This document contains a lab workbook for configuring a Cisco ASA firewall. It includes instructions and configuration examples for setting up security policies, interfaces, routing, object groups, access control lists and verifying connectivity using ping and telnet tests between interfaces representing the inside, outside and DMZ zones. The goal is to allow only certain necessary traffic flows while blocking all others based on source, destination, application and interface.

1. ©2016 RHC Technologies
R H C
TECHNOLOGIES
#LIKE #FOLLOW #WATCH
Cisco ASA Firewall
LAB WORKBOOK
Prepared By
Sai Linn Thu

2. ©2016 RHC Technologies
R H C
TECHNOLOGIES
#LIKE #FOLLOW #WATCH
Security Policy
( Allow / Deny )

3. ©2016 RHC Technologies
R H C
TECHNOLOGIES
#LIKE #FOLLOW #WATCH
Security Policy
( Allow / Deny )
Employee
E-­‐mail
Finance
(
$
)
Internet
Employee
Deny
Permit
Deny
Permit
Execu9ve
Deny
Deny
Permit
Permit
BYOD
Deny
Permit
Deny
Permit
Guest
Permit
Deny
Deny
Permit
Source
Destination

4. ©2016 RHC Technologies
R H C
TECHNOLOGIES
#LIKE #FOLLOW #WATCH
{lowest 0} > Security Level < {highest 100}
Internet
outside ( 0 )
inside ( 100 )
dmz ( 50 )

5. ©2016 RHC Technologies
R H C
TECHNOLOGIES
#LIKE #FOLLOW #WATCH
{lowest 0} > Security Level < {highest 100}
Internet
outside ( 0 )
inside ( 100 )
dmz zone 1 ( 50 )
dmz zone 2 ( 60 )
dmz zone 3 ( 70 )

6. ©2016 RHC Technologies
R H C
TECHNOLOGIES
#LIKE #FOLLOW #WATCH
Incoming traffic / Outgoing traffic
Internet
outside ( 0 )
inside ( 100 )
dmz ( 50 )
Incoming traffic
( Low – to – High )
Outgoing traffic
( High – to – Low )
(Block, Explicitly Allow)
(Allow, but Inspected)

7. ©2016 RHC Technologies
R H C
TECHNOLOGIES
#LIKE #FOLLOW #WATCH
Internet
outside ( 0 )
inside ( 100 )
dmz ( 50 )
150.1.1.0/24
10.1.1.0/24
192.168.1.0/24
Facebook : 173.252.74.68/32
Youtube : 172.217.25.174/32
192.168.5.5/24
10.10.10.10/24
ASA
int g0
nameif inside
security-level 100
ip add 10.1.1.100 255.255.255.0
int g1
nameif outside
security-level 0
ip add 150.1.1.100 255.255.255.0
!
int g2
nameif dmz
security-level 50
ip add 192.168.1.100 255.255.255.0
!
#show int ip brief
LAB

8. ©2016 RHC Technologies
Verify ping test on ASA !
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
ASA
ASA#ping 173.252.74.68
ASA#ping 10.10.10.10
ASA#ping 192.168.5.5
SUCCESS [or] FAIL ?

9. ©2016 RHC Technologies
R H C
TECHNOLOGIES
#LIKE #FOLLOW #WATCH
Internet
outside ( 0 )
inside ( 100 )
dmz ( 50 )
150.1.1.0/24
10.1.1.0/24
192.168.1.0/24
Facebook : 173.252.74.68/32
Youtube : 172.217.25.174/32
192.168.5.5/24
10.10.10.10/24
ASA
route outside 0 0 150.1.1.1
route inside 10.10.10.0 255.255.255.0 10.1.1.1
route dmz 192.168.5.0 255.255.255.0 192.168.1.1
#show route

10. ©2016 RHC Technologies
Verify ping test on ASA !
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
ASA
ASA#ping 173.252.74.68
ASA#ping 10.10.10.10
ASA#ping 192.168.5.5
SUCCESS [or] FAIL ?

11. ©2016 RHC Technologies
Configure default routes from LAN , DMZ and INTERNET !
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
LAN#ip route 0.0.0.0 0.0.0.0 10.1.1.100
DMZ#ip route 0.0.0.0 0.0.0.0 192.168.1.100
INTERNET#ip route 0.0.0.0 0.0.0.0 150.1.1.100

12. ©2016 RHC Technologies
Verify ping test from LAN to INTERNET !
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
LAN
LAN#ping 173.252.74.68
LAN#ping 173.252.74.68 source lo0
SUCCESS [or] FAIL ?
Outbound traffic : Low > High is OK ( inspected )
Inbound traffic : High > Low is DROP ( require ACL )

13. ©2016 RHC Technologies
Configure vty password & enable password on LAN , DMZ and INTERNET !
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
LAN
line vty 0 4
password testlan
!
enable password testlan
!
DMZ
line vty 0 4
password testdmz
!
enable password testdmz
!
INTERNET
line vty 0 4
password testout
!
enable password testout
!

14. ©2016 RHC Technologies
Verify telnet test from LAN < > INTERNET // LAN < > DMZ // DMZ < > INTERNET
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
LAN
LAN#telnet 173.252.74.68
LAN#telnet 173.252.74.68 /source-interface lo0
Please also test LAN < > DMZ // DMZ < > INTERNET.
SUCCESS [or] FAIL ?
INTERNET
INTERNET#telnet 10.10.10.10
INTERNET#telnet 10.10.10.10 /source-interface lo0

15. ©2016 RHC Technologies
Configure ACL to allow telnet traffic from INTERNET to LAN!
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
ASA
access-list INTERNET_LAN permit tcp any any eq telnet
!
access-group INTERNET_LAN in interface outside
!
INTERNET
INTERNET#telnet 10.10.10.10
INTERNET#telnet 10.10.10.10 /source-interface lo0
INTERNET#telnet 10.10.10.10 /source-interface lo1
Verify telnet test from INTERNET to LAN
SUCCESS [or] FAIL ?

16. ©2016 RHC Technologies
Configure ACL to allow telnet traffic from DMZ to LAN!
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
ASA
access-list DMZ_LAN permit tcp any any eq telnet
!
access-group DMZ_LAN in interface dmz
!
DMZ
DMZ#telnet 10.10.10.10
DMZ#telnet 10.10.10.10 /source-interface lo0
Verify telnet test from DMZ to LAN
SUCCESS [or] FAIL ?

17. ©2016 RHC Technologies
Verify telnet test from INTERNET to DMZ !
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
INTERNET
INTERNET#telnet 192.168.5.5
INTERNET#telnet 192.168.5.5 /source-interface lo0
INTERNET#telnet 192.168.5.5 /source-interface lo1
Why SUCCESS ?
Because of the below config we configured in the previous step.
ASA
access-list INTERNET_LAN permit tcp any any eq telnet
!
access-group INTERNET_LAN in interface outside
!

18. ©2016 RHC Technologies
Delete the below config
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
ASA
NO access-list INTERNET_LAN permit tcp any any eq telnet
!
NO access-group INTERNET_LAN in interface outside
!
After deleting the config,
We cannot be able to TELNET from INTERNET to LAN, and also from INTERNET to DMZ.
But we still can be able to telnet from DMZ to LAN.

19. ©2016 RHC Technologies
Configure the policy as below :
1) ONLY Allow TELNET from 173.252.74.68 to LAN.
2) ONLY Allow TELNET from 172.217.25.174 to DMZ.
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
ASA
access-list INTERNET_LAN permit tcp host 173.252.74.68 10.10.10.0 255.255.255.0 eq telnet
!
access-list INTERNET_LAN permit tcp host 172.217.25.174 192.168.5.0 255.255.255.0 eq telnet
!
access-group INTERNET_LAN in interface outside
!

20. ©2016 RHC Technologies #LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
Verify telnet test from INTERNET to LAN !
INTERNET
INTERNET#telnet 10.10.10.10 > {success/fail}
INTERNET#telnet 10.10.10.10 /source-interface lo0 > {success/fail}
INTERNET#telnet 10.10.10.10 /source-interface lo1 > {success/fail}
Verify telnet test from INTERNET to DMZ !
INTERNET
INTERNET#telnet 192.168.5.5 > {success/fail}
INTERNET#telnet 192.168.5.5 /source-interface lo0 > {success/fail}
INTERNET#telnet 192.168.5.5 /source-interface lo1 > {success/fail}

21. ©2016 RHC Technologies
Configure the policy as below :
1) Allow ping ( ICMP ) from LAN to DMZ.
2) Allow ping ( ICMP ) from LAN to INTERNET.
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
ASA
access-list INTERNET_LAN permit icmp any any echo-reply
!
access-list DMZ_LAN permit icmp any any echo-reply
!
access-group INTERNET_LAN in interface outside
!
access-group DMZ_LAN in interface dmz

22. ©2016 RHC Technologies
Verify ping test from LAN to INTERNET & DMZ !
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
LAN
LAN#ping 173.252.74.68 source lo0
LAN#ping 192.168.5.5 source lo0
SUCCESS [or] FAIL ?
Outbound traffic : Low > High is OK ( inspected )
Inbound traffic : High > Low is OK ( required ACL is configured )

23. ©2016 RHC Technologies
Configure the policy as below :
1) Allow ping ( ICMP ) from INTERNET to LAN.
2) Allow ping ( ICMP ) from DMZ to LAN.
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
ASA
access-list INTERNET_LAN permit icmp any any echo
access-list INTERNET_LAN permit icmp any any echo-reply
!
access-group INTERNET_LAN in interface outside
!
access-list DMZ_LAN permit icmp any any echo
access-list DMZ_LAN permit icmp any any echo-reply
!
access-group DMZ_LAN in interface dmz

24. ©2016 RHC Technologies
Verify ping test from INTERNET to LAN & DMZ to LAN!
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
ping test
INTERNET#ping 10.10.10.10 source lo0
INTERNET#ping 10.10.10.10 source lo1
INTERNET#ping 192.168.5.5 source lo0
INTERNET#ping 192.168.5.5 source lo1
DMZ#ping 10.10.10.10 source lo0
DMZ#ping 10.10.10.10 source lo1
SUCCESS {or} FAIL ?

25. ©2016 RHC Technologies
R H C
TECHNOLOGIES
#LIKE #FOLLOW #WATCH
Internet
outside ( 0 )
inside ( 100 )
dmz ( 50 )
150.1.1.0/24
10.1.1.0/24
192.168.1.0/24
Facebook : 173.252.74.68/32
Youtube : 172.217.25.174/32
Google DNS : 8.8.8.8/32 , 8.8.4.4/32
192.168.5.5/24
10.10.10.10/24
ASA
int g0
nameif inside
security-level 100
ip add 10.1.1.100 255.255.255.0
int g1
nameif outside
security-level 0
ip add 150.1.1.100 255.255.255.0
!
int g2
nameif dmz
security-level 50
ip add 192.168.1.100 255.255.255.0
!
#show int ip brief
LAB

26. ©2016 RHC Technologies
R H C
TECHNOLOGIES
#LIKE #FOLLOW #WATCH
Internet
outside ( 0 )
inside ( 100 )
dmz ( 50 )
150.1.1.0/24
10.1.1.0/24
192.168.1.0/24
Facebook : 173.252.74.68/32
Youtube : 172.217.25.174/32
Google DNS : 8.8.8.8/32 , 8.8.4.4/32
192.168.5.5/24
10.10.10.10/24
ASA
route outside 0 0 150.1.1.1
route inside 10.10.10.0 255.255.255.0 10.1.1.1
route inside 11.11.11.0 255.255.255.0 10.1.1.1
route inside 12.12.12.0 255.255.255.0 10.1.1.1
route dmz 192.168.5.0 255.255.255.0 192.168.1.1
#show route

27. ©2016 RHC Technologies
Configure the policy using object-group as below :
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
ASA
object-group network GoogleDNS
network-object host 8.8.8.8
network-object host 8.8.4.4
!
object-group network LAN
network-object 10.10.10.0 255.255.255.0
network-object 11.11.11.0 255.255.255.0
network-object 12.12.12.0 255.255.255.0
!
object-group service PING
service-object icmp echo
service-object icmp echo-reply
!
access-list INTERNET_LAN permit object-group PING object-group GoogleDNS object-group LAN
!
access-group INTERNET_LAN in interface outside

28. ©2016 RHC Technologies
Verify ping test from INTERNET to LAN!
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
ping test
INTERNET#ping 10.10.10.10 source lo0
INTERNET#ping 10.10.10.10 source lo1
INTERNET#ping 10.10.10.10 source lo2
INTERNET#ping 10.10.10.10 source lo3
INTERNET#ping 11.11.11.11 source lo0
INTERNET#ping 11.11.11.11 source lo1
INTERNET#ping 11.11.11.11 source lo2
INTERNET#ping 11.11.11.11 source lo3
INTERNET#ping 12.12.12.12 source lo0
INTERNET#ping 12.12.12.12 source lo1
INTERNET#ping 12.12.12.12 source lo2
INTERNET#ping 12.12.12.12 source lo3

29. ©2016 RHC Technologies
R H C
TECHNOLOGIES
#LIKE #FOLLOW #WATCH
Internet
outside ( 0 )
inside ( 100 )
dmz ( 50 )
150.1.1.0/24
10.1.1.0/24
192.168.1.0/24
Facebook : 173.252.74.68/32
Youtube : 172.217.25.174/32
Google DNS : 8.8.8.8/32 , 8.8.4.4/32
192.168.5.5/24
150.1.1.5/32
10.10.10.10/24
ASA
Object network DMZ-Private
host 192.168.5.5
!
Object network DMZ-Public
host 150.1.1.5
!
nat(dmz,outside) source static DMZ-Private DMZ-Public
!
Access-list INTERNET_LAN permit tcp any any eq telnet
LAB
DMZ
line vty 0 4
password testdmz
!
enable password testdmz
!

30. ©2016 RHC Technologies
Verify telnet from INTERNET to DMZ Public IP!
#LIKE #FOLLOW #WATCH
R H C
TECHNOLOGIES
ping test
INTERNET#telnet 150.1.1.5 /source-interface lo0
INTERNET#telnet 150.1.1.5 /source-interface lo1
INTERNET#telnet 150.1.1.5 /source-interface lo2
INTERNET#telnet 150.1.1.5 /source-interface lo3

31. © www.rhctechnologies.com
R H C
TECHNOLOGIES
RHC Technologies
#LIKE #FOLLOW #WATCH