PIX 6.X - Configuring Logical / VLAN interfaces

Scenario:
The inside/ethernet1 interface of the PIX will be mapped to two VLANs, VLAN1 with IP address 192.168.1.2/24 and VLAN2 with IP address 192.168.2.2. The outside interface has IP address 10.199.248.225/24

Topology:



[Thanks to former colleague Dan for the image.]


PIX 6 Configuration:

interface ethernet1 auto
nameif ethernet1 inside security100
address inside 192.168.1.2 255.255.255.0

interface ethernet1 vlan2 logical
nameif vlan2 inside2 security50
address vlan2 192.168.2.2 255.255.255.0

Notes:
Your Physical Interface is (by default), your VLAN1.


PIX 7 Configuration:

interface Ethernet1
nameif inside
security-level 100
ip address 192.168.1.2 255.255.255.0
no shut

interface Ethernet1.2
vlan 2
nameif inside2
security-level 50
ip address 192.168.2.2 255.255.255.0
no shut

VPN: Clearing IPSEC Tunnels

As per the IPSEC Checklist and Best Practices, whenever changes are going to be done to live IPSEC tunnels, it is a good practice to turn off the tunnels.

Cisco IOS Router:
clear crypto isakmp []
clear crypto sa entry

Cisco PIX 6.X / 7.X:
clear crypto isakmp sa
clear crypto ipsec sa

VPN Concentrator 3000:
Administration --> Administer Sessions --> Logout link of tunnel

PIX / ASA: %PIX|ASA-6-302014: Teardown TCP connection

%PIXASA-6-302014: Teardown TCP connection id for interface:real-address/real-port to interface:real-address/real-port duration hh:mm:ss bytes bytes [reason] [(user)]

Explanation: A TCP connection between two hosts was deleted. The following list describes the message values:

• connection id is an unique identifier.
• interface, real-address, real-port identify the actual sockets.
• duration is the lifetime of the connection.
• bytes bytes is the data transfer of the connection.
• user is the AAA name of the user.

The reason variable presents the action that causes the connection to terminate.

Conn-timeout
Connection ended because it was idle longer than the configured idle timeout.

Deny Termiate
Flow was terminated by application inspection.

Failover primary closed
The standby unit in a failover pair deleted a connection because of a message received from the active unit.

FIN Timeout
Force termination after 10 minutes awaiting the last ACK or after half-closed timeout.

Flow closed by inspection
Flow was terminated by inspection feature.

Flow terminated by IPS
Flow was terminated by IPS.

Flow reset by IPS
Flow was reset by IPS.

Flow terminated by TCP Intercept
Flow was terminated by TCP Intercept.

Invalid SYN
SYN packet not valid.

Idle Timeout
Connection timed out because it was idle longer than timeout value.

IPS fail-close
Flow was terminated due to IPS card down.

SYN Control
Back channel initiation from wrong side.

SYN Timeout
Force termination after 30 seconds awaiting three-way handshake completion.

TCP bad retransmission
Connection terminated because of bad TCP retransmission.

TCP FINs
Normal close down sequence.

TCP Invalid SYN
Invalid TCP SYN packet.

TCP Reset-I
Reset was from the inside.

TCP Reset-O
Reset was from the outside.

TCP segment partial overlap
Detected a partially overlapping segment.

TCP unexpected window size variation
Connection terminated due to variation in the TCP window size.

Tunnel has been torn down
Flow terminated because tunnel is down.

Unauth Deny
Denied by URL filter.

Unknown
Catch-all error.

Xlate Clear
Command-line removal

Other Notes:
The "inside" in TCP RESET-I refers to the more secure interface (i.e., interface with higher security level). Consequently, "outside" in TCP RESET-O refers to the less secure interface (i.e., interface with lower security level).

This is useful indetermining the source of the TCP session disconnection. That is, on which interface the disconnection was received from. Usually, it is actually the host on the interface itself that tears down the connection (could be due to failed authentication). Whatever the case, you have narrowed down the cause of the error.

The other reasons are pretty straightforward.

Reference:
PIX 7.2: SYSLOG 302014

PIX/ASA 7.X: Policy NAT

TOPOLOGY:
10.10.10.10 ---- YourASA ======= RemoteDevice ---- 20.20.20.20

SCENARIO:
- Host 10.10.10.10 is translated to 172.16.0.10 when going to host 20.20.20.20 (VPN traffic)
- Host 10.10.10.10 is translated through NAT/PAT normally elsewhere.

CONFIGURATION:

access-list NONAT permit ip host 172.16.0.10 host 20.20.20.20
access-list VPN10 permit ip host 172.16.0.10 host 20.20.20.20
access-list POLICY_NAT extended permit ip host 10.10.10.10 host 20.20.20.20

static (inside, outside) 172.16.0.10 acl POLICY_NAT
nat (inside) 0 access-list NONAT
nat (inside) 1 0 0
global (outside) 1 in interface
...
! DEFINE PHASE1 / ISAKMP PARAMETERS !
! DEFINE PHASE2 / IPSEC PARAMETERS !
...
crypto map OUTSIDE_MAP 10 match address VPN10
...
crypto map OUTSIDE_MAP interface outside
isakmp enable outside

---

NOTES:
In the above example, note that the source IP address of the VPN traffic is the translated IP address (172.16.0.10), not the inside/original source address.

The static statement is evaluated first before the crypto match statement. Hence, if the traffic matches acl "POLICY_NAT", the traffic is translated first, before it will be evaluated against the crypto map policy. (See NAT Order of Operation)

Due to the software requirements, this is available only to ASA and PIX capable of supporting 7.x and later.

---

REFERENCES:
PIX/ASA 7.X: Policy NAT:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808c9950.shtml
NAT Order of Operation:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080133ddd.shtml

PIX: Dynamic Site-to-Site IPSEC Configuration

SCENARIO:

Configure a tunnel between 10.2.2.0/24 to 10.1.1.0/24, between one static and one dynamic VPN peers.

This is a typical scenario when one device has a dynamic "outside" IP address (such as DHCP).

Notes:
The configuration can be expanded to include remote access VPN on either peer;
The configuration can be expanded to include more than one dynamic peer;
In case of multiple VPN devices, there should always be at least one static peer.

---

TOPOLOGY:

10.2.2.0 --- STATIC ==== (( INTERNET )) ===== DYNAMIC ---- 10.1.1.0

STATIC.inside = 10.2.2.1/24
STATIC.outside = 203.1.1.1/24
DYNAMIC.outside = DHCP
DYNAMIC.inside = 10.1.1.1/24

---

CONFIGURATIONS:
- several possible simple configurations, depending on the PIX OS running on either device.

PHASE 1 / ISAKMP PARAMETERS:
- authentication = pre-shared key (MY_ISAKMP_KEY)
- encryption = 3DES
- hash = MD5
- group = 2

PHASE 2 / IPSEC PARAMETERS:
- ESP-3DES, ESP-MD5

---

STATIC PIX 6.X:

access-list NONAT permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0

nat (inside) 0 access-list NONAT

sysopt connection permit-ipsec

isakmp identity address
isakmp nat-traversal

isakmp key MY_ISAKMP_KEY address 0.0.0.0 netmask 0.0.0.0 no-xauth

isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2

isakmp policy 10 lifetime 86400

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map DYN_MAP 1 set transform-set ESP-DES-MD5
crypto map MY_STATIC_MAP 20 ipsec-isakmp dynamic DYN_MAP

crypto map MY_STATIC_MAP interface outside
isakmp enable outside

---

STATIC PIX 7.0/7.1:

access-list NONAT extended permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0

nat (inside) 0 access-list NONAT

sysopt connection permit-ipsec

isakmp identity address
isakmp nat-traversal

isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 86400

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map DYN_MAP 1 set transform-set ESP-3DES-MD5
crypto map MY_STATIC_MAP 20 ipsec-isakmp dynamic DYN_MAP

tunnel-group MY_GROUP type ipsec-l2l
tunnel-group MY_GROUP general-attributes
tunnel-group MY_GROUP ipsec-attributes
pre-shared-key MY_ISAKMP_KEY

crypto map MY_STATIC_MAP interface outside
isakmp enable outside

---

STATIC PIX 7.2:

access-list NONAT extended permit ip 10.2.2.0 255.255.255.0 10.1.1.0 255.255.255.0

nat (inside) 0 access-list NONAT

sysopt connection permit-vpn

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map DYN_MAP 1 set transform-set ESP-3DES-MD5
crypto map MY_STATIC_MAP 20 ipsec-isakmp dynamic DYN_MAP

crypto isakmp nat-traversal
crypto isakmp identity address

crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400

tunnel-group MY_GROUP type ipsec-l2l
tunnel-group MY_GROUP general-attributes
tunnel-group MY_GROUP ipsec-attributes
pre-shared-key MY_ISAKMP_KEY

crypto map MY_STATIC_MAP interface outside
crypto isakmp enable outside

---

DYNAMIC PIX 6.X:

access-list NONAT permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
access-list VPN permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0

nat (inside) 0 access-list NONAT

sysopt connection permit-ipsec

isakmp identity hostname
isakmp nat-traversal

isakmp key MY_ISAKMP_KEY address 203.1.1.1 netmask 255.255.255.255

isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 1000

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map DYNAMIC_MAP 10 ipsec-isakmp
crypto map DYNAMIC_MAP 10 match address VPN
crypto map DYNAMIC_MAP 10 set peer 203.1.1.1
crypto map DYNAMIC_MAP 10 set transform-set ESP-3DES-MD5

crypto map DYNAMIC_MAP interface outside
isakmp enable outside

---

DYNAMIC PIX 7.0/7.1:

access-list NONAT permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
access-list VPN permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0

nat (inside) 0 access-list NONAT

sysopt connection permit-ipsec

isakmp identity hostname
isakmp nat-traversal

isakmp key MY_ISAKMP_KEY address 203.1.1.1 netmask 255.255.255.255

isakmp policy 10 authentication pre-share
isakmp policy 10 encryption 3des
isakmp policy 10 hash md5
isakmp policy 10 group 2
isakmp policy 10 lifetime 1000

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map DYN_MAP 1 set transform-set ESP-3DES-MD5
crypto map DYNAMIC_MAP 10 ipsec-isakmp dynamic DYN_MAP
crypto map DYNAMIC_MAP 10 match address VPN
crypto map DYNAMIC_MAP 10 set peer 203.1.1.1


tunnel-group MY_GROUP type ipsec-l2l
tunnel-group MY_GROUP general-attributes
tunnel-group MY_GROUP ipsec-attributes
pre-shared-key MY_ISAKMP_KEY

crypto map DYNAMIC_MAP interface outside
isakmp enable outside

---

DYNAMIC PIX 7.2:

access-list NONAT permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0
access-list VPN permit ip 10.1.1.0 255.255.255.0 10.2.2.0 255.255.255.0

nat (inside) 0 access-list NONAT

sysopt connection permit-ipsec

crypto isakmp identity hostname
crypto isakmp nat-traversal

crypto isakmp policy 10
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto dynamic-map DYN_MAP 1 set transform-set ESP-3DES-MD5
crypto map DYNAMIC_MAP 10 ipsec-isakmp dynamic DYN_MAP
crypto map DYNAMIC_MAP 10 match address VPN
crypto map DYNAMIC_MAP 10 set peer 203.1.1.1

tunnel-group MY_GROUP type ipsec-l2l
tunnel-group MY_GROUP general-attributes
tunnel-group MY_GROUP ipsec-attributes
pre-shared-key MY_ISAKMP_KEY

crypto map DYNAMIC_MAP interface outside
isakmp enable outside

---

REFERENCE

PIX 6: http://www.cisco.com/en/US/products/sw/secursw/ps2308/products_configuration_example09186a0080094680.shtml
PIX 7: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805733df.shtml

PIX 7.0: Simple Remote Access VPN

TOPOLOGY:

192.168.201.0 ---- PIX --- (( INTERNET )) ---- home_user

VPN Client Pool = 172.16.1.1 to 172.16.1.254

---

PIX 7.0/7.1 CONFIGURATION:

access-list SPLIT permit ip 192.168.201.0 255.255.255.0 172.16.1.0 255.255.255.0
access-list NONAT permit ip 192.168.201.0 255.255.255.0 172.16.1.0 255.255.255.0

nat (inside) 0 access-list NONAT

sysopt connection permit-ipsec

isakmp identity address
isakmp nat-traversal

isakmp policy 200 authentication pre-share
isakmp policy 200 encryption des
isakmp policy 200 hash sha
isakmp policy 200 group 2
isakmp policy 200 lifetime 86400

crypto ipsec transform-set MYSET esp-des esp-md5-hmac
crypto dynamic-map CISCO 1 set transform-set MYSET
crypto map MYMAP 65535 ipsec-isakm dynamic CISCO

ip local pool CLIENTPOOL 172.16.1.1-172.16.1.254

tunnel-group REMOTEACCESS type ipsec-ra
tunnel-group REMOTEACCESS general-attributes
address-pool CLIENTPOOL
tunnel-group REMOTEACCESS ipsec-attributes
pre-shared-key CISCO123

group-policy REMOTEACCESS internal
group-policy REMOTEACCESS attributes
wins-server value 10.1.1.3
dns-server value 10.1.1.3
vpn-idle-timeout 30

crypto map MYMAP interface outside
isakmp enable outside

---

PIX 7.2 CONFIGURATION:

access-list SPLIT permit ip 192.168.201.0 255.255.255.0 172.16.1.0 255.255.255.0
access-list NONAT permit ip 192.168.201.0 255.255.255.0 172.16.1.0 255.255.255.0

nat (inside) 0 access-list NONAT

sysopt connection permit-vpn

crypto isakmp identity address
crypto isakmp nat-traversal

crypto isakmp policy 200
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400

crypto ipsec transform-set MYSET esp-des esp-md5-hmac
crypto dynamic-map CISCO 1 set transform-set MYSET
crypto map MYMAP 65535 ipsec-isakm dynamic CISCO

ip local pool CLIENTPOOL 172.16.1.1-172.16.1.254

tunnel-group REMOTEACCESS type ipsec-ra
tunnel-group REMOTEACCESS general-attributes
address-pool CLIENTPOOL
tunnel-group REMOTEACCESS ipsec-attributes
pre-shared-key CISCO123

group-policy REMOTEACCESS internal
group-policy REMOTEACCESS attributes
wins-server value 10.1.1.3
dns-server value 10.1.1.3

crypto map MYMAP interface outside
isakmp enable outside

PIX/ASA 7.X: Simple PIX-to-PIX VPN Tunnel

Secnario:
Typical site-to-site / LAN-to-LAN VPN tunnel between the respective inside networks of two PIX 7.X devices.

Topology:

10.10.1.0 ---- ThisPIX ========= OtherPix ---- 10.10.2.0

ThisPix.inside = 10.10.1.1
ThisPix.outside = 192.168.10.2

OtherPix.inside = 10.10.2.0
OtherPix.outside = 192.168.10.1

VPN Tunnel between 10.10.1.0/24 and 10.10.2.0/24

Configuration:
[The following only includes the configuration for the "ThisPix" device. The configuration of the "OtherPix" should be the "mirror-image" of that of "ThisPix" (that is, source address becomes destination address, and vice versa, while others, such as the PHASE1 properties are the same).]

[Also, note that several syntax changes have been made from one version to another. It is best to consult the "Command Reference Guide" for the PIX/ASA version running and/or use the "?" command from the command prompt.

PIX 7.0:

access-list NONAT extended permit ip 10.10.1.0 255.255.255.0 10.10.2.0 255.255.255.0
access-list VPN20 extended permit ip 10.10.1.0 255.255.255.0 10.10.2.0 255.255.255.0

nat (inside) 0 access-list NONAT
sysopt connection permit-ipsec

crypto ipsec transform-set MY-ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto map OUTSIDE_MAP 20 match address VPN20
crypto map OUTSIDE_MAP 20 set peer 192.168.10.1
crypto map OUTSIDE_MAP 20 set transform-set MY-ESP-AES-256-SHA

isakmp nat-traversal
isakmp identity address
isakmp policy 10 authentication pre-share
isakmp policy 10 encryption aes-256
isakmp policy 10 hash sha
isakmp policy 10 group 5
isakmp policy 10 lifetime 86400

tunnel-group 192.168.10.1 type ipsec-l2l
tunnel-group 192.168.10.1 ipsec-attributes pre-shared-key CISCO

crypto map OUTSIDE_MAP interface outside
isakmp enable outside

PIX 7.2:
access-list NONAT extended permit ip 10.10.1.0 255.255.255.0 10.10.2.0 255.255.255.0
access-list VPN20 extended permit ip 10.10.1.0 255.255.255.0 10.10.2.0 255.255.255.0

nat (inside) 0 access-list NONAT
sysopt connection permit-vpn

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto map OUTSIDE_MAP 20 match address VPN20
crypto map OUTSIDE_MAP 20 set peer 192.168.10.1
crypto map OUTSIDE_MAP 20 set transform-set ESP-AES-256-SHA

isakmp nat-traversal
isakmp identity address

isakmp policy 10
 authentication pre-share
 encryption aes-256
 hash sha group 5 lifetime 86400

tunnel-group 192.168.10.1 type ipsec-l2l
tunnel-group 192.168.10.1 ipsec-attributes
 pre-shared-key CISCO

crypto map OUTSIDE_MAP interface outside
isakmp enable outside

Reference:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00805a87f7.shtml

PIX/ASA: Permit Pass-through IPSEC traffic

This is a scenario in which the PIX with NAT is not the VPN/IPSEC peer; it just serves as a pass-through VPN device.

Topology:


PIX 6.X Configuration:
ip address outside 10.99.99.1 255.255.255.0
ip address inside 10.1.1.1 255.255.255.0

global (outside) 1 interface
nat (inside) 0 0.0.0.0 0.0.0.0
static (inside,outside) 10.99.99.12 10.1.1.2 netmask 255.255.255.255 0 0

access-list acl-out permit esp host 10.99.99.2 host 10.99.99.12
access-list acl-out permit udp host 10.99.99.2 host 10.99.99.12 eq isakmp
access-list acl-out permit udp host 10.99.99.2 host 10.99.99.12 eq 4500

access-group acl-out in interface outside
isakmp enable outside
isakmp enable inside
isakmp nat-traversal


PIX 7.X and up Configuration:
interface Ethernet0
nameif outside
security-level 0
ip address 10.99.99.1 255.255.255.0
!
interface Ethernet1
nameif inside
security-level 100
ip address 10.1.1.1 255.255.255.0
!

global (outside) 1 interface
nat (inside) 0 0.0.0.0 0.0.0.0
static (inside,outside) 10.99.99.12 10.1.1.2 netmask 255.255.255.255 0 0

access-list acl-out permit esp host 10.99.99.2 host 10.99.99.12
access-list acl-out permit udp host 10.99.99.2 host 10.99.99.12 eq isakmp
access-list acl-out permit udp host 10.99.99.2 host 10.99.99.12 eq 4500

access-group acl-out in interface outside

Notes:
Configuration is very straighforward. Permit the traffic through an access-list, like how you would when permitting any other traffic. For IPSEC, permit ESP, ISAKMP, and UDP4500.

References:
PIX6: http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a008009486e.shtml
PIX 7:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008045a2d2.shtml

PIX 7.X: SSH/Telnet on the Inside and Outside Interface

To manage it remotely, you need to configure PIX 7.X to permit incoming SSH and/or Telnet connections to it. Note that since Telnet sends all information including passwords in clear text, SSH is preferred the method.



Configuration Tasks:
1. Specify credentials:
  passwd mypassword
  -- or --
  username myusername password mypassword
  aaa authentication ssh local

2. [SSH only] Generate RSA key pair:
  crypto key zeroize rsa
  crypto key generate rsa modulus 1024

Note: The "zeroize" command is there just in case a previous RSA key has already been generated previously. You can set the modulus to any other value aside from 1024. The larger the modulus, the more secure the RSA key.

3. Specify the hosts allowed to connect to the PIX:

  ssh 0 0 inside
  ssh 10.199.248.0 255.255.255.0 outside
  -- or --
  telnet 0 0 inside
  telnet 10.199.248.0 255.255.255.0 outside

Note: Syntax parameters for either case is: source_ip_address subnet_mask source_interface. The 0 0 above indicates "any".

4. [Optional] Specify the telnet/ssh session timeout:
  ssh timeout 10
  -- or --
  telnet timeout 10

Reference:
For further reading, I suggest the following URL:
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008069bf1b.shtml

Basic PIX Configuration

This should be your most basic configuration if you want your PIX to have internet access, assuming there are no other blocking/filtering device that exists between the PIX and the internet:

Topology:
PIX inside: 192.168.102.254 /24
PIX outside: 10.199.248.50 /24
ISP/default gateway: 10.199.248.254 /24



PIX 6.X Configuration:
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
ip address outside 10.199.248.50 255.255.255.0
ip address inside 192.168.102.254 255.255.255.0
global (outside) 1 interface
nat (inside) 1 0 0
route outside 0 0 10.199.248.3 1


PIX 7.X Configuration
interface Ethernet0
 no shutdown
 nameif outside
 ip address 10.199.248.50 255.255.255.0
interface Ethernet1
 no shutdown
 nameif inside
 ip address 192.168.102.254 255.255.255.0
global (outside) 1 interface
nat (inside) 1 0 0
route outside 0 0 10.199.248.3

Notes:
Slight difference when dealing with different PIX OS, but principle is the same. First, configure the interfaces. Next, configure translation (shown here is the simplest NAT). Lastly, configure default route.