZ Access Rule generated by ASDM. In some cases, a task assumes the configuration of certain features in a prior task. Ping from the ASA to R1 G0/0/0 at IP address 172.16.3.1. Press Enter. _______________________________________________________________________________________ Save the RSA keys to persistent flash memory using the, Configure the ASA to allow SSH connections from any host on the inside network (192.168.1.0/24) and from the remote management host at the branch office (172.16.3.3) on the outside network. Part 3: Configuring ASA Settings and Interface Security Using the CLI. Click Continue. Bypass Setup mode and configure the ASDM VLAN interfaces. Step 2: Configure basic settings for routers and switches. To learn more about this feature, ####### Would you like to enable anonymous error reporting to help improve, ####### the product? c. From PC-B, attempt to ping the R1 G0/0 interface at IP address 209.165.200.225. INFO: Security level for outside set to 0 by default. In Parts 2 through 4 you will configure basic ASA settings and the firewall between the inside and outside networks. [confirm] . While in object definition mode, use the nat command to specify that this object is used to translate a DMZ address to an outside address using static NAT, and specify a public translated address of 209.165.200.227. We will not be configuring the ASA this way, therefore enter. The pings should be successful. d. Configure the hostname for the switches. If these pings are not successful, troubleshoot the basic device configurations before continuing. The selection of any4 translates to a quad zero route. Close the Error in sending command window. In Part. Note: The responses to the prompts are automatically stored in the startup-config and the running config.However, additional security-related commands, such as a global default inspection service policy, are inserted into the running-config by the ASA OS. Practice Final Exam Answers CCNA Cybersecurity Operations (Version 1.1) CyberOps 9 Delete disk0:/FSCK0000.REC? f. You should see the new interface named dmz, in addition to the inside and outside interfaces. b. Repeat the dhcpd command and specify the pool as 192.168.1.5-192.168.1.36. c. (Optional) Specify the IP address of the DNS server to be given to clients. Part 5: Configure DMZ, Static NAT, and ACLs. The ASA creates three security interfaces: Outside, Inside, and DMZ. policy-map type inspect dns preset_dns_map, NETSEC-ASA(config)# policy-map global_policy, NETSEC-ASA(config-pmap)# class inspection_default, NETSEC-ASA(config-pmap-c)# show run policy-map. Prior to ASA version 8.3, NAT configuration from the CLI was the same as the older PIX firewalls. In Step 2a, the network object INSIDE-NET is used to translate the inside network addresses (192.168.10.0/24) to the global address of the outside ASA interface. 209.165.200.226 255.255.255.255 is directly connected, Beginning with ASA version 8.3, network objects are used to configure all forms of NAT. configure ASA features, such as DHCP and enhanced login security. The ASA in this lab uses ASDM version 7.15(1). _______________________________________________________________________________________ Set the date and time. The ASA 5505 Base license allows for the creation of up to three named VLAN interfaces. The Interface tab is displayed by default and the currently defined inside (VLAN 1, E0/1) and outside (VLAN 2, E0/0) interfaces are listed. However, you must disable communication between the third interface and one of the other interfaces using the no forward command. Note: Do not configure ASA settings at this time. Part 1: Configure Basic Device Settings Part 2: Access the ASA Console and ASDM Part 3: Configure Basic ASA Settings and Firewall Using the ASDM Startup Wizard Part 4: Configure ASA Settings from the ASDM Configuration Menu Part 5: Configure DMZ, Static NAT, and ACLs If either port is administratively down, bring it up with the no shutdown command. c. Use the show interface command to ensure that ASA Layer 2 ports E0/0 (for VLAN 2) and E0/1 (for VLAN 1) are both up. Verify connectivity between hosts, switches, and routers. The default administrative distance is one by default. Router R1 G0/0 and the ASA OUTSIDE interface are already using 209.165.200.225 and .226. Se e the Router Interface Summary Table at the end of this lab to determine which interface identifiers to use based on the equipment in your class. Note: ISR G2 devices have GigabitEthernet interfaces instead of FastEthernet Interfaces. You can no longer connect to the ASA using SSH with the default username and the login password. After completing this course you can: - Having an in-depth, theoretical understanding of. Click OK on the message to remove the port from the inside interface and add it to this new interface. Erase configuration in flash memory? successful? ASDM provides an intuitive, GUI-based tool for configuring the ASA from a PC. Add SSH access to the ASA from host 172.16.3.3 on the outside network. Attach the devices that are shown in the topology diagram and cable as necessary. You can also go directly to the CLI to configure the ASA settings, as described in Part 3. In this part, you will set up the network topology and configure basic settings on the routers, such as interface IP addresses and static routing. On the Startup Wizard Step 4 screen Switch Port Allocation, verify that port Ethernet0/1 is allocated for Inside VLAN 1 and that port Ethernet0/0 is allocated for Outside VLAN 2. Last configuration change at 14:04:35 UTC Sun Jan 24 2021, platform punt-keepalive disable-kernel-core. The Security Level should be automatically set to the highest level of 100. Security level 100 (INSIDE) is the most secure and level 0 (OUTSIDE) is the least secure. Depending on the router model and Cisco IOS version, the available commands and output produced might vary from what is shown in this lab. Tip: Most ASA show commands, as well as ping, copy, and others, can be issued from within any configuration mode prompt without the do command that is required with IOS. e. Enable the E0/1 interface using the no shutdown command and verify the E0/1 and VLAN 1 interface status. o Device Management. Respond with no. hits and addresses being translated for the HTTP connection. b. When prompted to pre-configure the firewall through interactive prompts (Setup mode), respond with no. b. Leave these fields blank as they have not yet been configured. Help to improve the ASA platform by enabling anonymous reporting, which allows Cisco to securely receive minimal error and health. Week 3 - Pre-Task How many times a week Ingles II (16481), Tarea de preguntas de investigacin Grupo 7, Semana 3 - (AC-S03) Week 03 - Task: Assignment - A job interview, Semana 03.Tema 1. NETSEC-ASA(config)# http 192.168.1.0 255.255.255.0 INSIDE. Step 1: Configure a static default route for the ASA. [Y]es, [N]o, [A]sk later: N. ####### In the future, if you would like to enable this feature. , Enable password [