ASA Modular Policy Framework L3/L4 Konfigurasyonu

Merhaba,

İzleyeceğiniz video da, Service Policy'nin çok basit anlamda MPF kullanılarak nasıl konfigüre edildiğini ve mantığını, icmp traceroute ve ftp gibi protocoller kullanılarak anlatmaya çalıştım. Bu video içerisindeki örnekler service policy'nin sadece L3/L4 inspection için nasıl kullanıldığı ile ilgili örneklerdir.

Aşağıda kullanılan cihazların başlangıç konfigürasyonlarını bulabilirsiniz. Her ne kadar başlangıç konfigürasyonları içinde interface konfigürasyonları ve static route'lar dışında bir konfigürasyon olmasa bile başlangıç konfigleri bazen gerekli olabiliyor.

============================================================ R10 ============================================================ R10#sh run Building configuration... Current configuration : 896 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R10 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated username cisco privilege 15 password 0 cisco ! ! archive log config hidekeys ! ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface FastEthernet0/1 ip address 16.1.1.2 255.255.255.0 duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 FastEthernet0/1 ! ! no ip http server no ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local ! ! end ================================================================= ASA-1 ================================================================= ASA-1# sh run : Saved : ASA Version 8.4(2) ! hostname ASA-1 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface GigabitEthernet0 description *** INSIDE_NETWORK nameif inside security-level 100 ip address 10.100.1.1 255.255.255.0 ! interface GigabitEthernet1 description *** DMZ_NETWORK *** nameif dmz security-level 50 ip address 172.16.1.1 255.255.255.0 ! interface GigabitEthernet2 nameif outside security-level 0 ip address 22.22.22.33 255.255.255.252 ! interface GigabitEthernet3 shutdown no nameif no security-level no ip address ! interface GigabitEthernet4 shutdown no nameif no security-level no ip address ! interface GigabitEthernet5 shutdown no nameif no security-level no ip address ! ftp mode passive object network WWW_PRIVATE host 172.16.1.32 object network WWW_PUBLIC host 22.22.22.1 object network FTP_PRIVATE host 172.16.1.33 object network FTP_PUBLIC host 22.22.22.2 object network INSIDE_FTP_PRIVATE host 10.100.1.111 object network INSIDE_FTP_PUBLIC host 22.22.22.23 object network DNS_PRIVATE host 172.16.1.200 object network DNS_PUBLIC host 22.22.22.3 access-list outside_access extended permit tcp any object INSIDE_FTP_PRIVATE eq ftp access-list outside_access extended permit tcp any object WWW_PRIVATE eq www access-list outside_access extended permit tcp any object FTP_PRIVATE eq ftp pager lines 24 logging console debugging mtu inside 1500 mtu dmz 1500 mtu outside 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-647.bin no asdm history enable arp timeout 14400 ! object network WWW_PRIVATE nat (dmz,outside) static WWW_PUBLIC object network FTP_PRIVATE nat (dmz,outside) static FTP_PUBLIC object network INSIDE_FTP_PRIVATE nat (inside,outside) static INSIDE_FTP_PUBLIC object network DNS_PRIVATE nat (dmz,outside) static DNS_PUBLIC access-group outside_access in interface outside ! router ospf 10 router-id 111.111.111.111 network 10.100.1.1 255.255.255.255 area 0 network 172.16.1.1 255.255.255.255 area 0 log-adj-changes default-information originate ! route outside 0.0.0.0 0.0.0.0 22.22.22.34 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL http server enable http 10.100.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart telnet 10.100.1.0 255.255.255.0 inside telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect ftp ! service-policy global_policy global prompt hostname context no call-home reporting anonymous crashinfo save disable Cryptochecksum:dfca605ecef317ead3e6456aead8181b : end ================================================================= R6 ================================================================= R6#sh run Building configuration... Current configuration : 3034 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R6 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! interface FastEthernet0/0 ip address 10.100.2.1 255.255.255.0 ip nat inside ip virtual-reassembly duplex auto speed auto ! interface Serial0/0 ip address 86.1.1.1 255.255.255.252 ip nat outside ip virtual-reassembly clock rate 2000000 ! interface FastEthernet0/1 ip address 16.1.1.1 255.255.255.0 duplex auto speed auto ! interface FastEthernet1/0 no ip address shutdown duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Serial0/0 ! ! ip http server ip http authentication local ip http secure-server ip nat inside source list NAT interface Serial0/0 overload ! ip access-list extended NAT permit ip 10.100.2.0 0.0.0.255 any ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ============================================================= R8 ============================================================= R8#sh run Building configuration... Current configuration : 3251 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R8 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! no ip domain lookup ip domain name lab.local ip host company-B.com 84.1.1.1 ip host levent.com 22.22.22.1 ip host ftp.levent.com 22.22.22.2 ! multilink bundle-name authenticated ! ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface Loopback0 ip address 8.8.8.8 255.255.255.255 ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface Serial0/0 ip address 81.1.1.2 255.255.255.252 clock rate 2000000 ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface Serial0/1 ip address 86.1.1.2 255.255.255.252 clock rate 2000000 ! interface Serial0/2 ip address 85.1.1.2 255.255.255.252 clock rate 2000000 ! interface Serial0/3 ip address 84.1.1.2 255.255.255.252 clock rate 2000000 ! ip forward-protocol nd ip route 16.1.1.0 255.255.255.0 86.1.1.1 ip route 22.22.22.0 255.255.255.192 Serial0/0 ip route 41.21.12.0 255.255.255.252 Serial0/3 ! ! ip http server ip http authentication local ip http secure-server ip dns server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ========================================================= R1 ========================================================= R1#sh run Building configuration... Current configuration : 2894 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R1 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface Serial0/0 ip address 81.1.1.1 255.255.255.252 clock rate 2000000 ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet1/0 ip address 22.22.22.34 255.255.255.252 duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Serial0/0 ip route 22.22.22.0 255.255.255.224 FastEthernet1/0 ! ! ip http server ip http authentication local ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ======================================================= ML-SW1 ======================================================= ML_SW1#sh run Building configuration... Current configuration : 3957 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname ML_SW1 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 no ip routing no ip cef ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address no ip route-cache shutdown duplex auto speed auto ! interface FastEthernet0/1 no ip address no ip route-cache shutdown duplex auto speed auto ! interface FastEthernet1/0 description ASA_1-Gig0-IN switchport access vlan 100 spanning-tree portfast ! interface FastEthernet1/1 description ASA_1-Gig1-DMZ switchport access vlan 200 spanning-tree portfast ! interface FastEthernet1/2 description ASA_1-Gig2-OUT switchport access vlan 300 spanning-tree portfast ! interface FastEthernet1/3 ! interface FastEthernet1/4 ! interface FastEthernet1/5 description SW1_DMZ switchport access vlan 200 ! interface FastEthernet1/6 description SW2_IN switchport access vlan 100 ! interface FastEthernet1/7 description R1_Perimeter_Fa1/0 switchport access vlan 300 spanning-tree portfast ! interface FastEthernet1/8 ! interface FastEthernet1/9 ! interface FastEthernet1/10 description ASA_2-Gig0-IN switchport access vlan 100 spanning-tree portfast ! interface FastEthernet1/11 description ASA_2-Gig1-DMZ switchport access vlan 200 spanning-tree portfast ! interface FastEthernet1/12 description ASA_2-Gig2-OUT switchport access vlan 300 spanning-tree portfast ! interface FastEthernet1/13 ! interface FastEthernet1/14 ! interface FastEthernet1/15 ! interface Vlan1 no ip address no ip route-cache ! interface Vlan100 ip address 10.100.1.253 255.255.255.0 ! ip default-gateway 10.100.1.1 ip forward-protocol nd ! ! ip http server ip http authentication local ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ML_SW1# ML_SW1#sh interface statu Port Name Status Vlan Duplex Speed Type Fa1/0 ASA_1-Gig0-IN connected 100 a-full a-100 10/100BaseTX Fa1/1 ASA_1-Gig1-DMZ connected 200 a-full a-100 10/100BaseTX Fa1/2 ASA_1-Gig2-OUT connected 300 a-full a-100 10/100BaseTX Fa1/3 notconnect 1 auto auto 10/100BaseTX Fa1/4 notconnect 1 auto auto 10/100BaseTX Fa1/5 SW1_DMZ connected 200 a-full a-100 10/100BaseTX Fa1/6 SW2_IN connected 100 a-full a-100 10/100BaseTX Fa1/7 R1_Perimeter_Fa1/0 connected 300 a-full a-100 10/100BaseTX Fa1/8 notconnect 1 auto auto 10/100BaseTX Fa1/9 notconnect 1 auto auto 10/100BaseTX Fa1/10 ASA_2-Gig0-IN connected 100 a-full a-100 10/100BaseTX Fa1/11 ASA_2-Gig1-DMZ connected 200 a-full a-100 10/100BaseTX Fa1/12 ASA_2-Gig2-OUT connected 300 a-full a-100 10/100BaseTX Fa1/13 notconnect 1 auto auto 10/100BaseTX Fa1/14 notconnect 1 auto auto 10/100BaseTX Fa1/15 notconnect 1 auto auto 10/100BaseTX ================================================= R7 ================================================= INTERNAL_DNS#sh run Building configuration... Current configuration : 2922 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname INTERNAL_DNS ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! no ip domain lookup ip domain name lab.local ip host levent.com 172.16.1.32 ip host company-B.com 84.1.1.1 ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address duplex auto speed auto ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet1/0 ip address 172.16.1.200 255.255.255.0 duplex auto speed auto ! router ospf 10 router-id 7.7.7.7 log-adjacency-changes network 172.16.1.200 0.0.0.0 area 0 ! ip forward-protocol nd ! ! ip http server ip http authentication local ip http secure-server ip dns server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ========================================================= ASA-3 ========================================================= ASA-3(config)# sh run : Saved : ASA Version 8.4(2) ! hostname ASA-3 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface GigabitEthernet0 nameif inside security-level 100 ip address 10.100.1.1 255.255.255.0 ! interface GigabitEthernet1 nameif outside security-level 0 ip address 41.21.12.2 255.255.255.252 ! interface GigabitEthernet2 shutdown no nameif no security-level no ip address ! interface GigabitEthernet3 shutdown no nameif no security-level no ip address ! interface GigabitEthernet4 shutdown no nameif no security-level no ip address ! interface GigabitEthernet5 shutdown no nameif no security-level no ip address ! ftp mode passive object network INSIDE_NETWORK subnet 10.100.1.0 255.255.255.0 pager lines 24 logging console debugging mtu inside 1500 mtu outside 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-647.bin no asdm history enable arp timeout 14400 ! object network INSIDE_NETWORK nat (inside,outside) dynamic interface route outside 0.0.0.0 0.0.0.0 41.21.12.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL http server enable http 10.100.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart telnet 10.100.1.0 255.255.255.0 inside telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect icmp inspect ftp policy-map type inspect ftp benim parameters ! service-policy global_policy global prompt hostname context no call-home reporting anonymous crashinfo save disable Cryptochecksum:9f9398ce2a97aa56a5266643bb743c3f : end ============================================================== R4 ============================================================== R4#sh run Building configuration... Current configuration : 2852 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R4 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address duplex auto speed auto ! interface Serial0/0 ip address 84.1.1.1 255.255.255.252 ip virtual-reassembly clock rate 2000000 ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet1/0 ip address 41.21.12.1 255.255.255.0 duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Serial0/0 ! ! ip http server ip http authentication local ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end

Herkese iyi çalışmalar.