Cisco PIX Firewalls: Configure, Manage, & Troubleshoot

326_PIX_2e_FM.qxd

5/7/05

11:25 AM

Page i

Register for Free Membership to [email protected] Over the last few years, Syngress has published many best-selling and critically acclaimed books, including Tom Shinder’s Configuring ISA Server 2004, Brian Caswell and Jay Beale’s Snort 2.1 Intrusion Detection, and Angela Orebaugh and Gilbert Ramirez’s Ethereal Packet Sniffing. One of the reasons for the success of these books has been our unique [email protected] program. Through this site, we’ve been able to provide readers a real-time extension to the printed book. As a registered owner of this book, you will qualify for free access to our members-only [email protected] program. Once you have registered, you will enjoy several benefits, including: ■

Four downloadable e-booklets on topics related to the book. Each booklet is approximately 20-30 pages in Adobe PDF format. They have been selected by our editors from other best-selling Syngress books as providing topic coverage that is directly related to the coverage in this book.

■

A comprehensive FAQ page that consolidates all of the key points of this book into an easy-to-search Web page, providing you with the concise, easy-to-access data you need to perform your job.

■

A “From the Author” Forum that allows the authors of this book to post timely updates links to related sites, or additional topic coverage that may have been requested by readers.

Just visit us at www.syngress.com/solutions and follow the simple registration process. You will need to have this book with you when you register. Thank you for giving us the opportunity to serve your needs. And be sure to let us know if there is anything else we can do to make your job easier.

326_PIX_2e_FM.qxd

5/7/05

11:25 AM

Page ii

326_PIX_2e_FM.qxd

5/7/05

11:25 AM

Page iii

Cisco PIX Firewalls C o n f i g u r e , M a n a g e , & Tr o u b l e s h o o t

Thorsten Behrens Brian Browne Ido Dubrawsky Daniel Kligerman Michael Sweeney Charles Riley Technical Editor Umer Khan Technical Reviewer

326_PIX_2e_FM.qxd

5/7/05

11:25 AM

Page iv

Syngress Publishing, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively ìMakersî) of this book (ìthe Workî) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents.The Work is sold AS IS and WITHOUT WARRANTY.You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other incidental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable care, including backup and other appropriate precautions, when working with computers, networks, data, and files. Syngress Media®, Syngress®, “Career Advancement Through Skill Enhancement®”,“Ask the Author UPDATE®,” and “Hack Proofing®,” are registered trademarks of Syngress Publishing, Inc. “Syngress:The Definition of a Serious Security Library™,” “Mission Critical™,” and “The Only Way to Stop a Hacker is to Think Like One™” are trademarks of Syngress Publishing, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. KEY SERIAL NUMBER 001 HJIRTCV764 002 PO9873D5FG 003 829KM8NJH2 004 GHFDDD5638 005 CVPLQ6WQ23 006 VBP965T5T5 007 HJJJ863WD3E 008 2987GVTWMK 009 629MP5SDJT 010 IMWQ295T6T PUBLISHED BY Syngress Publishing, Inc. 800 Hingham Street Rockland, MA 02370 Cisco PIX Firewalls: Configure, Manage, & Troubleshoot

Copyright © 2005 by Syngress Publishing, Inc. All rights reserved. Printed in the United States of America. Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication. Printed in the United States of America 1 2 3 4 5 6 7 8 9 0 ISBN: 1-59749-004-0 EDT: 000231

Publisher: Andrew Williams Acquisitions Editor: Gary Byrne Technical Editor: Charles Riley Cover Designer: Michael Kavish

Page Layout and Art: Patricia Lupien Copy Editor: Adrienne Rebello and Beth Roberts Indexer: Julie Kawabata

Distributed by O’Reilly Media, Inc. in the United States and Canada. For information on rights and translations, contact Matt Pedersen, Director of Sales and Rights, at Syngress Publishing; email [email protected] or fax to 781-681-3585.

326_PIX_2e_FM.qxd

5/7/05

11:25 AM

Page v

Acknowledgments Syngress would like to acknowledge the following people for their kindness and support in making this book possible. Syngress books are now distributed in the United States and Canada by O’Reilly Media, Inc.The enthusiasm and work ethic at O’Reilly are incredible, and we would like to thank everyone there for their time and efforts to bring Syngress books to market:Tim O’Reilly, Laura Baldwin, Mark Brokering, Mike Leonard, Donna Selenko, Bonnie Sheehan, Cindy Davis, Grant Kikkert, Opol Matsutaro, Steve Hazelwood, Mark Wilson, Rick Brown, Leslie Becker, Jill Lothrop,Tim Hinton, Kyle Hart, Sara Winge, C. J. Rayhill, Peter Pardo, Leslie Crandell, Valerie Dow, Regina Aggio, Pascal Honscher, Preston Paull, Susan Thompson, Bruce Stewart, Laura Schmier, Sue Willing, Mark Jacobsen, Betsy Waliszewski, Dawn Mann, Kathryn Barrett, John Chodacki, Rob Bullington, and Aileen Berg. The incredibly hardworking team at Elsevier Science, including Jonathan Bunkell, Ian Seager, Duncan Enright, David Burton, Rosanna Ramacciotti, Robert Fairbrother, Miguel Sanchez, Klaus Beran, Emma Wyatt, Chris Hossack, Krista Leppiko, Marcel Koppes, Judy Chappell, Radek Janousek, and Chris Reinders for making certain that our vision remains worldwide in scope. David Buckland, Marie Chieng, Lucy Chong, Leslie Lim, Audrey Gan, Pang Ai Hua, Joseph Chan, and Siti Zuraidah Ahmad of STP Distributors for the enthusiasm with which they receive our books. David Scott, Tricia Wilden, Marilla Burgess, Annette Scott, Andrew Swaffer, Stephen O’Donoghue, Bec Lowe, Mark Langley, and Anyo Geddes of Woodslane for distributing our books throughout Australia, New Zealand, Papua New Guinea, Fiji,Tonga, Solomon Islands, and the Cook Islands.

v

326_PIX_2e_FM.qxd

5/7/05

11:25 AM

Page vi

Coauthor Mike Sweeney in his DWC’d-out Test Lab.

We would not have been able to publish this book without the professional, prompt, and friendly service provided by the great people at Duane Whitlow & Co., Inc., which provided the rented Cisco equipment that we used to write this book. As we tested the PIX 7.0 beta, we needed fast delivery of multiple boxes with very specific configurations for use in our test lab. All of the folks at DWC made sure that we had exactly what we needed, when we needed it, and where we needed it. No problems. No hassles. We would like to extend a special thank you to Duane, Conrad, and the rest of the DWC team. —Syngress Publishing

Duane Whitlow & Co., Inc. Since 1977, Duane Whitlow & Co. Inc. has specialized in providing both new and used IBM and plug-compatible computer equipment to computer users worldwide. In these ever-changing times, recent focus has centered on buy, sell, lease, and short-term rental of used Cisco System networking equipment. Meeting specific needs using multiple platforms and systems integration is our specialty. For example: Short-term rentals of Cisco System Products for corporate customers, training companies and students studying for their Cisco Certification are unique programs from DWC that are specifically designed for those special needs.

Duane Whitlow & Co., Inc. www.dwc-computer.com 4950 Keller Springs Rd., Ste 415 Addison, TX 75001 Phone 800/977-7473 or 972/931-3001 Fax 972/931-3340 email: [email protected] or [email protected]

326_PIX_2e_FM.qxd

5/7/05

11:25 AM

Page vii

Technical Editor and Foreword Contributor

Charles Riley, along with Methuselah, has spent some time specializing in networking and security. He remembers reverse engineering Basic code to enlarge the ship in Canyon Cruiser on the Commodore 64, causing its wings to scrape the pixilated walls. Shortly afterward, he was forced to resign from the middle school computer club. Had there been appropriate security in place at the time, life might have taken a different turn. The career of Charles spans decades, starting as a young cowherd at the tender age of 6. At less than 4 feet tall, and while other children were watching Captain Kangaroo, Charles was herding several tons of walking, unpredictable beef into a large barn. From there, it was a logical transition to herding packets through a network, and sheltering them behind a firewall. Charles has coauthored and edited several books, including Routing and Configuring Cisco Voice over IP, Second Edition, and The Best Damn Cisco Internetworking Book Period (Syngress Publishing, ISBN: 1-931836-91-4). He has designed and implemented robust networking solutions for large Fortune 500 and privately held companies. Charles started as an U.S. Army telecommunications specialist at Fort Huachuca, Arizona, eventually finishing his Army career as the network manager of the 7th Army Training Command in Grafenwoehr, Germany. Charles graduated from the University of Central Florida in 1989. He’d like express his gratitude and love to his beloved wife, Rene’. Her belief and love lifted him to greater heights than he ever thought possible. Rene’ first saw the writer in the cowherd, and then proceeded to make everything wonderful.To his daughter,Tess, who has the potential to soar so high; he is eagerly looking forward to seeing you do so. He wishes to thank you both for the time and support.

326_PIX_2e_FM.qxd

5/7/05

11:25 AM

Page viii

Contributing Authors Michael Sweeney (CCNA, CCDA, CCNP, MCSE, SCP) is the owner of the Network Security consulting firm Packetattack.com. Packetattack.com specialties are network design and troubleshooting, wireless network design, security, and analysis.The Packetattack team uses such industry standard tools as NAI Sniffer, AiroPeekNX, and Airmagnet. Packetattack.com also provides digital forensic analysis services. Michael has been a contributing author for Syngress for the books Cisco Security Specialist Guide to PIX Firewalls, ISBN: 1-931836-63-9; Cisco Security Specialist Guide to Secure Intrusion Detection Systems, ISBN: 1-932266-69-0; and Building DMZs For Enterprise Networks, ISBN: 1-931836-88-4.Through PacketPress, Michael has also published Securing Your Network Using Linux, ISBN: 1-411621-77-8. Michael graduated from the University of California, Irvine, extension program with a certificate in communications and network engineering. Michael currently resides in Orange, CA, with his wife, Jeanne, and daughters, Amanda and Sara.

Brian Browne (CISSP) is the Principal Consultant with Edoxa, Inc., and provides both strategic and technical information security consulting. He has 14 years of experience in the field of information security and is skilled in all phases, from security management through hands-on implementation. His specific security experience includes Sarbanes-Oxley and HIPAA gap analysis and remediation, vulnerability assessments, network security, firewall architecture, virtual private networks (VPN), UNIX security, Windows Active Directory security, and public key infrastructure (PKI). He also conducts application performance assessments and network capacity planning using Opnet IT Guru. Brian resides in Willow Grove, PA, with his wife, Lisa and daughter, Marisa. viii

326_PIX_2e_FM.qxd

5/7/05

11:25 AM

Page ix

Daniel Kligerman (B.Sc, CCSE, CCIE #13999) is the Manager of the Data Diagnostic Centre at TELUS National Systems, responsible for the support and management of enterprise customers’ data and VoIP networks. Daniel was the technical editor of Check Point Next Generation with Application Intelligence Security Administration (Syngress, ISBN: 1-932266-89-5) and the contributing author of Building DMZs for Enterprise Networks (Syngress, ISBN: 1-931836-88-4), Check Point NG VPN-1/Firewall-1 Advanced Configuration and Troubleshooting (Syngress, ISBN: 1-931836-97-3), Nokia Network Security Solutions Handbook (Syngress, ISBN: 1-931836-70-1), and Check Point Next Generation Security Administration (Syngress, ISBN: 1-928994-74-1). He resides in Toronto, Canada, with his wife, Merita.

Thorsten Behrens (CCMSE, CCSE+, CCNA, CNE) is a Senior Security Engineer with Integralis’ Managed Security Services Team.Thorsten’s specialties include Check Point FireWall-1, Cisco PIX, and ISS RealSecure.Thorsten is a German national who delights his neighbors in Springfield, MA, with bagpipe practice sessions.

Ido Dubrawsky (CCNA, CCDA, SCSA, CISSP) is a Senior Security Consultant with SBC’s Callisma consulting practice. Previously, Ido was a Network Security Architect working in the SAFE architecture group of Cisco Systems, Inc. His responsibilities include research into network security design and implementation. Previously, Ido was a member of Cisco’s Secure Consulting Services in Austin,TX, where he conducted security posture assessments and penetration tests for clients as well as provided technical consulting for security design reviews. Ido was one of the codevelopers of the Secure Consulting Services wireless network assessment toolset. His strengths include Cisco routers and switches, PIX firewalls, the Cisco Intrusion Detection System, and the Solaris operating system. His specific interests are in ix

326_PIX_2e_FM.qxd

5/7/05

11:25 AM

Page x

vulnerability assessments, penetration testing, freeware detection systems, and network performance monitoring. Ido holds bachelor’s and master’s degrees from the University of Texas at Austin in Aerospace Engineering and is a longtime member of USENIX and SAGE. He has written numerous articles covering Solaris security and network security for Sysadmin as well as the online SecurityFocus. He is a contributor to Hack Proofing Sun Solaris 8 (Syngress Publishing, ISBN: 1-928994-44-X) and Hack Proofing Your Network, Second Edition (Syngress, ISBN: 1-928994-70-9). He currently resides in Silver Spring, MD, with his family.

Technical Reviewer and Contributor Umer Khan (CCIE #7410, MCSE, SCSA, SCNA, CCA, SCE, CNX) is the Manager of Networking,Telecommunications, and Windows Infrastructure at Broadcom Corporation (www.broadcom.com), where he enjoys the challenging and fast-paced IT environment. Umer’s teams are responsible for the design, implementation, and support of a broad range of Broadcom’s global IT infrastructure, some of which include LAN, MAN, WAN, 802.11 wireless, PBX, VoIP, VPN, firewall, cellular, Windows server, Active Directory, Citrix, Microsoft Exchange, SQL, IIS, Biztalk, VMware, authentication, content load balancing, caching, audio/video conferencing, and audio/video distribution technologies. Umer has contributed toward several publications, including the Sun Certified System Administrator for Solaris 8 Study Guide (ISBN: 007-212369-9) and Sniffer Pro: Network Optimization and Troubleshooting Handbook (Syngress, ISBN: 1-93-183657-4). He was also the technical editor for Cisco Security Specialist’s Guide to PIX Firewalls (Syngress, ISBN: 1-931836-63-9). Umer completed his bachelor’s in computer engineering at Illinois Institute of Technology. His personal Web site is located at www.umer-khan.net.

x

326_PIX_2e_TOC.qxd

5/7/05

2:12 PM

Page xi

Contents

Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxv Chapter 1 Introduction to Security and Firewalls . . . . . .1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2 The Importance of Security . . . . . . . . . . . . . . . . . . . . . . . . .2 What Is Information Security? . . . . . . . . . . . . . . . . . . . . .2 The Early Days of Information Security . . . . . . . . . . . . . .4 Insecurity and the Internet . . . . . . . . . . . . . . . . . . . . . . .4 The Threats Grow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5 Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6 Creating a Security Policy . . . . . . . . . . . . . . . . . . . . . . . . . . .8 Cisco’s Security Wheel . . . . . . . . . . . . . . . . . . . . . . . . . . . .10 Securing the Environment . . . . . . . . . . . . . . . . . . . . . . .11 Monitoring Activity . . . . . . . . . . . . . . . . . . . . . . . . . . .13 Testing Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13 Improving Security . . . . . . . . . . . . . . . . . . . . . . . . . . . .15 Firewall Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15 What Is a Firewall? . . . . . . . . . . . . . . . . . . . . . . . . . . . .16 Types of Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18 Packet Filters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18 Stateful Inspection Packet Filters . . . . . . . . . . . . . . . .19 Application Proxies . . . . . . . . . . . . . . . . . . . . . . . . . .20 Inbound and Outbound . . . . . . . . . . . . . . . . . . . . . . . .21 Firewall Interfaces: Inside, Outside, and DMZ . . . . . . . . .22 Firewall Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24 Address Translation . . . . . . . . . . . . . . . . . . . . . . . . . . . .25 Static Translation . . . . . . . . . . . . . . . . . . . . . . . . . . . .26 Dynamic Translation . . . . . . . . . . . . . . . . . . . . . . . . .27 Port Address Translation . . . . . . . . . . . . . . . . . . . . . .28 xi

326_PIX_2e_TOC.qxd

xii

5/7/05

2:12 PM

Page xii

Contents

Virtual Private Networking . . . . . . . . . . . . . . . . . . . . . .28 Cisco Security Certifications . . . . . . . . . . . . . . . . . . . . . . . .30 Cisco Firewall Specialist . . . . . . . . . . . . . . . . . . . . . . . . .30 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .30 Cisco Certified Security Professional . . . . . . . . . . . . . . .31 Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31 Cisco Certified Internetwork Expert Security . . . . . . . .32 The Qualification (Written) Exam . . . . . . . . . . . . . .32 The Lab Exam . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32 The CSPFA Exam . . . . . . . . . . . . . . . . . . . . . . . . . . . .34 Exam Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . .34 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .37 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . .39 Chapter 2 Introduction to PIX Firewalls . . . . . . . . . . . .41 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .42 Cisco PIX Version 7.0 . . . . . . . . . . . . . . . . . . . . . . . . . . . .42 Major Changes to Cisco PIX 7.0 . . . . . . . . . . . . . . . . . .43 What’s New in PIX 7.0? . . . . . . . . . . . . . . . . . . . . . . . . . . .44 Commands New to 7.0 . . . . . . . . . . . . . . . . . . . . . . . . . . .44 Modified Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45 What Commands Do We Bid Farewell To? . . . . . . . . . . . . .45 PIX Firewall Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . .45 Embedded Operating System . . . . . . . . . . . . . . . . . . . . .46 The Adaptive Security Algorithm . . . . . . . . . . . . . . . . .46 State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48 Security Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50 How ASA Works . . . . . . . . . . . . . . . . . . . . . . . . . . .50 Technical Details for ASA . . . . . . . . . . . . . . . . . . . . .51 User Datagram Protocol . . . . . . . . . . . . . . . . . . . . . .55 Advanced Protocol Handling . . . . . . . . . . . . . . . . . . . . .56 VPN Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57 URL Filtering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .58 Address Translation . . . . . . . . . . . . . . . . . . . . . . . . . . . .58 High Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . .58 PIX Hardware . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59

326_PIX_2e_TOC.qxd

5/7/05

2:12 PM

Page xiii

Contents

Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59 PIX 501 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .61 PIX 506E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .61 PIX 515E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62 PIX 525 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .62 PIX 535 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .63 Cisco Firewall Services Module . . . . . . . . . . . . . . . . .63 Software Licensing and Upgrades . . . . . . . . . . . . . . . . . . . .63 Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .64 Upgrading Software . . . . . . . . . . . . . . . . . . . . . . . . . . .66 Preliminary Upgrade to 6.3 . . . . . . . . . . . . . . . . . . .67 Upgrade from 6.3 to 7.0 Code . . . . . . . . . . . . . . . . .69 Downgrading from 7.0 to 6.3 . . . . . . . . . . . . . . . . . .74 Management Access . . . . . . . . . . . . . . . . . . . . . . . . . . .75 Console Port . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .75 USB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77 Telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77 SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77 Web . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77 Password Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . .78 Command-Line Interface . . . . . . . . . . . . . . . . . . . . . . .80 Administrative Access Modes . . . . . . . . . . . . . . . . . . .80 Basic Commands . . . . . . . . . . . . . . . . . . . . . . . . . . .83 Hostname and Domain Name . . . . . . . . . . . . . . . . . .84 Configuring Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . .85 The interface Command . . . . . . . . . . . . . . . . . . . . . .85 The nameif Command . . . . . . . . . . . . . . . . . . . . . . .86 The security-level Command . . . . . . . . . . . . . . . . . .86 The ip address Command . . . . . . . . . . . . . . . . . . . . .86 Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .87 Password Configuration . . . . . . . . . . . . . . . . . . . . . .89 Basic Security (What Is Configured by Default Out of the Box) . . . . . . . . . . . . . . . . . . . . . . . . . . . .90 Managing Configurations . . . . . . . . . . . . . . . . . . . . . . .90 Configuration Commands . . . . . . . . . . . . . . . . . . . . .90 Configure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90

xiii

326_PIX_2e_TOC.qxd

xiv

5/7/05

2:12 PM

Page xiv

Contents

Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91 Copy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .91 Show . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .92 The configure Command . . . . . . . . . . . . . . . . . . . . .94 Initializing Images . . . . . . . . . . . . . . . . . . . . . . . . . . . .95 Powercycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95 Reload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95 Factory Default Configurations . . . . . . . . . . . . . . . . . . .95 Cisco Catalyst 6500 Series Firewall Services Module .98 IP Version 6 (IPv6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .99 IPv4 vs. IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .99 Header Comparison . . . . . . . . . . . . . . . . . . . . . . . .100 IPv6 Addresses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .100 IPv6 Address Space . . . . . . . . . . . . . . . . . . . . . . . . . . .102 The Fundamentals of IPv6 Addresses . . . . . . . . . . . . . .103 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .106 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .108 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .110 Chapter 3 PIX Firewall Operations . . . . . . . . . . . . . . . .113 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .114 Security Contexts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .115 The Bare Minimum: Outbound Traffic . . . . . . . . . . . . . . .117 Configuring Dynamic Address Translation . . . . . . . . . .117 Blocking Outbound Traffic (Defining an Access List) . .122 Access Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .122 Opening Your Network: Allowing Inbound Traffic . . . . . . .130 Static Address Translation . . . . . . . . . . . . . . . . . . . . . . .130 Access Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .132 ICMP Access Lists . . . . . . . . . . . . . . . . . . . . . . . . .133 Port Redirection . . . . . . . . . . . . . . . . . . . . . . . . . . .135 Enabling/Disabling of ACL Entries (New) . . . . . . . .136 Outbound ACLs (New) . . . . . . . . . . . . . . . . . . . . . . . . . .137 Time-Based ACLs (New) . . . . . . . . . . . . . . . . . . . . . . . . .139 NAT Control (New) . . . . . . . . . . . . . . . . . . . . . . . . . . . . .141 Bypassing NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .141 Identity NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .142

326_PIX_2e_TOC.qxd

5/7/05

2:12 PM

Page xv

Contents

NAT Exemption . . . . . . . . . . . . . . . . . . . . . . . . . . . . .142 Static Identity NAT . . . . . . . . . . . . . . . . . . . . . . . . . . .143 Policy NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .144 Object Grouping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .145 Configuring and Using Object Groups . . . . . . . . . . . . .146 ICMP-Type Object Groups . . . . . . . . . . . . . . . . . .146 Network Object Groups . . . . . . . . . . . . . . . . . . . . .147 Protocol Object Groups . . . . . . . . . . . . . . . . . . . . .147 Service Object Groups . . . . . . . . . . . . . . . . . . . . . .148 TurboACLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .149 Conduit and Outbound . . . . . . . . . . . . . . . . . . . . . . . .150 Case Study . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .150 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .156 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .158 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .159 Chapter 4 Adaptive Security Device Manager . . . . . . .161 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .162 Features, Limitations, and Requirements . . . . . . . . . . . . . . .162 Supported PIX Firewall Hardware and Software Versions 163 PIX Device Requirements . . . . . . . . . . . . . . . . . . .163 Host Requirements for Running ASDM . . . . . . . . .164 Adaptive Security Device Manager Limitations . . . . . . .164 Unsupported Commands . . . . . . . . . . . . . . . . . . . .164 Unsupported Characters . . . . . . . . . . . . . . . . . . . . .165 ASDM CLI Does Not Support Interactive Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .165 Printing from ASDM . . . . . . . . . . . . . . . . . . . . . . .166 Installing, Configuring, and Launching ASDM . . . . . . . . . .166 Preparing for Installation . . . . . . . . . . . . . . . . . . . . . . .166 Installing or Upgrading ASDM . . . . . . . . . . . . . . . . . .167 Obtaining a DES Activation Key . . . . . . . . . . . . . . .167 Configuring the PIX Firewall for Network Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . . . .168 Installing a TFTP Server . . . . . . . . . . . . . . . . . . . . .168 Upgrading the PIX Firewall and Configuring the DES Activation Key . . . . . . . . . . . . . . . . . . . . .168

xv

326_PIX_2e_TOC.qxd

xvi

5/7/05

2:12 PM

Page xvi

Contents

Installing or Upgrading ASDM on the PIX Device .169 Enabling and Disabling ASDM . . . . . . . . . . . . . . . . . . .170 Launching ASDM . . . . . . . . . . . . . . . . . . . . . . . . . . . .171 Configuring the PIX Firewall Using ASDM . . . . . . . . . . . .182 Using the Startup Wizard . . . . . . . . . . . . . . . . . . . . . .182 Configuring System Properties . . . . . . . . . . . . . . . . . . .187 The AAA Menu . . . . . . . . . . . . . . . . . . . . . . . . . . .189 The Advanced Menu . . . . . . . . . . . . . . . . . . . . . . .191 The ARP Static Table Menu . . . . . . . . . . . . . . . . . .195 The Auto Update Menu . . . . . . . . . . . . . . . . . . . . .195 The DHCP Services Menu . . . . . . . . . . . . . . . . . . .196 The DNS Client Menu . . . . . . . . . . . . . . . . . . . . .198 The Failover Menu . . . . . . . . . . . . . . . . . . . . . . . . .199 The History Metrics Category . . . . . . . . . . . . . . . .201 The IP Audit Menu . . . . . . . . . . . . . . . . . . . . . . . .201 The Logging Menu . . . . . . . . . . . . . . . . . . . . . . . .203 The Priority Queue Category . . . . . . . . . . . . . . . . .207 The SSL Category . . . . . . . . . . . . . . . . . . . . . . . . .208 The SunRPC Server Category . . . . . . . . . . . . . . . .208 The URL Filtering Category . . . . . . . . . . . . . . . . .208 Configuring VPNs Using ASDM . . . . . . . . . . . . . . . . . . . .210 Configuring a Site-to-Site VPN Using ASDM . . . . . . .210 Configuring a Remote Access VPN Using ASDM . . . .216 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .225 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .226 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .227 Chapter 5 Application Inspection . . . . . . . . . . . . . . . .229 New Features in PIX 7.0 . . . . . . . . . . . . . . . . . . . . . . . . .230 Supporting and Securing Protocols . . . . . . . . . . . . . . . . . .230 TCP, UDP, ICMP, and the PIX Firewall . . . . . . . . . . . .231 Application Layer Protocol Inspection . . . . . . . . . . . . . . . .234 Defining a Traffic Class . . . . . . . . . . . . . . . . . . . . . . . .235 Associating a Traffic Class with an Action . . . . . . . . . . .239 Customizing Application Inspection Parameters . . . . . .240 Applying Inspection to an Interface . . . . . . . . . . . . . . .240

326_PIX_2e_TOC.qxd

5/7/05

2:12 PM

Page xvii

Contents

Domain Name Service . . . . . . . . . . . . . . . . . . . . . .240 Remote Procedure Call . . . . . . . . . . . . . . . . . . . . .241 SQL*Net . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .243 Internet Locator Service and Lightweight Directory Access Protocol . . . . . . . . . . . . . . . . . . . .244 HTTP Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . .245 FTP Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .246 Active versus Passive Mode . . . . . . . . . . . . . . . . . . .246 ESMTP Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . .249 ICMP Inspection . . . . . . . . . . . . . . . . . . . . . . . . . . . .250 H.323 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .250 Simple Network Management Protocol (SNMP) . . .251 Voice and Video Protocols . . . . . . . . . . . . . . . . . . . . . .252 SIP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .252 CTIQBE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .252 SCCP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .253 Real-Time Streaming Protocol (RTSP), NetShow, and VDO Live . . . . . . . . . . . . . . . . . . . . . . . . . . . .253 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .254 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .255 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .256 Chapter 6 Filtering, Intrusion Detection, and Attack Management . . . . . . . . . . . . . . . . . . . . . . . . . .259 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .260 Filtering Web and FTP Traffic . . . . . . . . . . . . . . . . . . . . . .260 Filtering URLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .260 Websense and Sentian by N2H2 . . . . . . . . . . . . . . .261 Fine-Tuning and Monitoring the Filtering Process . .262 Configuring HTTP URL Filtering . . . . . . . . . . . . .266 Configuring HTTPS Filtering . . . . . . . . . . . . . . . . .267 Setting Up FTP Filtering . . . . . . . . . . . . . . . . . . . .267 Active Code Filtering . . . . . . . . . . . . . . . . . . . . . . . . .268 Filtering Java Applets . . . . . . . . . . . . . . . . . . . . . . . .269 Filtering ActiveX Objects . . . . . . . . . . . . . . . . . . . .270 Virus Filtering; Spam, Adware, Malware, and Other-Ware Filtering . . . . . . . . . . . . . . . . . . . . . . .270

xvii

326_PIX_2e_TOC.qxd

xviii

5/7/05

2:12 PM

Page xviii

Contents

TCP Attack Detection and Response . . . . . . . . . . . . . .271 PIX Intrusion Detection . . . . . . . . . . . . . . . . . . . . . . . . . .273 Supported Signatures . . . . . . . . . . . . . . . . . . . . . . . . . .273 Configuring Intrusion Detection/Auditing . . . . . . . . . .276 Disabling Signatures . . . . . . . . . . . . . . . . . . . . . . . . . . .278 Configuring Shunning . . . . . . . . . . . . . . . . . . . . . . . . .279 Attack Containment and Management . . . . . . . . . . . . . . . .279 Placing Limits on Fragmentation . . . . . . . . . . . . . . . . .279 SYN FloodGuard . . . . . . . . . . . . . . . . . . . . . . . . . . . .281 The TCP Intercept Feature . . . . . . . . . . . . . . . . . . .281 Preventing IP Spoofing . . . . . . . . . . . . . . . . . . . . . . . .282 Other Ways the PIX Can Prevent, Contain, or Manage Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .283 Configuring Connection Limits and Timeouts . . . . .283 Preventing MAC Address Spoofing . . . . . . . . . . . . .284 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .286 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .286 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .288 Chapter 7 Services . . . . . . . . . . . . . . . . . . . . . . . . . . . .289 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .290 DHCP Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . .290 DHCP Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .290 Cisco IP Phone-Related Options . . . . . . . . . . . . . .292 DHCP Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .293 DHCP Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .293 PPPoE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .294 EasyVPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .297 EasyVPN Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . .297 Routing and the PIX Firewall . . . . . . . . . . . . . . . . . . . . . .298 Unicast Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . . .298 Static Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . .299 RIP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .300 OSPF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .301 Network Address Translation as a Routing Mechanism 302 Multicast Routing . . . . . . . . . . . . . . . . . . . . . . . . . . . .302 Stub Multicast Routing . . . . . . . . . . . . . . . . . . . . . .303

326_PIX_2e_TOC.qxd

5/7/05

2:12 PM

Page xix

Contents

PIM Multicast Routing . . . . . . . . . . . . . . . . . . . . .304 BGP through PIX Firewall . . . . . . . . . . . . . . . . . . . . .304 Queuing and Policing . . . . . . . . . . . . . . . . . . . . . . . . . . . .305 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .306 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .306 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .308 Chapter 8 Configuring Authentication, Authorization, and Accounting . . . . . . . . . . . . . . . . . .309 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .310 New and Changed Commands in 7.0 . . . . . . . . . . . . .310 Introducing AAA Concepts . . . . . . . . . . . . . . . . . . . . . . . .311 Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .314 Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .315 Accounting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .315 AAA Security Protocols . . . . . . . . . . . . . . . . . . . . . . .315 RADIUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .315 How RADIUS Works . . . . . . . . . . . . . . . . . . . . . .316 TACACS+ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .318 How TACACS+ Works . . . . . . . . . . . . . . . . . . . . .319 Optional Security Protocols and Methods . . . . . . . .321 AAA Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .322 Configuring Console Authentication . . . . . . . . . . . . . . . . .322 Configuring Local Authentication . . . . . . . . . . . . . . . .323 Configuring Local AAA Using the ASDM . . . . . . . .326 Configuring Command Authorization . . . . . . . . . . . . . . . .326 Configuring Local Command Authorization . . . . . . . .328 Configuring TACACS+ and RADIUS Console Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .329 Configuring TACACS+ Command Authorization . . . .333 Configuring Authentication for Traffic through the Firewall 337 Configuring Cut-through Proxy . . . . . . . . . . . . . . . . .337 Virtual HTTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .340 Virtual Telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .342 Configuring Authorization for Traffic through the Firewall 343 Configuring Accounting for Traffic through the Firewall . . .344 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .346

xix

326_PIX_2e_TOC.qxd

xx

5/7/05

2:12 PM

Page xx

Contents

Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .347 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .349 Chapter 9 PIX Firewall Management . . . . . . . . . . . . . .351 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .352 Configuring Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . .352 Logging Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .353 Dropped and Changed Syslog Messages from 6.x . . . . .354 Logging Facility . . . . . . . . . . . . . . . . . . . . . . . . . . . . .362 Local Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .363 Buffered Logging . . . . . . . . . . . . . . . . . . . . . . . . . .363 Console Logging . . . . . . . . . . . . . . . . . . . . . . . . . .364 Terminal Logging . . . . . . . . . . . . . . . . . . . . . . . . . .364 Remote Logging via Syslog . . . . . . . . . . . . . . . . . . . . .365 Disabling Specific Syslog Messages . . . . . . . . . . . . . . . .370 Configuring Remote Access . . . . . . . . . . . . . . . . . . . . . . .371 Secure Shell . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .372 Enabling SSH Access . . . . . . . . . . . . . . . . . . . . . . . .372 Troubleshooting SSH . . . . . . . . . . . . . . . . . . . . . . .377 Telnet . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .379 Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .381 Configuring Simple Network Management Protocol . . . . .381 Configuring System Identification . . . . . . . . . . . . . . . .382 Configuring Polling . . . . . . . . . . . . . . . . . . . . . . . . . . .383 Configuring Traps . . . . . . . . . . . . . . . . . . . . . . . . . . . .385 Managing SNMP on the PIX . . . . . . . . . . . . . . . . . . .386 Configuring System Date and Time . . . . . . . . . . . . . . . . . .387 Setting and Verifying the Clock and Time Zone . . . . . .387 Configuring and Verifying the Network Time Protocol 390 NTP Authentication . . . . . . . . . . . . . . . . . . . . . . . .392 Management Using the Cisco PIX Adaptive Security Device Manager (ASDM) . . . . . . . . . . . . . . . .394 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .397 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .398 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .399

326_PIX_2e_TOC.qxd

5/7/05

2:12 PM

Page xxi

Contents

Chapter 10 Configuring Virtual Private Networking 401 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .402 What’s New in PIX 7.0 . . . . . . . . . . . . . . . . . . . . . . . . . .403 IPsec Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .403 IPsec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .404 Internet Key Exchange . . . . . . . . . . . . . . . . . . . . . .408 Security Associations . . . . . . . . . . . . . . . . . . . . . . . .411 Certificate Authority Support . . . . . . . . . . . . . . . . .415 Configuring a Site-to-Site VPN . . . . . . . . . . . . . . . . . . . .416 Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .416 Allowing IPsec Traffic . . . . . . . . . . . . . . . . . . . . . . .418 Enabling IKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . .418 Creating an ISAKMP Protection Suite . . . . . . . . . .419 Defining an ISAKMP Preshared Key . . . . . . . . . . . .420 Configuring Certificate Authority Support . . . . . . .420 Configuring Crypto Access-Lists . . . . . . . . . . . . . . .427 Defining a Transform Set . . . . . . . . . . . . . . . . . . . .429 Bypassing Network Address Translation . . . . . . . . . .430 Configuring a Crypto Map . . . . . . . . . . . . . . . . . . .430 Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . .432 Remote Access—Configuring Support for the Cisco Software VPN Client . . . . . . . . . . . . . . . . . . . . . . . . . . . .433 Enabling IKE and Creating an ISAKMP Protection Suite 434 Defining a Transform Set . . . . . . . . . . . . . . . . . . . . . . .435 Crypto Maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .435 Tunnel Groups and Group Policies . . . . . . . . . . . . . . . .436 Address Pool Configuration . . . . . . . . . . . . . . . . . . . . .436 Split Tunneling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .437 NAT Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .438 Authentication against Radius,TACACS+, SecurID, or Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . .438 Automatic Client Update . . . . . . . . . . . . . . . . . . . . . .439 Configuring Client Firewall Requirements . . . . . . . . . .439 Sample Configurations of PIX and VPN Clients . . . . . .440 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .444 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .444 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .446

xxi

326_PIX_2e_TOC.qxd

xxii

5/7/05

2:12 PM

Page xxii

Contents

Chapter 11 Configuring Failover . . . . . . . . . . . . . . . . .447 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .448 Failover Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .448 Failover Requirements . . . . . . . . . . . . . . . . . . . . . . . . .448 Active/Standby and Active/Active Failover . . . . . . . . . .449 The Failover Link . . . . . . . . . . . . . . . . . . . . . . . . . . . .451 Stateful Failover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .452 Failure Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . .454 Configuration Synchronization, and Command Replication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .455 IP and MAC Addresses Used . . . . . . . . . . . . . . . . . . . .456 Configuring and Monitoring Failover . . . . . . . . . . . . . . . .458 Configuring and Monitoring Cable-Based Active/ Standby Failover . . . . . . . . . . . . . . . . . . . . . . . . . . . . .458 Configuring and Monitoring LAN-Based Active/ Standby Failover . . . . . . . . . . . . . . . . . . . . . . . . . . . . .465 Configuring Cable-Based Active/Active Failover . . . . .468 Configuring LAN-Based Active/Active Failover . . . . . .469 Advanced Failover Control and Configurations . . . . . . . . .469 Forcing Failover . . . . . . . . . . . . . . . . . . . . . . . . . . . . .470 Disabling Failover . . . . . . . . . . . . . . . . . . . . . . . . . . . .470 Failover Authentication and Encryption . . . . . . . . . . . .470 HTTP Replication . . . . . . . . . . . . . . . . . . . . . . . . . . .471 Failure Detection Parameters . . . . . . . . . . . . . . . . . . . .471 Failover Preemption . . . . . . . . . . . . . . . . . . . . . . . . . .473 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .473 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .474 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .476 Chapter 12 Troubleshooting and Performance Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .477 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .478 Troubleshooting Hardware and Cabling . . . . . . . . . . . . . . .479 Troubleshooting PIX Hardware . . . . . . . . . . . . . . . . . .480 Troubleshooting PIX Cabling . . . . . . . . . . . . . . . . . . .491 Troubleshooting Connectivity . . . . . . . . . . . . . . . . . . . . . .494 Checking Addressing . . . . . . . . . . . . . . . . . . . . . . . . . .495

326_PIX_2e_TOC.qxd

5/7/05

2:12 PM

Page xxiii

Contents

Checking Routing . . . . . . . . . . . . . . . . . . . . . . . . . . .497 Failover Cable . . . . . . . . . . . . . . . . . . . . . . . . . . . .501 Checking Translation . . . . . . . . . . . . . . . . . . . . . . . . . .502 Checking Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . .505 Troubleshooting IPsec . . . . . . . . . . . . . . . . . . . . . . . . . . . .507 IKE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .509 IPsec . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .512 Capturing Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .515 Displaying Captured Traffic . . . . . . . . . . . . . . . . . . . . .516 Display on the Console . . . . . . . . . . . . . . . . . . . . . .516 Display to a Web Browser . . . . . . . . . . . . . . . . . . . .517 Downloading Captured Traffic . . . . . . . . . . . . . . . . . . .517 Support Options as Troubleshooting Tools . . . . . . . .518 Monitoring and Troubleshooting Performance . . . . . . . . . .519 CPU Performance Monitoring . . . . . . . . . . . . . . . . . .520 The show cpu usage Command . . . . . . . . . . . . . . .521 The show processes Command . . . . . . . . . . . . . . . .521 The show perfmon Command . . . . . . . . . . . . . . . .523 Memory Performance Monitoring . . . . . . . . . . . . . . . .524 The show memory Command . . . . . . . . . . . . . . . .525 The show xlate Command . . . . . . . . . . . . . . . . . . .525 The show conn Command . . . . . . . . . . . . . . . . . . .525 The show block Command . . . . . . . . . . . . . . . . . . .526 Network Performance Monitoring . . . . . . . . . . . . . . . .526 The show interface Command . . . . . . . . . . . . . . . .526 The show traffic Command . . . . . . . . . . . . . . . . . .527 Identification (IDENT) Protocol and PIX Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .527 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .529 Solutions Fast Track . . . . . . . . . . . . . . . . . . . . . . . . . . . . .530 Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . .531 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .533 Note: Throughout this book, italics or angled brackets <,> indicate specific information or values (IP addresses, port numbers, etc.) with must be filled in for your specific configuration.

xxiii

326_PIX_2e_TOC.qxd

5/7/05

2:12 PM

Page xxiv

326_PIX_2e_Fore.qxd

5/7/05

3:59 PM

Page xxv

Foreword

“Always do right. This will gratify some of the people and astonish the rest.”—Mark Twain “Always firewall. That will inconvenience some of the attackers and impede the rest.”—Charles Riley (apologies to Mr. Twain)

You hold in your hand a book that was given life to aid our fellow security professionals, our brothers and sisters in the trenches of information warfare engaged in protecting the information and networks in their charge. But you are not alone; the tools in the endless war between protectors of the information and the attackers who would own that information have advanced and improved greatly.Witness the overhaul of the PIX operating system in version 7.0, the main subject of this book. Version 7.0 makes many improvements to the code, including adding longdesired features.Version 7.0 also gives the “Old Yeller” treatment to commands that are no longer relevant or can no longer do the job. For example, the conduit command with its awkward syntax is no more. Cisco has made the commands more like its mainstream IOS, although there are a few holdouts that mark version 7.0 as a PIX operating system.These commands are among many detailed in this book. Each chapter has been carefully organized and developed to provide maximum coverage of version 7.0. In assembling this book, the mission of our team was to provide you, our reader, with a font of information that will allow you to master 7.0 and use it for your own purposes.The result is the 12 chapters that make up this book: Chapter 1 Introduction to Security and Firewalls Chapter 2 Introduction to PIX Firewalls Chapter 3 PIX Firewall Operations Chapter 4 Adaptive Security Device Manager xxv

326_PIX_2e_Fore.qxd

xxvi

5/7/05

3:59 PM

Page xxvi

Foreword

Chapter 5 Application Inspection Chapter 6 Filtering, Intrusion Detection, and Attack Management Chapter 7 Services Chapter 8 Configuring Authentication, Authorization, and Accounting Chapter 9 PIX Firewall Management Chapter 10 Configuring Virtual Private Networking Chapter 11 Configuring Failover Chapter 12 Troubleshooting and Performance Monitoring Version 7.0 introduces contexts, something that might be new to many readers. PIX firewalls running 7.0 can run either in routed mode (where they are aware of and participate in IP routing) or in transparent mode where the firewall silently performs its function, but is not seen as a hop in the path to a destination. Contexts are just one of the many changes that Cisco made to version 7.0. For more, read on—and thank you for being part of the vanguard of information security.When it comes to protecting your networks and data, Shakespeare put it best in Henry V: From this day to the ending of the world, But we in it shall be remember’d; We few, we happy few, we band of brothers; For he to-day that sheds his blood with me Shall be my brother; be he ne’er so vile, This day shall gentle his condition: And gentlemen in England now a-bed Shall think themselves accursed they were not here, And hold their manhoods cheap whiles any speaks

—Charles Riley HoH Consultants LLC

www.syngress.com

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 1

Chapter 1

Introduction to Security and Firewalls Solutions in this chapter: ■

The Importance of Security

■

Creating a Security Policy

■

Cisco’s Security Wheel

■

Firewall Concepts

■

Cisco Security Certifications


Summary
Solutions Fast Track
Frequently Asked Questions 1

326_PIX_2e_01.qxd

2

5/6/05

12:40 PM

Page 2

Chapter 1 • Introduction to Security and Firewalls

Introduction In an age where our society relies so heavily on electronic communication, the need for information security is continuously increasing. Given the value and confidential nature of the information that exists on today’s networks, CIOs are investing very heavily in security. Without security, a company can suffer from theft or alteration of data, legal ramifications, and other issues that all result in monetary losses. Consequently, corporations are realizing the need to create and enforce an information security policy. Furthermore, companies are now experiencing significant pressure from external regulators and governance rules such as Sarbanes-Oxley. In this chapter, you will learn about why information security is necessary. We also look at how and why security policies are created and how security needs to be handled as a process. We look at firewalls in general, explore the different types of firewalls available in the market, and learn basic concepts about how firewalls work. Finally, we discuss the three relevant security certifications that Cisco offers in the context of PIX firewalls: the Cisco Firewall Specialist, the Cisco Certified Security Professional (CCSP), and the Cisco Certified Internet Expert (CCIE) Security.

The Importance of Security Over the last couple of decades, many companies began to realize that their most valuable assets were not only their buildings or factories, but also the intellectual property and other information that flowed internally within the company, as well as outwardly to suppliers and customers. Company managers, used to dealing with risk in their business activities, started to think about what might happen if their key business information fell into the wrong hands, perhaps a competitor’s. For a while, this risk was not too large, due to how and where that information was stored. Closed systems was the operative phrase. Key business information, for the most part, was stored on servers accessed via dumb terminals or terminal emulators and had few interconnections with other systems. Any interconnections tended to be over private leased lines to a select few locations, either internal to the company or to a trusted business partner. However, over the last 10 years or so, the Internet has changed how businesses operate, and there has been an amazing acceleration in the interconnectedness of organizations, systems, and networks. Entire corporate networks have access to the Internet, often at multiple points.This proliferation has created risks to sensitive information and business-critical systems where they had never existed before.The importance of information security in the business environment has now been underscored, as has the need for skilled, dedicated practitioners of this specialty.

What Is Information Security? We have traditionally thought of security as consisting of people, sometimes with guns, watching over and guarding tangible assets such as a stack of money or a research lab. Maybe they sat at a desk and watched via closed-circuit cameras installed around the property.These

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 3

Introduction to Security and Firewalls • Chapter 1

people usually had minimal training and sometimes did not understand much about what they were guarding or why it was important. However, they did their jobs (and continue to do so) according to established processes, such as walking around the facility on a regular basis and looking for suspicious activity or people who do not appear to belong there. Information security moves that model into the intangible realm. Fundamentally, the objective of information security is to ensure that only authorized people (and systems) have access to information. Information security professionals sometimes have different views on the role and definition of information security. One definition offered by Simson Garfinkel and Gene Spafford is, “A computer is secure if you can depend on it and its software to behave as you expect.”This definition actually implies a lot. If information stored on your computer system is not there when you go to access it, or if you find that it has been tampered with, you can no longer depend on it as a basis for making business decisions. What about nonintrusive attacks, though—such as someone eavesdropping on a network segment and stealing information such as passwords? This definition does not cover that scenario, since nothing on the computer in question has changed. It is operating normally, and it functions as its users expect. Sun Microsystems’ mantra of “The Network is the Computer” is true. Computing is no longer just what happens on a mainframe, a minicomputer, or a server; it also includes the networks that interconnect systems. The three primary areas of concern in information security have traditionally been defined as follows: ■

Confidentiality Ensuring that only authorized parties have access to information. Encryption is a commonly used tool to achieve confidentiality. Authentication and authorization, treated separately in the following discussion, also help with confidentiality.

■

Integrity Ensuring that information is not modified by unauthorized parties (or even improperly modified by authorized ones!) and that it can be relied on. Checksums and hashes are used to validate data integrity, as are transaction-logging systems.

■

Availability Ensuring that information is accessible when it is needed. In addition to simple backups of data, availability includes ensuring that systems remain accessible in the event of a denial of service (DoS) attack. Availability also means that critical data should be protected from erasure—for example, preventing the wipeout of data on your company’s external Web site.

Often referred to simply by the acronym CIA, these three areas serve well as a security foundation.To fully scope the role of information security, however, we also need to add a few more areas of concern to the list. Some security practitioners include the following within the three areas described, but by getting more granular, we can get a better sense of the challenges that must be addressed: ■

Authentication Ensuring that users are, in fact, who they say they are. Static passwords, of course, are the longstanding way to authenticate users, but other methods such as cryptographic tokens and biometrics are also used.

3

326_PIX_2e_01.qxd

4

5/6/05

12:40 PM

Page 4

Chapter 1 • Introduction to Security and Firewalls ■

Authorization/access control Ensuring that a user, once authenticated, is able to access only information to which he or she has been granted permission by the owner of the information.This can be accomplished at the operating system level using file system access controls or at the network level using access control lists on routers or firewalls.

■

Accounting Ensuring that activity and transactions on a system or network can be monitored and logged in order to maintain system availability and detect unauthorized use.This process can take various forms: logging by the operating system, logging by a network device such as a router or firewall, or logging by an intrusion detection system (IDS) or packet-capture device.

You can say that your information is secure when all six of these areas have been adequately addressed.The definition of adequately varies based on business requirements and the particular situation at hand. Some areas may present greater risk in a particular environment than in others. In the field of information security, risk must always be outweighed against the benefits of implementing tighter security policy.

The Early Days of Information Security If we set the dial on our “way-back machine” to the 1980s, we would find that the world of information security was vastly different from today. Companies’ “important” computing was performed on large, expensive systems that were tightly controlled and sat in very chilly rooms with limited human access. Users got their work done either via terminals connected to these large computers or large metal IBM PCs on their desks.These terminals pretty much allowed users to do only what the application and systems programmers enabled them to, via menus and perhaps a limited subset of commands to run jobs. Access control was straightforward and involved a small set of applications and their data, and frankly, not many users outside the glass room understood how to navigate around a system from a command prompt. As far as PCs were concerned, management’s view was that nothing important was really happening with users’ Lotus 1-2-3 spreadsheets, so they were not a security concern. Networking was limited in extent. Corporate local area networks (LANs) were nearly nonexistent.Technologies such as X.25 and expensive leased lines at the then blazing speeds of 56 kbps ruled the day. Wide area network (WAN) links were used to move data from office to office in larger companies, and sometimes to other related entities. Because networks consisted of a series of point-to-point private links, the risk of an intruder gaining access to inner systems was slim.

Insecurity and the Internet The federation of networks that became the Internet consisted of a relatively small community of users by the 1980s, primarily in the research and academic communities. Because it was rather difficult to get access to these systems and the user communities were rather closely knit, security was not much of a concern in this environment, either.The main objective of connecting these various networks together was to share information, not keep

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 5

Introduction to Security and Firewalls • Chapter 1

it locked away.Technologies such as the UNIX operating system and the Transmission Control Protocol/Internet Protocol (TCP/IP) networking protocols that were designed for this environment reflected this lack of security concern. Security was simply viewed as unnecessary. By the early 1990s, however, commercial interest in the Internet grew.These commercial interests had very different perspectives on security, ones often in opposition to those of academia. Commercial information had value, and access to it needed to be limited to specifically authorized people. UNIX,TCP/IP, and connections to the Internet became avenues of attack and did not have much capability to implement and enforce confidentiality, integrity, and availability. As the Internet grew in commercial importance, with numerous companies connecting to it and even building entire business models around it, the need for increased security became quite acute. Connected organizations now faced threats that they had never had to consider before.

The Threats Grow When the corporate computing environment was a closed and limited-access system, threats mostly came from inside the organizations.These internal threats came from disgruntled employees with privileged access who could cause a lot of damage. Attacks from the outside were not much of an issue since there were typically only a few, if any, private connections to trusted entities. Potential attackers were few in number, since the combination of necessary skills and malicious intent were not at all widespread. With the growth of the Internet, external threats grew as well.There are now millions of hosts on the Internet as potential attack targets, which entice the now large numbers of attackers.This group has grown in size and skill over the years as its members share information on how to break into systems for both fun and profit. Geography no longer serves as an obstacle, either.You can be attacked from another continent thousands of miles away just as easily as from your own town. Threats can be classified as structured or unstructured. Unstructured threats are from people with low skill and perseverance.These usually come from people called script kiddies—attackers who have little to no programming skill and very little system knowledge. Script kiddies tend to conduct attacks just for bragging rights among their groups, which are often linked only by an Internet Relay Chat (IRC) channel.They obtain attack tools that have been built by others with more skill and use them, often indiscriminately, to attempt to exploit a vulnerability on their target. If their attack fails, they will likely go elsewhere and keep trying. Additional risk comes from the fact that they often use these tools with little to no knowledge of the target environment, so attacks can wind up causing unintended results. Unstructured threats can cause significant damage or disruption, despite the attacker’s lack of sophistication.These attacks usually are detectable with current security tools. Structured attacks are more worrisome because they are conducted by hackers with significant skill. If the existing tools do not work for them, they are likely to modify them or write their own.They are able to discover new vulnerabilities in systems by executing complex actions that the system designers did not protect against. Structured attackers often use so-called zero-day exploits, which are exploits that target vulnerabilities that the system vendor

5

326_PIX_2e_01.qxd

6

5/6/05

12:40 PM

Page 6

Chapter 1 • Introduction to Security and Firewalls

has not yet issued a patch for or does not even know about. Structured attacks often have stronger motivations behind them than simple mischief.These motivations or goals can include theft of source code, theft of credit card numbers for resale or fraud, retribution, or destruction or disruption of a competitor. A structured attack might not be blocked by traditional methods such as firewalls or detected by an IDS. It could even use noncomputer methods such as social engineering.

NOTE Social engineering, also known as people hacking, is a means for obtaining security information from people by tricking them. The classic example is calling up a user and pretending to be a system administrator. The hacker asks the user for his or her password to ostensibly perform some important maintenance task. To avoid being hacked via social engineering, educate your user community that they should always confirm the identity of any person calling them and that passwords should never be given to anyone over e-mail, instant messaging, or the phone.

Attacks With the growth of the Internet, many organizations focused their security efforts on defending against outside attackers (that is, anyone originating from an external network) who are not authorized to access their systems. Firewalls were the primary focus of these efforts. Money was spent on building a strong perimeter defense, resulting in what Bill Cheswick from Bell Labs famously described years ago as “a crunchy shell around a soft, chewy center.” Any attacker who succeeded in getting through (or around) the perimeter defenses would then have a relatively easy time compromising internal systems.This situation is analogous to the enemy parachuting into the castle keep instead of breaking through the walls (the technology is off by a few centuries, but you get the idea!). Perimeter defense is still vitally important, given the increased threat level from outside the network. However, it is simply no longer adequate by itself. Various information security studies and surveys have found that the majority of attacks actually come from inside the organization.The internal threat can include authorized users attempting to exceed their permissions or unauthorized users trying to go where they should not be at all.The insider is potentially more dangerous than outsiders because he or she has a level of access that the outsider does not—to both facilities and systems. Many organizations lack the internal preventive controls and other countermeasures to adequately defend against this threat. Networks are wide open, servers could be sitting in unsecured areas, system patches might be out of date, and system administrators might not review security logs.

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 7

Introduction to Security and Firewalls • Chapter 1

The greatest threat, however, arises when an insider colludes with a structured outside attacker.The outsider’s skills, combined with the insider’s access, could result in substantial damage or loss to the organization. Attacks can be defined in three main categories: ■

Reconnaissance attacks Hackers attempt to discover systems and gather information. In most cases, these attacks are used to gather information to set up an access or a DoS attack. A typical reconnaissance attack might consist of a hacker pinging IP addresses to discover what is alive on a network.The hacker might then perform a port scan on the systems to see which applications are running as well as try to determine the operating system and version on a target machine.

■

Access attacks An access attack is one in which an intruder attempts to gain unauthorized access to a system to retrieve information. Sometimes the attacker needs to gain access to a system by cracking passwords or using an exploit. At other times, the attacker already has access to the system but needs to escalate his or her privileges.

■

DoS attacks Hackers use DoS attacks to disable or corrupt access to networks, systems, or services.The intent is to deny authorized or valid users access to these resources. DoS attacks typically involve running a script or a tool, and the attacker does not require access to the target system, only a means to reach it. In a distributed DoS (DDoS) attack, the source consists of many computers that usually are spread across a large geographic boundary.

In recent years, attacks have become significantly more complex, and these days blended threats have become the norm. A blended threat makes use of multiple attack methods and techniques to spread and cause damage. Examples of these blended threats include Nimda, CodeRed, and Gaobot. Let’s take a look at the example of Gaobot.The source code for this virus has been posted to numerous Web sites, resulting in about a 1,000 variants. Once it infects a system, it overwrites the local HOSTS file and blocks access to anti-virus software update sites. It also attempts to terminate any anti-virus and firewall software, and then connects to an IRC server, where it waits to receive commands from the attacker.The attacker can remotely activate various functionality, including launching a DOS attack, sniffing traffic, shutting down the computer, terminating processes, and so on. Computer viruses have been around for a long time, but now the threats have increased with a variety of malware software.These include viruses, worms, trojan horses, backdoors, rootkits, key loggers, spyware, and a lot more.To fully protect a system nowadays, a combination of network firewalls, system firewalls, intrusion detection system, anti-virus software, anti-spyware software, and a variety of other hardware and software tools are required. Even still, the end-user of a system must be careful, as clicking one wrong button in a Web browser or e-mail client application can load a variety of software on the device.

7

326_PIX_2e_01.qxd

12:40 PM

Page 8

Chapter 1 • Introduction to Security and Firewalls

Creating a Security Policy A comprehensive security policy is fundamental to an effective information security program, providing a firm basis for all activities related to the protection of information assets. In creating their policies, organizations take one of two basic approaches: that which is not expressly prohibited is allowed, or that which is not explicitly allowed is prohibited.The chosen approach is usually reflective of the organization’s overall culture.

Designing & Planning… Developing a Comprehensive Security Policy A good security policy addresses the following areas: ■

Defines roles and responsibilities

■

Defines acceptable use of the organization’s computing resources

■

Serves as a foundation for more specific procedures and standards

■

Defines data sensitivity classifications

■

Helps prevent security incidents by making clear management’s expectations for protecting information

■

Provides guidance in the event of a security incident

■

Specifies results of noncompliance

Figure 1.1 shows a hierarchical security model. Each layer builds on the ones beneath it, with security policies serving as the foundation. An organization that implements security tools without defining good policies and architecture is likely to encounter difficulties.

Figure 1.1 Security Hierarchy Layer 5 Auditing , Monitoring, and Investigating

Layer 4 Technologies and Products

Validation

8

5/6/05

Layer 3 Awareness and Training

Layer 2 Architecture and Processes

Layer 1 Policies and Standards

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 9

Introduction to Security and Firewalls • Chapter 1

Creation of the security policy is guided by management’s level of trust in the organization’s people, de facto processes, and technology. Many organizations resist formalizing their policies and enforcing them, since they do not want to risk damaging their familial and trusting culture. When a security incident occurs, however, these organizations discover that they might have little or no guidance on how to handle it or that they do not have a legal foundation to prosecute or even terminate an employee who breaches security. Others follow a command-and-control model and find that defining policies fits right into their culture.These organizations, however, could wind up spending a great deal of money to enforce controls that provide little incremental reduction in risk and create an oppressive atmosphere that is not conducive to productivity. For most organizations, a middle approach is best, following the dictum,“Trust, but verify.” The policy creation process might not be easy. People have very different ideas about what policies represent and why they are needed.The process should strive to achieve a compromise among the various stakeholders: ■

Executive managers

■

Internal auditors

■

Human resources

■

IT staff

■

Security staff

■

Legal staff

■

Employee groups

As you can see, some level of buy-in from each of these stakeholder groups is necessary to create a successful policy. Particularly important is full support from executive management. Without it, a security policy will become just another manual gathering dust on the shelf. Employees need to see that management is behind the policy, leading by example. Once a representative policy development team has been put together, its members should begin a risk-assessment process.The result of this effort is a document that defines how the organization approaches risk, how risk is mitigated, and the assets that are to be protected and their worth.The policy should also broadly define the potential threats that the organization faces.This information will be a guideline to the amount of effort and money that will be expended to address the threats and the level of risk that the organization will accept. The next step is to perform a business needs analysis that defines information flows within the organization as well as information flowing into and out of it.These flows should each have a business need defined; this need is then matched with the level of risk to determine whether it will be allowed, allowed with additional controls, or restricted. A good policy has these characteristics: ■

States its purpose and what or who it covers

■

Is realistic and easy to implement

9

326_PIX_2e_01.qxd

10

5/6/05

12:40 PM

Page 10

Chapter 1 • Introduction to Security and Firewalls ■

Has a long-term focus—in other words, does not contain specifics that will change often

■

Is clear and concise

■

Is up to date, with provisions for regular review

■

Is communicated effectively to all affected parties, including regular awareness training

■

Is balanced between security of assets and ease of use

Probably the most important component of a security policy is the definition of acceptable use. It covers how systems are to be used, user password practices, what users can and cannot do, user responsibility in maintaining security, and disciplinary action if users engage in improper activity. It is essential that all users sign this policy, acknowledging that they have read and understood it. Ideally, users should review the acceptable use policy on an annual basis.This practice helps reinforce the message that security is important. Finally, an organization’s security policy guides the design, architecture, and implementation of security devices such as firewalls, intrusion detection systems, honeypots, and so on, for both internal and perimeter networks. Firewall policies will be covered in more detail in a later section.

NOTE You can find examples of security policies, including a sample acceptable use policy, on the SANS Security Policy Resource page located at www.sans.org/ resources/policies/.

Cisco’s Security Wheel Experienced security professionals often say that information security is not a goal or result, it is a process.This truism refers to the fact that you can never secure your network and then be done with it. Information security is a dynamic field that is continually presenting challenges in the form of new technology, new threats, and new business processes. If you were to set a target secure state and then actually achieve it, you would find that the landscape had changed and further effort is required. One example of this sort of change is the ongoing discovery of vulnerabilities in existing software, for which patches must be applied. Although this process might seem daunting and often frustrating, it is what keeps many security practitioners interested in the field and excited about working in a mode of continuous improvement. Cisco has created a model, called the Cisco Security Wheel, that shows this process graphically (see Figure 1.2).

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 11

Introduction to Security and Firewalls • Chapter 1

Figure 1.2 The Cisco Security Wheel Secure

Manage and Improve

Corporate Security Policy

Monitor and Respond

Test

The Security Wheel really starts “rolling” when you have created your corporate security policy.The model defines four ongoing steps: 1. Secure the environment. 2. Monitor activity and respond to events and incidents. 3. Test the security of the environment. 4. Improve the security of the environment. Each of these steps is discussed in detail in the following sections.

Securing the Environment The task of securing an entire network can be overwhelming if viewed in the whole, especially if it covers multiple locations and thousands of systems. However, you can make the process much more manageable by breaking it down into smaller subtasks. Based on the risk analysis that was performed during the policy development process, you can identify which of the following areas need attention first, second, and so on: ■

Confidentiality For example, does your policy specify that sensitive information being communicated over public networks such as the Internet needs to be encrypted? If so, you might want to begin evaluating deployment of virtual private network (VPN) technology. A VPN creates an encrypted “tunnel” between two sites or between a remote user and the company network. Other efforts may include data classification, and user education in handling of sensitive information.

■

Integrity Does the risk assessment identify particular risks to company information? Does your company maintain a high-traffic Web site? Various tools and processes can be used to enhance the integrity of your information.

11

326_PIX_2e_01.qxd

12

5/6/05

12:40 PM

Page 12

Chapter 1 • Introduction to Security and Firewalls ■

Availability Various factors that have an impact on the availability of critical networks and systems might have been identified.This area of security, although important, will probably prove less critical than some of the others, unless you have been experiencing frequent system outages or have been the victim of frequent DoS attacks.

■

Authentication Although it’s one of the first lines of defense, authentication is a common area of weakness. Many organizations do not have adequate password policies and processes in place. For example, passwords are not changed on a regular basis, are not required to be of a certain level of complexity, or can be reused.

■

Access control Another common area of weakness, access controls at both the network and system level, are often not as strong as they should be. Drives may be shared by all users with read/write access.The typical user has a greater level of access than he or she needs to do a job.Tightening up access controls can result in substantial improvements in a company’s security posture. Some technological solutions include firewalls, router access lists, and policy enforcement tools that validate and perhaps control file system access.

■

Auditing This is a primary activity in the next phase, monitoring.

Another key task in securing your systems is closing vulnerabilities by turning off unneeded services and bringing them up to date on patches. Services that have no defined business need present an additional possible avenue of attack and are just another component that needs patch attention. Keeping patches current is actually one of the most important activities you can perform to protect yourself, yet it is one that many organizations neglect.The Code Red and Nimda worms of 2001 were successful primarily because so many systems had not been patched for the vulnerabilities they exploited, including multiple Microsoft Internet Information Server (IIS) and Microsoft Outlook vulnerabilities. Patching, especially when you have hundreds or even thousands of systems, can be a monumental task. However, by defining and documenting processes, using tools to assist in configuration management, subscribing to multiple vulnerability alert mailing lists, and prioritizing patches according to criticality, you can get a better handle on the job. One useful document to assist in this process has been published by the U.S. National Institute of Standards and Technology (NIST), which can be found at http://csrc.nist.gov/publications/nistpubs/800-40/sp800-40.pdf (800-40 is the document number). Patch sources for a few of the key operating systems are located at: ■

Microsoft Windows: http://windowsupdate.microsoft.com

■

Sun Solaris: http://sunsolve.sun.com

■

Red Hat Linux: www.redhat.com/apps/support/

■

Hewlett-Packard HP/UX: http://us-support.external.hp.com

Also important is having a complete understanding of your network topology and some of the key information flows within it as well as in and out of it.This understanding helps you define different zones of trust and highlights where rearchitecting the network in places

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 13

Introduction to Security and Firewalls • Chapter 1

might improve security—for example, by deploying additional firewalls internally or on your network perimeter.

Monitoring Activity As you make efforts to secure your environment, you move into the next phase of information security: establishing better mechanisms for monitoring activity on your network and systems. Adequate monitoring is essential so that you can be alerted, for example, when a security breach has occurred, when internal users are trying to exceed their authority, or when hardware or software failures are having an impact on system availability. Effective monitoring has two components: turning on capabilities already present on your systems and implementing tools for additional visibility.The first component includes use of the auditing function built into: ■

Operating systems such as administrator account access.

■

Network devices, as in login failures and configuration changes.

■

Applications, including auditing capability in the application as created by the vendor (for commercial software), as well as auditing added within a custom-developed application. Monitored events tend to be more transactional in nature, such as users trying to perform functions for which they are not authorized.

Most systems have such auditing turned off by default, however, and require you to specifically enable it. Be careful not to turn on too much, since you will be overwhelmed with data and will wind up ignoring it.This “turn on and tune” methodology flows into the second component, which also includes deployment of tools such as IDS on networks and hosts. In any environment that contains more than a few systems, performing manual reviews of system and audit logs, firewall logs, and IDS logs becomes an impossible and overwhelming task. Various tools (such as Swatch, at http://swatch.sourceforge.net) can perform log reduction and alert only on important events.

Testing Security It is far, far better to test your own security and find holes than for a hacker to find them for you. An effective security program includes regular vulnerability assessments and penetration testing as well as updates to your risk assessment when there are significant changes to the business or the technology. For example, initiating extranet links to business partners or starting to provide remote broadband access to employees should be accompanied by an updated risk profile that identifies the risks of the new activity and the component threats, prioritized by probability and severity.This testing identifies the components that need to be better secured and the level of effort required. A partial list of things that need to be tested or checked for include: ■

Security policy compliance, including things like password strength

■

System patch levels

13

326_PIX_2e_01.qxd

14

5/6/05

12:40 PM

Page 14

Chapter 1 • Introduction to Security and Firewalls ■

Services running on systems

■

Custom applications, particularly public-facing Web applications

■

New servers added to the network

■

Active modems that accept incoming calls

NOTE Modems that are set up to accept incoming calls on computers can be very dangerous as they can be used as a bridge from an outside network to a company’s internal networks. Modems nowadays tend to be configured with a fully functional TCP/IP stack, enabling easy bridging and/or routing functionality. For example, a user could dial into their ISP, and configure their PC as a bridge or router between the two networks, creating a back door in the process. The same problem exists nowadays with Wi-Fi networks, which are proliferating very quickly. The vulnerability will become even worse as technologies like WiMax become more common. A user can connect to a WiMax access point several miles away, and open a backdoor via their PC to your “secure” network.

A multitude of tools, both freeware and commercial off-the-shelf, are available to perform security testing. Some freeware tools include: ■

Nmap (www.insecure.org/nmap/) Nmap is one of the most commonly used network and port scanning tools, used by hackers and security professionals alike. It also has the ability to “fingerprint” the operating system of the target host by analyzing the responses to different types of probes.

■

Nessus (www.nessus.org) Nessus is a powerful, flexible vulnerability-scanning tool that can test different target platforms for known holes. It consists of a server process that is controlled by a separate graphical user interface (GUI). Each vulnerability is coded via a plug-in to the Nessus system, so new vulnerabilities can be added and tested for.

■

whisker (http://sourceforge.net/projects/whisker/) whisker is a collection of PERL scripts used to test Web server CGI scripts for vulnerabilities, a common point of attack in the Web environment.

■

Security Auditor’s Research Assistant (www-arc.com/sara/) SARA is a third-generation UNIX-based security assessment tool based on the original SATAN. SARA interfaces with other tools such as nmap and Samba for enhanced functionality.

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 15

Introduction to Security and Firewalls • Chapter 1 ■

L0phtCrack (www.atstake.com/products/lc/) L0phtCrack is used to test (crack) Windows and UNIX passwords. It is a great tool to look for weak passwords.

Commercial tools include: ■

ISS Internet Scanner (www.iss.net) Internet Scanner is used to scan networks for vulnerabilities. ISS also makes scanners specifically for databases, host systems, and wireless networks.

■

Symantec Enterprise Security Manager (www.symantec.com) ESM helps monitor for security policy compliance.

■

NetIQ Vulnerability Manager (www.netiq.com) Vulnerability Manager assesses for vulnerabilities across an enterprise with easy-to-use reporting.

In addition to testing security yourself, it is good practice to bring in security experts that are skilled in vulnerability assessments and penetration testing.These experts (sometimes known as ethical hackers) conduct attacks in the same manner as a hacker would, looking for any holes accessible from the outside.They are also able to conduct internal assessments to validate your security posture against industry best practices or standards such as the Common Criteria (http://csrc.nist.gov/cc/) or ISO17799. Internal assessments include interviews with key staff and management, reviews of documentation, and testing of technical controls. A third-party review potentially provides a much more objective view of the state of your security environment and can even be useful in convincing upper management to increase IT security funding.

Improving Security The fourth phase in the Security Wheel is that of improving security. In addition to securing your network, setting up monitoring, and performing vulnerability testing, you need to stay abreast, on a weekly or even daily basis, of current security news, primarily consisting of new vulnerability reports. Waiting for a particular vendor to alert you to new vulnerabilities is not enough; you also need to subscribe to third-party mailing lists such as Bugtraq (www.securityfocus.com), CERT (www.cert.org), or Security Wire Digest (www.infosecuritymag.com). Also important is verifying configurations on key security systems on a regular basis to ensure that they continue to represent your current policy. Most important of all, the four steps of the Security Wheel must be repeated continuously.

Firewall Concepts In this section, we discuss the concept and definition of firewalls and look at the different types of firewalls and some other architectural aspects such as network interfaces, address translation, and VPNs.

15

326_PIX_2e_01.qxd

16

5/6/05

12:40 PM

Page 16

Chapter 1 • Introduction to Security and Firewalls

What Is a Firewall? The term firewall comes from the bricks-and-mortar architectural world. In buildings, a firewall is a wall built from heat- or fire-resistant material such as concrete that is intended to slow the spread of fire through a structure. In the same way, on a network a firewall is intended to stop unauthorized traffic from traveling from one network to another.The most common deployment of firewalls occurs between a trusted network and an untrusted one, typically the Internet. Figure 1.3 depicts this configuration and shows the border router that terminates a serial connection from the Internet service provider (ISP). In the past, it was actually rather common for Internet-connected organizations to have no firewalls, instead simply relying on the security of their host systems to protect their data. As networks got larger, it became unwieldy and risky to try to adequately secure each and every host, especially given the ever-increasing hacker threat.

Figure 1.3 Typical Firewall Placement

Internet

Border router

Firewall

Internal LAN

More and more sites, however, are also deploying firewalls into their internal networks, to separate zones of criticality. One example is putting a firewall between the payroll department subnet and the rest of the organization’s network. In this case, the company security policy could have specified that the payroll data and systems are sensitive, that few (if any) employees outside the department need to initiate connections into it, and that payroll employees need outbound access to other local network resources as well as the Internet. Deployment of internal firewalls has driven the requirement for faster firewalls that can handle Gigabit and multi-Gigabit speeds.

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 17

Introduction to Security and Firewalls • Chapter 1

Configuring & Implementing… Deploying a Firewall For quite some time, it was common for companies to think that once they deployed a firewall, they were secure. However, firewalls are just one component in an enterprise security strategy. They are generally good at what they do (filtering traffic), but they cannot do everything. The nature of perimeter security has also changed; many companies no longer need outbound-only traffic. Many enterprises now deal with much more complex environments that include business partner connections, VPNs, and complicated e-commerce infrastructures. This complexity has driven huge increases in firewall functionality. Most firewalls now support multiple network interfaces and can control traffic between them, support VPNs, and enable secure use of complicated application protocols such as H.323 for videoconferencing. The risk, however, is that as more and more functionality is added to the firewall, holes might arise in these features, compromising integrity and security. Another risk is that these features will exact a performance penalty, reducing the firewall’s ability to focus on traffic filtering. So the message is this: Try to use your firewall to the minimum extent possible so it can focus on its core function, and you can better manage the security risk of the other functions by shifting them to other systems to handle the load.

Firewall systems have certainly evolved over the years. Originally, firewalls were handbuilt systems with two network interfaces that forwarded traffic between them. However, this was an area for experts only, requiring significant programming skills and system administration talent. Recognizing a need in this area, the first somewhat commercial firewall was written in the early 1990s by Marcus Ranum, who was working for Trusted Information System (TIS) at the time. It was called the Firewall Toolkit, or fwtk for short. It was an application proxy design (definitions of firewall types are in the following section) that intermediated network connections from users to servers.The goal was to simplify development and deployment of firewalls and minimize the amount of custom firewall building that would otherwise be necessary.The Gauntlet firewall product evolved from the original fwtk, and TIS was acquired by Network Associates, Inc. Other vendors got into the firewall market, including Check Point, Netscreen, Symantec, and of course, Cisco. Research firm Meta Group believes that in the year 2005, the market for firewalls will be approximately US$ 2.5 billion worldwide. Meta Group states that this is due to the increase in firewall usage at companies—more firewalls are being deployed, not only externally, but also internally between business units. Next, let’s look at the types of firewalls and compare their functionalities.

17

326_PIX_2e_01.qxd

18

5/6/05

12:40 PM

Page 18

Chapter 1 • Introduction to Security and Firewalls

Types of Firewalls Although the original fwtk used a proxy-type design, other types of firewalls use a much different approach. Before we look at these, recall the Open Systems Interconnect (OSI) model (see Figure 1.4).

Figure 1.4 The OSI Model Application

FTP, Telnet, HTTP, etc.

Presentation Session Transport

TCP, UDP, etc.

Network

IP, ICMP, etc.

Data link

Ethernet, Token Ring, etc.

Physical

Copper or optical media, or wireless

Using this model as a reference, we can compare how the types of firewalls operate and make informed decisions about which type of firewall is appropriate for a particular need.

Packet Filters In its most basic form, a packet filter makes decisions about whether to forward a packet based only on information found at the IP or TCP/UDP layers; in effect, a packet filter is a router with some intelligence. However, a packet filter only handles each packet individually; it does not keep track of TCP sessions.Thus, it is poorly equipped to detect spoofed packets that come in through the outside interface, pretending to be part of an existing session by setting the ACK flag in the TCP header. Packet filters are configured to allow or block traffic according to source and destination IP addresses, source and destination ports, and type of protocol (TCP, UDP, ICMP, and so on). Figure 1.5 shows how inspection only goes as far as the transport layer—for example,TCP.

Figure 1.5 Packet Filter Data Flow Application Presentation Session Transport Network Data link Physical

Inspection done here

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 19

Introduction to Security and Firewalls • Chapter 1

NOTE The term source address spoofing refers to an attacker deliberately modifying the source IP address of a packet in an effort to trick packet filters or firewalls into thinking that the packet came from a trusted network so that it will pass the packet through. It also serves the obvious benefit of hiding the source of the attack packets. The attacker can also undermine any access controls that are based solely on the source IP address. If the source IP used is that of an existing host, however, the real owner of that address will receive any replies to the attacker’s packets and will reject them with a TCP reset, since they do not match an existing session in its tables. An attacker will typically use spoofing when he or she just wants to initiate some action without needing to see a reply, as in a reflection DoS attack such as smurf, where a ping is sent to a broadcast address using the source IP of the intended DoS target. More complicated attacks using IP spoofing are possible, particularly where the attacker is trying to exploit UNIX trust relationships. This is how Kevin Mitnick attacked Tsutomu Shimomura’s systems on Christmas Day, 1994. Although Mitnick succeeded in his attack while coming over the Internet, this type of spoofing attack works only on an internal network these days (unless the victim has no firewall and is running old software).

So why would you use a packet filter? Historically, the benefit was speed. Since it does not have to do any inspection of application data, a packet filter can operate nearly as fast as a router that is performing only packet routing and forwarding. As we will see, however, the packet filter concept has been improved, and with advances in hardware/software technology, a new type of firewall providing stateful inspection capability has now replaced packet filters, and can provide the same level of performance.

Stateful Inspection Packet Filters The concept of stateful inspection came about in an effort to improve on the capability and security of regular packet filters while capitalizing on their inherent speed. A packet filter with stateful inspection is able to keep track of network sessions, so when it receives an ACK packet, it can determine its legitimacy by matching the packet to the corresponding entry in the connection table. An entry is created in the connection table when the firewall sees the first SYN packet that begins the TCP session.This entry is then looked up for succeeding packets in the session. Entries are automatically timed out after some configurable timeout period. Statefulness can also be applied to UDP communication in a pseudo fashion, which normally has no concept of state. In this case, the firewall creates an entry in the connection table when the first UDP packet is transmitted. A UDP packet from a less secure network (a

19

326_PIX_2e_01.qxd

20

5/6/05

12:40 PM

Page 20

Chapter 1 • Introduction to Security and Firewalls

response) will be accepted only if a corresponding entry is found in the connection table. If we move up to the application layer, we can see further use for statefulness for protocols such as FTP. FTP is a bit different in that the server that the user connects to on port 21 will initiate a data connection back on port 20 when a file download is requested. If the firewall has not kept track of the FTP control connection that was initially established, it will not allow the data connection back in.This concept also applies to many of the newer multimedia protocols such as H.323 and SIP. Stateful inspection packet filters remain the speed kings of firewalls and are the most flexible where new protocols are concerned, but they are sometimes less secure than application proxies. Check Point FireWall-1, Juniper/Netscreen, and the Cisco PIX are the leading examples of this type of firewall.

NOTE Modern stateful inspection firewalls often provide deep packet inspection capabilities, allowing the firewall to inspect network traffic as high as the application layer. For example, the latest versions of the PIX firewall are able to allow/deny traffic based on HTTP and FTP commands, which sit at the application layer of the OSI model.

Application Proxies As their name implies, application proxy firewalls act as intermediaries in network sessions. The user’s connection terminates at the proxy, and a corresponding separate connection is initiated from the proxy to the destination host. Connections are analyzed all the way up to the application layer to determine if they are allowed. It is this characteristic that gives proxies a higher level of security than packet filters, stateful or otherwise. However, as you might imagine, this additional processing extracts a toll on performance. Figure 1.6 shows how packet processing is handled at the application layer before it is passed on or blocked.

Figure 1.6 Application Proxy Data Flow Inspection done here Application Presentation Session Transport Network Data link Physical

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 21

Introduction to Security and Firewalls • Chapter 1

One potentially significant limitation of application proxies is that as new application protocols are implemented, corresponding proxies must be developed to handle them.This means that you could be at the mercy of your vendor if there is a hot new video multicasting technology, for example, but there is no proxy for it.

NOTE Modern proxy-based firewalls often provide the ability to configure generic proxies for IP, TCP, and UDP. Although not as secure as proxies that work at the application layer, these configurable proxies often allow for passing of newer protocols.

One example of a proxy-based firewall is the Symantec Enterprise Firewall ().

Inbound and Outbound When you go to a Web site or check your mail, the computer you are using opens a connection over the network to another computer. When defining the direction of a connection in terms of network traffic and firewalls, outbound from your computer means that your computer initiated the connection, and includes the data returned to the request.The outbound request and the return data together are considered a session. So, outbound and inbound are terms relative to the system that makes the request and the system that is the target of a request.These terms are also used to discuss connections relative to a protected inside network and the outside network (for example, “outbound to the Internet” and “inbound from the Internet”). The benefit of using a firewall to control inbound connections to a protected network when connected to the Internet is unquestionable. Restricting inbound traffic can eliminate exposure to worms and other attacks on vulnerable services, and is a requirement to keep computers from infection on the Internet.This also allows a protected network to continue to provide rich services, such as a Windows domain, print services, and access to files on network shares, without exposing those services to the dangers of the Internet. Home gateways and firewalls help protect home networks in a similar manner. Restricting outbound connections out to the Internet also has become increasingly important. Systems infected with malware often install programs that can hide from detection, collect information, and send it back to their master across the Internet.That information can be files from your hard drive or network shares, or another popular source of information for hackers is keystroke recorders. A keystroke recorder will do just that—capture all the information from the keyboard.This recorder can capture the URL for your bank’s Web site, your username and your password, and send them across the Internet to the hacker. Besides just capturing information, many hacker programs can connect to a master and allow access to microphones, webcams, or even give full remote control of the compromised machine to an attacker somewhere out on the Internet. Allowing freely open connec-

21

326_PIX_2e_01.qxd

22

5/6/05

12:40 PM

Page 22

Chapter 1 • Introduction to Security and Firewalls

tions out through a firewall facilitates these compromises.These kinds of compromises put personal privacy and security, as well as our corporate privacy and security, at risk. An enterprise can design its firewall architecture so inbound and outbound traffic goes through the same firewall, or the same set of firewalls. However, based on security, performance, and availability requirements, these roles can also be separated. In this case, the firewalls handling outbound traffic are called outbound firewalls, and similarly, the firewalls handling inbound traffic are referred to as inbound firewalls.

Firewall Interfaces: Inside, Outside, and DMZ In its most basic form, a firewall has just two network interfaces: inside and outside.These labels refer to the level of trust in the attached network, where the outside interface is connected to the untrusted network (often the Internet) and the inside interface is connected to the trusted network. In an internal deployment, the interface referred to as outside may be connected to the company backbone, which is probably not as untrusted as the Internet but just the same is trusted somewhat less than the inside. Recall the previous example of a firewall deployed to protect a payroll department. As a company’s Internet business needs become more complex, the limitations of having only two interfaces become apparent. For example, where would you put a Web server for your customers? If you place it on the outside of the firewall, as in Figure 1.7, the Web server is fully exposed to attacks, with only a screening router for minimal protection.You must rely on the security of the host system in this instance.

Figure 1.7 A Web Server Located outside the Firewall

Internet

Border router

Web server

Firewall

Internal LAN

The other possibility in the two-interface firewall scenario is to put the Web server inside the firewall, on an internal segment (see Figure 1.8).The firewall would be configured to allow Web traffic on port 80, and maybe 443 for Secure Sockets Layer (SSL), through to

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 23

Introduction to Security and Firewalls • Chapter 1

the IP address of the Web server.This prevents any direct probing of your internal network by an attacker, but what if he or she is able to compromise your Web server through port 80 and gain remote superuser access? Then he or she is free to launch attacks from the Web server to anywhere else in your internal network, with no restrictions.

Figure 1.8 A Web Server Located inside the Firewall Internet

Border router Web server Firewall

Internal LAN

The answer to these problems is to have support for more than two interfaces on your firewall, as most systems now do.This solution allows for establishment of intermediate zones of trust that are neither inside nor outside.These are referred to as DMZs (for the military term demilitarized zone). A DMZ network is protected by the firewall to the same extent as the internal network but is separated so that access from the DMZ to the internal network is filtered as well. Figure 1.9 shows this layout.

Figure 1.9 A DMZ Network Internet

Web server

Border router

DMZ

Firewall

Internal LAN

23

326_PIX_2e_01.qxd

24

5/6/05

12:40 PM

Page 24

Chapter 1 • Introduction to Security and Firewalls

Another design sometimes deployed uses two firewalls: an outer one and an inner one, with the DMZ lying between them (see Figure 1.10). Sometimes firewalls from two different vendors are used in this design, with the belief that a security hole in one would be blocked by the other. However, evidence shows that nearly all firewall breaches come from misconfiguration, not from errors in the firewall code itself.Thus, such a design generally increases expense and management overhead, without providing much additional security, if any.

Figure 1.10 A Two-Firewall Architecture Internet

Web server

Border router

Firewall DMZ Firewall

Internal LAN

Some companies implement multiple DMZs, each with a different business purpose and corresponding level of trust. For example, one DMZ segment could contain only servers for public access, whereas another could host servers just for business partners or customers.This approach enables a more granular level of control and simplifies administration. In a more complex e-commerce environment, the Web server might need to access customer data from a backend database server on the internal LAN. In this case, the firewall would be configured to allow Hypertext Transfer Protocol (HTTP) connections from the outside to the Web server and then specific connections to the appropriate IP addresses and ports as needed from the Web server to the inside database server.

Firewall Policies As part of your security assessment process, you should have a clear idea of the various business reasons for the different communications allowed through your firewall. Each protocol carries with it certain risks, some far more than others.These risks must be balanced with

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 25

Introduction to Security and Firewalls • Chapter 1

their business benefits. For example, one person needing X Windows (a notoriously difficult protocol to secure properly) access through the firewall for a university class she is taking is unlikely to satisfy this requirement. On the other hand, a drop-box File Transfer Protocol (FTP) server for sharing of files with customers might satisfy it. It often happens that the firewall rule base grows organically over time and reaches a point where the administrator no longer fully understands the reasons for everything in there. For that reason, it is essential that the firewall policy be well documented, with the business justification for each rule clearly articulated in this documentation. Changes to the firewall policy should be made sparingly and cautiously, only with management approval, and through standard system maintenance and change control processes.

Address Translation RFC 1918, “Address Allocation for Private Internets,” specifies certain nonregistered IP address ranges that are to be used only on private networks and are not to be routed across the Internet.The RFC uses the term ambiguous to refer to these private addresses, meaning that they are not globally unique.The reserved ranges are: 10.0.0.0

-

10.255.255.255

(10/8 prefix) (172.16/12 prefix)

172.16.0.0

-

172.31.255.255

192.168.0.0

-

192.168.255.255 (192.168/16 prefix)

The primary motivation for setting aside these private address ranges was the fear in 1996 that the 32-bit address space of IP version 4 was becoming rapidly depleted due to inefficient allocation. Organizations that had at most a few thousand hosts, most of which did not need to be accessible from the Internet, over the years had been allocated huge blocks of IP addresses that had gone mostly unused. By renumbering their private networks with these reserved address ranges, companies could potentially return their allocated public blocks for use elsewhere, thus extending the useful life of IP v4. The sharp reader, however, will point out that if these addresses are not routable on the Internet, how does one on a private network access the Web? The source IP of such a connection would be a private address, and the user’s connection attempt would just be dropped before it got very far.This is where Network Address Translation (NAT), defined in RFC 1631, comes into play. Most organizations connected to the Internet use NAT to hide their internal addresses from the global Internet.This serves as a basic security measure that can make it a bit more difficult for an external attacker to map out the internal network. NAT typically is performed on the Internet firewall and takes two forms, static or dynamic. When NAT is performed, the firewall rewrites the source and/or the destination addresses in the IP header, replacing them with translated addresses.This process is configurable. First, some terms need to be defined. In the context of address translation, inside refers to the internal, private network. Outside is the greater network to which the private network connects (typically the Internet). Local IP addresses are seen on the inside network, and global IP addresses are seen on the outside network.

25

326_PIX_2e_01.qxd

26

5/6/05

12:40 PM

Page 26

Chapter 1 • Introduction to Security and Firewalls

Within the inside address space, addresses are referred to as inside local (typically RFC 1918 ranges) and are translated to inside global addresses that are visible on the outside. For example, if we have a host on the inside network of 10.0.0.0/8 having a real IP address of 10.18.2.7, this would be considered its inside local address. When communicating with the outside world (for example, the Internet), this private address would get translated to a public, routable IP address, which would be referred to as this device’s inside global address. Similarly, for translations of outside addresses coming to the inside, distinction is made also between local and global addresses. Outside global addresses are the real addresses assigned to hosts on the outside network. Outside local, as the name might imply, is the reverse of inside global.These are addresses of outside hosts that are translated for access internally. Figure 1.11 provides a visual description of these terms. In the figure, SA stands for Source Address of the packet, and DA stands for the Destination Address.

Figure 1.11 NAT Terminology Inside network

Outside network

SA = Inside Local DA = Outside Local

SA = Inside Global DA = Outside Global

DA = Inside Local SA = Outside Local

DA = Inside Global SA = Outside Global

To keep these terms straight, just keep in mind the direction in which the traffic is going—in other words, from where it is initiated.This direction determines which translation will be applied.

Static Translation In static NAT, a permanent one-to-one mapping is established between inside local and inside global addresses.This method is useful when you have a small number of inside hosts that need access to the Internet and have adequate globally unique addresses to translate to. When a NAT router or firewall receives a packet from an inside host, it looks to see if there is a matching source address entry in its static NAT table. If there is, it replaces the local source address with a global source address and forwards the packet. Replies from the outside destination host simply are translated in reverse and routed onto the inside network. Static translation is also useful for outside communication initiated to an inside host. In this situa-

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 27

Introduction to Security and Firewalls • Chapter 1

tion, the destination (not the source) address is translated. Figure 1.12 shows an example of static NAT. Each local inside address (192.168.0.10, 192.168.0.11, and 192.168.0.12) has a matching global inside address (10.0.1.10, 10.0.1.11, and 10.0.1.12, respectively).

Figure 1.12 Static Address Translation Static NAT Table Local 192.168.0.10 192.168.0.11 192.168.0.12

Inside network

Global 10.0.1.10 10.0.1.11 10.0.1.12

192.168.0.10 Internet 192.168.0.11

PIX using NAT

192.168.0.12

Dynamic Translation When dynamic NAT is set up, a pool of inside global addresses is defined for use in outbound translation. When the NAT router or firewall receives a packet from an inside host and dynamic NAT is configured, it selects the next available address from the global address pool that was set up and replaces the source address in the IP header. Dynamic NAT differs from static NAT because address mappings can change for each new conversation that is set up between two given endpoints. Figure 1.13 shows how dynamic translation might work.The global address pool (for example purposes only) is 10.0.1.10 through 10.0.1.12, using a 24-bit subnet mask (255.255.255.0).The local address 192.168.0.10 is mapped directly to the first address in the global pool (10.0.1.10).The next system needing access (local address 192.168.0.12 in this example) is mapped to the next available global address of 10.0.1.11.The local host 192.168.0.11 never initiated a connection to the Internet, and therefore a dynamic translation entry was never created for it.

27

326_PIX_2e_01.qxd

28

5/6/05

12:40 PM

Page 28

Chapter 1 • Introduction to Security and Firewalls

Figure 1.13 Dynamic Address Translation Inside network

192.168.0.10 Internet 192.168.0.11

192.168.0.12

PIX using NAT Dynamic translation Global address pool: 10.0.1.10-12 Local 192.168.0.10 192.168.0.12

Global 10.0.1.10 10.0.1.11

Port Address Translation What happens when there are more internal hosts initiating sessions than there are global addresses in the pool? This can be handled through a configurable parameter in NAT known as overloading, also referred to as Port Address Translation, or PAT. In this situation, you have the possibility of multiple inside hosts being assigned to the same global source address.The NAT/PAT box needs a way to keep track of which local address to send replies back to.This is done by using unique source port numbers as the tracking mechanism and involves possible rewriting of the source port in the packet header.You should recall that TCP and UDP use 16 bits to encode port numbers, which allows for 65,536 different services or sources to be identified (for each TCP and UDP). When performing translation, PAT tries to use the original source port number if it is not already used. If it is, the next available port number from the appropriate group is used. Once the available port numbers are exhausted, the process starts again using the next available IP address from the pool.

Virtual Private Networking The concept of VPN initially was developed as a solution to the high cost of dedicated lines between sites that needed to exchange sensitive information. As the name indicates, it is not quite private networking, but “virtually private.”This privacy of communication over a public network such as the Internet typically is achieved using encryption technology and usually addresses the issues of confidentiality, integrity, and authentication. In the past, organizations that had to enable data communication between multiple sites used a variety of pricey WAN technologies such as point-to-point leased lines, Frame Relay, X.25, and Integrated Services Digital Network (ISDN).These were especially expensive for companies that had international locations. However, whether circuit-switched or packet-

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 29

Introduction to Security and Firewalls • Chapter 1

switched, these technologies carried an inherent decent measure of security. A hacker typically would need to get access to the underlying telecom infrastructure to be able to snoop on communications.This was, and still is, a nontrivial task, since carriers typically have done a good job on physical security. Even so, organizations such as banks that had extreme requirements for WAN security would deploy link encryption devices to scramble all data traveling across these connections. Another benefit to having dedicated links has been that you had a solid baseline of bandwidth that you could count on. Applications that had critical network throughput requirements would drive the specification of the size of WAN pipe that was needed to support them. VPNs experienced slow initial adoption due to the lack of throughput and reliability guarantees on the Internet as well as the complexity of configuration and management. Now that the Internet has proven its reliability for critical tasks and many of the management hurdles have been overcome, VPN adopters are now focusing their attention on issues of interoperability and security.The interoperability question has mostly been answered as VPN vendors are implementing industry-standard protocols such as IPsec for their products.The IPsec standards provide for confidentiality, integrity, and optionally, authentication. Because of these improvements, organizations are now able to deploy VPNs in a rather straightforward manner, enabling secure access to the enterprise network for remote offices and/or telecommuters. Figure 1.14 shows the two main reasons for setting up VPNs.The first is to provide site-to-site connectivity to remote offices.The second is for telecommuters, adding flexibility by enabling enterprise access not only via dial-up to any ISP but also through a broadband connection via a home or hotel, for example. VPNs are used for many other reasons nowadays, including setting up connectivity to customers, vendors, and partners.

Figure 1.14 VPN Deployment

Satellite office Internet PIX VPN tunnels Telecommuter

SECURITY ALERT Many organizations have gone through the trouble of setting up VPN links for their remote users but have not taken the extra step of validating or improving the security of the computers that these workers are using to access the VPN. The most secure VPN tunnel offers no protection if the user’s PC has been compromised by a Trojan horse program that allows a hacker to ride through the VPN tunnel right alongside legitimate, authorized traffic.

29

326_PIX_2e_01.qxd

30

5/6/05

12:40 PM

Page 30

Chapter 1 • Introduction to Security and Firewalls

The solution is to deploy cost-effective firewall and intrusion detection software or hardware for each client that will be accessing the VPN, as well as continuous monitoring of the datastream coming out of the tunnel. Combined with real-time antivirus scanning and regular security scans, this solution helps ensure that the VPN does not become an avenue for attack into the enterprise.

Cisco Security Certifications Cisco offers a variety of certifications for the practitioner to demonstrate competence in Cisco security technologies. For specializing in a particular technology, Cisco offers a variety of Cisco Qualified Specialist certifications. In the area of PIX firewalls, there is a Cisco Firewall Specialist certification. At the professional level, Cisco has the Certified Security Professional (CCSP), and at the expert level, there is the Cisco Certified Internetwork Expert (CCIE) Security.These two certifications show that the holder has significant experience and skills using and integrating a broad range of Cisco security products, including VPN devices, IDS, and, of course, PIX firewalls.

Cisco Firewall Specialist The Cisco Firewall Specialist is one of many programs offered under the portfolio of Cisco Qualified Specialist certifications. It demonstrates expertise in Cisco PIX firewall and Cisco IOS router security.

Requirements A valid Cisco Certified Network Associate (CCNA) certification is a prerequisite. Once this requirement is met, the candidate needs to pass two exams to obtain the certification, listed in Table 1.1.

Table 1.1 Cisco Firewall Specialist Certification Exam Requirements Exam Number

Training Course

642-501

Securing Cisco IOS Networks (SECUR)

642-521

Cisco Secure PIX Firewall (CSPFA)

NOTE Cisco keeps its certifications up to date; therefore, the certifications and their requirements are constantly changing. As of publication of this book, Cisco has not yet released updated exams/certifications for PIX firewall software 7.0. Visit Cisco’s Web site for the latest information on current certification and exams.

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 31

Introduction to Security and Firewalls • Chapter 1

A person with the Cisco Firewall Specialist certification needs to recertify every two years by taking a written exam.

Cisco Certified Security Professional The CCSP certification is a professional level certification program offered by Cisco. A person who has achieved the CCSP certification has proven through examination that he or she possesses a keen understanding of network security processes, technologies, and risks. He or she also understands how to deploy, configure, and manage Cisco security tools to support efforts in perimeter defense, network and host intrusion monitoring, and network-level encryption.

Requirements Like the Cisco Firewall Specialist, the initial requirement to obtain the CCSP certification is a current CCNA certification. With that, the candidate can choose to get specific training through a Cisco Training Partner or Cisco e-learning to augment and reinforce their skills or simply sit in for the necessary written exams.There is no requirement that the candidate go through training in order to take the exams. However, because the exams are quite rigorous, the candidate should ensure that they meet all the knowledge objectives as described for each course and corresponding exam. After passing the CCNA, the current five exams that must be passed to obtain CSS-1 certification are shown in Table 1.2.

Table 1.2 CCSP Certification Exam Requirements Exam Number

Training Course

642-501

Securing Cisco IOS Networks (SECUR)

642-521

Cisco Secure PIX Firewall Advanced (CSPFA)

642-531

Cisco Secure Intrusion Detection Systems (CSIDS)

642-511

Cisco Secure Virtual Private Networks (CSVPN)

642-541

Cisco SAFE Implementation (CSI)

NOTE Cisco keeps its certifications up to date; therefore, the certifications and their requirements are constantly changing. As of publication of this book, Cisco has not yet released updated exams/certifications for PIX firewall software 7.x. Visit Cisco’s Web site for the latest information on current certification and exams.

31

326_PIX_2e_01.qxd

32

5/6/05

12:40 PM

Page 32

Chapter 1 • Introduction to Security and Firewalls

A person with CCSP certification needs to recertify every three years by taking a written exam.

Cisco Certified Internetwork Expert Security The CCIE certification demonstrates that the holder belongs to the top tier of internetworking talent.The extremely challenging path to CCIE certification requires passing both a written test and a comprehensive hands-on lab exam. As an adjunct to the CCIE program, Cisco has created a security designation for those who want to demonstrate additional toplevel competence in Cisco’s security technologies.

The Qualification (Written) Exam Cisco’s written exam (350-018) for CCIE Security covers the following areas of knowledge: ■

Security protocols

■

Application protocols

■

General networking

■

Security technologies

■

Cisco security applications

■

General security knowledge

■

General Cisco knowledge

NOTE A detailed blueprint of the CCIE Security written exam is available on Cisco’s Web site at www.cisco.com/go/ccie.

The written exam is a computerized multiple-choice test and contains 100 questions. The candidate is allotted two hours to complete the test to demonstrate comprehensive knowledge in each of these areas in order to pass the written exam and qualify to take the lab exam.

The Lab Exam Whereas the written exam is of a more theoretical, “book knowledge” nature, the CCIE Security lab exam validates actual hands-on skills in building and troubleshooting an internetwork built with Cisco technologies.The eight-hour lab exam requires a solid understanding of routing and switching, augmented by firewall and VPN knowledge. It should be noted that achieving CCIE certification depends on the candidate’s preparation as a combination of self-study, training, and work experience. It is unlikely that

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 33

Introduction to Security and Firewalls • Chapter 1

training or self-study alone will be enough to pass the CCIE exam, since in-depth knowledge of Cisco commands and architecture is required.The candidate should be very familiar with the following equipment and services: ■

2600 series routers

■

3600 series routers

■

3700 series routers

■

Catalyst 3550 series switches

■

PIX firewalls

■

Certificate Authority Support

■

Cisco Secure Access Control System

■

Cisco Secure Intrusion Detection System

■

Cisco VPN concentrators

■

Cisco IDS sensors

Cisco’s lab exam covers the following broad areas of technology: ■

Bridging and switching

■

IGP Routing

■

PIX Firewall

■

ISDN

■

BGP

■

IP/IOS features

■

AAA

■

VPN

■

IOS firewall

■

Advanced security

■

Intrusion detection system

NOTE A detailed blueprint of the CCIE Security lab exam is available on Cisco’s Web site at www.cisco.com/go/ccie.

33

326_PIX_2e_01.qxd

34

5/6/05

12:40 PM

Page 34

Chapter 1 • Introduction to Security and Firewalls

The CSPFA Exam The Cisco Secure PIX Firewall Advanced exam (642-521) is required for both the Cisco Firewall Specialist and Cisco Certified Security Professional certifications.This computerbased exam is 75 minutes in duration and includes 55 to 65 questions.This book covers all the objectives of the CSPFA exam and in most cases overshoots them.The goal of this book is not only to provide the knowledge needed to pass the CSPFA exam, but also to provide real-world insights that will help you better deploy and manage Cisco PIX firewalls in your environment.

Exam Objectives The CSPFA (642-521) exam covers the following topic areas: ■

■

■

■

■

Cisco PIX Firewall Technology and Features ■

Firewalls

■

PIX Firewall models

Cisco PIX Firewall Family ■

PIX Firewall models

■

PIX services module

■

PIX Firewall licensing

Getting Started with the Cisco PIX Firewall ■

User interface

■

Examining the PIX Firewall status

■

ASA security levels

■

Basic PIX Firewall configuration

■

Syslog configuration

■

DHCP server configuration

■

PPPoE and the PIX Firewall

Translations and Connections ■

Transport Protocols

■

Network Address Translation

■

Configuring DNS support

■

Port Address Translations

Access Control Lists and Content Filtering ■

ACLs

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 35

Introduction to Security and Firewalls • Chapter 1

■

■

■

■

■

■

■

■

Converting Conduits to ACLs

■

Using ACLs

Object Grouping ■

Overview of object grouping

■

Getting started with object groups

■

Configuring object groups

■

Nested object groups

Advanced Protocol Handling ■

Advanced protocols

■

Multimedia support

Attack Guards, Intrusion Detection, and Shunning ■

Attack guards

■

Intrusion detection

Authentication, Authorization, and Accounting ■

Introduction

■

Installation of CSACS for Windows NT

■

Authentication configuration

■

Downloadable ACLs

Failover ■

Understanding failover

■

Serial failover configuration

■

LAN-based failover configuration

Virtual private networks ■

PIX Firewall enables a secure VPN

■

Prepare to configure VPN support

■

Configure IKE parameters

■

Configure IPsec parameters

■

Test and verify VPN configuration

■

Cisco VPN client

■

Scale PIX Firewall VPNs

System maintenance

35

326_PIX_2e_01.qxd

36

5/6/05

12:40 PM

Page 36

Chapter 1 • Introduction to Security and Firewalls

■

■

■

■

■

Remote access

■

Command authorization

Cisco PIX Device Manager ■

PDM overview

■

Prepare for PDM

■

Using PDM to configure the PIX Firewall

■

Using PDM to create a site-to-site VPN

■

Using PDM to create a remote access VPN

Enterprise PIX Firewall Management ■

Configuring access and translation rules

■

Reporting, tools, and administration

Enterprise PIX Firewall Maintenance ■

Introduction to the auto update server

■

PIX Firewall and AUS communication settings

■

Devices, images, and assignments

■

Reports and administration

Firewall Services Module ■

FWSM overview

■

Using PDM with the FWSM

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 37

Introduction to Security and Firewalls • Chapter 1

Summary In this chapter, we learned about the importance of security to any organization deploying networks today.Threats can come from both outside and inside. A security strategy must address issues of confidentiality, integrity, availability, authentication, access control, and accounting. Every organization with an IT infrastructure needs an information security policy.The policy development and maintenance process should include multiple stakeholders representing the different areas of the organization, and it must take into account the overall risk picture. Information security is not a goal or result, it is a process. Cisco’s Security Wheel describes this ongoing process of securing your network, monitoring and responding to incidents, testing for vulnerabilities, and managing and improving security. Firewalls are devices that regulate and filter traffic between networks.The most common deployment is on an Internet connection, but more and more organizations are using firewalls internally to segment sensitive areas.There are two fundamental approaches to firewall design: packet filtering, which operates at the network layer, and application proxying, which works at the application layer and understands details of particular applications. Packet filters have the advantage of speed, but proxies have the advantage in security. Stateful packet filters, an evolution of basic packet filters, have the intelligence to keep track of connections to make more informed pass/block decisions. Firewall architectures often include one or more DMZ networks, which enable services to be made available to the Internet while keeping them protected by the firewall and segmented from the internal LAN. Network Address Translation allows an organization to use private, nonunique addresses on their internal networks.These addresses are translated to globally unique addresses for routing on the Internet. NAT also provides security by hiding internal network details from the outside. Virtual private networks are supported by most major firewalls today.They enable remote sites and users to gain authenticated, confidential access to the enterprise from the Internet. Cisco offers two security-specific certification programs: CCSP and CCIE Security. CCSP requires the CCNA certification and passing of five written tests. CCIE Security is a more advanced certification and requires a rigorous hands-on lab exam in addition to a difficult written exam.

Solutions Fast Track The Importance of Security
Information security is more important than ever due to the interconnectedness of businesses and the increased sophistication of hackers.

37

326_PIX_2e_01.qxd

38

5/6/05

12:40 PM

Page 38

Chapter 1 • Introduction to Security and Firewalls


Fundamental areas of security include confidentiality, integrity, availability, authentication, authorization, and accounting.
The Internet and its associated protocols were not initially designed to be secure. This means that extra effort is required to secure information assets using defined and documented processes, additional technologies, and security awareness.
The greater threat to an organization comes from employee and contractor misuse on the inside. Perimeter defense is important but should not be the only area of effort.

Creating a Security Policy
A good security policy forms the foundation for all other information security activities. It should be general in scope so that changes in people or technology do not require that the policy be changed as well.
Participation from key stakeholders in the policy development process is essential to gaining support for the policy.
The policy process should include a companywide risk assessment and documentation of the critical information flows.
The high-level policies flow down and guide creation of specific standards, processes, and procedures.

Cisco’s Security Wheel
The Cisco Security Wheel is a model that graphically represents the ongoing process nature of security.
Based on the security policy, the Wheel includes four major functions: secure, monitor and respond, test, and manage and improve.
Many tools, both commercial and free, are available to support each function in the Security Wheel.

Firewall Concepts
Firewalls are most often placed between an organization’s internal network and the Internet, although they are increasingly used within the internal LAN to separate different zones of trust.
There are two fundamental approaches to firewall design: packet filters and application proxies. Many packet filters offer the ability to keep track of active connections (statefulness) and in general offer much faster performance and the most flexibility. Application proxies are considered more secure but require that a proxy agent be available for each application running through the firewall.

326_PIX_2e_01.qxd

5/6/05

12:40 PM

Page 39

Introduction to Security and Firewalls • Chapter 1


Firewall policies should be assiduously documented with business justification, with a defined process for making changes.
Address translation allows use of private, nonroutable IP addresses on the internal (local) network, which are translated at the firewall into globally unique addresses for routing on the Internet.
Most firewalls support virtual private networking (VPN) capability, which allows other sites and remote users to connect to the enterprise network through encrypted tunnels.

Cisco Security Certifications
To achieve the Cisco Certified Security Professional (CCSP) certification, you need to demonstrate a solid understanding of Cisco network security, PIX firewalls, VPN solutions, and Cisco Secure IDS by taking five written exams. CCNA certification is a prerequisite.
CCIE Security is extremely complex and requires detailed knowledge of networking, PIX firewalls, and VPNs.The CCIE Security process includes both a written exam and an eight-hour hands-on lab exam.

Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form. You will also gain access to thousands of other FAQs at ITFAQnet.com.

Q: How do I convince my managers of the need for security and get more funding? A: Unfortunately, managers in many organizations have not expanded their definition of business risk to include risk to information assets.The problem is that generally, most other risks are quantifiable, and it is a straightforward calculation to determine how much money should be spent to mitigate those risks, if any. Information security is a thornier problem in that hard-and-fast numbers are not available to enable an organization to determine how likely it is that they will experience a security incident and how much it will cost. It is becoming easier to calculate these numbers based on various industry surveys and direct loss experiences, but the seemingly random nature of attacks makes such quantification tough. Management often views information security as spending money (often lots of it) to protect against something that might never happen. It frequently takes an actual serious breach or worm infestation to “shake the money tree.” In the (fortu-

39

326_PIX_2e_01.qxd

40

5/6/05

12:40 PM

Page 40

Chapter 1 • Introduction to Security and Firewalls

nate) absence of that event, you should collect as much data as you can. Participate in trade groups and information security associations so you can talk to others in your industry or field. Document carefully the risks and threats you face, along with descriptions of the business benefits that the spending will result in.The need for security is real, and you must convince your management of that.

Q: How can I get a policy developed when my company takes a very casual and trusting approach to security?

A: Talk to the various stakeholders in your company about what they perceive as the key risks. Every company has risks, and the company culture does not change that. Try to convince the stakeholders of the benefits of protecting information assets—if not from employees, at least from outside attackers. Creating an acceptable use policy is a great start.

Q: I do not have enough staff to adequately manage security. How can I keep on top of everything?

A: You need to prioritize your activities and automate wherever possible. Perform a risk analysis, evaluate where the greatest threats are, and do what is necessary to protect against them. Build a secure baseline configuration for all your OS platforms from which all new systems are built. Develop a good configuration management process to make it easier to stay current on patches. By making a strong initial effort to secure your network, you will experience less tactical firefighting.

Q: I have a new Web application that needs to communicate with a database server on my internal LAN. How do I make this application secure with my firewall?

A: Place your Web server on the DMZ network. Create rules to filter traffic from the outside coming into your Web server. Accessible ports should be only HTTP (TCP 80) and/or HTTPS (TCP 443) and any others necessary for the application to run. Then restrict inbound traffic to come from the Web server IP address only, going only to the database server IP and destination port number(s). Monitor this backend connection continuously, and deploy network-based intrusion detection on the DMZ as well as host-based intrusion detection on the Web and database servers to detect malicious activity.

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 41

Chapter 2

Introduction to PIX Firewalls Solutions in this chapter: ■

Cisco PIX Version 7.0

■

What’s New in PIX 7.0?

■

Some Commands That Have Been Added to PIX 7.0

■

What Command Have Been Modified?

■

What Commands Do We Bid Farewell To?

■

PIX Firewall Features

■

PIX Hardware

■

PIX Software Licensing and Upgrades

■

Command-Line Interface

■

IP Version 6 (IPv6)


Summary
Solutions Fast Track
Frequently Asked Questions 41

326_PIX_2e_02.qxd

42

5/7/05

1:00 PM

Page 42

Chapter 2 • Introduction to PIX Firewalls

Introduction It is a cliché, but a true one, to say that network security is vital and integral to any organization needing to protect its information. Good security administration can be labor-intensive, and organizations can find it difficult to maintain the security of a large number of internal machines. Most organizations place a layer of security in the form of a firewall between the networks containing their data and the users (trusted and untrusted) of that data. Increasingly, firewalls provide additional security or performance services; they sit at a point in the network that mediates all communication with the end host, so various types of service extensions can naturally be integrated into them. Even in high-security environments, where the resources to harden and provide ongoing security support for the end application are available, firewalls can play an important role. Firewalls can help provide defense in depth: multiple protective technologies support higher levels of trust in case of error or omission at one layer. Having multiple controls also supports the concept of separation of duties: different groups can support application layer and network layer securities, ensuring that no single person or group can compromise the entire system. Cisco PIX firewalls are a line of appliances that offer world-class security and high levels of performance and reliability.They are a mature product, having been a part of enterprise and service provider networks since 1995. Cisco PIX firewalls fit into a wide range of environments, from small office/home office (SOHO) environments to large enterprises and service providers. With support for complex protocols, the latest VPN technologies, and intrusion detection features, PIX firewalls are leaders in the market. In this chapter, you will learn about some of the main features that Cisco PIX firewalls have to offer. We will look at the different models of PIX and the types of environment in which they fit. We will then perform basic configuration on a PIX firewall through the command-line interface.

Cisco PIX Version 7.0 The Cisco PIX version 7.0 release was highly anticipated in the Cisco community with rumors of nifty new features and the retirement of some older commands (favored and illfavored). Version 7.0 incorporates new features and new ways of securing your network, which makes the PIX firewall a very competitive product. Version 7.0 standardizes the PIX firewall along internetwork operating system (IOS) lines. Anyone who is familiar with the IOS command structure and the IOS way of configuration will find the changes friendly and welcome. Commands have been deleted, changed, or added, which in many cases, provide long-sought-after structure and consistency that were lacking in previous releases. Longtime PIX administrators and engineers may have a harder time to adapting to the changes than PIX newcomers who are starting with version 7.0 since old habits can be hard to break. Cisco had added many new features to its PIX firewalls with 7.0. In some cases, these features are simply enhanced versions, and in other cases, long overdue overhauls. It is beyond the scope of this book to discuss each individual change. Instead, we will focus on the most typical configuration scenarios and provide the 7.0 way of accomplishing them.

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 43

Introduction to PIX Firewalls • Chapter 2

The PIX software design team has eliminated several awkward and/or useless commands such as outbound and conduit in favor of the more flexible and consistent access lists.The old FIXUP command, which always brought to mind uncomfortable dating experiences, has been replaced by Inspect commands, which are familiar to anyone who has configured IOS firewall features.The IPsec sysopt feature is now enabled by default, or we should say, the function provided by this command is now a matter of course in 7.0 and configurable.The default is that IPsec is permitted through the interface, but does not have the right to bypass any VPN access lists for the control of end-user behaviors. The interface commands have been overhauled so that they are more aligned with the structure of IOS. As with configuring interfaces on any other IOS device, you start with interface Ethernet and configure its parameters below it.The parameters for speed, duplex, and description are now nested together rather than the old way of separate line items. Certain VPN commands, such as those for IPsec, have also been updated to be more consistent with their IOS progeny. The no, show, and clear commands are more like IOS than ever before. Previously, this particular group was subject to very individualized behaviors, requiring memorization and frequent consultation of the command reference manuals.They now have more predictive results, which should reduce trial-and-error hunts to negate or clear certain parts of a configuration.

Major Changes to Cisco PIX 7.0 Some of the bigger changes to the PIX code include the following: ■

PIX command line is now much more IOS-like than ever.The structure and syntax follow the Cisco router IOS very closely now.

■

The much-maligned PIX PDM is no more, and has been replaced by the Cisco Adaptive Security Device Manager (ASDM). ASDM can be run as a Java applet or as a Windows native application.

■

Exchange users rejoice, as there is now ESMTP inspection available to you.

■

Enhanced inspection engines for H.323, SIP, RTSP, and more.

■

Ethertype ACLs are now available.

■

Virtual firewalls, or what Cisco calls “Security Contexts.”

■

Enhanced VPN support for items like the ability to block clients based on OS type and VPN version.

■

OSPF routing over a VPN.

■

IPv6 Support for inspection, ACLs, and management.

■

The ability to schedule a reload.

■

The ability to have multiple configurations and rollback support.

43

326_PIX_2e_02.qxd

44

5/7/05

1:00 PM

Page 44

Chapter 2 • Introduction to PIX Firewalls ■

VPN stateful failover.

■

Active/Active failover.

What’s New in PIX 7.0? There are a slew of new commands to use in the PIX 7.0 code. We will list most of them to give you an idea of what’s in store as you read through the book. Some commands have been dropped completely; others, such as the CA command, has been deprecated. Other commands are completely new in version 7.0. Let’s take a quick look at our brave new world.

Commands New to 7.0 The following commands have been added to PIX 7.0: ■

boot system Specifies which image to use on bootup and which configuration file to use.

■

crashinfo A file generated on a system crash is written to flash.You can force a crash test and read the file.

■

copy capture Copies a capture file to a TFTP server.

■

crypto ca The new prefix for several commands such as authenticate, trustpoint, enroll, and more.

■

crypto key Generates RSA key pairs.

■

class-map Classifies traffic for an interface.

■

downgrade Will downgrade the PIX from 7.0 to an older version and reformat flash.

■

duplex This was a keyword and now is a configuration mode command.

■

nat control NAT controls that allow inside to communicate with outside without a NAT rule.

■

ospf Now allowed over a VPN.

■

security-level This was a keyword and is now a configuration mode command.

■

speed This was a keyword and is now a configuration mode command.

■

tunnel-group Create and manage the database of IPsec/L2TP connection records.

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 45

Introduction to PIX Firewalls • Chapter 2

Modified Commands The following commands have been modified in usage or have new parameters to choose from: aaa server, ca, clear, copy, crypto ipsec, dhcp, established, failover, igmp, interface, ip address, Isakmp, Mgcp, Mroute, nameif, no, pager, Show, shutdown, ssh, telnet, tftp server, and vlan.

What Commands Do We Bid Farewell To? These commands are either no longer supported at all or will be dropped completely in the next release of 7.x code: access-list compiled, ca save all, conduit, crypto dyamic-map, failover ip, fixup, floodguard, multicast interface, no tftp server, outbound, sysopt, vpnd, and ^Z (control Z) as an exit command. The fixup commands in your configuration will automatically be migrated to the new inspection format when you upgrade from 6.3 to 7.0 code.The one fixup command that will not migrate to the new inspection format is the fixup ESP-IKE command. For help in converting your conduit commands to access lists, Cisco offers a tool to registered customers located at http://www.cisco.com/pcgi-bin/tablebuild.pl/pix. Cisco also offers a tool to analyze the complete configuration at https://www.cisco.com/cgibin/Support/OutputInterpreter/home.pl, which also requires you to be registered. In Figure 2.1 we see the screen for the output interpreter tool.

Figure 2.1 Cisco Web-Based Output Interpreter Tool

PIX Firewall Features The PIX 500 series firewalls are market leaders for security appliances for good reason.They provide robust performance in a firewall while providing a highly scalable architecture ranging from plug-and-play SOHO devices to carrier-class firewalls with gigabit connections.They

45

326_PIX_2e_02.qxd

46

5/7/05

1:00 PM

Page 46

Chapter 2 • Introduction to PIX Firewalls

provide protective services that define what a firewall should do. From stateful packet inspection to content filtering, VPN termination to address translation, and offering support for PKI applications to providing security to multimedia applications, the PIX does it all. With such flexibility comes the requirement to configure the devices correctly. Luckily, for those who are already comfortable with an IOS router prompt, the PIX is based on the same familiar command prompt. Of course, the PIX fits into standard Cisco management tools such as CiscoWorks, so it will seamlessly integrate into your network environment.

Embedded Operating System Many firewalls are based on general-purpose operating systems (OS).This means that maintenance is required to ensure that the correct configuration is used and that the base OS is patched and secured.This requirement offers both a higher long-term cost as well as the potential for security weaknesses. An embedded OS is one in which the OS is self-contained in the device and resident in ROM.This involves reduced maintenance costs, and because no customizations or OS configurations are required, a single image is downloaded and stored to flash. It means that there is little that can actually go wrong with the OS itself; you cannot accidentally leave an unnecessary service running because the firewall has all its services tuned to only those features appropriate for a security device. Unlike appliances based on a general-purpose kernel such as Linux or Windows CE, the PIX is based on a hardened, specialized OS specific to security services.This OS allows for kernel simplification, which supports explicit certification and validation:The PIX OS has been tested for vendor certification such as ICSA Labs’ firewall product certification criteria and the very difficult-to-obtain International Standards Organization (ISO) Common Criteria EAL4 certification.This testing allows for maximum assurance in deployment from Cisco’s positive security engineering based on good commercial development practices. Kernel simplification has advantages in throughput as well; the PIX 535 will support up to 256,000 simultaneous connections, far exceeding the capabilities of a UNIX- or Windowsbased OS on equivalent hardware. One key advantage to the software on a PIX firewall is its command-line structure similarity to Cisco IOS.This means that firewall administrators have the ability to rapidly master management of the PIX, reducing deployment costs and supporting management by network operations center (NOC) personnel.

The Adaptive Security Algorithm The heart of the PIX is the Adaptive Security Algorithm, or ASA.The ASA is a mechanism to determine if packets should be passed through the firewall, consistent with the information flow control policy as implemented in the access control list (ACL) table.The PIX evaluates packet information against a developed state and decides whether to pass the packet. Let’s go through this process. First, there is the concept of a datastream. Packets flowing across a network have identifying characteristics: IP address of source and destination, sometimes numbers associated with the type of communication (ports) of source and destination,

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 47

Introduction to PIX Firewalls • Chapter 2

and numbers such as IP identifiers or synchronization and acknowledgment numbers that identify where a packet belongs in a particular connection. When you open a Web page—say, to www.cisco.com/index.html—you establish a connection between your browser and the Web server. One piece of HTML is transferred; if it has not been cached, this page represents about 90K of text.That text may then open additional connections for all the embedded pictures. The process involves a “dance” between browser and server—a “handshake” to initialize the connection, a “get” to specify the data being requested, a “response” to say if the data is available, and the actual data itself. Because the file is so large, these steps all occur in multiple packets between browser and Web server, with data flowing down from the server and acknowledgment of receipt of data flowing up from the browser. In the following list of steps we see how the Cisco PIX will use ASA to check the initialization of a connection and to verify the correct response for the connection. 1. The inside host starts a connection to an outside resource or host. 2. The PIX makes an entry into the state table with the following information: The source IP address The source port The destination IP address The destination source port The TCP sequencing information Any additional TCP flags The randomly generated TCP sequence number 3. The connection is compared with the security policies. If the policy disallows the connection, the connection is dropped. 4. If the connection is allowed, then the connection request is allowed to continue to the destination. 5. The outside resource or host replies to the initial connection request. 6. The response from the outside resource or host is received by the PIX and compared with the session object. If the response from the outside resource matches the session object, the response is allowed to continue to the inside. If there is not a match, the connection is dropped. The information flow control policy is an expression of the information that is allowed to flow through the network. A sample policy might be, “If the datastream was initiated by someone on the inside, let it pass; if the datastream was initiated by someone from the outside, block it.” An ACL table is a mechanism via which you can try to implement this policy. It compares those distinguishing numbers against a database to see if the packet is consistent with policy. If it is not allowed by the database, the packet is dropped and optionally logged.

47

326_PIX_2e_02.qxd

48

5/7/05

1:00 PM

Page 48

Chapter 2 • Introduction to PIX Firewalls

The earliest routers used fixed ACLs to determine if a packet should be routed; they compared fundamental information about the packet, such as the IP address of the source or destination or the type of service requested or, for some services such as TCP, individual flags on the packets.Then, based on fixed rules, they decided to route the traffic or to drop it. For example, the fixed rules may allow any packet that might possibly be a “return” packet because under certain circumstances such a packet would be valid.This isn’t too much of a problem because a “return” packet, if it hasn’t been requested by the original host, should be dropped by the host. However, that can cause some information to leak out, so it is helpful to get rid of such packets if we can. The concept of state is the idea that ACLs should probably change over time. A stateful packet filter allows for dynamic rule bases—for example, if the packet is coming from the outside toward the inside, you should check to see if this packet was part of a previously opened datastream. Now, we allow packets back in only if they were previously authorized; the Cisco Web server can’t decide to send us data unless we previously requested it. The biggest problem with fixed rules is that to allow certain kinds of traffic—FTP, for example—overly permissive ACLs would need to be implemented. In FTP, two TCP data flows are developed. One, the command channel, runs from the client out to the user—from the inside to the outside. Routers would generally be able to determine the direction of this flow and allow that traffic, as described previously.The second, the data channel, is negotiated by the FTP server and flows from the server back into the client—from the outside to the inside. Moreover, the TCP port—a service identifier telling you an identifier for the port— varies depending on how many files the server has transferred since reboot; thus, the ACL would have to allow all inbound traffic in a wide range of TCP ports.This means that a malicious user would have free run of the network in those ranges. Consequently, router ACL-based firewalls are little more than Swiss cheese enforcement points! The smart approach is to monitor the negotiation between the FTP server and client. That’s part of the concept of state. Armed with that piece of information, the firewall can open only the necessary port for the inbound data flow, and open it only while the transfer is active—dynamically changing the ACLs over time.This allows the firewall to permit authorized traffic and disallow inappropriate traffic with far more sophistication than a static rule.

State State is a way of saying that the firewall is maintaining a history of the traffic that has passed and will compare new packets against history to see if the packet is allowed by policy rules. There is also a performance benefit of maintaining state: if a packet can be determined to be similar to those already passed, a full analysis against the firewall policy rules does not need to be followed; it can be passed based on the existing state.This allows the PIX to perform at line rate where static access lists would be much slower. One key piece of state is to record active connections. If we can add something to a connection table when it first starts and remove that thing from a connection table when the connection is (gracefully) closed, we have a leg up for that concept of “similar to those already passed.”This data is stored in the connections table (CONN).

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 49

Introduction to PIX Firewalls • Chapter 2

The PIX has the ability to rewrite the characteristic information described previously, such as IP address and port data.Thus, another piece of state is to remember what IP address and port data the PIX has seen lately as well as remembering what it did with them before. It needs to remember how it translated something from a protected net into the outside world.This data is stored in the translations table (XLATE). Here are the XLATE and CONN tables’ output as displayed by the PIX operating system on a quiet firewall: PIX1# show xlate 3 in use, 112 most used PAT Global 192.168.50.230(1225) Local 10.10.10.11(32775) PAT Global 192.168.50.230(22451) Local 10.10.10.11(4025) PAT Global 192.168.50.230(22450) Local 10.10.10.11(32778) PIX1# show conn 1 in use, 26 most used TCP out 192.168.50.140:21 in 10.10.10.11:32775 idle 0:00:10 Bytes 154 flags UIO

This code shows that the user at 10.10.10.11 has connected to 192.168.50.140 on port 21 (FTP).The translation maps between socket 192.168.50.230, 1225 on the outside and socket 10.10.10.11, 32775 on the inside.The flags from the connection table are showing that the connection is up and that there is inbound and outbound data. A little while later: PIX1# show conn 1 in use, 26 most used TCP out 192.168.50.140:21 in 10.10.10.11:32775 idle 0:06:48 Bytes 216 flags UFRIO

Notice that the idle counter is larger (the traffic flow has been idle, and no packets have been received), a few more bytes have passed, and the flags now have F, for outside FIN, and R, for outside acknowledged FIN. This indicates that the firewall has recorded the transfer. In addition to the basic housekeeping of passing traffic appropriately (there is translation going on, so that must be addressed), the PIX is monitoring transported traffic. Port 21 is FTP, so it knows that there might be an inbound connection. It knows from the first output that traffic between those two devices on those socket pairs is expected and should be passed. It knows from the second output that traffic between those two devices should no longer occur because the sides have reset each other. Any stray packets are now either lost retransmissions or unauthorized activity.The firewall has “learned” about the transfer over time and is able to change its rules in response to past traffic.

49

326_PIX_2e_02.qxd

50

5/7/05

1:00 PM

Page 50

Chapter 2 • Introduction to PIX Firewalls

Security Levels When firewalls were first implemented, they typically had only two interfaces: the outside, or “black,” network, and the inside, or “red,” network.These interfaces corresponded to degrees of trust: Because the inside was controlled and was “us,” we could allow pretty much anything originating in the red network to travel to the black network. Furthermore, because the outside was “them,” we limited pretty much anything originating in the black network to come inside the firewall. The current approach is to have a DMZ, or multiple service networks.This makes the idea of “us versus them” much more complex.The PIX 535 has a modular chassis with support for up to 10 interfaces! Using the security-level command, you can assign a security level, an integer between 1 and 100. Make sure that each interface has a different value. When you are designing your security zones, order the zones by degrees of trust and then assign integers to the levels, corresponding to how much you trust the network—0 is the default for the outside (untrusted network), 100 is the default for the inside (trusted network), and values between 1 and 99 are for relative trust such as the DMZ, which may be assigned 50.

How ASA Works Informally, ASA allows traffic to flow from a higher security level to a lower security level, unless modified by access-list commands. More formally, the manual notes: ■

No packets can traverse the PIX firewall without a connection and state.

■

Outbound connections or states are allowed, except those specifically denied by ACLs. An outbound connection is one in which the originator or client is on a higher security interface than the receiver or server.

■

Inbound connections or states, except those specifically allowed, are denied. An inbound connection or state is one in which the originator or client is on a lower security interface or network than the receiver or server.You can apply multiple exceptions to a single xlate (translation).This lets you permit access from an arbitrary machine, network, or any host on the Internet to the host defined by the xlate.

■

All ICMP packets are denied unless specifically permitted.

■

All attempts to circumvent the previous rules are dropped, and a message is generated. It is sent to a management device (local buffer, SNMP trap, syslog, console), depending on the severity of the attempt and local configuration. (Note that normal traffic may also trigger logging, again depending on configuration. At the highest debugging mode, every packet generates an alert!)

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 51

Introduction to PIX Firewalls • Chapter 2

Technical Details for ASA The PIX is an Internet Protocol (IP) firewall. It accepts and passes only IP packets; all others are dropped. It is worth taking a moment to look at the details of the protocols to see what the PIX is looking at and how it uses that information.

Internet Protocol IP is an unreliable, routable packet delivery protocol. All upper-layer protocols use IP to send and receive packets. IP receives segments from the transport layer, fragments them into packets, and passes them to the network layer. The IP address is a logical address assigned to each node on a TCP/IP network. IP addressing is designed to allow routing of packets across internetworks. Since IP addresses are easy to change or spoof, they should not be relied on to provide identification in untrusted environments. As shown in Figure 2.2, the source and destination addresses are included in the IP header.

Figure 2.2 The IP Header 0

4

VER

8

IHL

16 Type of

24

31

Total Length

Service

Identification

Time to Live

19

Flags

Protocol

Fragment Offset

Header Checksum

Source Address

Destination Address

Options

Padding

Data Payload

Let’s review the meaning of key fields in Figure 2.2 to put what the PIX does in context: ■

The protocol parameter indicates the upper-level protocol that is using IP.The decimal value for TCP is 6, and UDP is 17.The list of assigned numbers for this field is available at www.iana.org/assignments/protocol-numbers. Note that this field is important for access-list commands.The command syntax is: access-list {deny | permit} <protocol>…

51

326_PIX_2e_02.qxd

52

5/7/05

1:00 PM

Page 52

Chapter 2 • Introduction to PIX Firewalls

The protocol number here corresponds to this field. Note that you can specify the keyword tcp for type 6 or udp for type 17. ■

The source address and destination address fields are filled with the IP addresses of the respective devices; note that an IP address is four octets, so this can be viewed as a 32-bit number.You will see these numbers in the XLATE table.

Transmission Control Protocol Many services, such as HTTP, SMTP, or SSH, are based on TCP.This protocol provides reliable service by being connection oriented and includes error detection and correction.The connection must be established before a data transfer can occur, and transfers are acknowledged throughout the process. Firewalls can identify the connection establishment and often interrupt that establishment as part of the protective mechanism. Acknowledgments assure that data is being received properly. The acknowledgment process provides robustness in the face of network congestion or communication unreliability.The acknowledgment has also been used to penetrate stateless firewalls; the PIX can identify packets that are not part of valid streams and block transmission.TCP also determines when the transfer ends and closes the connection, thus freeing resources on the systems. As noted earlier, the PIX watches for transfer end and acts appropriately. Checksums assure that the data has not been accidentally modified during transit. In Figure 2.3, we see the construction of the TCP header. As the PIX firewall often modifies the TPC header (for implementing random sequence numbers or address translation), it also recalculates and updates the checksum field.

Figure 2.3 The TCP Header 0

4

10

16

Source Port

31

24

Destination Port

Sequence Number

Acknowledgment Number

Source Address Data Offset

Reserved

U R G

A C K

P S H

R S T

Checksum

S Y N

F I N Urgent Pointer

Options

Padding

Data Payload

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 53

Introduction to PIX Firewalls • Chapter 2

The PIX inspects TCP packets for several fields, notably source port, destination port, sequence and acknowledgment numbers, and TCP flags. Notice that source and destination ports and information about the flags are listed in the CONN connections table. The concept of port is common to both TCP and UDP (discussed in the following section).The idea is that for these types of protocols, we can identify an ordered pair (IP address and port), called a socket, with each side of the communication flow. Multiple communications from the same host (same IP) can be distinguished by different port numbers—thus different sockets. Sockets on the server generally have a “well-known port” number.The PIX has a mapping between well-known ports and their English equivalents. We have enough background to see how ASA works for TCP connections. A TCP datastream begins with the “three-way handshake.”The idea is for each side to set up the initial sequence number, a pointer that will describe the position in the datastream for each packet sent.The TCP flag that indicates a request to start that datastream is the SYN flag.The first three packets are an initial SYN request from the client to the server; then back from the server to the client with acknowledgment of the client’s request (by setting the ACK flag) and the server’s need to initialize as well (by setting the SYN flag); and finally the client back to the server, acknowledging the server’s synchronization request.Therefore, from the TCP level, the path is SYN, SYN/ACK, ACK. We see this handshake in Figure 2.4.

Figure 2.4 TCP Three-Way Handshake SYN Packet from Host A Host A

Host B ACK and SYN Packet From Host B

Host A

Host B ACK Packet from Host A

Host A

Host B Data Transfer

At the PIX, a little more goes on. Figure 2.5 provides a diagram for how information flows through the PIX. Let’s follow the flow of the first network packets.

53

326_PIX_2e_02.qxd

54

5/7/05

1:00 PM

Page 54

Chapter 2 • Introduction to PIX Firewalls

Figure 2.5 Basic ASA Operations Access Control Lists

2

1

6

PIX using ASA

Client 7

3

XLATE Connections

Server 5

4

Inspection Engine

1. A TCP SYN packet arrives at the PIX Firewall from the client to establish a new connection per the TCP three-way handshake process. 2. The PIX Firewall checks the ACL database to determine if the connection is to be allowed or denied. 3. The PIX Firewall creates a new entry in the connection database (XLATE and CONN tables). 4. The PIX Firewall checks the inspections database to determine if this new connection requires an application-level inspection. 5. After application inspection is complete, the PIX Firewall forwards the packet to the destination system (the server). 6. The destination system sends its response to the initial request. 7. The PIX Firewall receives the reply packet, validates the connection in the connection database, and forwards the packet because it belongs to an established session.

TCP Sequence Number Randomization All those SYN and SYN/ACK exchanges seek to get both sides to agree on an initial sequence number (ISN) for each side of their communication.This adds a layer of security protection; in theory, you would have to be able to “hear” the TCP SYN request to know what ISN to use.The IP address of the host in the datastream must be able to receive the packet, and therefore, for example, hosts on the Internet can’t masquerade as local hosts. Unfortunately, many servers use an easily guessed ISN generation function. One famous break-in, Kevin Mitnick’s raid on Tsunomo Shinomura’s data, chronicled in the book Takedown, was based on this flaw.The PIX provides protection against this type of attack by

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 55

Introduction to PIX Firewalls • Chapter 2

using TCP sequence number randomization. As the packets pass through the firewall, they are rewritten so that the ISNs cannot be predicted. Randomization is not foolproof; other methods such as authentication and authorization can help strengthen security. Randomization by itself provides an extra layer of protection that will let your security officers sleep better at night.

User Datagram Protocol Several Internet applications, notably Domain Name Service (DNS) and many streaming audio and video protocols, use User Datagram Protocol (UDP). UDP is a simple, unreliable transport service. It is connectionless, so delivery is not assured.The simple design of the UDP header in Figure 2.6 illustrates the efficiency of UDP. Since connections are not set up and torn down, there is very little overhead. Lost, damaged, or out-of-order segments will not be retransmitted unless the application layer requests it. UDP is used for fast, simple messages sent from one host to another. Due to its simplicity, UDP packets are more easily spoofed than TCP packets. If reliable or ordered delivery of data is needed, applications should use TCP.

Figure 2.6 The UDP Header 0

16

31

Source Port

Destination Port

Length

Checksum Data Payload

There is usually a trade-off between simplicity and security, and this is true with UDP. Because TCP is connection oriented, we can identify the start of the session by unique flags—but as you can see in Figure 2.6, there aren’t any flags here. All you have to work with is the UDP socket pairs. This is where the firewall state comes in.The PIX has the ability to recognize the first UDP packet in a datastream. When the first packet is permitted by the information flow control policy (either because it is coming from a trusted net toward a less trusted one or because of an explicit exception in the ACL), the same sort of process shown in Figure 2.5 occurs. If permitted, an entry is made in the connections table, and further packets with the same socket pairs are associated with that authorized datastream until an idle timeout occurs. (The idle timeout is set with the timeout command and defaults to two minutes.) Note that other protocols besides TCP and UDP are permitted. Most common is the Internet Control Message Protocol (ICMP). ICMP provides diagnostic functions and error reporting for IP. For example, ICMP can provide feedback to a sending host when a destination is unreachable or time is exceeded (TTL=0). A ping is an ICMP echo request message, and the response is an ICMP echo reply.

55

326_PIX_2e_02.qxd

56

5/7/05

1:00 PM

Page 56

Chapter 2 • Introduction to PIX Firewalls

Other types of protocols can be filtered by the PIX, although the concept of socket does not apply (and so you cannot specify extra parameters on the access list beyond filtering on the source and destination addresses).The special protocol 0 refers to any IP packet, and you can specify any value between 0 and 255.You can also use literals; you have already seen the literals TCP (which is 17), UDP (which is 6), and ICMP (which is 1). These other protocols are handled similarly to the UDP approach, with idle time-outs removing entries from the connection table when they are no longer valid.

Advanced Protocol Handling The PIX combines stateful packet filtering with advanced protocol handling with proxies via application inspection (this was called fixup). Application inspection gives us a tighter security model for that given protocol. For example, if we configured an access list for SMTP, we could filter on port, source IP, and destination IP. When we use the SMTP inspection engine in conjunction with an access-list, only the seven basic SMTP commands will be allowed and as restricted by the ACL.The inspection command also allows us to change the port assignment of the protocol. Using our same example of SMTP, we could say along with the default inspect SMTP (port 25) use port 8080 also. In pre-7.0 code, we used the fixup command, but now we need to use two commands.The first command, called class-map, allows us to name the mapping, which in this example is SMTP-INSPTECTION-8080.Then we use the match command to specify the port, the protocol, and the port number: PIX1(config)# class-map SMTP-INSPECTION-8080 PIX1(config-cmap)# match port tcp eq 8080 PIX1(config-cmap)# exit PIX1(config)#

Our final result in the configuration looks like this: ! class-map SMTP-INSPECTION match port tcp eq smtp 8080 class-map inspection_default match default-inspection-traffic !

Now along with port 25, the Cisco PIX would listen on port 8080 for SMTP traffic. You can also inspect a range of port such like this: class-map RANGEOPORTS match port tcp range 1024 1055

Now the class-map of RANGEOPORTS will match from 1024 to 1055. Providing support for complex protocols is a distinguishing characteristic of the PIX. The default class-map includes FTP, HTTP, H.323, RSH, RTSP, SMTP, ESMTP, SIP, skinny, SNMP, MGCP, ICMP, NetBios, DNS, and SQLNET.

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 57

Introduction to PIX Firewalls • Chapter 2

Application support of this type is the real power of the PIX firewall.The PIX is more than just a gatekeeper passing or blocking packets; it understands the underlying protocol and actively rewrites the communications—enforcing RFCs, eliminating dangerous commands, and preventing the leakage of information—to provide the highest level of security available, consistent with application functionality. In the following example, we will use the FTP inspection engine that is enabled by default and tighten things up a bit more by restriction of which FTP commands can be used through the PIX. We configure the FTP inspection engine just as we did before, but with a twist. PIX1(config)# ftp-map FTP-INSPECTION PIX1(config-ftp-map)# request-command deny ?

ftp-map mode commands/options: appe

Append to a file

cdup

Change to parent of current directory

dele

Delete a file at server site

get

FTP client command for the retr command - retrieve a file

help

Help information from server

mkd

Create a directory

put

FTP client command for the stor command - store a file

rmd

Remove a directory

rnfr

Rename from

rnto

Rename to

site

Specify server specific command

stou

Store a file with a unique name

PIX1(config-ftp-map)# request-command deny dele

You can see in this example that we are going to block the delete function of FTP by using the request-command deny dele command.You can also see the range of options that we can block of the FTP commands.

VPN Support An important aspect of network security is confidentiality of information. Packets flowing along a network are much like postcards sent through the mail; if you don’t want the world reading your messages, you have to take additional steps. To achieve the kind of confidentiality offered on a private network, several approaches have been followed. One is to use encryption to conceal (encrypt) the information. An early standard, supported by Microsoft, is the Point-to-Point Tunneling Protocol (PPTP). Much like putting a letter inside a sealed envelope, this standard allows encapsulating (and concealing) network traffic inside a transport header. A similar but more comprehensive approach is to use the Layer 2 Tunneling Protocol (L2TP).This protocol is native to many Microsoft deployments, and so the PIX’s support for PPTP and L2TP is an important element of the feature set.

57

326_PIX_2e_02.qxd

58

5/7/05

1:00 PM

Page 58

Chapter 2 • Introduction to PIX Firewalls

In the fall of 1998, the Security Architecture for IP (IPsec) was published in RFC2401. Cisco has provided a leadership position in IPsec implementation, having coauthored many of the IPsec RFCs as well as providing solutions for some of the stickier IPsec issues, such as trying to use NAT and L2TP/IPsec together. Trying to use NAT with L2TP/IPsec is one of the bigger issues with VPNs and network security that uses IPsec since NAT rewrites the IP header, which defeats the entire purpose of L2TP/Ipsec, which ensures the authenticity of the IP header. So there is an RFC numbered 3193 that details how NAT Traversal is used to allow the UDP encapsulation of the authenticated IP packet using port 4500. The PIX is an excellent IPsec tunnel termination point. It has a wide range of interoperable standards and is straightforward to configure with preshared keys or with a certificate authority (CA). Many companies are using the PIX as an integrated firewall/VPN terminator, particularly in SOHO environments, as well as a stand-alone VPN terminator in conjunction with another (dedicated) firewall. One of the PIX’s best features is VPN performance.The simplicity of the PIX firewall appliance makes it a sound choice for VPN termination in many enterprise or carrier-class environments.

URL Filtering A uniform resource locator, or URL, is the way we identify user-friendly addresses for information on the World Wide Web (WWW) instead of using IP addresses, which are not nearly as friendly.The PIX firewall supports URL filtering by intercepting a request and validating its permissibility against a database located on a N2H2 or Websense server.The N2H2 server can be running Linux (see www.n2h2.com/products/bess.php?os=lnx&device=pix) or Microsoft Windows (see www.n2h2.com/products/bess.php?os=win&device=pix); the Websense server can use these platforms or be installed on a Solaris server (www.websense.com/products/integrations/ciscoPIX.cfm). URL filtering provides the means to apply and enforce an acceptable use policy for Internet browsing as well as to capture and analyze how your personnel are using the Internet.The servers themselves provide reporting capabilities so that you can determine how well your policy is being followed.

Address Translation Network address translation is a key feature of the Cisco PIX. In fact, the PIX originated as an appliance created by a company called Network Translations Inc., and the PIX’s first role simply was to perform address translation. (The name PIX comes from Private Internet Exchange, reflecting its purpose: to exchange traffic between private networks and the Internet.) Refer back to Chapter 1 for more information on address translation.

High Availability The three fundamental concepts of information security are confidentiality, integrity, and availability.The PIX addresses the availability idea by providing a robust, fault-tolerant envi-

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 59

Introduction to PIX Firewalls • Chapter 2

ronment. Fault-tolerant has a specific meaning where firewalls are concerned: if an error or failure occurs, alerts are triggered and sent, allowing corrective actions to be taken. The term high availability usually refers to hardware fault tolerance. Obviously, a firewall is a critical piece of equipment: to effectively perform its function, it is usually placed in the middle of multiple datastreams. Cisco hardware is of very high quality, and the PIX has no moving parts. Nonetheless, errors or problems will occur, and even the best-made equipment does fail. High availability is a device configuration so that isolated failure of the hardware will not bring down your network. To achieve high-availability requires multiples of hardware. In this case, two PIX firewalls are configured similarly and maintain communications between themselves: loss of these special communications equates to a failure, allowing corrective actions to occur automatically. If one firewall in the pair fails, the other transparently picks up the traffic, and alarm messages are sent to the network management console. High availability can be configured in several ways. Naturally, you need a second PIX that will be configured in a hot standby fashion.The simplest and least expensive way is through a serial cable, provided when you purchase the failover license. Alternately, a LAN interface can be dedicated to the failover process. With the failover cable, hello packets containing the number of bytes seen by the interfaces are transmitted between the two boxes, and if the values differ, failover can occur. With the LAN interface, full state information is transmitted so that in the event of a failover, the TCP sessions can keep running without reinitialization. PIX 7.0 also allows for firewalls to be run in active/active mode, enabling the ability to balance some of the traffic across a pair of firewalls.

PIX Hardware The PIX has many different configuration models to ensure that the product will be suited to different environments. Obviously, the requirements of a SOHO user will be different from those of a service provider. Cisco has provided various classes with different price points to ensure optimum product placement.

Models Five models are currently supported: the 501, the 506E, the 515E, the 525, and the 535. However, there are three models that you may see deployed in enterprise environments: the 515, the 525, and the 535. As it turns out, these are the three models that the new 7.0 code will run on. The 7.0 code at the time of this writing does not run on the SOHO models, which are the 501 and 506E. Table 2.1 shows the vital characteristics of each of the models.

59

10

8

6**

2

2

Yes

Yes

Yes

No

No

1.7Gbps

330Mbps

190Mbps

100Mbps

60Mbps

Clear-Text Throughput

YES

Yes

Yes

Yes

No

No

5Gps

425Mbps*

145Mbps*

135Mbps*

16Mbps

3Mbps

3DES VAC ThroughAvailable? put

* Maximum 3DES throughput is achieved with the VPN+ Accelerator; ** Maximum requires the unrestricted license.

FWSM

535

525

515E

506E

133MHz AMD SC520 300MHz Intel Celeron 443MHz Intel Celeron 600MHz Intel Pentium III 1GHz Intel Pentium III No

Failover Support

1Gb

1Gb**

512Mb**

128Mb**

32Mb

16Mb

RAM Memory

1:00 PM

501

Model

Maximum Interfaces

5/7/05

Processor Type

60

Table 2.1 PIX Model Characteristics

326_PIX_2e_02.qxd Page 60

Chapter 2 • Introduction to PIX Firewalls

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 61

Introduction to PIX Firewalls • Chapter 2

PIX 501 The 501 is the basic entry model for the PIX line, with a fixed hardware configuration. It has a four-port 10/100Mbps switch for inside connectivity and a single 10/100Mbps interface for connecting to the Internet upstream device (such as cable modem or DSL router). It will provide 3Mbps throughput on a 3DES IPsec connection, which should satisfy most SOHO requirements.The base license is a 10-user license with DES IPsec.There is an optional 50-user upgrade and/or 3DES VPN support.There is also an unlimited user count version available. The 501 is based on a 133MHz AMD SC520 processor with 16MB of RAM and 8MB of flash.There is a console port, a full/half duplex RJ45 10BaseT port for the outside, and an integrated, auto-sensing, auto-MDIX 4 port RJ45 10/100 switch for the inside.

PIX 506E The 506E product, an enhanced version of the 506, has replaced it on the product sheets.The chassis are similar, but the 506E has a beefier CPU, a quieter fan, and a new power supply.The CPU is a 300MHz Intel Celeron, and the RAM and flash are of the same capacity as the original 506. Clear-text throughput has been increased to 100Mbps (wire speed), and 3DES throughput increased to 16Mbps. Licensing on the 506E (and 506) is provided in a single, unlimited-user mode.The only extra license you may need is the 3DES license.The 506E has one console port and two RJ45 10BaseT ports, one for the outside and one for the inside.

PIX 515E The 515E replaced the 515 in May 2002. It has a higher-performing 433MHz Intel Celeron, increasing base firewall performance, and is intended for the enterprise core of small- to medium-sized businesses.The 515E can offload the arithmetic load of DES computation from the OS to a dedicated VPN accelerator card (VAC+), delivering up to 135Mbps 3DES throughput and 2,000 VPN tunnels. Licensing is similar: the restricted license limits you to three interfaces and no failover, whereas the unrestricted license has the memory upgrade, the VAC+, and up to six interfaces.

61

326_PIX_2e_02.qxd

62

5/7/05

1:00 PM

Page 62

Chapter 2 • Introduction to PIX Firewalls

The chassis is a 1U pizza-box, intended for rack mounting.The most important difference between the 506E and the 515E is that the 515E chassis is hardware configurable.The 515E provides a slot for an additional single-port or four-port Fast Ethernet interface, allowing the inside, outside, and up to four additional service networks. The licensing is flexible, allowing enterprises to purchase only what they need.The restricted license limits the number of interfaces to three and does not support high availability.The unrestricted license allows for an increase in RAM (from 32MB to 128MB) and up to six interfaces, together with failover capability

PIX 525 The PIX 525 replaced the PIX 520 in June 2001. It is designed for large enterprise or small service provider environments.The diskette drive found on the 520 is gone.The 525 supports single- or four-port 10/100 Fast Ethernet, 4/16 Token Ring, and dual-attached multimode FDDI cards, as well as Gigabit Ethernet. Performance tells the story here: the 525 with its 600MHz Intel Pentium III boasts 330Mbps clear-text throughput and, with the VPN+ accelerator card, 145Mbps of 3DES IPsec tunnel traffic. Licensing is based on interface counts and failover, as with the other models.The restricted license limits the PIX 525 to 128MB of RAM and six interfaces.The unrestricted license bumps RAM to 512MB, allows up to eight interfaces, and supports failover. As before, 3DES licensing is separate, if desired.

PIX 535 The PIX 535 is the top-of-the-line model, suitable for service provider environments. Performance is the key: up to 1.7Gbps clear-text throughput, half a million simultaneous connections, and 7000 connection initialization/teardowns per second. With the VAC+, you can get 425Mbps 3DES throughput, with up to 2000 simultaneous security associations (VPN tunnels). In terms of hardware, the PIX 535 is based on a 1GHz Intel Pentium III, with up to 1GB of RAM. It has a 16MB flash and 256K cache running at 1GHz, as well as a dual 64bit 66MHz PCI system bus. Cards available are the one- or four-port 10/100 Ethernet NICs or 1GB Ethernet multimode “stick and click” fiber connectors.

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 63

Introduction to PIX Firewalls • Chapter 2

Cisco Firewall Services Module The Cisco Firewall Services Module (FWSM) is an integrated firewall and switching module based on the Cisco PIX. It is designed and intended for the Catalyst 6500 series switch and the Cisco 7600 series router. It offers 5Gbps of throughput with one million concurrent connections.You can place up to four FWSMs in a single chassis.You can manage the FWSM using PDM version 4 for FWSM (Release 2.3), Monitoring Center for Performance or using Management Center for Firewalls.You can also configure the FWSM to use Telnet or SSHv1 to access the CLI of the module. The FWSM can work with either CatOS or IOS-based code and supports a few different supervisor cards. In Table 2.2, we see the relationship between supervisor cards and the level of code needed to run an FWSM. At the time of this writing, version 7.0 had not been deployed for the FWSM.

Table 2.2 Supervisor Cards Needed to Run an FWSM Sup1 (with MSFC)

Sup2 (with MSFC)

Sup720

Module Code

Cisco IOS/CatOS

Cisco IOS /CatOS

Cisco IOS /CatOS

FWSM Version

12.1(13)E /7.5(1)

12.1(13)E /7.5(1)

12.2(14)SX1 /8.2(1)

Software Licensing and Upgrades The PIX uses software licensing to enable or disable features within the PIX OS. Although the hardware is common to all platforms (except that certain licenses can ship with additional memory or hardware accelerators) and the software is common, features differ depending on the activation key. The activation key allows you to upgrade features without acquiring new software, although the process is similar.The activation key is computed by Cisco depending on what you have ordered and your serial number; it is different for each piece of PIX hardware.The serial number is based on the flash, so if you replace the flash, you have to replace the activation key.

63

326_PIX_2e_02.qxd

64

5/7/05

1:00 PM

Page 64

Chapter 2 • Introduction to PIX Firewalls

The activation key enables feature-specific information such as interfaces, high availability, and type of encryption. More specific information is found in the section, “PIX Licensing and Upgrades.” To get information about the activation key, use the show version command.The command provides information about the code version, hardware information, and activation key information. Alternately, the command show activation-key provides this printout: PIX1# show activation-key Serial Number:

808413563

Running Activation Key: 0xf9200218 0x4c8b6b1f 0x253632cd 0x8c5d666b

Licensed features for this platform: Maximum Physical Interfaces : 10 Maximum VLANs

: 100

Inside Hosts

: Unlimited

Failover

: Active/Active

VPN-DES

: Enabled

VPN-3DES-AES

: Enabled

Cut-through Proxy

: Enabled

Guards

: Enabled

URL Filtering

: Enabled

Security Contexts

: 2

GTP/GPRS

: Disabled

VPN Peers

: Unlimited

This platform has an Unrestricted (UR) license.

The flash activation key is the SAME as the running key. PIX1#

Updating the activation key in version 7.0 of the PIX OS couldn’t be simpler.The command activation-key activation-key-four-or-five-tuple sets the key to the new value. Note that activation tuples are in hexadecimal, are case insensitive, and don’t require you to start the numbers with 0x.Thus, the previously mentioned machine could be set with: PIX1(config)# activation-key 75fe7c49 c08b4082 08979930 e4b4c4b0 004b4ccd

Licensing Generally, Cisco PIX licensing falls into one of four types: Restricted, Unrestricted, Failover, and Failover Active/Active.The restricted and unrestricted apply to all Cisco PIX firewalls

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 65

Introduction to PIX Firewalls • Chapter 2

except the 501 and 506, but the failover applies to only the 515, 525 and 535 models.The 501 and 506 do not have the required interfaces for the failover. With the release of the PIX 7.0 code, the Failover method has added an Active/Active feature to its Active and Standby model.

NOTE The Cisco FWSM does not require a license of any kind. FWSM does not run 7.0 at the time of this writing.

There are various pieces that make up the licensing or feature set for the Cisco PIX. In Table 2.3 we see several of the key features of each license type and how they differ between the licenses.

Table 2.3 PIX 500 Series Licensing UR (unrestricted) FO (Failover)

FO-AA (Failover Active/Active

Security Contexts No support

2 Default up to 5

2 default up to 5

Failover

No support

Active/Standby Active/Standby Active/Active

Active Standby Active/Active

Max VLANs

10

25

25

25

Concurrent

49 K

130 K

130 K

130 K

Connections Max. Physical

3

6

6

6

None Default Base DES or 3DES/AES

None Default Base DES or 3DES/AES

None Default Base DES or 3DES/AES

None Default Base DES or 3DES/AES

Min RAM

64 MB

128 MB

128 MB

128 MB

PIX 525

Restricted

UR (unrestricted) FO (failover)

FO-AA(Failover Active/Active)

Security Contexts No support

2 or 5,10,20,50 2 or 5,10,20,50

2 or 5,10,20,50

Failover

No support

Active Standby Active Standby Active/Active

Active Standby Active/Active

Max VLANS

25

100

100

100

Concurrent Connections

110 K

280 K

280 K

280 K

PIX 515/515E

Interfaces Encryption

Restricted

2 Default

Continued

65

326_PIX_2e_02.qxd

66

5/7/05

1:00 PM

Page 66

Chapter 2 • Introduction to PIX Firewalls

Table 2.3 continued PIX 500 Series Licensing PIX 525

Restricted

UR (unrestricted) FO (failover)

FO-AA(Failover Active/Active)

Max. Physical Interfaces

6

10

10

10

Encryption

None Base DES 3DES/AES

None Base DES 3DES/AES

None Base DES 3DES/AES

None Base DES 3DES/AES

Min RAM

128 MB

512 MB

512 MB

512MB

PIX 535

Restricted

UR (unrestricted) FO (failover)

FO-AA(Failover Active/Active)

Security Contexts No support

2,5,10,20, 50,100

2,5,10,20,50,100

Failover

No support

Active Standby Active Standby Active/Active

Active Standby Active/Active

Max VLANs

50

200

200

200

Concurrent Connections

250 K

500 K

500 K

500 K

Max Physical Interfaces

8

14

14

14

Encryptions

None Base DES 3DES/AES

None Base DES 3DES/AES

None Base DES 3DES/AES

None Base DES 3DES/AES

Min RAM

512 MB

1024 MB

1024 MB

1024 MB

2,5,10,20,50, 100

Upgrading Software The traditional way of managing images is via TFTP, a fast and efficient UDP protocol. Unfortunately, it is not authenticated, so you have to be a bit careful to ensure that your data gets saved when you write to a TFTP server and that the data downloaded doesn’t get corrupted. By default, UNIX and Linux hosts have TFTP software preinstalled. If you do have a UNIX laptop, try man tftpd to see how to turn it on. If you have a Windows laptop, the server is not installed (although a client might well be—it’s standard on most NT and Win2K environments). Luckily, a TFTP server for a Windows environment is easy to acquire and install. Perhaps one of the best is the Solar Winds TFTP server, which Solarwinds gives away as a freebie in the hopes you will buy the entire suite of tools (which is well worth the money).You can get the TFTP server at www.solarwinds.net/Tools/Free_tools/TFTP_Server/. In Figure 2.7, we see a screenshot of the Solarwinds TFTP server running on a Windows XP host.

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 67

Introduction to PIX Firewalls • Chapter 2

Figure 2.7 Solarwinds TFTP Server

Another free TFTP server is provided by Cisco via its Web site. It can be downloaded at www.cisco.com/cgi-bin/tablebuild.pl/tftp. Simply provide your Cisco user ID when you download, and launch the installer executable. Running the Cisco TFTP server is straightforward.The server, by default, is not running. (This mode is recommended because there is no authentication; you don’t want anyone uploading or downloading files without your knowledge.) The first time you run it, press O for Options (under the View menu) to set the log file, if desired, and set the TFTP root directory where the images are stored. If you are going to be upgrading the PIX software, FTP the binary image down from the Web into that directory, and you are ready for the transfer.

Preliminary Upgrade to 6.3 Before we can upgrade to 7.0, you must be running version 6.2 or 6.3; if not, you will need to upgrade to either of these versions. Upgrading to 6.2 or 6.3 will resolve configuration issues that may arise from older configurations when you upgrade to 7.0.The following steps will take you through the 6.3 upgrade. Once that upgrade is complete, we can move to the 7.0 upgrade, which is very significant because it will completely reformat the FLASH to the IOS style of formatting. There are also new memory requirements. For the PIX 515E, the memory requirements are 64MB of RAM for a restricted license and 128MB of RAM for Unrestricted or Failover licensing.The Cisco PIX 525 restricted license requires 128MB of RAM and the unrestricted license requires 256MB of RAM.The 535 PIX with a restricted license requires 512MB of RAM and 1024MB of RAM for an unrestricted license.

67

326_PIX_2e_02.qxd

68

5/7/05

1:00 PM

Page 68

Chapter 2 • Introduction to PIX Firewalls

NOTE This 6.3 image for the PIX 515 can access only the first 8 MB of RAM even if 16 MB of RAM is installed. When the 7.0 image tries to load into the memory, there may not be enough room, and an error will result. The solution is to load the 7.0 code from monitor mode.

If you have a very old version of the software (pre 5.1(x)), you must upgrade using monitor mode.You can follow the preceding notes or the following step-by-step procedure: 1. Enter monitor mode. Remember, this requires that you get a console session running, power-cycle the box, and press Escape within 10 seconds of the boot. 2. The PIX is currently unconfigured. Set up your download interface by doing the following: ■

Use interface number to set the TFTP interface.The default is 1, so you don’t have to set it if the TFTP server is on the inside.

■

Use address IP address to set the IP address of the PIX.

■

Hopefully, your server is on the same network as the TFTP interface. If not, you can set a default gateway with gateway IP address.

3. Next prepare the transfer information: ■

Use server IP address to set the IP address of your TFTP server.

■

Use file filename to set the name of the image to upload.

4. Finally, execute the transfer. Use tftp to start the file. This process loads a new image in place, and when you reboot, you will come up under the new image. Luckily, this process should not apply—unless you accidentally upload the wrong file or your TFTP transfer fails. Monitor mode is used primarily in the event of disaster. The process of updating your software on a reasonably new version of code is straightforward.You can avoid monitor mode and do everything from the PIX enable command line. Log in to the PIX and get into enable mode. It is a good idea to ping your TFTP server to verify connectivity—for example: PIX1# ping inside 10.1.1.1

Get the version of the software onto your TFTP server, and copy the file to flash: pixfirewall# copy tftp flash Address or name of remote host [127.0.0.1]? 10.1.1.1 Source file name [cdisk]? pix621.bin copying tftp://10.1.1.1/pix621.bin to flash [yes|no|again]? yes

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 69

Introduction to PIX Firewalls • Chapter 2 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Received 1640448 bytes. Erasing current image. Writing 1640448 bytes of image. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Image installed.

On the next reload, the new image is available.

Upgrade from 6.3 to 7.0 Code Now that we have our PIX running version 6.3, and we have resolved any configuration issues such as still using conduits—which are not supported in 7.0, we can move on to the upgrade. We will use the TFTP server just as we did for the 6.3 upgrade.The format is to use the copy tftp command shown in the following example and then tell the PIX to copy to FLASH the image, as shown in the next example. # copy tftp:/// flash:image

The IP address and the filename do not have to be specified on the command line; the PIX will prompt you for the IP address of the server and the filename if you just give the command: # copy tftp flash:image pixfirewall(config)# copy tftp flash:image Address or name of remote host [0.0.0.0]? 192.168.50.14 Source file name [cdisk]? pix-7.0.0.97-.bin copying tftp://192.168.50.14/pix-7.0.0.97-.bin to flash:image [yes|no|again]? yes !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ::: Trimmed for clairity ::: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Received 5105664 bytes Erasing current image Writing 5046328 bytes of image !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Image installed pixfirewall(config)# reload Proceed with reload? [confirm]

Version 7.0 does things in new ways that are different from previous versions.There are new messages associated with the booting process. Version 7.0 will reformat the flash and

69

326_PIX_2e_02.qxd

70

5/7/05

1:00 PM

Page 70

Chapter 2 • Introduction to PIX Firewalls

rewrite the directory structure. For the new image to start the installation process, we have to reload the PIX. Once the Cisco PIX reloads, we see the following text: Rebooting..

CISCO SYSTEMS PIX FIREWALL Embedded BIOS Version 4.3.207 01/02/02 16:12:22.73 Compiled by morlee 256 MB RAM

PCI Device Table. Bus Dev Func VendID DevID Class Irq 00 00 00 8086 7192 Host Bridge 00 07 00 8086 7110 ISA Bridge 00 07 01 8086 7111 IDE Controller 00 07 02 8086 7112 Serial Bus 9 00 07 03 8086 7113 PCI Bridge 00 0D 00 8086 1209 Ethernet 11 00 0E 00 8086 1209 Ethernet 10 00 11 00 14E4 5823 Co-Processor 11 00 13 00 1011 0026 PCI-to-PCI Bridge 01 00 00 8086 1229 Ethernet 11 01 01 00 8086 1229 Ethernet 10 01 02 00 8086 1229 Ethernet 9 01 03 00 8086 1229 Ethernet 5

Cisco Secure PIX Firewall BIOS (4.2) #0: Mon Dec 31 08:34:35 PST 2001 Platform PIX-525 System Flash=E28F128J3 @ 0xfff00000

Use BREAK or ESC to interrupt flash boot. Use SPACE to begin flash boot immediately. Reading 5042688 bytes of image from flash.

flashfs[7]: erasing block 52...done. flashfs[7]: Checking block 53...block number was (-19520) flashfs[7]: erasing block 53...done. flashfs[7]: Checking block 54...block number was (26492) flashfs[7]: erasing block 54...done. flashfs[7]: Checking block 55...block number was (-23649) ::: trimmed for clairity :::

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 71

Introduction to PIX Firewalls • Chapter 2 flashfs[7]: erasing block 124...done. flashfs[7]: Checking block 125...block number was (0) flashfs[7]: erasing block 125...done. flashfs[7]: 0 files, 1 directories flashfs[7]: 0 orphaned files, 0 orphaned directories flashfs[7]: Total bytes: 16128000 flashfs[7]: Bytes used: 1024 flashfs[7]: Bytes available: 16126976 flashfs[7]: flashfs fsck took 147 seconds. flashfs[7]: Initialization complete.

Saving the configuration ! Saving a copy of old configuration as downgrade.cfg ! Saved the activation key from the flash image Saved the default firewall mode (single) to flash Saving image file as image.bin !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! :: Trimmed for clairity:::

GTP/GPRS : Not Supported VPN Peers : Unlimited

This machine has an Unrestricted (UR) license.

Encryption hardware device : VAC+ (Crypto5823 revision 0x1) Creatingcontext 'single_vf'... Done. (0) -------------------------------------------------------------------------C i s c o S y s t e m s Private Internet eXchange --------------------------------------------------------------------------

Cisco PIX Security Appliance Software Version 7.0(1

Compiled on Thu 31-Mar-05 14:37 by builders

Setting dispatch table to default

****************************** Warning *******************************

71

326_PIX_2e_02.qxd

72

5/7/05

1:00 PM

Page 72

Chapter 2 • Introduction to PIX Firewalls This product contains cryptographic features and is subject to United States and local country laws governing, import, export, transfer, and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute, or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return the enclosed items immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to [email protected]. ******************************* Warning *******************************

Copyright (c) 1996-2004 by Cisco Systems, Inc.

Restricted Rights Legend

Use, duplication, or disclosure by the Government is subject to restrictions as set forth in subparagraph (c) of the Commercial Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS sec. 252.227-7013.

Cisco Systems, Inc. 170 West Tasman Drive San Jose, California 95134-1706

Cryptochecksum(unchanged): 25d8ff73 485b6e70 c0df6bbb e42f9639 INFO: converting 'fixup protocol dns maximum-length 512' to MPC commands INFO: converting 'fixup protocol ftp 21' to MPC commands INFO: converting 'fixup protocol h323_h225 1720' to MPC commands INFO: converting 'fixup protocol h323_ras 1718-1719' to MPC commands

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 73

Introduction to PIX Firewalls • Chapter 2 INFO: converting 'fixup protocol http 80' to MPC commands INFO: converting 'fixup protocol netbios 137-138' to MPC commands INFO: converting 'fixup protocol rsh 514' to MPC commands INFO: converting 'fixup protocol rtsp 554' to MPC commands INFO: converting 'fixup protocol sip 5060' to MPC commands INFO: converting 'fixup protocol skinny 2000' to MPC commands INFO: converting 'fixup protocol smtp 25' to MPC commands INFO: converting 'fixup protocol sqlet 1521' to MPC commands INFO: converting 'fixup protocol sunrpc_udp 111' to MPC commands INFO: converting 'fixup protocol tftp 69' to MPC commands INFO: converting 'fixup protocol sip udp 5060' to MPC commands INFO: converting 'fixup protocol xdmcp 177' to MPC commands Type help or '?' for a list of available commands. pixfirewall>

Now when we use the show version command, we will see that our code is now 7.0. pixfirewall# show version

Cisco PIX Security Appliance Software Version 7.0(1) Device Manager Version 5.0(1)

Compiled on Thu 31-Mar-05 14:37 by builders System image file is "flash:/image2.bin" Config file at boot was "startup-config" pixfirewall up 50 secs

Hardware: PIX-525, 256 MB RAM, CPU Pentium III 600 MHz Flash E28F128J3 @ 0xfff00000, 16MB BIOS Flash AM29F400B @ 0xfffd8000, 32KB

Encryption hardware device : VAC+ (Crypto5823 revision 0x1) 0: Ext: Ethernet0 : media index 0: irq 10 1: Ext: Ethernet1 : media index 1: irq 11 2: Ext: Ethernet2 : media index 2: irq 11 3: Ext: Ethernet3 : media index 3: irq 10 4: Ext: Ethernet4 : media index 4: irq 9 5: Ext: Ethernet5 : media index 5: irq 5

License Features for this Platform: Maximum Physical Interfaces : 10

73

326_PIX_2e_02.qxd

74

5/7/05

1:00 PM

Page 74

Chapter 2 • Introduction to PIX Firewalls Maximum VLANs : 100 Inside Hosts : Unlimited Failover : Active/Active VPN-DES : Enabled VPN-3DES-AES : Enabled Cut-through Proxy : Enabled Guards : Enabled URL-filtering : Enabled Security Contexts : 2 GTP/GPRS : Not Supported VPN Peers : Unlimited

This machine has an Unrestricted (UR) license.

Serial Number: 80XXXX563 Running Activation Key: 0xf92xx218 0x4c8xxb1f 0x2xx32cd 0x8cxx666b Configuration has not been modified since last system restart. pixfirewall#

Downgrading from 7.0 to 6.3 One feature new in version 7.0 is the ability to downgrade from 7.0 back to 6.3.There are some caveats to remember when attempting to downgrade the PIX.To effect this downgrade of code, we will use the downgrade command. Cisco also recommends that the files are stored locally since the downgrade cannot tolerate any interruption.The downgrade will verify the four tuple key, which is stored when the PIX is upgraded. If the PIX cannot verify the key, it will have to be reentered. We see in the following example, the downgrade command parameters that we can choose from: PIX1# downgrade ?

/noconfirm

Do not prompt for confirmation

flash:

URL of the image to reboot with

ftp:

URL of the image to reboot with

http:

URL of the image to reboot with

https:

URL of the image to reboot with

tftp:

URL of the image to reboot with

PIX1#

When the downgrade is completed, the downgrade command will reboot the PIX to enable the old code. When you use the downgrade command, if you do not specify the configuration file to use, the PIX will use the saved downgrade.cfg by default.

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 75

Introduction to PIX Firewalls • Chapter 2

Management Access Management access is how you will access the Cisco PIX for your configuration and management.The Cisco PIX is very flexible for access.You can connect through a console port and a simple eight wire cable, you can connect to it by telnet, you can connect by SSH or you can connect by HTTPS using a browser.This gives you a lot of options for configuring the Cisco PIX management access in a secure manner for your own situation. In this section we will cover the various methods of connecting to your Cisco PIX firewall and how to configure the access and how to keep the access as secure as possible.

Console Port The primary mechanism for talking to a PIX is via the console port. Some devices have the old DB9 connectors—nine-pin D-subminiature connectors similar to those found on the back of many PCs.The newer devices use the Cisco standard RJ45 connector (rollover cable), similar to those used with most Cisco routers and switches. In each case, an appropriate cable is provided with your equipment. The communication is via null-modem and uses communications set to 8-N-1. If you are using Windows, a good program to communicate with a PIX is HyperTerminal, which is provided with most Windows-based installations, under Accessories/Communications. When launching HyperTerminal, configure your connection to direct-connect to COM 1, as shown in Figure 2.8.

Figure 2.8 Configuring HyperTerminal

The communications parameters then need to be set, as shown in Figure 2.9.

75

326_PIX_2e_02.qxd

76

5/7/05

1:00 PM

Page 76

Chapter 2 • Introduction to PIX Firewalls

Figure 2.9 Port Communication Properties for HyperTerminal

At this point, you should be connected. Power on your PIX, and you will see the boot process taking place, as shown in Figure 2.10.Your output will differ slightly.

Figure 2.10 Sample Output from Boot Sequence

If you do not see output or the output is garbled, it usually means your parameters are not set correctly. If you are not using the provided cable, make sure it is null-modem and that your parameters are set to 8 bit, 9600 baud, 1 stop bit, no parity, and no flow control.

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 77

Introduction to PIX Firewalls • Chapter 2

USB Even though the Cisco PIX 515, 525 and 535 have a USB port available, it is not used for any purpose at this time.

Telnet Telnet is one of the most common ways to access a network device and although the Cisco PIX will support Telnet access on the inside interface by default and on the outside interface only when used with encryptions such as IPsec.Telnet is strongly discouraged in favor of using SSH, which is encrypted.The default port for Telnet is TCP port 23.The default Telnet password for the Cisco PIX is “cisco.”

SSH Secure Shell (SSH) is the preferred method of connecting over a network to the Cisco PIX firewall. SSH is a suite of encrypted applications that can replace Telnet, copy and FTP with SSH, SCP, and SCP. SSH uses port 22 and is not enabled by default. For full details on the usage of SSH and enabling SSH on the Cisco PIX firewall, please see Chapter 8.

Web The Cisco PIX can be managed by a Web interface called the Adaptive Security Device Manager (ASDM), which replaces the PIX Device Manager (PDM).The new ASDM can be accessed by using HTTPS or by using a Windows application installed on the management console.The Web-based interface is Java-based, so it is not a requirement to use Internet Explorer; you can use a recent release of Mozilla or FireFox to manage the PIX. In Figure 2.11 we see the startup screen, which offers the choice of the Windows application or the Java-based front end.

Figure 2.11 Choosing the ASDM Front End

77

326_PIX_2e_02.qxd

78

5/7/05

1:00 PM

Page 78

Chapter 2 • Introduction to PIX Firewalls

Once you have chosen the front end, the ASDM will start up. In Figure 2.12, we see the final screen of the ASDM when starting using Java and FireFox 1.01.

Figure 2.12 Running ASDM in the FireFox Web Browser

Password Recovery Cisco makes it easy to recover from a lost or forgotten password on its PIX firewalls with a minimum of downtime.You download a program, depending on your OS version, that will execute on the PIX and reset the password to the default, cisco.You can then get in and use enable mode to set the password to a known value. Earlier you saw that monitor mode was used for emergencies. Forgetting the password is a pretty good emergency. With the emergency defined, use Table 2.4 to find the recovery file you will need to download from Cisco’s Web site.

Table 2.4 PIX Password Recovery Binaries Version

Filename

URL

4.3 <

nppix.bin

www.cisco.com/warp/public/110/nppix.bin

4.4 release

np44.bin

www.cisco.com/warp/public/110/np44.bin

5.0 release

np50.bin

www.cisco.com/warp/public/110/np50.bin

5.1 release

np51.bin

www.cisco.com/warp/public/110/np51.bin

5.2 release

np52.bin

www.cisco.com/warp/public/110/np52.bin

5.3 release

np53.bin

www.cisco.com/warp/public/110/np53.bin Continued

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 79

Introduction to PIX Firewalls • Chapter 2

Table 2.4 continued PIX Password Recovery Binaries Version

Filename

URL

6.0 release

np60.bin

www.cisco.com/warp/public/110/np60.bin

6.1 release

np61.bin

www.cisco.com/warp/public/110/np61.bin

6.2 release

np62.bin

www.cisco.com/warp/public/110/np62.bin

6.3 release

np63.bin

www.cisco.com/warp/public/110/np63.bin

Follow these steps to effect a Cisco PIX firewall recovery. 1. Pick the correct version of the software from Table 2.2. 2. Place this software on a TFTP server accessible to the PIX. 3. Connect to the PIX on the console port. Verify connectivity. (You should get a password prompt, which you can’t answer.) 4. Reboot the PIX. 5. Within 10 seconds of the reboot, press Esc to enter monitor mode. 6. Use the interface command to set the interface to that of the TFTP server. 7. Use the address command to specify the IP address of that interface. 8. Use the server command to specify the IP address of the TFTP server. 9. Use the gateway command to specify the default route to the TFTP server, if needed. (This is not recommended; if at all possible, try to have the TFTP server on the same network as the PIX interface to minimize the likelihood of file corruption.) 10.

Use the file command to specify the filename of the recovery file you chose in Step 1.

11.

Use the ping command to verify that you can connect to the TFTP server.

12.

Use the tftp command to start the download.

At this point, you should be prompted to erase the passwords, and you will be in.The default password has now been set to cisco, with no enable password. It is possible to turn off password recovery and to force the user trying to recover the password to erase the configuration.To disable the password recovery, we use this command: PIX1(config)# no service password-recovery

This command will force the user to erase all flash systems before the password can be reset using the PIX password recovery tool. Use this command with caution! If you do not keep copies of the current configuration and lock yourself out of the PIX with this command, your only recourse to regain control of your firewall is to delete its entire configuration and start over.

79

326_PIX_2e_02.qxd

80

5/7/05

1:00 PM

Page 80

Chapter 2 • Introduction to PIX Firewalls

Command-Line Interface “Real administrators use the command line” is the comment heard a lot around network geeks when discussing their favorite network equipment. In the case of the Cisco PIX firewall, the command line is a very flexible way to configure the Cisco PIX and now with the new 7.0 code, it is a bit easier if you already knew the IOS command structure since many of the old PIX commands were updated to reflect the structure of the IOS command line. And in some rare cases, the command line is still the only way to configure certain features that the ASDM does not support just yet.This section will show you just how rich the command line is for those willing to learn and use the Cisco PIX command line so sit back and get ready to dig into the nuts and bolts of your Cisco PIX firewall.

Administrative Access Modes An administrative access mode is a state in which the administrator is able to issue commands, potentially to change the configuration of the PIX. Monitor mode, described earlier, is an administrative access mode, but it is contained in ROM rather than in the binary image, and hopefully you will never have to use it. When you first log in, you are in an unprivileged mode.You can identify the mode you are in from the prompt: If the prompt looks like the hostname followed by a right-angle bracket (>), you are in unprivileged mode. Few commands are available: PIX1> ? clear

Reset functions

enable

Turn on privileged commands

exit

Exit from the EXEC

help

Interactive help for commands

login

Log in as a particular user

logout

Exit from the EXEC

ping

Send echo messages

quit

Exit from the EXEC

show

Show running system information

PIX1>

This is not a complete list of the available commands. For example, when you are in unprivileged mode: PIX1> show ? checksum

Display configuration information cryptochecksum

curpriv

Display current privilege level

flash: history running-config version

Display information about flash: file system Display the session command history Show current operating configuration Display system software version

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 81

Introduction to PIX Firewalls • Chapter 2 PIX1>

PIX1# show version

Cisco PIX Security Appliance Software Version 7.0(0)102 Device Manager Version 5.0(0)73

Compiled on Sun 20-Feb-05 00:40 by builders System image file is "flash:/image2.bin" Config file at boot was "startup-config"

PIX1 up 30 mins 11 secs

Hardware:

PIX-525, 256 MB RAM, CPU Pentium III 600 MHz

Flash E28F128J3 @ 0xfff00000, 16MB BIOS Flash AM29F400B @ 0xfffd8000, 32KB :: trimmed for clarity ::: …

The most important of these is enable mode, which turns on the privileged commands. At this point, your prompt will change; now it ends in a pound sign.To show your new privilege: PIX1# ?

activation-key

Modify activation-key

asdm

Disconnect a specific ASDM session

blocks

Set block diagnostic parameters

capture more

Capture inbound and outbound packets on one or interfaces

cd

Change current directory

clear

Reset functions

client-update groups clock configure copy crashinfo

Execute client updates on all or specific tunnelManage the system clock Configure using various methods Copy from one file to another Crash information

debug

Debugging functions (see also 'undebug')

delete

Delete a file

dir

List files on a filesystem

81

326_PIX_2e_02.qxd

82

5/7/05

1:00 PM

Page 82

Chapter 2 • Introduction to PIX Firewalls disable

Exit from privileged mode

downgrade

Downgrade the file system and reboot

erase

Erase a filesystem

exit

Exit from the EXEC

failover or force it

Switch a unit or failover group to active state back to an unfailed state

format

Format a filesystem

fsck

Fsck a filesystem

gdb

Manipulate remote debugger

help

Interactive help for commands

kill

Terminate a telnet session

logging

Configure flash file name to save logging buffer

logout

Exit from the EXEC

memory

Memory tools

mkdir

Create new directory

more

Display the contents of a file

no

Negate a command or set its defaults

perfmon

Change or view performance monitoring options

ping

Send echo messages

pwd

Display current working directory

quit

Exit from the EXEC

reload

Halt and reload system

rename

Rename a file

rmdir

Remove existing directory

show

Show running system information

shun hosts

Manages the filtering of packets from undesired

ssh

Disconnect a specific SSH session

terminal

Turn on/off syslogging to this terminal

test

Test subsystems, memory, and interfaces

undebug vpn-sessiondb

Disable debugging functions (see also 'debug') Configure the VPN Session Manager

who

Show active administration sessions on the system

write terminal

Write running configuration to memory, network, or

PIX1#

While you remain in enable mode but have not yet entered the configuration mode (which requires enable privileges), you are more or less protected from accidentally harming the system: you can erase the configuration in total, but it will not make small changes until

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 83

Introduction to PIX Firewalls • Chapter 2

you enter configuration mode. Use the configure terminal command to get into configuration mode. Again, your prompt will change to show privilege: PIX1(config)#

There are approximately 100 lines of commands, so it is not appropriate to show them all here. Unlike a Cisco router, for which there are additional modes, these are all the modes that occur: you have no rights (nonenable), you are somewhat protected (enable mode only), or you are changing the configuration (enable and configuration mode). However, note that if you are in configuration mode, your show commands are still available. The PIX also stores previous commands you’ve executed. Use the show history command to see what you’ve executed.This feature is helpful in two ways: One, if you are unsure what you have executed so far, look at the show history command to see what you’ve done to date. PIX1# show history show en show version show history PIX1#

A more common use is when you have lots of similar commands.You can use the uparrow key to see the previous line in your history and then use the basic commands (covered in the following section) to edit the line and resubmit it.

NOTE The PIX firewall provides help functionality built into the command-line interface. Use the question mark key (?)—it is your friend. At any point, pressing ? will help you complete your commands. In addition, a “man page” or “manual page” functionality is built in. For example, if you want to ping something and forgot the syntax, try ping ?. If you don’t remember what the ping command does, try help ping. This provides usage, and description and syntax issues. In the new 7.0 code, online help has been greatly reduced to keep the size of the image small and to lessen the risk of a possible exploits taking advantage of the code used to provide the online help.

Basic Commands The environment at the command prompt is similar to that of a Cisco router and uses emacs-style commands, shown in Table 2.5.

83

326_PIX_2e_02.qxd

84

5/7/05

1:00 PM

Page 84

Chapter 2 • Introduction to PIX Firewalls

Table 2.5 Basic Keystroke Shortcuts Command

Result

Tab

Command-line completion.

Ctrl + A

Moves the cursor to the start of a line.

Ctrl + B

Moves the cursor one character left (nondestructive).

Alt + B

Moves the cursor one word left.

Ctrl + D

Deletes the character under the cursor.

Ctrl + E

Moves the cursor to the end of the line.

Ctrl + F

Moves the cursor one character right.

Alt + F

Moves the cursor one word right.

Ctrl + H or Rubout

Erases the previous character.

Ctrl + R

Reprints a line.

Up Arrow or Ctrl + P

Displays the previous line.

Up Arrow or Ctrl + N

Displays the next line.

Help or ?

Displays help.

To see additional editing commands, try searching the Web for emacs style commands. However, the list shown in Table 2.5 is sufficient for most users. For example, if you are setting up multiple ACL statements, you can save a great deal of effort by changing only a port number, then pressing Ctrl + P to get the previous line, Alt + F to move right a few words, Ctrl + D to delete the old port, and then typing the new port. In addition, you don’t have to type the full command—you have to provide only enough of the command to establish a unique initial segment. For example, the command configure terminal can be abbreviated; the first three letters aren’t enough (both conduit and configure start with con), and only one option from the configure command starts with t. Therefore, to get into configuration mode, just type conf t. Such shortcuts can save a bit of typing, particularly on long commands.

Hostname and Domain Name Two useful commands are the hostname and domain-name commands.These set the hostname (which appears in the prompt) and the domain name of the PIX.The syntax is hostname and domain-name —for example: PIX1(config)# hostname PIX1 PIX1(config)# domain-name secret.com

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 85

Introduction to PIX Firewalls • Chapter 2

Configuring Interfaces The most important aspect of a network device is the network interface. In the PIX, configuring the network interface is a fairly straightforward process.You need to specify the security context and a few parameters to put connectivity in context. Once completed, the default information flow policy takes over.

The interface Command The interface command has changed in the new PIX 7.0 code.The interface command now sets which physical interface we will be working with just like if we were working on a router. From the interface prompt we can set the various parameters of the interface with the commands we see here: PIX1(config-if)# ? Interface configuration commands: default

Set a command to its defaults.

description

Interface specific description.

duplex

Configure duplex operation.

exit

Exit from interface configuration mode.

help

Interactive help for interface subcommands.

igmp

IGMP interface commands.

ip

Configure ip addresses.

ipv6

IPv6 interface subcommands.

management-only

Dedicate an interface to management. Block thru traffic

nameif

Assign name to interface.

no

Negate a command or set its defaults.

ospf

Configure interface specific OSPF parameters.

pim

PIM interface commands.

security-level

Specify the security level of this interface after this keyword, Eg: 0, 100 etc. The relative security level between two interfaces determines the way the Adaptive Security Algorithm is applied. A lower security_level interface is outside relative to a higher level interface and equivalent interfaces are outside to each other.

shutdown

Shutdown the selected interface.

speed

Configure speed operation.

PIX1(config-if)#

85

326_PIX_2e_02.qxd

86

5/7/05

1:00 PM

Page 86

Chapter 2 • Introduction to PIX Firewalls

The nameif Command The nameif command is used to give an interface a logical name.The name should be memorable, since it will be used in all other commands.To set the name of the interface now requires you to use the interface command first to change to the physical interface you want to set the name on first, much like working on a router.The format of the new command is: nameif <word>

The <word> is the string of the characters that make up the name and the string can be up to 49 characters.The command looks like this: PIX1(config-if)# nameif DMZ

The security-level Command This is a new command for the 7.0 code. Where we use to set the security level using the nameif command, it is now a separate command called security-level.The format is very simple: security-level <0-100>

We will pick our security levels, with 0 being the least trusted interface such as the outside interface and 100 being the most trusted interface such as the inside interface. We can go from the MOST trusted level to the LEAST trusted level by default so we can go from the inside to the outside. But we cannot go the other way, or from LEAST trusted to MOST trusted, unless we put a specific exception in place.

The ip address Command The ip address command has changed from 6.3 to 7.0.To set the ip address in 7.0 requires you to use the interface command first to change to the physical interface you want to set the ip address on first, much like working on a router.The format of the new command is: interface

Which will look like: PIX1(config)# interface ethernet 0

Once we have changed to the physical interface, we can set the ip address using the format ip address <subnet_mask>: PIX1(config-if)# ip address 192.168.1.1 255.255.255

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 87

Introduction to PIX Firewalls • Chapter 2

NOTE The PIX can also obtain an IP address through DHCP client or PPPoE functionality.

Static Routes Though the PIX is not a router and does not have a wide selection of routing protocols, it does offer static routes, RIP, and a limited, basic version of OSPF. Specifying a static route is done with the following syntax: route [metric]

Translating this syntax into English, it reads “If packets destined for interface if_name on the network specified by network address ip_address are bounded by mask netmask, then route it via a next hop at gateway_ip.”The optional metric command is used to give an indication of distance (preference). A particularly important route is the default route.This is the “route of last resort”—the route used when no other direction is known for the packet. Only one default route is allowed on the PIX.This route is indicated by the 0 route with netmask 0; for example: PIX1(config)# route outside 0 0 192.168.50.140 1

To see our routes, you will use the command show route as we see here: PIX1(config)# show route

S

0.0.0.0 0.0.0.0 [1/0] via 172.16.1.1, inside

C

172.16.1.0 255.255.255.0 is directly connected, inside

C

192.168.0.0 255.255.255.0 is directly connected, Outside

PIX1(config)#

We have one static route and two connected routes showing in our example.To set up RIP on an interface, we just need to use the RIP command in this format: Rip <default|passive>

We can specify if RIP will be the default and advertise the routes on the interface or be passive and just listen for updates. We can set the version of RIP we want to use, version 1 or version 2. In the following example we are advertising from the DMZ interface and using RIP version 2: PIX1(config)# rip dmz default version 2

To use OSPF we need to go into the router configuration by using the router command from the configuration mode. First, we type the router command, then the protocol, which in this case is OSPF, and finally the area number we want or need to use as we see here:

87

326_PIX_2e_02.qxd

88

5/7/05

1:00 PM

Page 88

Chapter 2 • Introduction to PIX Firewalls PIX1(config)# router ospf 100 PIX1(config-router)# ? Router configuration commands: area compatible default-information

OSPF area parameters OSPF compatibility list Control distribution of default information

distance

Define an administrative distance

exit

Exit from router configuration mode

help

Interactive help for router subcommands

ignore

Do not complain about specific event

log-adj-changes

Log changes in adjacency state

neighbor

Specify a neighbor router

network

Add/remove interfaces to/from OSPF routing process

no

Negate a command

redistribute

Redistribute information from another routing process

router-id

router-id for this OSPF process

summary-address timers

Configure IP address summaries Adjust routing timers

PIX1(config-router)#

Once we are in the config-router mode, we can set up OSPF to broadcast the network information we want to transmit. In the following example, we are going to set up network 172.16.2.0 with a mask of /24 and use area 100. PIX1(config-router)# network 172.16.2.0 255.255.255.0 area 100

OSPF also has parameters for the interfaces to configure if required. First, change to the interface and then configure the OSPF parameters as we see here: PIX1(config)# interface ethernet 1 PIX1(config-if)# ospf ?

interface mode commands/options: authentication

Enable authentication

authentication-key

Authentication password (key)

cost

Interface cost

database-filter

Filter OSPF LSA during synchronization and flooding

dead-interval

Interval after which a neighbor is declared dead

hello-interval

Time between HELLO packets

message-digest-key

Message digest authentication password (key)

mtu-ignore

Ignores the MTU in DBD packets

network

Network type

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 89

Introduction to PIX Firewalls • Chapter 2 priority

Router priority

retransmit-interval

Time between retransmitting lost link state

transmit-delay

Link state transmit delay

advertisements

PIX1(config-if)#

As you can see, Cisco has brought a lot of flexibility to the PIX and 7.0 by including the protocol OSPF.

Password Configuration Two passwords need to be set: a password for access to the PIX and an enable password to get into privileged (enable) mode.The PIX is limited to 16-byte passwords and is case sensitive. A basic password will assign a password, such as: PIX1(config)# passwd cisco PIX1(config)# enable password cisco

In the configuration, the password is stored in an encrypted fashion.The command then looks like this: enable password 2KFQnbNIdI.2KYOU encrypted passwd 2KFQnbNIdI.2KYOU encrypted

When first connecting to the PIX, you will see a password prompt: Connected to 10.10.10.1. Escape character is '^]'.

User Access Verification

Password: Type help or '?' for a list of available commands. pix1> en Password: *****

You should note that to preserve security, the password is not echoed to the screen, and the previous sequence will get you into enable mode.

NOTE The PIX also supports local user accounts with individual passwords. Alternatively, you can use RADIUS or TACACS+ for console authentication.

89

326_PIX_2e_02.qxd

90

5/7/05

1:00 PM

Page 90

Chapter 2 • Introduction to PIX Firewalls

Basic Security (What Is Configured by Default Out of the Box) The basic PIX security posture out of the box with the exception of the 525, 535, and FWSW is that all traffic is allowed out of the outside interface to the Internet or external network, and all inbound traffic is blocked at the outside interface.This security posture makes it relatively easy to set up the Cisco PIX and to have it online quickly with the minimum of fuss. However, to improve your security posture, you must go back and lock down the outbound traffic with various access lists and filters.

Managing Configurations Having a configuration is just the start of the care and feeding of your Cisco PIX firewall. You also need to manage the configuration and this means that you need to know how to make changes, how to save those changes, how to back up the configuration and how to restore your configuration. All important stuff to know and we will show you in this section just how easy it can be.

Configuration Commands Just as with any network device, the most important task related to your PIX is ongoing management. It is important that you be comfortable not just manipulating the configuration with configuration mode but also pushing configurations out to storage and in from backup systems. Key commands here are write, which allows you to store a command; copy, which allows you to manage the underlying PIX application software; and configure, which allows you to update the configuration.

Configure You can manage configurations via the configure command.This is the alternative to the write commands. For example, just as write terminal dumps the configuration to the terminal, configure terminal allows you to change the configuration from the terminal. These commands generally merge the configuration from the media with the existing configuration.You will often want to clear configure to wipe out the existing configuration so you can pull a complete stored config.The other choices are: configure [terminal|floppy|memory]

You’ve used this one already, in the conf t command. It allows you to add commands from the terminal, from a diskette (if the PIX has a diskette drive), or from flash (memory). Analogous to the copy command, the following command configure http[s]://[<user>:<password>@][:<port>]/<pathname>

merges a configuration that is stored on a Web server with the running configuration. configure net []:[<pathname>] configure factory-default [ [<mask>]]

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 91

Introduction to PIX Firewalls • Chapter 2

Write The write command allows you to write the configuration to various types of media. Allowed variants are write net, write memory, write standby, write terminal, write erase, and write floppy. write net [[server_ip] : [filename] ]

The write command writes the configuration to a TFTP server.The IP address of the server can be specified on the command line or preset with the TFTP server command, tftpserver [if_name] ip_address path. Specifying a value on this line supersedes the value on the TFTP server line, but if the TFTP-server information is set, you can provide just a colon (or no parameters at all). The next command allows you to store the configuration to flash.The uncompressed parameter specifies storing the configuration as an uncompressed string and is generally not necessary. write memory [uncompressed]

If you want to print the configuration to the terminal (screen), use this command: write terminal

Note that this command prints out the running configuration. Show running-config lists the same output as write terminal, and show startup-config shows the configuration that is stored in flash. If the pager variable is set, the screen will pause after a fixed number of lines.To store the configuration via an ASCII capture, set the pager to 0, and then type write terminal. There is one other write command, which must be used with great care: write erase.This command clears the flash configuration to a known good state and allows you to reconfigure.

Copy The copy command is a similar way of managing images.The most common use of the command is in the copy tftp command—for example: copy tftp[:[[//location] [/tftp_pathname]]] flash[:[image | pdm]]

Most of the copy parameters are self-explanatory as they specify the location and filename of the TFTP server and, as previously mentioned, can be set with the TFTP-server command.The keyword flash indicates that the information is being stored to flash.The files can be conventional images, in which case they are available on the next reload, or PDM images, in which case they are available immediately. Images can also be downloaded from a Web server via conventional HTTP or over SSL. This is specified by the following command: copy http[s]://[user:password@] location [:port ] / http_pathname flash [: [image | pdm] ]

91

326_PIX_2e_02.qxd

92

5/7/05

1:00 PM

Page 92

Chapter 2 • Introduction to PIX Firewalls

The first part is the standard URL notation: http for clear-text Web use or https for SSL service.The user:password@location portion allows you to encode user information; if you are working via a Web browser, this portion displays a pop-up dialogue box requesting an username and password. Because the PIX does not have a pop-up, you can specify it on the command line by inserting it before the @ sign. If the Web server is running on a nonstandard port, you can also specify it here by putting the port after a colon, similar to this: copy http://fwadmin:[email protected]:99/pix_image flash

This solution is convenient if you do not have a TFTP server handy and can safely store the image files on a Web server.

Show The show command is one of the most used commands as this is how we can see what version of PIX hardware and code we have, how the interfaces are configured, what IP addresses are used, how much CPU processing power is being used, and more.The show command is available in both the user mode and the enable mode. In the following example we see the few show commands available in the user mode: checksum

Display configuration information cryptochecksum

curpriv

Display current privilege level

flash:

Display information about flash: file system

history running-config

Display the session command history Show current operating configuration

version

Display system software version

In the enable mode, there are many more commands available. Some of the most common uses of the show command are shown in the following example:. PIX1# show config : Saved : Written by enable_15 at 20:07:18.845 PST Sun Mar 20 2005

PIX Version 7.0(0)102 names ! interface Ethernet0 nameif Outside security-level 0 ip address 192.168.0.254 255.255.255.0 ! interface Ethernet1 nameif inside security-level 100

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 93

Introduction to PIX Firewalls • Chapter 2 ip address 172.16.1.50 255.255.255.0 ::: truncated for clarity::::

PIX1# show ip System IP Addresses: Interface Subnet mask

Method

Ethernet0 255.255.255.0

CONFIG

Ethernet1 255.255.255.0

CONFIG

Ethernet2 255.255.255.0

CONFIG

Name

IP address

Outside

192.168.0.254

inside

172.16.1.50

DMZ

10.0.0.254

Name

IP address

Outside

192.168.0.254

inside

172.16.1.50

DMZ

10.0.0.254

Current IP Addresses: Interface Subnet mask

Method

Ethernet0 255.255.255.0

CONFIG

Ethernet1 255.255.255.0

CONFIG

Ethernet2 255.255.255.0

CONFIG

PIX1# pix2# show xlate 0 in use, 0 most used PIX1# show version Cisco PIX Security Appliance Software Version 7.0(0)102 Device Manager Version 5.0(0)73 Compiled on Sun 20-Feb-05 00:40 by builders System image file is "flash:/image2.bin" Config file at boot was "startup-config"

PIX1 up 1 hour 33 mins

Hardware:

PIX-525, 256 MB RAM, CPU Pentium III 600 MHz

Flash E28F128J3 @ 0xfff00000, 16MB BIOS Flash AM29F400B @ 0xfffd8000, 32KB

Encryption hardware device : VAC+ (Crypto5823 revision 0x1) 0: Ext: Ethernet0

: media index

0: irq 10

1: Ext: Ethernet1

: media index

1: irq 11

2: Ext: Ethernet2

: media index

2: irq 11

3: Ext: Ethernet3

: media index

3: irq 10

93

326_PIX_2e_02.qxd

94

5/7/05

1:00 PM

Page 94

Chapter 2 • Introduction to PIX Firewalls 4: Ext: Ethernet4

: media index

4: irq 9

5: Ext: Ethernet5

: media index

5: irq 5

Licensed features for this platform: Maximum Physical Interfaces : 10 Maximum VLANs

: 100

::: truncated for clarity ::: PIX1# show crypto key mypubkey rsa Key pair was generated at: 12:44:05 PST Mar 17 2005 Key name: Usage: General Purpose Key Modulus Size (bits): 2048 Key Data:

30820121 300d0609 2a864886 f70d0101 01050003 82010e00 30820109 02820100 77cbf246 e512d6e7 60a03f63 4af21793 96a97614 478ed7ea 39f92892 6cd878bd be8973dc e0050462 289a7892 2a89ba87 29096f17 8506f22e 7f843f08 43804cb9 02030100 01 Key pair was generated at: 12:03:16 PST Mar 27 2005 Key name: .server Usage: Encryption Key Modulus Size (bits): 768 Key Data:

307c300d 06092a86 4886f70d 01010105 00036b00 30680261 00b51f5e ec12e6de 2da476bc d3d15276 1e7acd7d 6abf377f 398e0481 42f37b9f b9fa4175 8a92a525 ::truncated for clarity :::

The various show commands allow us to view certain aspects and operations of the PIX firewall.To see all of the options, just type show ? and then you can page through the options.

The configure Command To use the configure command, you have to be in the configure mode (config t) first.The configure command allows us to clear configurations, configure from flash, configure from the network, and it will let us configure the secondary or failover Cisco PIX. In the following example we see the options we can use with the configure command: configure [terminal|floppy|memory] configure http[s]://[<user>:<password>@][:<port>]/<pathname> configure net []:[<pathname>] configure factory-default [ [<mask>]] clear configure [primary|secondary|all]

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 95

Introduction to PIX Firewalls • Chapter 2

Initializing Images There will always be a time where it is just easier to whack the existing configuration and start over. Or you are upgrading and need to remove an existing configuration before the vultures on Ebay get their hands on the old PIX firewall. Or you made a change to the configuration and now you need to backout but have lost access to the PIX and hopefully you did not save the configuration to flash just yet.This section will address the need to either reload or remove an existing configuration.

Powercycle Generally, after installing a new image, you will want to have the PIX reboot and use the new image. Similarly, it is helpful to occasionally restore the configuration to what is running on the flash—if, for example, you have been exploring commands and have gotten to an uncertain state.You can always power-cycle the device; this solution has no moving parts, and configurations and images are fully flushed to flash.There is a better way: the reload command.

Reload You can restart the PIX gracefully using the reload command.This command prompts you to verify you really want to reboot the PIX firewall.The reload command can be executed only from privileged mode: pix1# reload Proceed with reload? [confirm]

At this point, there is a brief pause while the PIX reboots, and then you will be working under the new system. Note: If you want to bypass pressing the second carriage return, you can type reload noconfirm, but when you are executing a potentially dangerous command such as a reboot, it is generally good to have an “Are you really sure you want to do this?” checkpoint.

Factory Default Configurations The factory default configuration is very pared down compared with 7.0 predecessors.The interfaces are not named or addressed, and have no security levels assigned.The default password for Telnet and the administrative mode is blank. Application inspection is enabled for several common protocols, using a combination of class-maps and policy-maps.The following example shows the default configuration on an unconfigured PIX 525. PIX Version 7.0(1) names !

95

326_PIX_2e_02.qxd

96

5/7/05

1:00 PM

Page 96

Chapter 2 • Introduction to PIX Firewalls interface Ethernet0 shutdown no nameif no security-level no ip address

!

interface Ethernet1 shutdown no nameif no security-level no ip address !

interface Ethernet2 shutdown no nameif no security-level no ip address !

interface Ethernet3 shutdown no nameif no security-level no ip address !

interface Ethernet4 shutdown no nameif no security-level no ip address !

interface Ethernet5 shutdown no nameif no security-level

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 97

Introduction to PIX Firewalls • Chapter 2 no ip address !

enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted

hostname pixfirewall

ftp mode passive

pager lines 24

no failover

no asdm history enable

arp timeout 14400

timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute

no snmp-server location no snmp-server contact snmp-server enable traps snmp

telnet timeout 5 ssh timeout 5 console timeout 0 !

class-map inspection_default match default-inspection-traffic ! policy-map global_policy class inspection_default inspect dns maximum-length 512 inspect ftp

97

326_PIX_2e_02.qxd

98

5/7/05

1:00 PM

Page 98

Chapter 2 • Introduction to PIX Firewalls inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp ! service-policy global_policy global

Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e : end

To reset the configuration back to this default condition for the 515 and 515E, we need to use the configure factory-default command.This command is not supported on the 525 or 535 Cisco PIX. When we attempt to use this command on our 525, it fails as shown. PIX1(config)# configure factory-default

'config factory-default' is not supported on PIX-525

NOTE In order to use the new ASDM with the Cisco PIX 515 and 7.0 code, you must have a license for DES or 3DES.

Cisco Catalyst 6500 Series Firewall Services Module The Cisco FWSM may be based on the Cisco PIX design, but is a very different breed than the traditional Cisco PIX. With the FWSM in place in a Cisco 6500, before the module can be accessed to be configured, the switch must be configured. Once the switch is configured, Telnet or SSH to the switch and use the session command to access the FWSM.The default password for the FWSM is cisco, which you should change as soon as possible. Once you have logged into the FWSM, enter the administrative mode by typing the command enable. The initial enable password is blank; pressing the Enter key is sufficient.To start configuring the FWSM, you will use the config t command, which takes you to the configuration mode.

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 99

Introduction to PIX Firewalls • Chapter 2

IP Version 6 (IPv6) In version 7.0, Cisco introduces support for IP version 6. This is good news, as the demise (exhaustion) of the IP version 4 address space has been predicted and anticipated for several decades now. Before we delve into configuration of IPv6 on the PIX, we need to review IPv6 addresses. Although 32 bits of address space originally were thought to be “more than enough,” time and growth haven’t proved this not to be the case. Additionally, IPv4 suffers from a lack of hierarchical structure; although addresses may be sequentially allocated and summarized, they are not optimized by routing or allocation. Designers of IPv6 worked diligently to ensure that the same issues would not be encountered with version 6 of IP, by specifically addressing each of these issues. Members of the Internet community who were responsible for developing the protocol carefully scrutinized each new Request for Comments (RFC) penned for IP. In this section, we will cover IP version 6, which was developed to overcome the exhaustion of IPv4 addresses and to improve on IPv4 in general.

IPv4 vs. IPv6 IPv6 eases the network administrator’s burden in that Aggregatable Global Unicast (to be discussed later) addresses do not require translation when used to access external networks such as the Internet. In IPv4, private address spaces are used when global addresses are unavailable.These private addresses must be translated to a limited set of global addresses when accessing external networks. IPv4 address translation schemes include Network Address Translation (NAT) and Port Address Translation (PAT). IPv6 virtually eliminates the need for address translation as a means of accessing external networks. Table 2.6 illustrates the reduced address administration burden placed upon IPv6 network administrators.

Table 2.6 Address Administration Comparison Address Administration Issues

IPv4 Private Class A Block

IPv6 Aggregatable Global Unicast

Address length

32 bits

128 bits

Length of preassigned upstream fields

8 bits

48 bits

Length of delegated addressing fields

24 bits

80 bits

Host identifier length

24 – subnet bits

64 bits

Subnet identifier length

24 – host bits

16 bits (SLA ID)

Allocate host addresses for subnet identifiers

Yes

No

Determine subnet identifiers

Yes

Yes

Determine host identifiers

Yes

No

Address Translation Required (NAT/PAT)

Yes

No

99

326_PIX_2e_02.qxd

100

5/7/05

1:00 PM

Page 100

Chapter 2 • Introduction to PIX Firewalls

Header Comparison Five fields are eliminated, including the variable-length IPv4 options field. Removal of the variable-length field and other fields permits the IPv6 header to have a fixed header of 40 bytes in length. A comparison of the two types of headers is summarized in Table 2.7.

Table 2.7 Header Comparison Header

IPv4

IPv6

Header format

Variable

Fixed

Header fields

13

8

Header length

20-60 bytes

40 bytes

Address length

32 bits

128 bits

Header checksum

Yes

No

Fragmentation fields

Yes

No

Extension headers

No

Yes

To provide for additional options, IPv6 defines the following extension headers that are used to provide specific information needed for particular operations. ■

Hop-by-Hop Options header

■

Destination Options header

■

Routing header

■

Fragment header

■

Authentication header

■

Encapsulating Security Payload header

IPv6 Addresses IPv6 splits its address into a set of definite scopes, or boundaries, by which addresses are delegated.The Format Prefix is used to show that an address is GRU, or another type of address, and is always set to the same value.This allows a router to quickly discern what type of IPv6 packet it has received. By obtaining this information quickly, the routing device can more efficiently send the packet to its next hop or final destination. Two fields, the TLA ID and the NLA ID, are key to understanding IPv6’s support for an aggregatable addressing hierarchy The Top-Level Aggregation Identifier (TLA ID) designates a large block of addresses from which smaller blocks of addresses are allocated to downstream networks.This makes address assignment more structured and eases routing burdens. IPv6 global addresses will be assigned to service providers or TLA organizations.The TLA organizations in turn

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 101

Introduction to PIX Firewalls • Chapter 2

will allocate addressing space to the Next-Level Aggregation (NLA) organizations.This hierarchical method of allocating address space encourages address aggregation to reduce the size of core routing tables. The Next-Level Aggregation Identifier (NLA ID) address block is a block of addresses that are assigned downstream out of a TLA block.These addresses are to be aggregated as much as possible into bigger TLA blocks, when they are exchanged between providers, in the Internet core.This stabilizes routing through the network. The Site-Level Aggregation Identifier (SLA ID) enjoys most of the benefits that an NLA does, except for its size: the SLA is usually a network or network provider with a much smaller network. Unlike the TLA ID and the NLA ID, the SLA ID usually is not delegated to a downstream organization with a preassigned value. Per RFC 3587, the SLA ID allows an organization to define its own local subnets and addressing hierarchy.Therefore, a smaller delegation of address space is needed. It retains the values of aggregations in that its routing tables are kept smaller, even when receiving a full Internet routing table from its upstream provider. It also enjoys the benefits of global route stability in that its upstream provider, whether an NLA or a TLA, aggregates according to the principles of the IPv6 aggregations model.The 16 bits provided by the SLA ID for subnet identifiers can support 65,535 subnets, enough for all but the largest organizations.To support even larger networks, a downstream organization may request that a lowerorder portion of the NLA ID be delegated. The IPv6 architecture provides advantages in network performance and scalability.These advantages include: ■

Reduced Address Translation Overhead Address translation to overcome address space limitations is unnecessary.

■

Reduced Routing Overhead IPv6 addresses are allocated via service providers to encourage an addressing hierarchy that reduces routing overhead.

■

Increased Route Stability A single provider can aggregate the routes of many networks and allow route flapping to be isolated to that provider’s network. Routing changes need only to be advertised between peer routers in a provider’s network.

■

Reduced Broadcasts IPv6 uses Neighbor Discovery to perform a similar function during the autoconfiguration process without the use of ARP broadcasts.

■

Scoped Multicasts In IPv6, a multicast address contains a scope field that can restrict multicast packets to the node, the link, or the organization.

■

Streamlined Header IPv6 header has only eight fixed-length fields.To implement extended functions, extension headers can be used that need not be checked by intermediate routers.This streamlined header architecture lowers network overhead.

■

No Intermediate Node Fragmentation Only the source node will perform packet fragmentation.To assist the source node, IPv6 provides a Path MTU Discovery function to determine the MTU size for the path from source to destination.

101

326_PIX_2e_02.qxd

102

5/7/05

1:00 PM

Page 102

Chapter 2 • Introduction to PIX Firewalls ■

No Header Checksum IPv6 eliminates the header checksum field. Although this may cause erroneous packets to be forwarded, the reliability of current links reduces that probability. Checksum verification is already performed at the source and destination by upper-layer processes such as TCP and UDP. In IPv6, checksum processing is solely the responsibility of the source and destination.This greatly reduces network overhead.

■

Mandatory use of IPsec IPsec in IPv4 was an option but now in IPv6, it is mandatory. IPsec will enhance the security model of TCP/IP through the entire architecture and should make network security easier to implement overall since it is now an integral part of the IP architecture.

■

Support of IPv4 IPv6 will support the “tunneling “ of the older IPv4 protocol over IPv6 links to help maintain backward compatibility.This will allow legacy networks to still attach to and utilize IPv6 as they transition to IPv6.

■

QoS Support IPv6 offers support for Quality of Service (QoS) for multimedia applications and others that require QoS.

IPv6 Address Space The 128 bits that IPv6 has available for addressing (2128 addresses) are used differently depending on the address format and type. For example, Globally Routable Unicast (GRU) addresses set the first three bits (Format Prefix) to 001.This leaves 125 bits for addresses (2125 addresses) before GRU address space is depleted. The IPv6 Aggregatable Global Unicast address is 128 bits long and is composed of a subnet prefix and an interface identifier.The first 64 bits are used for network numbering, and the last 64 bits are used for host numbering.The 48 bits of the last 64 bits of the host ID are derived from the MAC address, with 16 bits of padding.The format is shown in Figure 2.13.

Figure 2.13 IPv6 Address Structure 64 bits Subnet Identifier

64 bits Interface Identifier

The subnet prefix is the network number assigned to the link.The interface identifier is derived from the node’s Media Access Control (MAC) address. IPv6 actually uses the last 64 bits of the address to distinguish hosts from one another on the same subnet. Regardless of the address format, the last 64 bits on a device will remain the same. During IPv6 address autoconfiguration, the host node supplies its own interface ID from MAC components such as network cards and queries the local router or DHCPv6 server for a subnet prefix. Current

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 103

Introduction to PIX Firewalls • Chapter 2

MAC addresses are only 48 bits long, so each one is padded with a 16-bit prefix.The IEEE has proposed a MAC address known as EUI-64 that is 64 bits long. IPv6 addresses are classified as unicast, multicast, or anycast addresses.The IPv6 address space utilizes a 128-bit format that consists of an eight-part hex address separated by colons (:). Each part of the IPv6 address space represents 16 bits, thus providing a theoretical address space of 340,282,366,920,938,463,463,374,607,431,768,211,456 addresses. Because IPv6 has reserved addresses, the total assignable address space is smaller than this. The size and scope of the IPv6 address space enables allocations of addresses in a more hierarchal fashion than IPv4, which in turn enables independent customers of service providers to obtain and deploy globally routable addresses within their environments.The IPv6 address space provides more than enough address space to reassign public IPv6 addresses to all entities that require global routing over the Internet.

The Fundamentals of IPv6 Addresses IPv6 utilizes hex notation.This is a fundamental change from the dotted decimal notation used in the IPv4 addressing. Utilization of dotted decimal notation to express and address space equivalent to the size of the IPv6 scope would be complex and cumbersome.To express the same address space as IPv6 in decimal notation, the current IPv4 string would have to be expanded four times. If dotted decimal notation were used, addresses would appear as 15.25.35.45.55.65.75.85.95.105.115.125.135.145.155.165; thus, remembering IP addresses would be very difficult. Using hexadecimal notation allows for the expression of these numbers using two hexadecimal numbers. Conversion from decimal to hexadecimal and vice versa is a necessary evil for anyone considering IPv6, especially if IPv4 addresses are incorporated into the IPv6 address.Table 2.8 depicts decimal to hexadecimal equivalents. This table is useful when converting smaller numbers.

Table 2.8 Decimal to Hexadecimal Equivalents Decimal Notation

Hex Notation

0

0

1

1

2

2

3

3

4

4

5

5

6

6

7

7

8

8

9

9

10

a Continued

103

326_PIX_2e_02.qxd

104

5/7/05

1:00 PM

Page 104

Chapter 2 • Introduction to PIX Firewalls

Table 2.8 continued Decimal to Hexadecimal Equivalents Decimal Notation

Hex Notation

11

b

12

c

13

d

14

e

15

f

How are hexadecimal numbers used within the IPv6 addressing architecture? RFC3513 provides an addressing structure for IPv6 addressing architectures. Cisco requires that all addressing comply with RFC3513. Although the hexadecimal notation shortens the number of digits required to express a decimal value, the address structure is much longer than IPv4 because of the amount of address space. As previously discussed, IPv6 addresses utilize a 128-bit format that consists of an eightpart hex address separated by colons (:). Expressed another way, there are eight 16-bit hexadecimal values separated by colons as shown generically, where X is 16-bits of two hexadecimal values. X:X:X:X:X:X:X:X

Therefore, an IPv6 address is expressed as follows: ADBF:0:FEEA:0:0:00EA:00AC:DEED (or ADBF:0000:FEEA:0000:0000:00EA:00AC:DEED)

IPv6 provides two methods for compressing the syntax of the address space.The first is the omission of leading zeroes, and the second is the replacement of multiple groups of zeroes by double colons (::). Using these methods, the preceding address can be shortened considerably. For example, using the first method, omitting the leading zeroes, provides an address of ADBF:0:FEEA:0:0:EA:AC:DEED. If the second method is applied, the address is represented as ADBF:0:FEEA::EA:AC:DEED. However, the double colon can appear only once in the address. In addition to replacing multiple groups of zeroes within the address, the double colon can be used to represent the leading or trailing zeroes in an address. With a few minor differences, the configuration process for IPv6 is the same as that for IPv4, only with much longer addresses. Version 7.0 supports dual-stack configurations; consequently, the transition to IPv6 is facilitated because you can run both IP address versions at the same time. The following commands in PIX 7.0 code display IPv6: capture, configure, copy, http, name, object-group, ping, show conn, show local-host, show tcpstat, ssh, telnet, tftp-server, who, and write. This list of commands was modified to support IPv6: debug, fragment, ip verify, mtu, and icmp. And without inspection engines supporting IPv6, the Cisco PIX would be rather useless, so Cisco provided IPv6 with the following support for these inspection engines: FTP, HTTP, ICMP, SMTP,TCP, and UDP.

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 105

Introduction to PIX Firewalls • Chapter 2

The easiest way to configure a Cisco PIX firewall interface for IPv6 is like this: PIX1(config)# interface ethernet 1 PIX1(config-if)# ipv6 address autoconfig

To see our new IPv6 configuration, we use our old friend, the show command, like this: PIX1(config-if)# show ipv6 interface inside inside is up, line protocol is up IPv6 is enabled, link-local address is fe80::212:7fff:fecb:20b3 No global unicast address is configured Joined group address(es): ff02::1 ff02::2 ff02::1:ffcb:20b3 ICMP error messages limited to one every 100 milliseconds ICMP redirects are enabled ND DAD is enabled, number of DAD attempts: 1 ND reachable time is 30000 milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 1000 milliseconds ND router advertisements are sent every 200 seconds ND router advertisements live for 1800 seconds Hosts use stateless autoconfig for addresses.

We can see in the highlighted text that IPv6 is enabled and that we have an IPv6 address in place.

105

326_PIX_2e_02.qxd

106

5/7/05

1:00 PM

Page 106

Chapter 2 • Introduction to PIX Firewalls

Summary The PIX is a dedicated firewall appliance with a special-purpose, hardened operating system. The simplified kernel and reduced command structure (compared with firewalls based on general-purpose operating systems) means that all other things being equal, the PIX will have higher throughput and more reduced maintenance costs than the general-purpose device.The similarity to IOS provides an edge to security administrators who are familiar with the Cisco environment. The PIX is a hybrid firewall that performs stateful packet filtering using proxies for specific applications.The stateful packet filter is known as the Adaptive Security Algorithm, or ASA. ASA uses two databases, a table of translations and a table of known connections, to maintain state of the traffic transiting the network and to dynamically allow packets through the filter.The ASA inspects both packet header information, including source address, destination address, and TCP and UDP socket information, as well as packet contents for certain protocols, to make intelligent decisions on routing the packets. ASA has additional features: It will rewrite packets where necessary, as part of its inspection engine, where the protocols are well known. About a dozen inspection engines are associated with the PIX. Some, such as the FTP inspection engine, augment the ASA process by permitting the passing of packets associated with an allowed communication. Whereas the command channel follows the normal threeway handshake initiated by the client and directed at a well-known socket, the data channels have the handshake initiated by the server (in the opposite direction of the usual security policy) and directed at a port defined during the transaction. Others, such as the SMTP inspection engine, enforce a limited subset of protocol commands and provide additional security to potentially buggy applications. Still others, such as the multimedia inspection engines, provide the intelligence to extract IP addresses from the body of the packets and handle the complex rewriting and authorization for these interrelated protocols. In addition to its native packet-filtering and access control features, the PIX provides additional common firewall services. Again, a key advantage of an appliance is performance, and the PIX makes an excellent VPN terminator, with the ability to pass encrypted traffic at wire speed, when an accelerator card is installed. It can provide content logging and filtering to help control Web surfing and provides address translation to allow for either “sewing together” networks seamlessly at the perimeter or consolidating (and concealing) internal networks to present to the outside world a limited number of addresses. Modern environments depend on firewalls, and so the PIX provides high resiliency through its failover mechanism.This mechanism provides for a hot spare—a second PIX with an equivalent configuration that will automatically press itself into service should the primary device fail.This flexibility can be the traditional failover where one PIX works and the other waits, or you can configure the Active/Active Failover where both PIX firewalls are live and sharing the load while watching for failure. The PIX’s extensive capabilities are matched by hardware flexibility. As of this writing, five different models are shipping, designed to match almost any environment.The PIX 501 is designed for the SOHO user, with a small switch built in for basic use.The PIX 506E,

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 107

Introduction to PIX Firewalls • Chapter 2

designed for the small or branch office, supports better performance for connecting back to the corporate hub.The PIX 515E is designed for the enterprise core of small- to mediumsized business, with a rack-mount chassis and corresponding enterprise-class performance. The PIX 525 is designed for large enterprise or small service provider environments and has a slot-based configuration to allow for multiple interface configurations.The PIX 535 is the top-of-the-line model, designed for service provider environments, with the best possible throughput of the PIX appliances.The newest PIX is the FWSM blade Cisco PIX, which is a true enterprise PIX with a 6Gb Ethernet 802.1q trunk connecting the PIX to the switch or router backplane. Communicating with an unconfigured PIX is most easily achieved through the console cable.This is provided with each firewall kit. Use a communications program such as HyperTerminal, set your parameters to 9600 baud 8-N-1, and during the boot sequence you will see characters on your screen. Licensing for the PIX features is set via an activation key.You should have received information about your activation key when you purchased the PIX; additional features can be purchased and new activation keys applied.The activation keys are dependent on a (hardware) serial number based on your flash.You can add new keys through either monitor mode or the activation-key command. Licensing usually falls into three types: unrestricted (all features enabled), restricted (limited features and interfaces), or failover (used for hot standby machines). Password recovery is achieved by running a special program (different for each version of the operating system) on the PIX itself.The process requires either a dedicated boot diskette or the use of monitor mode and a TFTP download of a temporary image. The normal configuration of the PIX is achieved through a command-line interface. This interface uses the emacs editing commands and is very similar to that provided in the Cisco IOS.The command structure is modal, with three major modes: unprivileged, which has very few available commands; privileged, where all commands are available (subject to your privilege level, which can be set in a local database); and configuration mode, by which changes are made to the running configuration. Things that you will want to set up in every configuration include host and domain name, which configures the prompt and controls fields in the digital certificates used in VPN traffic, and the properties of the interfaces.You control a name—an association between a distinctive identifier for the interface and its default security characteristics—physical properties, and IP properties.You will also probably want to set up some basic routing, particularly the default route. Passwords on any security device are very important.There are passwords for access to the device (unprivileged mode) and for escalation to privileged mode.They can be shared passwords, one per box, or passwords on a per-user basis. Cisco recommends the latter method, which requires setting up AAA services, either remote or local. Managing configuration information is also important. Once you have built the perfect configuration, you do not want to have to retype it all in case of an emergency. Configurations can be stored in human-readable format via an ASCII capture (via write terminal) or as a text file on a TFTP server (via write net). Images can also be brought onto the

107

326_PIX_2e_02.qxd

108

5/7/05

1:00 PM

Page 108

Chapter 2 • Introduction to PIX Firewalls

system with the copy command, either from a TFTP server (copy tftp) or from a Web server URL (copy https://servername/pix_image flash).The system can then be restarted with the reload command and is ready to run under the new configuration. Now with 7.0 code, you can also keep multiple copies of the configuration in FLASH so you can rollback from faulty configuration.

Solutions Fast Track PIX Firewall Features
The Cisco PIX is a stateful inspection firewall that uses the Adaptive Security Algorithm (ASA).
The Cisco PIX uses a custom embedded operating system, which is contained within the system FLASH memory and has been tested for both ICSA and ISO compliance.
Traffic by default can flow from a high security level to a low level security level. This allows traffic to leave the inside network (level 100) and flow to the outside network (level 0) without restriction, but traffic is blocked coming into the PIX on the outside interface.
The Cisco PIX firewall offers both Network Address Translation (NAT) and Port Address translation (PAT).
Cisco offers the PIX firewall both with and without a DMZ port.The PIX 515 and higher model firewalls can support 2 or more interfaces.The Enterprise level Cisco PIX firewalls such as the 535 can have up to 10 interfaces.
The Cisco PIX interface with the 7.0 code is much more like configuring a Cisco router now so skills can more easily transfer from one to the other.
The Cisco PIX offers layer 2 virtual firewalls called “Security Contexts.”
The Cisco PIX offers IPv6 support.
The Cisco PIX offers Active/Active Failover where both PIX firewalls will pass traffic while guarding against the failure of one of them.
The Cisco PIX offers the OSPF routing protocol over VPN connections.

PIX Software Licensing and Upgrades
The Cisco PIX uses licensing to make features available on the PIX such as user count, or 3DES.
The Cisco FWSM does not use licensing like the traditional PIX firewall.

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 109

Introduction to PIX Firewalls • Chapter 2


The traditional method of upgrading the PIX software image is to use TFTP but with the new 7.0 code base, you can use the SSH command SCP (Secure Copy) to transfer configurations and images.
Failover and Active/Active only supported for unrestricted licenses.
The restricted license does not support security contexts.
The minimum RAM for a 515E with a restricted license is 64Mb, and for an unrestricted license is 128Mb of RAM.
The minimum RAM for a 525 with a restricted license is 128Mb, and for an unrestricted license is 512MB of RAM.
The minimum RAM for a 535 with a restricted license is 512Mb, and for an unrestricted license is 1024 Mb of RAM.

Command-Line Interface
The command line interface is the preferred method to configure the Cisco PIX and is the only way to initially configure the 525 and 535 PIX firewalls in their default states.
The Cisco PIX firewall has four administrative access modes using the command line, unprivileged mode, privileged mode, configuration mode, and monitor mode.
There are seven basic command line commands used to configure a Cisco PIX firewall, nameif, interface, ip address, security-level, nat, global, and route.
The command line interface can be used to pull up detailed information on the Cisco PIX status of interfaces, translations (xlate), CPU, memory, packets, and more.
The command line interface is one method of managing the Cisco PIX and can accomplish some tasks that the GUI cannot.

109

326_PIX_2e_02.qxd

110

5/7/05

1:00 PM

Page 110

Chapter 2 • Introduction to PIX Firewalls

Frequently Asked Questions The following Frequently Asked Questions, answered by the authors of this book, are designed to both measure your understanding of the concepts presented in this chapter and to assist you with real-life implementation of these concepts. To have your questions about this chapter answered by the author, browse to www.syngress.com/solutions and click on the “Ask the Author” form. You will also gain access to thousands of other FAQs at ITFAQnet.com.

Q: How do I recover my password from my Cisco PIX firewall? A: The password recovery for the Cisco PIX requires you to download a program from Cisco for the exact PIX firewall you are recovering the password from.This program will be used either from a floppy drive on the older PIX firewalls like the 520 or from a TFTP server on newer PIX firewalls.You will need to press the ESC key within 10 seconds of booting the PIX.You will configure the interface, address, and TFTP server in monitor mode.You will also configure a gateway and the filename of the recovery tool.You will use the tftp command to start downloading the tool and you will be prompted to erase the passwords.

Q: What are Cisco default passwords? A: The default Telnet password is cisco and the enable password is blank. Q: What is the default IP address for my Cisco PIX firewall? A: For the Cisco PIX 501, 506, 506E and the 515, the default IP address in the inside interface is 192.168.1.1 and the outside interface is configured to use DHCP from the ISP

Q: How do I clear an existing configuration so I can start over? A: For the PIX 501 and 506, you can use the configure factory-default, which will put the PIX back to factory specifications including the IP addresses.You can also use the clear configuration and then wri memory to blank the startup configuration. A final option is to use the clear all command.

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 111

Introduction to PIX Firewalls • Chapter 2

111

Q: How do I upgrade my old Cisco PIX to 7.0 code? A: For the PIX 501 and 506, the word is sorry, you cannot upgrade to 7.0 yet. For the owners of the 515E, 525 and 535, you have to first upgrade to 6.3 from whatever version you are on and then you can upgrade to 7.0.

Q: Does the 7.0 code on the Cisco PIX support IPv6? A: Yes, one of the features of the 7.0 code is that you can configure IPv6 either by enabling IPv6 processing or explicitly using an IPv6 address.To enable IPv6 processing on an interface, use the ipv6 enable command.To give an interface an IPv6 address, use the ipv6 address autoconfig

LY89

326_PIX_2e_02.qxd

5/7/05

1:00 PM

Page 112

326_PIX_2e_03.qxd

5/9/05

12:07 PM

Page 113

Chapter 3

PIX Firewall Operations

Solutions in this chapter: ■

Security Contexts

■

The Bare Minimum: Outbound Traffic

■

Opening Your Network: Allowing Inbound Traffic

■

Outbound ACLs (New)

■

Time-Based ACLs (New)

■

NAT Control (New)

■

Bypassing NAT

■

Policy NAT

■

Object Grouping


Summary
Solutions Fast Track
Frequently Asked Questions 113

326_PIX_2e_03.qxd

114

5/9/05

12:07 PM

Page 114

Chapter 3 • PIX Firewall Operations

Introduction Once the Cisco PIX firewall has been unboxed, plugged in, booted up, and configured with its initial system parameters, the first thing most security professionals want to do is configure it to pass traffic appropriately (i.e., according to the organization security policy). A firewall would not serve any purpose if it indiscriminately blocked all traffic.To properly protect a network environment, network traffic must be filtered in both outbound and inbound directions.The key to configuring a firewall is to permit only the traffic you want and block the traffic you do not want.This concept is easy to understand, but not always an easy task. This chapter provides the basics needed to pass traffic through Cisco PIX firewalls. Perhaps one of the most important fundamentals to traffic passing is address translation, of which there are two types: static and dynamic. Once translation has been configured, the PIX will automatically allow all connections from a higher security interface to a lower security interface and deny all connections from a lower security interface to a higher security interface.To configure more granular access, you can permit or deny specific traffic using access lists. The decisions to permit or deny specific traffic compose the firewall rules, typically in the form of access lists. Whether you are configuring rules for outbound or inbound traffic, the process is the generally the same: 1. Configure address translation. 2. Define an access list and apply it to an interface. You must ensure that users can access the required network services through the firewall. You must also ensure that external services are available to one or more communities of users. While the process for filtering inbound and outbound traffic is the same, task details differ. The Cisco PIX firewall offers several features that are valuable in managing traffic, including: ■

Object Grouping simplifies access list configuration and maintenance

■

TurboACLs

■

Time-based ACLs

■

Access list logging

■

Enabling/disabling ACL entries

■

NAT control

■

Policy NAT

Throughout the chapter, we provide examples to describe the various commands. We also include a complex case study to reinforce concepts.

326_PIX_2e_03.qxd

5/9/05

12:07 PM

Page 115

PIX Firewall Operations • Chapter 3

Security Contexts Have you ever wished you could clone your Cisco PIX firewall? Ever had the need to have two very different security policies in place on your network, say one for the finance folks (very restricted) and one for the IT folks (anything goes)? Well, Cisco has listened, and for version 7.0, implemented something called security contexts. When you set up a security context, each context has its own security policies, interfaces, and supported features.This means that not all PIX firewall features are supported in security contexts. Some that are not supported when you have multiple security contexts include: ■

Dynamic routing protocols

■

VPN

■

Multicast

When you start the PIX in single context mode and convert to multiple context mode, a new file called admin.cfg is created on the built-in flash.This is the default administrator security context.You can store multiple security contexts on the same flash or you can have the PIX download them from the network using TFTP, FTP, or HTTP(s).

NOTE When converting from single security context mode to multiple security context mode, the original startup configuration is not saved, so always make a backup when working with security contexts. The running configuration is used to make the two new security context files.

Use the mode command to place the Cisco PIX firewall in multiple security context mode. Our options for the mode command are