ASA Agenda: Overview

Device Initialization
Routing Protocols
ACLs & Object Groups
MPF and Application Inspection
Quality of Service
NAT
Transparent firewall
Multiple Context mode
High Availability
System Management

ASA Overview
Stateful Firewall Filtering
- Supports Application Aware Inspection
VPN Termination
- Supports both IPsec and SSL VPNs
Intrusion Prevention System (IPS)
- IPS 5.x on Advanced Inspection and
Prevention(AIP)
Security Service Module (SSM)
Content Filtering (Virus,spy-ware, spam
etc)
- Content Security and control (CSC)
Security Service Module(SSM)

ASA Stateful firewall Filtering

Track traffic that moves from trusted network to the
untrusted network
- E.g Inside to Outside interface
Create an entry in the state table for the traffic flow
- E.g TCP port 80 HTTP session from Client A to server
B
Track traffic that tries to enter from the untrusted
network to the trusted network
- If an entry exits in the state table, permit it
E.g the return HTTP flow from sever B to Client A
If no entry exists in the state table , deny it
E.g NMAP port scan from the outside network

ASA Security Levels

ASA classifies the levels of "trust" of an interface
by its
security-levels
- Range of 0 - 100
100 is the most trusted interface
- Assigned to interface "inside" by default
0 is the most untrusted interface
- Assigned to all other interface by default

ASA Security Levels

Traffic from higher to lower security levels
- permit by default
- E.g Inside to Outside
Traffic from lower to higher security levels
- permit if state already exists
- Deny if no state by default
- E.g Outside to Inside
Traffic between interfaces of same security
- Deny by default
- Exception with same-security-traffic permit
{inter-interface | intra-interface}

ASA Context Mode

ASA supports two different context modes of
operation
- Single context mode
- Multiple context mode ( Virtual firewalls)
Single Context Mode
- Shared Configuration for all interfaces, security
policies, routing
table , administrations etc.
Multiple Context Mode
- Separate configuration, interfaces, policies per
virtual context
- Allows for multiple virtual firewall for managed
services or policy separation.

ASA Firewall Modes

ASA supports two different firewall modes of
operation
- Routed firewall
- Transparent firewall
Routed Firewall
- Interfaces are in different subnets and different
VLANS
- Traffic is routed between interfaces :means the
need for static or dynamic routing protocols
Transparent firewall
- Interfaces are in the same subnet but different
VLANS
- Traffic is bridged between interfaces

ASA Context Modes & Firewall

Modes
Context Modes and firewall Modes can run
in any combination
- Single Context Mode Routed Firewall
- Single Context Mode Transparent Firewall
- Multiple Context Mode Routed Firewall
- Multiple Context Mode Transparent Firewall

ASA VPN Termination

Supports both IPsec and SSL VPN Termination
- IPsec with AH, ESP , ESP over UDP and TCP
- SSL over TCP
Supports both LAN to LAN and Remote Access VPNs
- IPsec LAN to LAN
. AKA site to site
- IPsec Remote Access
. AKA Easy VPN Server / Client
- SSL Remote Access
. Clientless VPN (WebVPN)
. Anyconnect SSL VPN Client