Tag: ASA

Setting up AnyConnect VPN’s on the Cisco ASA 5508x (FTD)

Setting up AnyConnect VPN’s on the Cisco ASA 5508x (FTD)

This was done on FTD vs 6.2.3-83. 

Everything I have found on the Cisco FTD is outdated and the latest FTM interface looks nothing like the articles I have seen on the net. Below is a picture of my interface.

  1. In the Top Menu (Monitoring, Policies, Objects, Device), Select Device
  2.  I then select Remote Access VPN
  3. Create a Connection Profile name ( I entered the client domain-VPN)
  4. For AD Realm/Directory I selected the Realm I created earlier:
  5. I then downloaded from Cisco.com the anyconnect-win-4.5.05030-webdeploy-k9.pkg for Windows clients and uploaded it to the ASA and selected Next.
  6. For the certificate of Device Identity, I selected “Create New Internal Certificate”
  7. I then selected “Upload Certificate and Key” and entered in the certificate and keys I created here:
  8. For the outside interface, I selected my external interface
  9. I then entered the FQDN of my external IP. If you don’t have a FQDN for your external ip, you should it will make your life easier.
  10. For the address pool,  I created a new network: IE 192.168.9.0/24 (I didn’t use IPV6)
  11. For DNS and domain name, I entered my internal DNS servers and internal domain name and selected next.
  12.  I set the VPN as NAT Exempt
  13. Select my inside interface and entered my inside network, selected next and finished

Creating a CSR for a Cisco ASA 5508-x running FTD (via FTM)

Creating a CSR for a Cisco ASA 5508-x running FTD (via FTM)

This was done on FTD vs 6.2.3-83. 

  1. The ASA was unable to create a csr, so I took care of that on my linux pc using openssl. You can also get help with that from this page: https://www.digicert.com/easy-csr/openssl.htm
  2. Once I had the csr, I submitted to godaddy and they sent me back two files.
  3. I combined the 2 files into one file by running the following in a linux terminal: cat whatever.crt gd_bundle.crt > combined.crt
  4. I then held the combined.crt along with my domain.key (created during csr) in a known director for later use with the ASA

Please check out my related article:

Setting up AnyConnect VPN’s on the Cisco ASA 5508x (FTD)

Creating an AD Realm on a Cisco ASA 5508-x running FTD (via FTM)

Creating an AD Realm on a Cisco ASA 5508-x running FTD (via FTM)

This was done on FTD vs 6.2.3-83. 

  1. In the Top Menu (Monitoring, Policies, Objects, Device), Select Objects
  2.  Under the Object types side menu, select Identity Realm
  3.  Enter a Realm name (I entered Client domain).
  4. For me, the Type: Active Directory was grayed out (it was my only choice anyway)
  5. For base DN, I entered: dc=example,dc=com
  6. for AD Primary domain, I entered our domain name
  7. Hostname, I entered the ip of the AD server and port I left at the default of 389
  8. I left encryption as None. I then tested satisfactory and saved the config.

Please check out my related article:

Setting up AnyConnect VPN’s on the Cisco ASA 5508x (FTD)

Issue with Barracuda Spam firewalls and Cisco PIX/ASA

I was working on a client’s barracuda to receive mail directly through the barracuda rather than their current setup.

I was able to remove it from the ASA adding the following to the config via cli: no fixup protocol smtp 25

For more on this you can read: https://blogs.it.ox.ac.uk/networks/2009/11/26/cisco-firewall-smtp-fixup-considered-harmful/

 

(1) “Why can’t anyone send mail to my Barracuda Spam & Virus Firewall over TLS, even though I have it enabled?”
—————————————————————————-

Solution #00003659

Scope:
All Barracuda Spam & Virus Firewalls in use with Cisco network hardware, all firmware versions.

Answer:
If enabled, the Barracuda Spam & Virus Firewall will advertise TLS (secure connection availability) for all incoming SMTP connections (for information on configuring this, see Solution #00000992). It’s possible the sending mail servers aren’t electing to send mail over TLS.

 

If it’s been configured correctly and the sending servers are trying to send mail over TLS, the problem could be that a device between the sending servers and the Barracuda Spam & Virus Firewall is interfering. For instance, a Cisco PIX firewall with the “SMTP Fixup protocol” enabled will mask the 250-STARTTLS echo reply from the Barracuda Spam & Virus Firewall, preventing the sending mail server from realizing that sending mail using a secure connection is an option. The only solution in this case is to disable the “SMTP Fixup protocol” on the Cisco PIX firewall (for instructions on how to do this, click here).

 

Cisco ASA firewalls may also interfere with the 250-STARTTLS SMTP response, but they can be explicitly configured to support ESMTP over TLS. If you are using a Cisco ASA firewall, click here for instructions on how to enable this functionality.

 

Additional Notes:

The Cisco PIX “SMTP Fixup protocol” can cause other problems when used with the Barracuda Spam & Virus Firewall. For more information, see Solution #00001728.

 

Link to This Page:
http://www.barracuda.com/kb?id=50160000000HQ7J