1. Download archive from here.
2. Download AIO version of GNS3 for Windows (Qemu should be patched or it won't start with asa's connected interfaces). My version was 0.8.3.
3. Configure Qemu in GNS3 with following settings:
Qemu Options: -vnc none -vga none -m 1024 -icount auto -hdachs 980,16,32
Kernel cmd line: -append ide_generic.probe_mask=0x01 ide_core.chs=0.0:980,16,32 auto nousb console=ttyS0,9600 bigphysarea=65536
4. Configure the paths to image.
5. The hardest part - start you lab and enjoy :)
Showing posts with label ASA. Show all posts
Showing posts with label ASA. Show all posts
Thursday, August 2, 2012
Sunday, February 21, 2010
ASA Image
In this article, I will show you how to emulate Cisco ASA using Qemu. Once again, please note that ASA is not provided and will not be. So please don’t ask. Also be aware that ASA does not 100% work in Qemu but that’s enough to play with it.
This Howto is still a draft and has been tested only on Linux.Installation
First compile and patch Qemu as you would do for running JunOS. This will give us pcap, lcap and UDP tunnels (i.e. GNS3/Dynamips connections) capabilities.
Then obtain ASA itself. If you are smart and patient you will find it. I used asa802-k8.bin for my installations. As far as I know, nobody has been able to run ASA > version 8.2 (ASA keeps rebooting).
The next step is to get an initrd and a Linux kernel (inside the initrd) from your ASA image to use them with Qemu and also fix the initrd for our needs. The initrd is zipped and archived in the ASA image, we have to extract it.
There are 2 ways, manually or using a tool I created.
Manual method
Create an hexadecimal dump of your image:
hexdump -C asa802-k8.bin > asa802-k8.hex |
grep “1f 8b 08 00 1d” asa802-k8.hex 001228b0 1f 8b 08 00 1d 3d 73 46 00 03 ec 3a 6d 54 14 57 |…..=sF…:mT.W| |
Let’s find the image size:
ls -la asa802-k8.bin -rwxr-xr-x 1 root staff 14524416 26 Nov 20:14 asa802-k8.bin 14524416 bytes. |
echo "14524416 ; ibase=16 ; last - 1228B0" | bc | tail -n 1 13334352 |
tail -c 13334352 asa802-k8.bin > asa802-k8.gz |
gzip -d asa802-k8 gzip: asa802-k8.gz: decompression OK, trailing garbage ignored |
mkdir tmp ; cd tmp |
cpio -i --no-absolute-filenames --make-directories < ../asa802-k8 |
cp vmlinuz ../asa802-k8.kernel |
This script formats the 256 MB flash on first start to be used by ASA. Loads the network drivers modules for Intel e100 (i82559er in Qemu) and Intel e1000 cards and activates the network interfaces to be used in ASA. I noticed that if we immediately start ASA after this first boot, it freezes (don’t really know why but it seems the system do something and slow down during the first minute …). The next time you start the system, the script will still load the activate the network interfaces and automatically start ASA.
#!/bin/sh FIRST_START=no if test ! -e /mnt/disk0/lina_monitor then fdisk /dev/hda << EOF n p 1 5 979 t 4 w EOF mkdosfs -F 16 /dev/hda1 mount -o umask=0000,noatime,check=s,shortname=mixed /dev/hda1 /mnt/disk0 cp /asa/bin/lina /mnt/disk0/lina cp /asa/bin/lina_monitor /mnt/disk0/lina_monitor FIRST_START=yes fi modprobe e100 modprobe e1000 ifconfig eth0 up ifconfig eth1 up ifconfig eth2 up ifconfig eth3 up ifconfig eth4 up ifconfig eth5 up if test $FIRST_START = yes then echo "" echo "" echo "This is your first boot, please wait about 1 min and then type the following commands:" echo "cd /mnt/disk0" echo "/mnt/disk0/lina_monitor" echo "" echo "Please note to use the following command under ASA to save your configs:" echo "copy run disk0:/.private/startup-config" echo "" exit fi cd /mnt/disk0 /mnt/disk0/lina_monitor |
Now you can compress all the file and have the initrd ready to use in Qemu:
find . | cpio -o -H newc | gzip -9 > ../asa802-k8.initrd.gz |
Using ASA with Qemu
Create a FLASH (this is a virtual hard disk).qemu-img create FLASH 256M |
qemu -hda FLASH -kernel asa802-k8.kernel -hdachs 980,16,32 \ -initrd asa802-k8.initrd.gz -m 512 -no-kqemu -nographic -append \ "console=ttyS0,9600n8 hda=980,16,32 bigphysarea=16384 auto nousb ide1=noprobe" |
Using ASA with GNS3
To be completed:In Preferences -> Qemu -> Qemuwrapper section:
Set the path to Qemuwrapper (can be found in the GNS3 package)
Set the working directory (e.g. /tmp).
Set the path to your patched Qemu in “Path to Qemu”
In ASA section:
Set the paths to your initrd and kernel.
Drag and Drop an ASA symbol on the scene, start the firewall and telnet to it.
Saturday, February 20, 2010
Interesting facts about ASA
In today's lab I found out quite a few interesting facts about ASA security algorithms.
Sample lab topology:
MyHostComputer:
Adapter1 - XX.XX.XX.XX/24 - Internet
Adapter1 - 192.168.137.1/24 - bridged to ASA and CorporateHost
Adapter2 - 192.168.138.1/24 - bridged to RemoteClient
CorporateHost:
Adapter1 - 192.168.137.195/24 - VMware bridged interface
Loopback1 - 192.168.255.100 - bridged to ASA. Default gateway of host 192.168.255.254
ASA:
Ethernet0/0 - 192.168.137.254/24 - Outside interface
Ethernet0/1 - 192.168.255.254/24 - Inside interface
ASA config:
nat (outside) 0 access-list REMOTE_NAT0_ACL
nat (outside) 1 access-list REMOTE_NAT_ACL
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 access-list NAT1_ACL
global (outside) 1 interface
access-list REMOTE_NAT_ACL extended permit ip 192.168.200.0 255.255.255.0 any
access-list REMOTE_NAT0_ACL extended permit ip 192.168.200.0 255.255.255.0 192.168.255.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.255.0 255.255.255.0 remote_protected 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 192.168.200.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 192.168.255.0 255.255.255.0 remote_protected 255.255.255.0
access-list NAT1_ACL extended permit ip 192.168.255.0 255.255.255.0 any
access-list INBOUND_PERMIT extended permit icmp host boss any
access-group INBOUND_PERMIT in interface outside
That is our initial data.
If you will take a closer look, you will notice that inbound pings are permitted through the appliance to the internal hosts. However, if I try to ping 192.168.255.100 from 192.168.137.1, I'm getting syslog message:
2010-02-20 12:30:47 Local4.Error 192.168.255.254 Feb 20 2010 12:30:50 192.168.255.254 : %ASA-3-305005: No translation group found for icmp src outside:boss dst inside:192.168.255.100 (type 8, code 0)
Well, why? There is no nat-control command in running config, inbound icmp are permitted. And message states, that no translation group for icmp. This is point to a decision that the problem is related to NAT, isn't it?
As I found out, the problem was related to ASA security algorithms. ASA is smart enough to understand, that packet is coming inbound, so the reply will come from inside interface to outside and PAT will be performed (be default, ASA doesn't track icmp connection in it's connections table). It means that the outbound packet (coming from inside to outside) will have it source address translated to IP address of outside interface of ASA (PAT). It means that host 192.168.137.1 will receive icmp reply from different address in contrast to address it was pinging. So it will drop the packet. So this process is totally useless and ASA decides to drop the packet as it first comes as icmp echo request. For pings to be successful, we need to add one more translation rule to NAT. Namely Identity NAT (NAT 0). That way the echo reply source address won't be translated as it goes through the ASA and will not be dropped by receiving host.
Therefore, to make it all works, we should add one more ACL:
access-list inside_nat0_outbound extended permit ip 192.168.255.0 255.255.255.0 host boss
Sample lab topology:
MyHostComputer:
Adapter1 - XX.XX.XX.XX/24 - Internet
Adapter1 - 192.168.137.1/24 - bridged to ASA and CorporateHost
Adapter2 - 192.168.138.1/24 - bridged to RemoteClient
CorporateHost:
Adapter1 - 192.168.137.195/24 - VMware bridged interface
Loopback1 - 192.168.255.100 - bridged to ASA. Default gateway of host 192.168.255.254
ASA:
Ethernet0/0 - 192.168.137.254/24 - Outside interface
Ethernet0/1 - 192.168.255.254/24 - Inside interface
ASA config:
nat (outside) 0 access-list REMOTE_NAT0_ACL
nat (outside) 1 access-list REMOTE_NAT_ACL
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 access-list NAT1_ACL
global (outside) 1 interface
access-list REMOTE_NAT_ACL extended permit ip 192.168.200.0 255.255.255.0 any
access-list REMOTE_NAT0_ACL extended permit ip 192.168.200.0 255.255.255.0 192.168.255.0 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.255.0 255.255.255.0 remote_protected 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 192.168.200.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 192.168.255.0 255.255.255.0 remote_protected 255.255.255.0
access-list NAT1_ACL extended permit ip 192.168.255.0 255.255.255.0 any
access-list INBOUND_PERMIT extended permit icmp host boss any
access-group INBOUND_PERMIT in interface outside
That is our initial data.
If you will take a closer look, you will notice that inbound pings are permitted through the appliance to the internal hosts. However, if I try to ping 192.168.255.100 from 192.168.137.1, I'm getting syslog message:
2010-02-20 12:30:47 Local4.Error 192.168.255.254 Feb 20 2010 12:30:50 192.168.255.254 : %ASA-3-305005: No translation group found for icmp src outside:boss dst inside:192.168.255.100 (type 8, code 0)
Well, why? There is no nat-control command in running config, inbound icmp are permitted. And message states, that no translation group for icmp. This is point to a decision that the problem is related to NAT, isn't it?
As I found out, the problem was related to ASA security algorithms. ASA is smart enough to understand, that packet is coming inbound, so the reply will come from inside interface to outside and PAT will be performed (be default, ASA doesn't track icmp connection in it's connections table). It means that the outbound packet (coming from inside to outside) will have it source address translated to IP address of outside interface of ASA (PAT). It means that host 192.168.137.1 will receive icmp reply from different address in contrast to address it was pinging. So it will drop the packet. So this process is totally useless and ASA decides to drop the packet as it first comes as icmp echo request. For pings to be successful, we need to add one more translation rule to NAT. Namely Identity NAT (NAT 0). That way the echo reply source address won't be translated as it goes through the ASA and will not be dropped by receiving host.
Therefore, to make it all works, we should add one more ACL:
access-list inside_nat0_outbound extended permit ip 192.168.255.0 255.255.255.0 host boss
Friday, February 19, 2010
ASA ambiguities
ACL's:
- For a standard ACL, the addresses or networks you enter are addresses that the remote is trying to reach (destination addresses). Instead of source addresses as it is at IOS.
- Network mask is used in ASA ACL's instead of wildcard masks at IOS.
VPN with NAT-Traversal
I'm going to talk about an issue that arise when you are trying to setup Remote Access VPN for devices behind the NAT/PAT. For the IPsec tunnel to be negotiated, first there is an ISAKMP connection has to be established. It uses UDP on port 500. That means, that PAT device must be configure with port forwarding to VPN device on UDP port 500. That is about ISAKMP. When both ISAKMP phases are negotiated and ISAKMP connection are established, it's time to establish IPsec tunnel. Let's assume, that we are using ESP encapsulation for our IPsec. ESP is a network layer protocol, os it doesn't contain any layer 4 headers with port numbers. But somehow PAT device has to translate these connections. It is done through using of NAT-Traversal or IPsec over TCP. NAT-Traversal encapsulate ESP packet in a UDP header with destination port 4500. So to get VPN working, we have to configure port forwarding on our PAT device with redirection of both UDP port 500 and 4500. The same thing can be accomplished with IPsec over TCP, but with IPsec over TCP we have an ability to change ports on with our tunnels will be established.
P.S. AH can't be used along with PAT devices on it's way, because MD5 hash that it generates, include IP headers, which means, that changing them will completely brake the hash and the packet will be discarded on recieving device. For example, ESP doesn't calculate hash of the whole packet. Instead, it calculate it for payload only. So ESP is a protocol of my choice. Why do someone should use AH these days anyway?
Split tunneling defines what traffic from the user must go across the tunnel and what traffic can leave the client in clear text. Split tunneling policies are defined with the split-tunnel-policy command. The default split-tunneling policy is tunnelall, which means that, with the exception of DHCP and ARP packets, all traffic from the remote must go across the tunnel. You can exclude networks from being tunneled (excludespecified parameter) or include networks that should only be tunneled (tunnelspecified parameter). When overriding the default split tunneling policy, you must use the split-tunnel-networklist command to specify what destination networks are (tunnelspecified) or are not tunneled (excludespecified). These are defined in an extended or standard ACL. For a standard ACL, the addresses or networks you enter are addresses that the remote is trying to reach (destination addresses). For an extended ACL, the addresses off of the higher-level interface of the appliance (corporate office networks) are the source addresses in an ACL statement, and the destination addresses are the internal addresses of the remotes.
Sounds stupid. I should test it.
P.S. AH can't be used along with PAT devices on it's way, because MD5 hash that it generates, include IP headers, which means, that changing them will completely brake the hash and the packet will be discarded on recieving device. For example, ESP doesn't calculate hash of the whole packet. Instead, it calculate it for payload only. So ESP is a protocol of my choice. Why do someone should use AH these days anyway?
Split tunneling defines what traffic from the user must go across the tunnel and what traffic can leave the client in clear text. Split tunneling policies are defined with the split-tunnel-policy command. The default split-tunneling policy is tunnelall, which means that, with the exception of DHCP and ARP packets, all traffic from the remote must go across the tunnel. You can exclude networks from being tunneled (excludespecified parameter) or include networks that should only be tunneled (tunnelspecified parameter). When overriding the default split tunneling policy, you must use the split-tunnel-networklist command to specify what destination networks are (tunnelspecified) or are not tunneled (excludespecified). These are defined in an extended or standard ACL. For a standard ACL, the addresses or networks you enter are addresses that the remote is trying to reach (destination addresses). For an extended ACL, the addresses off of the higher-level interface of the appliance (corporate office networks) are the source addresses in an ACL statement, and the destination addresses are the internal addresses of the remotes.
Sounds stupid. I should test it.
Monday, February 15, 2010
ASA translation policy order
When looking for a matching translation policy, the appliance goes through the following steps:
1. The appliance looks for an existing translation in the translation table; sometimes Cisco will refer to this as trying to find a “matching xlate slot” in the translation table.
2. If no entry exists in the translation table, the appliance looks for address translation exceptions in the nat 0 commands on a best-match basis.
3. If there are no matches on the Identity NAT commands, the appliance will try to find a match against the configured static NAT commands based on a best-match basis.
4. If there are no matches on the static NAT commands, the appliance will try to find a match against the configured static PAT (PAR) policies on a best match basis.
5. If no match is found within the PAR translation policies, the appliance then looks for a match in its policy nat and global commands with a corresponding ACL.
6. If there is not a match on a policy translation configuration, the appliance then looks for a match in its normal nat and global commands.
7. If a translation or translation policy doesn’t exist for the packet, the appliance will drop the packet if NAT control is enabled; if NAT control is not enabled, then the packet is not translated, but can flow through the appliance, assuming other appliance policies allow it.
1. The appliance looks for an existing translation in the translation table; sometimes Cisco will refer to this as trying to find a “matching xlate slot” in the translation table.
2. If no entry exists in the translation table, the appliance looks for address translation exceptions in the nat 0 commands on a best-match basis.
3. If there are no matches on the Identity NAT commands, the appliance will try to find a match against the configured static NAT commands based on a best-match basis.
4. If there are no matches on the static NAT commands, the appliance will try to find a match against the configured static PAT (PAR) policies on a best match basis.
5. If no match is found within the PAR translation policies, the appliance then looks for a match in its policy nat and global commands with a corresponding ACL.
6. If there is not a match on a policy translation configuration, the appliance then looks for a match in its normal nat and global commands.
7. If a translation or translation policy doesn’t exist for the packet, the appliance will drop the packet if NAT control is enabled; if NAT control is not enabled, then the packet is not translated, but can flow through the appliance, assuming other appliance policies allow it.
Saturday, February 13, 2010
ASA Site-to-Site IPsec VPN
Today, I would like to write about the simplest configuration of ASA for Site-to-Site IPsec VPN.
I'm going to post configuration example along with comments about every particular command.
I'm going to post configuration example along with comments about every particular command.
!--- Configure the outside interface.
!interface Ethernet0/1
nameif outside
security-level 0
ip address 172.16.1.1 255.255.255.0
!--- Configure the inside interface.
!interface Ethernet0/2
nameif inside
security-level 100
ip address 10.10.10.1 255.255.255.0
!-- Output suppressed
!passwd 2KFQnbNIdI.2KYOU encrypted
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
access-list 100 extended permit ip any any
access-list inside_nat0_outbound extended permit ip 10.10.10.0 255.255.255.0
10.20.10.0 255.255.255.0
!--- This access list (inside_nat0_outbound) is used
!--- with the nat zero command. This prevents traffic which
!--- matches the access list from undergoing network address translation (NAT).
!--- The traffic specified by this ACL is traffic that is to be encrypted and
!--- sent across the VPN tunnel. This ACL is intentionally
!--- the same as (outside_1_cryptomap).
!--- Two separate access lists should always be used in this configuration. access-list outside_1_cryptomap extended permit ip 10.10.10.0 255.255.255.0
10.20.10.0 255.255.255.0
!--- This access list (outside_cryptomap) is used
!--- with the crypto map outside_map
!--- to determine which traffic should be encrypted and sent
!--- across the tunnel.
!--- This ACL is intentionally the same as (inside_nat0_outbound).
!--- Two separate access lists should always be used in this configuration.pager lines 24
mtu inside 1500
mtu outside 1500
no failover
asdm image disk0:/asdm-613.bin
asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 10.10.10.0 255.255.255.0
nat (inside) 0 access-list inside_nat0_outbound
!--- NAT 0 prevents NAT for networks specified in
!--- the ACL inside_nat0_outbound.
access-group 100 in interface outside
route outside 0.0.0.0 0.0.0.0 172.16.1.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 0.0.0.0 0.0.0.0 dmz
no snmp-server location
no snmp-server contact
!--- PHASE 2 CONFIGURATION ---!
!--- The encryption types for Phase 2 are defined here. crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
!--- Define the transform set for Phase 2. crypto map outside_map 1 match address outside_1_cryptomap
!--- Define which traffic should be sent to the IPsec peer.
crypto map outside_map 1 set peer 172.17.1.1
!--- Sets the IPsec peercrypto map outside_map 1 set transform-set ESP-DES-SHA
!--- Sets the IPsec transform set "ESP-AES-256-SHA"
!--- to be used with the crypto map entry "outside_map". crypto map outside_map interface outside
!--- Specifies the interface to be used with
!--- the settings defined in this configuration. !--- PHASE 1 CONFIGURATION ---!
!--- This configuration uses isakmp policy 10.
!--- The configuration commands here define the Phase
!--- 1 policy parameters that are used. crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption des
hash sha
group 1
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
!
tunnel-group 172.17.1.1 type ipsec-l2l
!--- In order to create and manage the database of connection-specific
!--- records for ipsec-l2l—IPsec (LAN-to-LAN) tunnels, use the command
!--- tunnel-group in global configuration mode.
!--- For L2L connections the name of the tunnel group MUST be the IP
!--- address of the IPsec peer. tunnel-group 172.17.1.1 ipsec-attributes
pre-shared-key *
!--- Enter the pre-shared-key in order to configure the
!--- authentication method.
Wednesday, January 20, 2010
Emulating ASA with Qemu+pcap in Windows
Ok, here I'm going to explain how to emulate Cisco ASA using Qemu in Windows. Actually, there are more than just Qemu+pcap involved in the process, but the basic operations are performed by exactly these programs.Well, let's begin and document the entire process of setup and using ASA with ASDM.
Download asa.zip archive and unpack it to any folder. http://rapidshare.com/files/337827123/asa.zip (another I've put on UbuntuOne server). It contains:
When everything is loaded we need to telnet to it on localhost:1234 and type the following:
Then we should configure it with folowing:
Now let's configure ASDM.
Here is a link to ASDM which I was using: ASDM 6.2
In ASA configure the following lines:
Now, we need to set fiddler to decode HTTPS:
{
if ((oSession.url.EndsWith("/admin/asdm_handler")) || (oSession.url.EndsWith("/admin/pdm.sgz"))){
oSession.bBufferResponse = false;
}
static function OnBeforeResponse(oSession: Session)
{
if (oSession.url.EndsWith("/admin/exec/show+version/show+curpriv/perfmon+interval+10/show+asdm+sessions/show+firewall/show+mode/changeto+system/show+admin-context")) {
oSession.utilDecodeResponse();
oSession.utilReplaceInResponse('Hardware: ,','Hardware: ASA5520,');
}
if (oSession.url.EndsWith("/admin/exec/show+version")) {
oSession.utilDecodeResponse();
oSession.utilReplaceInResponse('Hardware: ,','Hardware: ASA5510,');
}
if (oSession.url.EndsWith("/admin/config")){
oSession.utilReplaceInRequest("write mem","copy /noconfirm running-config disk0:/.private/startup-config");
}
if (oSession.url.EndsWith("/admin/exec/write+memory")){
oSession.url.Replace("write+memory","copy+%2Fnoconfirm+running-config+disk0%3A%2F.private%2Fstartup-config");
}
Or download the following js file and replace Fiddler's CustomRules.js with it - http://rapidshare.com/files/337830003/Fiddler_custom_rule.rar.
Also to be able to use 3DES/AES encryption through ASDM, we have to add the following parts to Fiddler .js file:
static function OnBeforeResponse(oSession: Session)
{
if (oSession.url.EndsWith("/admin/exec/show+version/show+curpriv/perfmon+interval+10/show+asdm+sessions/show+firewall/show+mode/changeto+system/show+admin-context")) {
oSession.utilDecodeResponse();
oSession.utilReplaceInResponse('Hardware: ,','Hardware: ASA5510,');
oSession.utilReplaceInResponse('3DES-AES : Enabled','VPN-3DES-AES : Enabled');
oSession.utilReplaceInResponse('ADV END SEC : Enabled','Advanced Endpoint Assessment : Enabled');
oSession.utilReplaceInResponse('Serial Number: 123456789AB','Serial Number: JKX1014K074');
oSession.utilReplaceInResponse('Running Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000','Running Activation Key: 0x70192e4e 0x507e3e04 0xa8f2f16c 0x85c40864 0x4907ef91');
}
if (oSession.url.EndsWith("/admin/exec/show+version")) {
oSession.utilDecodeResponse();
oSession.utilReplaceInResponse('Hardware: ,','Hardware: ASA5510,');
oSession.utilReplaceInResponse('3DES-AES : Enabled','VPN-3DES-AES : Enabled');
oSession.utilReplaceInResponse('ADV END SEC : Enabled','Advanced Endpoint Assessment : Enabled');
oSession.utilReplaceInResponse('Serial Number: 123456789AB','Serial Number: JKX1014K074');
oSession.utilReplaceInResponse('Running Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000','Running Activation Key: 0x70192e4e 0x507e3e04 0xa8f2f16c 0x85c40864 0x4907ef91');
}
if (oSession.url.EndsWith("/admin/exec/show+activation-key")) {
oSession.utilDecodeResponse();
oSession.utilReplaceInResponse('Serial Number: 123456789AB','Serial Number: JKX1014K074 ');
oSession.utilReplaceInResponse('Running Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000','Running Activation Key: 0x70192e4e 0x507e3e04 0xa8f2f16c 0x85c40864 0x4907ef91');
oSession.utilReplaceInResponse('Failed to retrieve flash activation key.','Permanent Flash Activation Key: 0x70192e4e 0x507e3e04 0xa8f2f16c 0x85c40864 0x4907ef91');
oSession.utilReplaceInResponse('3DES-AES : Enabled','VPN-3DES-AES : Enabled');
oSession.utilReplaceInResponse('ADV END SEC : Enabled','Advanced Endpoint Assessment : Enabled');
}
}
Note, that function OnBeforeResponse is already exists in the file, so we have to add only additional IF statements to it.
The path to file is C:\Documents and Settings\Administrator\My Documents\Fiddler2\Scripts\CustomRules.js
Then we need to change the proxy in Java configuration. Go
Now we should copy ASDM .bin to flash of ASA from TFTP server (simple copy tftp flash).
Then try to connect to interface of ASA via browser https. Like https://192.168.200.2/admin
I had a problem with authentication, so it would be reasonably to add user in ASA:
P.S. ASDM like SDM works only on older Java versions. I use version 5 (like the last release of old 5).
P.P.S. Some problems exist with saving running-config to startup-config. We should either copy run flash:/.private/startup-config or if it doesn't work, we should use: copy run tftp and then tftp flash:/.private/startup-config. Looks like ASDM saving it without a problem.
Cheers!
Download asa.zip archive and unpack it to any folder. http://rapidshare.com/files/337827123/asa.zip (another I've put on UbuntuOne server). It contains:
- Unpacked image of asa802-k8.bin. We need to unpack .bin file to specify kernel and initrd files to Qemu. The process of unpacking described good here http://blog.gns3.net/2009/12/how-to-emulate-cisco-asa;
- Qemu (patched with pcap support). In Windows we have to get WinPcap installed for Qemu be able to bridge ASA network adapter with OS's interface/interfaces (for example, with MS Loopback interface); In linux we need to compile Qemu with pcap support (need libpcap-dev installed);
- Flash file created with qemu-img (ASA will be using it as disk for file system);
- .bat files with commands for Qemu startup. They include important information about startup options and network adapters, which ASA will use and to which the ASA's interfaces will be bridged. We should mention our virtual or phisycal interfaces to which we want bridge ASA. We can see them with GNS3 cloud or option in GNS3 folder in Start menu (Windows only).
When everything is loaded we need to telnet to it on localhost:1234 and type the following:
- modprobe e100
- ifconfig eth0 up
- ifconfig eth1 up etc.,(depends on how many interfaces we need to use/bridge);
- cd /mnt/disk0
- ./lina_monitor or /asa/bin/lina -m for multicontext mode
Then we should configure it with folowing:
- enable
- configure t
- int eth0/0
- nameif management
- security-level 100
- ip add 192.168.200.2 255.255.255.0 (put it to network of bridged host's adapter)
- no shutdown
- management-access management
Now let's configure ASDM.
Here is a link to ASDM which I was using: ASDM 6.2
In ASA configure the following lines:
- telnet 192.168.200.1 255.255.255.255 management (here is IP address of you interface)
- http server enable
- http 192.168.200.1 255.255.255.255 management
Now, we need to set fiddler to decode HTTPS:
- fiddler --> tools --> fiddler options --> https --> check 'decrypt https traffic'
- Fiddler --> Rules --> Customize Rules (CTRL-R) --> add the code below:
{
if ((oSession.url.EndsWith("/admin/asdm_handler")) || (oSession.url.EndsWith("/admin/pdm.sgz"))){
oSession.bBufferResponse = false;
}
static function OnBeforeResponse(oSession: Session)
{
if (oSession.url.EndsWith("/admin/exec/show+version/show+curpriv/perfmon+interval+10/show+asdm+sessions/show+firewall/show+mode/changeto+system/show+admin-context")) {
oSession.utilDecodeResponse();
oSession.utilReplaceInResponse('Hardware: ,','Hardware: ASA5520,');
}
if (oSession.url.EndsWith("/admin/exec/show+version")) {
oSession.utilDecodeResponse();
oSession.utilReplaceInResponse('Hardware: ,','Hardware: ASA5510,');
}
if (oSession.url.EndsWith("/admin/config")){
oSession.utilReplaceInRequest("write mem","copy /noconfirm running-config disk0:/.private/startup-config");
}
if (oSession.url.EndsWith("/admin/exec/write+memory")){
oSession.url.Replace("write+memory","copy+%2Fnoconfirm+running-config+disk0%3A%2F.private%2Fstartup-config");
}
Or download the following js file and replace Fiddler's CustomRules.js with it - http://rapidshare.com/files/337830003/Fiddler_custom_rule.rar.
Also to be able to use 3DES/AES encryption through ASDM, we have to add the following parts to Fiddler .js file:
static function OnBeforeResponse(oSession: Session)
{
if (oSession.url.EndsWith("/admin/exec/show+version/show+curpriv/perfmon+interval+10/show+asdm+sessions/show+firewall/show+mode/changeto+system/show+admin-context")) {
oSession.utilDecodeResponse();
oSession.utilReplaceInResponse('Hardware: ,','Hardware: ASA5510,');
oSession.utilReplaceInResponse('3DES-AES : Enabled','VPN-3DES-AES : Enabled');
oSession.utilReplaceInResponse('ADV END SEC : Enabled','Advanced Endpoint Assessment : Enabled');
oSession.utilReplaceInResponse('Serial Number: 123456789AB','Serial Number: JKX1014K074');
oSession.utilReplaceInResponse('Running Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000','Running Activation Key: 0x70192e4e 0x507e3e04 0xa8f2f16c 0x85c40864 0x4907ef91');
}
if (oSession.url.EndsWith("/admin/exec/show+version")) {
oSession.utilDecodeResponse();
oSession.utilReplaceInResponse('Hardware: ,','Hardware: ASA5510,');
oSession.utilReplaceInResponse('3DES-AES : Enabled','VPN-3DES-AES : Enabled');
oSession.utilReplaceInResponse('ADV END SEC : Enabled','Advanced Endpoint Assessment : Enabled');
oSession.utilReplaceInResponse('Serial Number: 123456789AB','Serial Number: JKX1014K074');
oSession.utilReplaceInResponse('Running Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000','Running Activation Key: 0x70192e4e 0x507e3e04 0xa8f2f16c 0x85c40864 0x4907ef91');
}
if (oSession.url.EndsWith("/admin/exec/show+activation-key")) {
oSession.utilDecodeResponse();
oSession.utilReplaceInResponse('Serial Number: 123456789AB','Serial Number: JKX1014K074 ');
oSession.utilReplaceInResponse('Running Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000','Running Activation Key: 0x70192e4e 0x507e3e04 0xa8f2f16c 0x85c40864 0x4907ef91');
oSession.utilReplaceInResponse('Failed to retrieve flash activation key.','Permanent Flash Activation Key: 0x70192e4e 0x507e3e04 0xa8f2f16c 0x85c40864 0x4907ef91');
oSession.utilReplaceInResponse('3DES-AES : Enabled','VPN-3DES-AES : Enabled');
oSession.utilReplaceInResponse('ADV END SEC : Enabled','Advanced Endpoint Assessment : Enabled');
}
}
Note, that function OnBeforeResponse is already exists in the file, so we have to add only additional IF statements to it.
The path to file is C:\Documents and Settings\Administrator\My Documents\Fiddler2\Scripts\CustomRules.js
Then we need to change the proxy in Java configuration. Go
- Control Panel - Java - Network Settings - use proxy: localhost:8888 - advanced "use the same proxy server for all protocols"
Now we should copy ASDM .bin to flash of ASA from TFTP server (simple copy tftp flash).
Then try to connect to interface of ASA via browser https. Like https://192.168.200.2/admin
I had a problem with authentication, so it would be reasonably to add user in ASA:
- username igro password cisco privilege 15
P.S. ASDM like SDM works only on older Java versions. I use version 5 (like the last release of old 5).
P.P.S. Some problems exist with saving running-config to startup-config. We should either copy run flash:/.private/startup-config or if it doesn't work, we should use: copy run tftp and then tftp flash:/.private/startup-config. Looks like ASDM saving it without a problem.
Cheers!
Subscribe to:
Posts (Atom)