Tag Archives | Cisco

I have been playing with an ASA 5505 lately. I wanted the ability to start fresh when I could not figure things out. I came up with the following commands to cut and paste into the console, allowing me to “Start over”.

First I reset to factory default and set the internal subnet range

configure factory-default 192.168.123.1 255.255.255.0

You have to hit the space bar a couple of times, then paste in the next sections:

boot system disk0:/asa911-k8.bin
interface Vlan2
 ip address 123.123.123.123 255.255.255.0
route outside 0.0.0.0 0.0.0.0 38.117.203.126
dhcpd dns 8.8.8.8
dhcpd address 192.168.123.5-192.168.123.132 inside
dhcpd enable inside

ssh scopy enable
ssh 192.168.123.0 255.255.255.0 inside
ssh timeout 60
ssh version 2
console timeout 0
username myusername password 3ncrypt3dp4$$w0rd encrypted privilege 15
no call-home reporting anonymous

!-- Optional - allow pings outbound
policy-map global_policy
  class inspection_default
   inspect icmp
   exit
   exit
!

This code above sets the external IP, enabled DHCP internally, enables ssh and scope, creates a user, and allows pings through.

I hope this might help someone.

This was a proof of concept that I worked on with @xrobx99. Thanks @xrobx99 for your help.

We were interested in how our users could access SharePoint behind our firewall on their mobile devices. We currently have an Cisco ASA in front of our organization. Idea is this: user receives an email notification from SharePoint that they need to approve a workflow. Email comes with a link and user clicks it on their Apple iOS device. That click would start an on demand VPN session to our ASA and the user be able to reach the SharePoint. This is how we got it all working.

First, you need to setup certificate authentication for your asa. If you don’t already have a PKI, then you can run a certificate server on your ASA. Looking at this blog post it is not that difficult to setup a local CA. That post describes how to do it via command line, to enable a CA vi asdm go to: Configuration > Remote Access VPN > Certificate Management > Local Certificate Authority

Clicking the enable box generates the following code:

  crypto ca server
      smtp from-address [email protected]
      no shutdown passphrase secret

Next add a user:

After adding a user, grab the One Time Password (OTP) and log into the enrollment site: http://site.name.com/+CSCOCA+/enroll.html. This will download a *.p12 file which I double clicked and added to my keychain (mac user). We will

Add a new tunnel-group

Next step was to set a a group-url for a new tunnel-group. We did this because we wanted the ability to log in with both passwords and certificates. This is what our tunnel groups looked like:

tunnel-group default webvpn-attributes
 group-url https://server.company.com enable
tunnel-group certificate webvpn-attributes
 authentication certificate
 group-url https://mobile.company.com enable

Add Certificate to iPhone Confiuration App

Fire up the iPhone confiruation utility and create a new Configuration Profile. Scroll down to “Credentials” section and add the *.p12 file with the OTP.

Next go to the VPN section to add the address of the ASA and check the on demand box for the the site.

Share the new configuration profile and apply it to your phone.

Now when you try to access a url that matches the on demand urls in the vpn section of the iPhone profile, the AnyConnect client will connect to the url that  allows certificate authentication. The certificate that you included in the profile will authenticate you, and you are in!

This was fun to put together!

The credit for this article goes to @xrobx99. I wanted to blog about his discovery so that others might find the solution quicker.

We have an Cisco ASA that we had to reboot every month because the memory would keep growing. We thought it was a memory leak (and it may have been in previous revisions), so we just lived with the fact that we had to keep rebooting the ASA to clean up the leak. @xrobx99 found that by default the ASA caches html when using webvpn. Well that explains that! A growing cache could easily be misinterpreted as a memory leak (see CSCtb68311)!

webvpn cache disable

Our memory use has not grown since making the change!

I have to say, it is difficult to learn Cisco products.  I have been hacking away at my new Cisco ASA 5505, and it is not easy. One of the toughest things is that the ASDM displays the configuration one way, but when you look at the config, it is completely different. For example, ASDM shows Connection Profiles, but the actual code uses tunnel-group. Not even close. The documentation has one line out of 46 pages.

You configure connection profiles using tunnel-group commands. In this chapter, the terms “connection profile” and “tunnel group” are often used interchangeably.

Took me quite a while to figure that out. I guess that is why people go to training (and the 5505 is not a consumer product).

My wife (Team Murphy’s CFO) allowed me to purchase a Cisco ASA 5505 for home. We use ASAs at work, and I am interested in how we can leverage these devices to their fullest. I am new to Cisco and to their IOS (the original IOS). I was impressed, the 5505 was easy to setup, I just swapped out my existing DDWRT and it worked out of the box. The 5505 had DHCP running on the internal interface, and NAT configured correctly.

Next I wanted to change the default network to use a different range. That proved more difficult when trying to do it over a network connection. I know I should be using the serial connection, but I did not want to sit in my coat closet to make the change. I also knew I would be hacking my config, and I wanted a scenario where I could early reset to the defaults. Every time I tried to reset to the defaults, the interface would hang because i was trying to do it over the network (as expected).

I found this link in the ASA documentation that described the default config for an ASA. I also found the environmental variable CONFIG_FILE. My thinking was, I could use the default config listed in the ASA documentation and save it to a file on the flash. If I wanted to return to the defaults, I could just change the  CONFIG_FILE environmental to point to that default config file on disk0:, and I would be back up and running in “factory defaults”.

I took it a step further and I added the following to my “jbmurphy_factory_defaults”:

ssh 192.168.XX.0 255.255.255.0 inside
ssh timeout 5
aaa authentication ssh console LOCAL
ssh scopy enable

These 4 lines enable ssh access to the ASA and allow me to scp my config file to disk0. Now, when I am working on a new config, I can scp it from my filesystem to the onboard storage, and issue a reboot.

That is my workflow so far. Thoughts?