ASA

Cisco's new ASA code allows you to securely take your Cisco IP Phone with you anywhere

jheary — Sun, 21 Sep 2008 21:04:49 -0400

Cisco recently released a new code upgrade for their ASA security appliance. The new release, 8.0.4, contains several new features and many bug fixes. Cisco also released a new version of its GUI, ASDM 6.1.3, that supports the new features of 8.0.4. The fact that 8.0.4 is an Early Deployment (ED) release means that it goes through extensive dev testing before release. It also means that it is meant to be a very stable release of ASA code and will contain numerous bug fixes to support that premise. In fact, 8.0.4 contains some 514 closed caveats that were discovered in previous ASA builds. Most ASA customers who are using SSLVPN features or are on an 8.0.3.X engineering release should seriously consider moving to the new 8.0.4 ED release. 8.0.4 doesn’t just include closed caveats but also some important new features. My favorite new feature has to be the IP Phone and Presence Proxy feature. First the IP Phone Proxy feature. This allows you to take your Cisco IP Phone home with you, plug it into the internet, have it setup an encrypted TLS tunnel back to your ASA, and register with your Cisco Call Manager just like you were at the office. Basically it gives you a VPN from your IP Phone to the Cisco ASA. This allows you to enable work from anywhere voice using your existing Cisco IP Phones. Now the presence proxy feature. This allows you to share your presence information with your other business partners and affiliates. Enterprises share Presence information, and can use IM applications. It allows you to secure connectivity (TLS proxy) between Cisco Unified Presence servers and Cisco or Microsoft Presence servers. Here are some of the benefits of using a Presence solution as reported by Cisco: • Increase productivity: Connect with colleagues on the first try by knowing their availability in advance on either Cisco Unified Personal Communicator and Cisco Unified IP Phone.

Read more

ChalkTalk - ASA Firewall – Packet Classification in Multiple Contexts Mode

yusuff — Thu, 28 Aug 2008 04:03:26 -0400

I recently posted a chalktalk article about ASA Firewall – Packet Classification in Multiple Contexts Mode... thought it might be useful to NW readers. http://www.cisco.com/public/news_training/itsnews/tech/chalktalk/200804.html Security Contexts Overview

Read more

How to build iPhone profiles for Cisco VPN

jheary — Wed, 30 Jul 2008 05:30:06 -0400
Apple came up with a slick way to allow you to distribute various iPhone setting to your users via email or the web, it is called profiles. Profiles are basically xml config files that act like plug-ins for the iPhone. They can configure things like Wi-FI, network, passcode, email and VPN settings on each iPhone. They can even be used to install certificates. Profiles like this are helpful if you have a large number of devices to manage or if you just have a large number of settings you want enforced on each users iPhone. Additionally, for certain settings, like some VPN and Wi-FI settings, you have to use profiles.

Read more

How to recycle end-of-life Cisco PIX gear

Cisco Subnet — Thu, 05 Jun 2008 16:19:57 -0400

Here's a marketing play for security appliances taken from the playbook of household appliance makers. When you buy a new washer/dryer or fridge, the retailer will often offer to haul away the old one for free if you pay the retailer for the delivery/installation service on the new one. Well, security vendor Astaro is pretty much doing the same thing in reverse, reports ChannelWeb. Astaro is urging users not to toss end-of-lifecycle PIX appliances into the landfill. Intead it is promising them that if they swap the old box out for a new Astaro box, Astaro will have the old gear recycled.

Read more

More MPF and a Quick Survey

brandon — Fri, 11 Apr 2008 00:45:47 -0400

So in my last post I talked about the Modular Policy Framework and we too a very short look at how a class-map, policy-map, and service-policy all fit together. I also said that today I would discuss how to add application layer functionality. Where I will, as promised but before I do that I want to take a quick survey. Please use the survey below to answer the following questions:

When it comes to studying for the CCSP, what do you do for lab access?

Does it make sense to build your own lab or does it make more sense to just run though to books?

If you are buying your own gear are you also planning on attempting the CCIE Security?

Read more

Getting better Acquainted with Modular Policy

brandon — Fri, 04 Apr 2008 11:27:41 -0400

I want to start by thanking all of you that took the time to fill out the poll. It looks as though it’s a pretty close 60/40 thing but the majority (60%) say that the CCSP is in fact worth it. With that said, I wanted to talk about the Modular Policy Framework over the next few days.

Read more

Is the CCSP Cert worth it?

brandon — Fri, 28 Mar 2008 17:09:01 -0400

So is it worth all that time you would have to put in to get the CCSP? For those of you who are just joining me you haven't missed much. This happens to be my first of a month long session of Blogging here at NWW. When I decided to do this I has to choose something that I felt would be relevant to you. I decided to stick with what I'm good at and focus in the realm of security, and since i've been training folks for the last 7 years on how to use the PIX, ASA, IPS, Cisco Routers, and AAA I decided to stick with that.

So to start out, I want to throw the ball into your hands. Do you think its worth it? There are a number of tests you can take. SND, SNRS, IPS, and SNPA are the core but what about CANAC, MARS, HIPS? I'd like to know if you see a benefit in getting certified.

Read more

Achieving two-factor authentication with digital certificates. Are costly OTP token solutions dead?

jheary — Wed, 23 Jan 2008 22:48:33 -0500
It is widely accepted that one of the best things you can do to secure your sslvpn infrastructure is implementing a two-factor authentication scheme. Typically, this has been accomplished using a one-time password token technology. But what about using digital certificates that are tied to usernames instead of an OTP token approach? The idea being that the certificate is the something you have and the username/pwd is the something you know. This is a newly supported feature on the Cisco ASA, but not new to the industry, so I thought it might be interesting to examine it.

Read more

Cisco VPN gateways support the iPhone

jheary — Thu, 13 Dec 2007 15:55:59 -0500
So you have your shiny cool new iPhone. You’re addicted to their very cool web browser. Now you want to be able to surf to your internal home or corporate networks using VPN right? The embedded iPhone VPN client works over both Wi-Fi and EDGE network connections. Good news, both the Cisco IOS routers and the ASA appliance support this. In fact, they’ve supported it all along. Here are some of the geeky details and how to set it up.

Read more

Cisco ASA password vulnerability

Cisco Subnet — Fri, 07 Sep 2007 16:43:45 -0400

US-CERT warned that Cisco's Adaptive Security Appliance (ASA) firewall may log user credentials, including passwords, as plain text when AAA authentication is enabled.
THe US-CERT notice reads:
When setting up or troubleshooting the ASA server's AAA authentication features, the test button can be used to confirm that the AAA service is functioning properly.
When the test button is clicked, the AAA username and password will be sent to the syslog service in plain text. If remote syslog is enabled, the credentials will be transmitted across the network in plain text, and stored on the syslog server in plain text.

Read more

Highlighting 5 NEW lesser known PIX/ASA Firewall Features

jheary — Tue, 28 Aug 2007 20:13:19 -0400
The 8.0.2 software release for the PIX and ASA platforms was a big one! My guess is you haven’t had the time, or the inspiration, to read through the release notes and drill into the configuration guide to find all of the new features you now get with the 8.0.2 code release. Fret not, I am here to help! (A little anyway) I won’t cover the major SSLVPN features in 8.0 since you’re probably already somewhat familiar with the huge updates to PIX/ASA SSLVPN features. Instead, here are 5 NEW 8.0.2 features that are less well known but that you’ll probably be interested in:

Read more

How to configure failover on a Cisco adaptive security appliance

Brad Reese — Mon, 21 May 2007 02:43:24 -0400
How to configure failover on a Cisco Adaptive Security Appliance. Failover can be setup for two identical security appliances connected to each other. The devices can be connected either through a dedicated failover link and optionally, a stateful failover link. The Cisco Adaptive Security Appliance (ASA) supports two failover configuration setups: 1. Active/Active failover Setup - With Active/Active failover, both units can pass network traffic. This allows you to configure load balancing on your network. Active/Active failover is only available on units that run in multiple context mode. Refer to: Configuring Active/Active Failover For more information and the step-by-step procedures to configure the Active/Active failover. 2. Active/Standby failover Setup - With Active/Standby failover, only one unit passes traffic while the other unit waits in a standby state. Active/Standby failover is available on units that run in either single or multiple context mode. Refer to: Configuring Active/Standby Failover For more information and the step-by-step procedures to configure the Active/Standby failover. Further information: Configuring Failover Enabling Multiple Context Mode Cisco Technical Note: If Advanced Inspection and Prevention Security Services Module (AIP-SSM) is used, it operates independently of the ASA in terms of failover. For failover, all that is needed from an ASA perspective is that the AIP modules be of the same hardware type. Beyond that, as with any other portion of failover, the configurations of the ASA between the active and standby must be in sync. http://www.BradReese.Com

Read more

Cisco three time channel product of the year winner and tied as a fourth cowinner

Brad Reese — Sun, 06 May 2007 02:04:03 -0400
The results are in for the eWEEK Channel Products of the Year Survey. Cisco cleaned house winning 3 product categories and tying for a fourth. VoIP Offerings: Security Appliances: Network Infrastructure: Network Security Software: Congratulations Cisco! Especially for tying Symantec as CoWinner in the highly coveted network security software category. http://www.BradReese.Com

Read more

Adaptive Security Appliance key to Cisco turnaround success in firewall market

Brad Reese — Sun, 11 Mar 2007 04:57:35 -0400
By the end of 2005, Cisco was getting its butt kicked in the firewall market, even though the Cisco PIX firewall had long been a familiar name. According to The NPD Group/Distributor Track, which monitors the U.S. dollar volume sales of high-tech products through certain major distributors, Symantec held a 55.6 percent share of the firewall segment at the end of 2005, compared with Cisco's 17.8 percent. Dark Reading Risky Business reports that solution providers point to two key events as the impetus for what amounted to a dramatic turnaround in 2006. First, in June 2006 Symantec said it would decrease its investment in security appliances, including the Symantec Gateway Security appliance line, which includes firewall capabilities. Second, in July 2006 Cisco added two new models to its Adaptive Security Appliance unified threat management series, which also includes a firewall. In the wake of these events, Cisco's U.S. dollar volume share for firewalls leapt nearly 20 percentage points in 2006 to 37.7 percent, overtaking Symantec's results, which slipped 21 percentages points to 34.6 percent, the NPD data shows. Check Point Software Technologies is the third best-seller with a 15.2 percent share. "Cisco's SMARTnet support is another reason behind Cisco's recent firewall market gains because customers like having an entire organization that works with them to support complex solutions," said Gary Berzack, CTO of Cisco partner eTribeca, New York. Steve Pettit, president of Blue Spruce Technologies, Greenland, N.H., is seeing "a lot of customers" upgrading from Cisco's PIX firewall to the ASA, and he thinks the ASA series is also taking market share away from Cisco competitors including Symantec and Check Point. Migration Guide from Cisco PIX 500 to Cisco ASA 5500 Series "A big reason for Cisco's firewall market leadership is the trend toward companies looking to consolidate multiple functions within a single appliance, which has helped fuel sales of the ASA line," said Steven Reese, security practice manager at Nexus Integration Services, a Valencia, Calif., solution provider.

Firewalls
Top 3 Best-Sellers*

2006
MARKET SHARE MARKET-SHARE
CHANGE OVER 2005

Cisco Systems 37.7% +19.9

Symantec 34.6% -21

Check Point 15.2% +5.7

* RANKING BASED ON 2006 REVENUE SHARE; HIGHLIGHTED VENDOR GAINED GREATEST SHARE FROM 2005 TO 2006
SOURCE: THE NPD GROUP/DISTRIBUTOR TRACK (INCLUDES GTDC DATA)

You may find of interest the Miercom Lab Test comparing the Cisco ASA 5520 Adaptive Security Appliance against the following Unified Threat Management (UTM) security appliance competitors: Check Point VPN-1 Pro, Fortinet FortiGate 1000 and Juniper Networks NetScreen-208. Do you have an interesting story about how the Cisco ASA has had a dramatic impact on Cisco's fortunes in the firewall market? http://www.BradReese.Com

Read more