Configuring Cisco Devices - PIX/ASA/FWSM/VPN Concentrator

Firewall Analyzer supports the following versions of various Cisco devices.

Cisco IOS Firewalls:

• 8xx
  
• 18xx
  
• 28xx
  
• 38xx
  
• 72xx
• 73xx
• 3005
• 1900
• 2911
• 3925

Cisco FWSM Catalyst Series:

• 6500
• 7600

Cisco PIX versions:

• 6.x
• 7.x

Cisco ASA:

• 5500 series
• 9.1

Cisco VPN Concentrators Series:

• 3000
• 3500

To find out the version of your PIX firewall, Telnet to the PIX firewall and enter the show version command.

• Getting logs from Virtual Firewall (Virtual Domain)
• Configuring Cisco PIX using Command Line Interface
• Configuring Cisco PIX from the User Interface
• Configuring SNMP protocol for Cisco PIX using Command Line Interface
• Configuring Cisco ASA using Command Line Interface
• Configuring SSL WebVPN in Cisco ASA appliance
• Configuring Cisco ASA NetFlow Logs
• Configuring SNMP protocol for Cisco ASA using Command Line Interface
• Configuring Cisco VPN 3000 Concentrator
• Configuring Cisco IOS Switch
• Configuring SNMP protocol for Cisco Firewalls using ASDM Web UI tool

Virtual Firewall (Virtual Domain) logs

Prerequisite for context/vdom in Cisco Firewalls

The Cisco Firewall IP address should be DNS resolvable from Firewall Analyzer.

There is no separate configuration required in Firewall Analyzer for receiving logs from Virtual Firewalls of the Cisco physical device.

Configuring Cisco PIX using Command Line Interface

1. Telnet to the PIX firewall and enter the enable mode
2. Type the following:
   configure terminal
logging on
logging timestamp
logging trap informational
logging device-id {context-name | hostname | ipaddress interface_name | string text}
logging host interface_name syslog_ip [17/<syslog_port>]
   
   where,

Example: logging host inside 11.23.4.56 17/1514

To verify your configuration, enter the show logging command after the last command above. This will list the current logging configuration on the PIX firewall.

Configuring Cisco PIX from the User Interface

Log in to the Cisco PIX user interface, and follow the steps below to configure the PIX firewall:

1. Enabling Logging
   1. Select Configure > Settings > Logging > Logging Setup
      
   2. Select the Enable logging setup and Enable logging failover check boxes
   3. Click Apply.
      Changes are applied to the assigned PIX firewall configuration files when they are generated. The configuration files are then downloaded to PIX firewalls at deployment.
      
2. Configuring Syslog Server
   1. Select Configure > Settings > Logging > Syslog
      
   2. Check Include Timestamp.
   3. Click Add to add a row.
   4. In the Add Syslog Server page that appears, enter the following:
      1. Interface Name - the firewall interface through which Firewall Analyzer can be reached, the interface can be either inside or outside.
      2. IP Address - the IP address of the syslog server to which logs have to be sent
      3. Under Protocol, select the UDP radio button
      4. The default UDP port is 514. If you have configured a different syslog listener port on your syslog server, enter the same port here.
   5. Click Apply
      
3. Configuring Logging Level
   1. Select Configure > Settings > Logging > Other
   2. Under Console Level List select Informational so that all report data is available
   3. Click Apply

Configure/Enable SNMP Protocol for Cisco PIX Firewall device

Using CLI Console:

configure terminal snmp-server host <interface name> <hostname |IP address of Firewall Analyzer>

If you want to create a new SNMP community use the below command:

configure terminal snmp-server community <community-string>

Example:

configure terminal snmp-server community public

Configuring Cisco ASA Versions

1. Telnet to the ASA firewall and enter the enable mode
2. Type the following:

configure terminal
logging enable
logging timestamp
logging trap informational
logging device-id {context-name | hostname | ipaddress interface_name | string text}
logging host interface_name syslog_ip [udp/<syslog_port>]

3. If there are no URL Reports available in Firewall Analyzer for CISCO ASA, enable HTTP inspection by executing the following command:
   inspect http

   Enabling HTTP inspection will generate syslogs with ID 304001. This ID will be used by Firewall Analyzer to generate URL Reports.

For more information, refer the Cisco PIX documentation.

Configuring Cisco ASA Versions using ASDM

Enable Logging

Carry out the steps given below:

• Load the ASDM
• Select Configuration > Device Management > Logging > Logging Setup
• Select Enable Logging
• Select Logging > Logging Filters
• Choose the syslog-servers as Informational
• Select Logging > Logging Filters > Syslog servers
• Click Add
• Enter the IP address and choose the appropriate interface and ensure that you choose UDP and enter the port number
• Select Logging > Syslog Setup
• Select 'Include time stamp in syslogs' option and scroll down to ensure the syslog ID's 302013, 302014,302015,302016 are in enabled state and the logging level is set to Informational
  

Disable Logging

You can disable specific syslog IDs based on your requirement.

Note: By selecting the check mark for the Include timestamp in syslogs option, you can add the date and time that they were generated as a field to the syslogs.

• Select the syslogs to disable and click Edit.
• From the Edit Syslog ID Settings window, select the Disable messages option and click OK.
• The disabled syslogs can be viewed in a separate tab by selecting Disabled syslog IDs from the Syslog ID Setup drop-down menu.

For more information, refer the Cisco PIX documentation.

Configuration for SSL WebVPN in Cisco ASA appliance

Firewall Analyzer requires syslog message IDs 722030 and 722031, which by default is at debug level, to process Cisco SVC VPN logs. Set the information level to these syslog IDs by executing below commands in global configuration mode:

You can confirm by executing the below command:

Configuring Cisco ASA NetFlow Logs and Disabling NetFlow on Cisco ASA/ADM using command line and ASDM

Firewall Analyzer support NetFlow version 9 packets, which is introduced in Cisco ASA 8.2.1/ASDM 6.2.1.

Configuring ASA device using console mode to send NetFlow version 9 packets to Firewall Analyzer is given below:

• As Firewall Analyzer is capable of receiving either Syslog or NetFlow packet from an ASA box, disable Syslog and enable NetFlow.

To disable Syslog and enable NetFlow execute the following commands:

(config)# flow-export destination inside <Firewall Analyzer Server IP> 1514
(config)# flow-export template timeout-rate 1
(config)# flow-export delay flow-create 60
(config)# logging flow-export-syslogs disable ---> This command will disable logging syslog messages
(config)# access-list netflow-export extended permit ip any any
(config)# class-map netflow-export-class
(config-cmap)#match access-list netflow-export

Associate global policy map with netflow class map

• Option 1

If you have a global policy map, associate the above netflow class-map netflow-export-class to the global policy.

For example: if your global policy map is named global_policy_asa, you need to execute the below commands:

(config)# policy-map global_policy_asa
(config-pmap)# class netflow-export-class
(config-pmap-c)# flow-export event-type any destination <Firewall Analyzer Server IP>

if the above command fails use the below:

(config-pmap-c)# flow-export event-type all destination <Firewall Analyzer Server IP>

• Option 2

If you wish to create a new policy map named netflow-export-policy and make this as your global policy follow the below steps:

(config)# policy-map netflow-export-policy
(config-pmap)# class netflow-export-class
(config-pmap-c)# flow-export event-type any destination <Firewall Analyzer Server IP>

if the above command fails use the one below:
(config-pmap-c)# flow-export event-type all destination <Firewall Analyzer Server IP>

Make policy map netflow-export-policy as your global policy:

(config)# service-policy netflow-export-policy global

For UI mode configuration using ASDM access, refer the Cisco forum topic: https://supportforums.cisco.com/docs/DOC-6114

To disable NetFlow on Cisco ASA/ADM execute the following commands:

(config)# flow-export disable

(config)# no flow-export destination inside <Firewall Analyzer Server IP> 1514

To disable NetFlow on Cisco ASA/ADM using ASDM

• Click on Configuration > Firewall
• Click on Service Policy Rules. Look for the policy indicating netflow export
• Check the IP address if the flow is pointing to the machine where you want to forward syslog.
• If so, delete it and write the configuration in to memory (Save it).

Configure/Enable SNMP Protocol for Cisco ASA Firewall device

Using CLI Console:

configure terminal snmp-server enable snmp-server host <interface name> <hostname | IP address of Firewall Analyzer> [poll]

Example:

configure terminal snmp-server enable snmp-server host inside 192.168.101.155 poll

If you want to create a new SNMP community use the below command:

configure terminal snmp-server community <community-string>

Example:

configure terminal snmp-server community public

Configuring Cisco VPN 3000 Concentrator

Currently we support Cisco IOS Compatible Log Format and Original Log Format for Cisco VPN Concentrator.

Importing of already saved Cisco VPN Concentrator logs is not supported because those logs are saved in either of the following formats which is not supported in Firewall Analyzer:

• Multi line
• Tab Delimited
• Comma Delimited

Follow the below steps to configure the VPN Concentrator:

1. Configuring Syslog Server
   1. Login to the Cisco VPN 3000 Concentrator Management console.
   2. Go to Configuration > System> Events >Syslog Servers
   3. Click the Add button
   4. In the Syslog Server text box enter the IP Address of the machine where Firewall Analyzer is running.
   5. Enter the Port value. The default syslog server port for Firewall Analyzer is 514.
   6. Facility is Local 7
2. Configuring Syslog Events
1. Go to Configuration > System> Events >General
2. For Syslog Format you can either select Original or Cisco IOS Compatible format.
3. For Events to Syslog select Severities 1-5
4. All other configurations are default for this page.
5. Click Apply button

For more information, refer the Cisco VPN Concentrator documentation.

Configuring Cisco IOS Switch

Follow the below steps to configure the Cisco IOS Switch:

1. Login to the Cisco IOS console or Telnet to the device.
2. Change the configuration mode of the device.

   Use the following command:

configure terminal

3. Enable logging by using the following commands:

logging on

logging trap informational

logging <IP Address>

4. If there is a Firewall module in the IOS device, use the following command to enable audit trail. This will generate traffic information.

ip inspect audit-trail

Configure/Enable SNMP Protocol for Cisco Firewall devices using Cisco ASDM tool

Using Web UI:

Configure SNMP parameters for SNMP Versions 1 and 2c
Carry out the following steps:

• In the ASDM main window, select Configuration > Device Management > Management Access > SNMP
• In the Community String (default) field, enter default community string. This applies to SNMP Versions 1 and 2c only
• Fill appropriate values in Contact and Location fields
• In the Listening Port field, enter the port number of the security appliance that listens for SNMP requests from management stations; or retain the default port number 161
• Click Apply

With this, SNMP parameters for Versions 1 and 2c are configured and the changes are saved to the running configuration.
To enable the SNMP Manager running in Firewall Analyzer to make queries to SNMP Agent running in the firewall:

• In the ASDM main window, choose Configuration > Device Management > Management Access > SNMP
• In the SNMP Management Stations pane, click Add. The Add SNMP Host Access Entry dialog box appears
• In the Interface Name drop-down list, choose the interface on which the Firewall Analyzer resides
• In the IP Address field, enter the Firewall Analyzer IP address
• In the UDP Port field, enter the Firewall Analyzer UDP port, or retain the default port 162
• In the Community String field, enter the Firewall Analyzer community string. If no community string is specified for a management station, the value set in the Community String (default) field on the SNMP Management Stations pane is used
• In the SNMP Version drop-down list, choose the SNMP version used by the Firewall Analyzer
• If you have selected SNMP Version 3 in the previous step, in the Username drop-down list, choose the name of a configured user
• To specify the method for communicating with this management station, check the Poll check boxes
• Click OK. The Add Firewall Analyzer Access Entry dialog box closes.
• Click Apply.

With this, the management station is configured and changes are saved to the running configuration.
Configure SNMP Parameters for Version 3:

SNMP Version 3 allows you to configure additional authentication and privacy options for more secure protocol operations by means of SNMP server groups and users.

Carry out the following steps:

• In the ASDM main window, choose Configuration > Device Management > Management Access > SNMP
• In the SNMPv3 Users pane, to add a configured user or a new user to a group, click Add. To change user parameters, click Edit. To remove a configured user from a group, click Delete. When you remove the last user in a group, ASDM deletes the group

• The Add SNMP User Entry dialog box appears
• In the Group Name drop-down list, choose the group to which the SNMP user will belong. The available groups are as follows:
  • Auth&Encryption, in which users have authentication and encryption configured
    
  • Authentication_Only, in which users have only authentication configured
    
  • No_Authentication, in which users have neither authentication nor encryption configured
• In the Username field, enter the name of configured user or new user. The username must be unique for the SNMP server group selected
• To have the password encrypted, click the Encrypt Password radio button. If you choose this option, you must enter the password as MD5 hash value.
• Indicate the type of authentication you want to use by clicking the appropriate radio button: MD5 or SHA
• In the Authentication Password field, type the password to use for authentication
• Indicate the type of encryption you want to use by clicking the appropriate radio button: DES or 3DES, or AES
• If you chose AES encryption, from the AES Size drop-down list, specify which level of AES encryption to use: 128 or 192 or 256
• In the Encryption Password field, type the password to use for encryption. The maximum number of characters allowed for this password is 64
• Click OK to create a group (if this is the first user in that group), display this group in the Group Name drop-down list, and create a user for that group. The Add SNMP User Entry dialog box closes
• The SNMPv3 Users pane lists the following information: SNMP Version 3 server group name, name of the user that belongs to the specified group, encrypted password setting, authentication setting, encryption algorithm setting, and the AES size setting
• Click Apply

With this, SNMP parameters for Version 3 are configured, and the changes are saved to the running configuration.