If user has two ISPs terminating on the ASA, the ASA is configured for ISP redundancy. So in some cases users would like to use both ISP to send the traffic outside. In such scenarios the best solution would be to use the Router. Using route-map on the router, one can confgure routing in such [...]

The pre-shared on the Cisco ASA are encrypted to view them in plain text you need to use the command more system:running-config | beg tunnel-group  

The traffic we want to be inspected is defined with the use of an access-list. In this example output, the access-list permits all IP traffic from any source to any destination. Therefore, to-be-inspected traffic can be anything that passes through the ASA. ciscoasa(config)#access-list traffic_for_ips permit ip any any ciscoasa(config)#class-map ips_class_map ciscoasa(config-cmap)#match access-list traffic_for_ips ciscoasa(config)#policy-map global_policy [...]

DCD (Dead Connection Detection)  detects a dead connection and allows it to expire, without expiring connections that can still handle traffic. You can configure DCD when you want idle, but valid connections to persist. After a TCP connection times out, the ASA sends Dead Connection Detection probes to the end hosts to find out the [...]

Yes it is possible to setup Dead Peer Detection (DPD) on the Cisco VPN client (Cisco software client for connecting to remote VPN gateway). Cisco VPN Client sends its R-U-THERE message to a peer if it has sent traffic to the peer, but hasn’t received response back within ten seconds. This basically means that R-U-THERE [...]

Hair-pinning also called as ‘U-turn ‘.The ASA includes a feature that lets a VPN client send IPSec-protected traffic to another VPN user by allowing such traffic in and out of the same interface using the command ‘same-security-traffic permit intra-interface’ In another application, this feature can redirect incoming VPN traffic back out through the same interface [...]

Unicast Reverse Path Forwarding (uRPF) can be used to help limit malicious traffic on a network. This feature works by enabling a firewall to verify the reachability of the source address in packets being forwarded. This capability can limit the appearance of spoofed addresses on a network. If the source IP address is not valid, [...]

The ASA does the nat in following order 1. NAT exemption (nat 0 access-list)—In order, till the first match. Identity NAT is not included in this category; it is included in the regular static NAT or regular NAT category. 2. Static NAT and Static PAT (regular and policy) (static)—In order, till the first match. Static [...]

The ASA supports a feature that lets a VPN client send IPsec-protected traffic to another VPN user by allowing such traffic in and out of the same interface is called “hairpinning”, this feature can be thought of as VPN spokes (clients) connecting through a VPN hub (Cisco ASA firewall). In another application, this feature can [...]

Unicast Reverse Path Forwarding (Unicast RPF) to help in limit the malicious traffic on an enterprise network. This security feature will work by enabling a router to verify the reachability of the source address in packets being forwarded.This capability can limit the appearance of spoofed addresses on a network. If the source IP address is [...]

Firewall Services Module (FWSM) is a integrated firewall module for Cisco Catalyst 6500 switches and Cisco 7600 Series routers.Up to four FWSMs can be installed in a single chassis, providing scalability to 20 Gbps per chassis. Based on Cisco PIX Firewall technology. Right now FWSM is end of sale & end of life.

We know that the Cisco ASA drops the packets that exceed the MSS value advertised by the client. We can bypass this behaviors by MPF (Modular Policy Framework) ================================================= Cisco-ASA(config)#access-list select_traffic permit tcp any host 192.168.9.2 Cisco-ASA#configure terminal Cisco-ASA(config)#class-map cm_allow_mss Cisco-ASA(config-cmap)#match access-list select_traffic Cisco-ASA(config-cmap)#exit Cisco-ASA(config)#tcp-map mss-map Cisco-ASA(config-tcp-map)#exceed-mss allow Cisco-ASA(config-tcp-map)#exit Cisco-ASA(config)#policy-map pm_allow_mss Cisco-ASA(config-pmap)#class cm_allow_mss Cisco-ASA(config-pmap-c)#set connection [...]

Modular Policy Framework (MPF) configuration defines set of rules for applying firewall features, such as you can use Modular Policy Framework to create a timeout configuration that is specific to a particular TCP application, as opposed to one that applies to all TCP applications Modular Policy Framework features: *QoS input policing *TCP normalization, TCP and [...]

In Asymmetric routing, a packet traverses from a source to a destination in one path and takes a different path when it returns to the source. In Cisco ASA/Pix firewalls, state information is built when the packets flow from a higher security domain to a lower security domain. The firewall will be an exit point [...]

NAT traversal (NAT-T) is a feature that allows IPsec traffic to “traverse” through NAT or PAT points without the incompatibilities that would normally arise. NAT (or PAT) works by translating a local address or addresses to a public address or several public addresses. In the case of PAT, several local addresses are translated to one [...]

In Cisco ASA by running ‘sh connection count’ we can check the number of open connections. By default value for half open connection is 100000 . ciscoasa# show conn count 1931 in use, 3139 most used We can configure the ASA to lower that value by creating class map to select the traffic class-map SYN_Flood_Attack [...]