Understanding and Troubleshooting ASA NAT
|
|
|
- Rafe Williams
- 6 years ago
- Views:
Transcription
1 Cisco Support Community Expert Series Webcasts in Russian: Understanding and Troubleshooting ASA NAT Created by Oleg Tipisov, Cisco TAC. Version 1.1. Cisco Public
2 Cisco Support Community Expert Series Webcasts in Russian Сегодня на семинаре эксперт Cisco TAC Expert s photo Олег Типисов CCIE in Routing and Switching 2 2
3 Спасибо, что посетили наш семинар сегодня Сегодняшняя презентация включает опросы аудитории Пожалуйста, участвуйте! 3
4 Спасибо, что посетили наш семинар сегодня Если Вы хотите получить копию слайдов сегодняшнего семинара, пожалуйста, используйте следующие ссылки: или, 4
5 Опрос #1 Каков уровень ваших знаний о ASA NAT? 1. Я представляю, что такое NAT, но не работал с ним 2. Мне приходилось настраивать NAT на ASA с помощью графического интерфейса ASDM 3. Я владею настройкой NAT из CLI и ASDM и применяю эту технологию в своей сети 4. Я неоднократно настраивал различные варианты NAT на ASA во многих версиях ПО 5
6 Задавайте Ваши вопросы! Используйте Q&A панель, чтобы послать вопрос. Наши эксперты ответят на них Cisco Support Community 2010 Cisco and/or its affiliates. All rights reserved. Cisco Public 6
7 Understanding and Troubleshooting ASA NAT Created by Oleg Tipisov, Cisco TAC. Version 1.1. Cisco Public Cisco Support Community 2010 Cisco and/or its affiliates. All rights reserved. Cisco Public 7
8 Introduction This session is mostly about ASA 8.3+ NAT ASA 8.2 configuration example is given, but slides are hidden to save time Two real-world troubleshooting scenarios are given Students are expected to understand ASA NAT CLI We will not discuss: 8.2 -> 8.3 Configuration migration NAT and Routing integration NAT RPF Check and associated issues Separate presentation is needed for each of the above 8
9 Agenda Introduction NAT Terminology ASA 8.2 Configuration Example ASA 8.3+ Configuration Example Troubleshooting Scenario #1 Troubleshooting Scenario #2 Final Recommendations 9
10 Introduction Cisco Support Community 2010 Cisco and/or its affiliates. All rights reserved. Cisco Public 10
11 ASA Features Stateful packet filter Security policy is based on interface security levels Application inspection NAT/PAT, NAT ALG Static & Dynamic IPv4 & IPv6 routing Integration with IPS, CSC and CX modules L2L & RA VPN (IPSec IKEv1, IPSec IKEv2, SSL) Redundancy features and failover 11
12 ASA Features Virtualization (multiple context mode) Transparent mode NetFlow v9 for security monitoring Botnet traffic filtering (Ironport integration) Identity firewall ASA Phone Proxy and other UC integration features 12
13 Latest Releases , , 5580, 5585-X 8.4(4) is the latest version 8.5 ASA SM 8.4(1) with few other features X 8.4(2) with few other features 8.7 ASA 1000V ASA in a Nexus 1000V switch 9.0 To be released soon 13
14 NAT Terminology Cisco Support Community 2010 Cisco and/or its affiliates. All rights reserved. Cisco Public 14
15 NAT Terminology Real Address vs. Mapped Address Connection vs. xlate Source Translation vs. Destination Translation (UN-NAT) Bidirectional NAT Dynamic NAT vs. Static NAT NAT vs. PAT Identity NAT NAT exemption or NAT 0 ACL (8.2- only) Policy NAT 15
16 ASA 8.2 Configuration Example Cisco Support Community 2010 Cisco and/or its affiliates. All rights reserved. Cisco Public 16
17 Security Policy Example Internet traffic blocked inbound to corporate network Corporate Network ASA Internet inside outside Corporate network allowed to access DMZ network and the Internet dmz DMZ network Internet allowed inbound access to DMZ 17
18 ASA Interface Configuration interface GigabitEthernet0/0.1 vlan 99 nameif inside security-level 100 ip address interface GigabitEthernet0/0.2 vlan 98 nameif dmz security-level 50 ip address interface GigabitEthernet0/1 nameif outside security-level 0 ip address route outside
19 ? ASA NAT and ACL Configuration 8.2 no nat-control! Dynamic PAT to outside interface IP global (outside) 1 interface nat (inside) / ! Static PAT static (dmz,outside) netmask /24! No NAT between inside and dmz interfaces access-list nonat extended permit ip nat (inside) 0 access-list nonat! Allow HTTP to DMZ server access-list outside_in extended permit tcp any host eq www access-group outside_in in interface outside host eq www public IP in this release! 19
20 ASA Dynamic NAT 8.2 %ASA : Built dynamic TCP translation from inside: /64253 to outside: /33627 %ASA : Built outbound TCP connection 0 for outside: /80 ( /80) to inside: /64253 ( /33627) ASA# show conn long TCP outside: /80 ( /80) inside: /64253 ( /33627), flags U, idle 30s, uptime 30s, timeout 1h0m, bytes 0 ASA# show xlate debug 2 in use, 2 most used Flags: D - DNS, d - dump, I - identity, i - dynamic, n - no random, r - portmap, s - static TCP PAT from inside: /64253 to outside: /33627 flags ri idle 0:00:36 timeout 0:00:30 Source port is always changed as of CSCsr
21 ASA Static NAT 8.2 %ASA : Built inbound TCP connection 1 for outside: /63715 ( /63715) to dmz: /80 ( /80) ASA# show conn long TCP outside: /63715 ( /63715) dmz: /80 ( /80), flags UB, idle 26s, uptime 26s, timeout 1h0m, bytes 0 ASA# show xlate debug 1 in use, 2 most used Flags: D - DNS, d - dump, I - identity, i - dynamic, n - no random, r - portmap, s - static NAT from dmz: to outside: flags s idle 0:08:00 timeout 0:00:00 ASA# show access-list access-list outside_in line 1 extended permit tcp any host eq www (hitcnt=1) 0x24e3fc02 number of connections, not packets! public IP 21
22 ? NAT Rules Order 8.2 no nat-control! Dynamic PAT to outside interface IP global (outside) 1 interface nat (inside) / ! Static PAT static (dmz,outside) netmask /24! No NAT between inside and dmz interfaces access-list nonat extended permit ip nat (inside) 0 access-list nonat! Allow HTTP to DMZ server access-list outside_in extended permit tcp any host eq www access-group outside_in in interface outside host eq www public IP in this release! 22
23 NAT Rules Order NAT Exemption (NAT 0 ACL) 2. Static NAT, Static PAT, Static Policy NAT/PAT in order, until the first match FWSM uses longest match for static NAT 3. Dynamic Policy NAT/PAT in order, until the first match 4. Regular Dynamic NAT/PAT longest match identity NAT doesn t have priority 23
24 NAT Pitfalls 8.2 no nat-control doesn t help much Policy NAT ACL doesn t support deny statements NAT exemption ACL doesn t support TCP/UDP ports Bidirectional NAT is difficult to configure Flexibility is limited 64K xlates per PAT IP port ranges cannot be configured (0-511, , ) no support for timeout pat-xlate 24
25 ASA 8.3+ Configuration Example Cisco Support Community 2010 Cisco and/or its affiliates. All rights reserved. Cisco Public 25
26 NAT in 8.3+ Completely new implementation NAT simplification Object NAT (Auto NAT) Twice NAT (Manual NAT) Bidirectional NAT is very easy to configure Flexibility is higher, new features are being implemented 26
27 Security Policy Example Internet traffic blocked inbound to corporate network Corporate Network ASA Internet inside outside Corporate network allowed to access DMZ network and the Internet dmz DMZ network Internet allowed inbound access to DMZ 27
28 Configuration Migration (8.2 > 8.3) INFO: MIGRATION - Saving the startup configuration to file INFO: MIGRATION - Startup configuration saved to file 'flash:8_2_1_0_startup_cfg.sav' *** Output from config line 4, "ASA Version 8.2(1) ". Cryptochecksum (unchanged): 66abf6f4 1b22b1c8 2f06d057 62b2e46a NAT migration logs: The following 'nat' command didn't have a matching 'global' rule on interface 'dmz' and was not migrated. nat (inside) INFO: NAT migration completed. Real IP migration logs: ACL <outside_in> has been migrated to real-ip version INFO: MIGRATION - Saving the startup errors to file 'flash:upgrade_startup_errors_ log' See this article about 8.2 -> 8.3+ software upgrade and configuration migration: 28
29 ASA Interface Configuration interface GigabitEthernet0/0.1 vlan 99 nameif inside security-level 100 ip address interface GigabitEthernet0/0.2 vlan 98 nameif dmz security-level 50 ip address interface GigabitEthernet0/1 nameif outside security-level 0 ip address route outside
30 ASA Object NAT 8.3+ object network obj subnet object network obj host object network obj nat (inside,outside) dynamic interface object network obj nat (dmz,outside) static / /24 access-list outside_in extended permit tcp any host eq www access-group outside_in in interface outside host eq www real IP in this release! 30
31 ASA Twice NAT 8.3+ object network obj subnet nat (inside,outside) source dynamic obj interface object network obj host object network obj host /24 nat (dmz,outside) source static obj obj access-list outside_in extended permit tcp any host eq www access-group outside_in in interface outside host eq www real IP in this release! /24 31
32 ASA Dynamic NAT 8.3+ %ASA : Built dynamic TCP translation from inside: /57126 to outside: /57126 %ASA : Built outbound TCP connection 3 for outside: /80 ( /80) to inside: /57126 ( /57126) ASA# show conn long TCP outside: /80 ( /80) inside: /57126 ( /57126), flags U, idle 12s, uptime 12s, timeout 1h0m, bytes 0 ASA# show xlate 2 in use, 3 most used Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice e - extended TCP PAT from inside: /57126 to outside: /57126 flags ri idle 0:00:23 timeout 0:00:30 Newest software tries to preserve source port if possible 32
33 ASA Static NAT 8.3+ %ASA : Built inbound TCP connection 4 for outside: /41506 ( /41506) to dmz: /80 ( /80) ASA# show conn long TCP outside: /41506 ( /41506) dmz: /80 ( /80), flags UB, idle 41s, uptime 43s, timeout 1h0m, bytes 0 ASA# show xlate 1 in use, 3 most used Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice e - extended NAT from dmz: to outside: flags s idle 0:00:47 timeout 0:00:00 ASA# show access-list access-list outside_in line 1 extended permit tcp any host eq www (hitcnt=1) 0xdae674c0 number of connections, not packets! public IP 33
34 NAT Rules Order (8.3+) 1. Section 1: Twice NAT default place for twice NAT rules in order, until the first match 2. Section 2: Object NAT static NAT (longest match) dynamic NAT (longest match) 3. Section 3: Twice NAT after-auto needs to be specified in nat command in order, until the first match 34
35 Опрос #2 Сталкивались ли Вы с проблемами при использовании NAT на ASA 1. Нет, никогда. Все отлично работает 2. Иногда бывало, но это были ошибки настройки 3. Проблемы встречались, но они легко решались переходом на новую версию 4. Проблемы возникали и их могли решить только инженеры Cisco TAC 5. Сплошные проблемы, не знаю, что делать 6. Я не использую NAT на ASA, потому что он не работает 35
36 Troubleshooting Scenario #1 Cisco Support Community 2010 Cisco and/or its affiliates. All rights reserved. Cisco Public 36
37 Security Policy Example Remote Office ASA Internet inside outside /24 dmz to / IPSec tunnel Server should be accessible from both Internet and Remote Office by Other DMZ servers should be accessible via VPN without NAT. VPN is terminated on some other device, such as perimeter router. DMZ servers should be able to talk to Internet DNS servers. 37
38 ASA Interface Configuration interface GigabitEthernet0/0.1 vlan 99 nameif inside security-level 100 ip address interface GigabitEthernet0/0.2 vlan 98 nameif dmz security-level 50 ip address interface GigabitEthernet0/1 nameif outside security-level 0 ip address route outside
39 ASA NAT Configuration 8.3+ object network obj subnet object network obj host object network obj host object network RemoteOfficeNet subnet object network RemoteOfficeNet-2 subnet to / /24 nat (dmz,outside) source static obj obj nat (dmz,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet-2 nat (dmz,outside) source dynamic obj interface 39
40 Customer Symptom to /24 Everything works, but gets wrong IP when goes to the Internet ASA# show conn long / TCP outside: /80 ( /80) dmz: /37116 ( /23384), flags U, idle 9s, uptime 9s, timeout 1h0m, bytes 0 At the same time inbound connections to work as expected TCP outside: /16123 ( /16123) dmz: /80 ( /80), flags UB, idle 12s, uptime 12s, timeout 1h0m, bytes 0 40
41 Troubleshooting Step #1 ASA# show run object object network obj subnet object network obj host object network obj host object network RemoteOfficeNet subnet object network RemoteOfficeNet-2 subnet to / /24 ASA# show run nat nat (dmz,outside) source static obj obj nat (dmz,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet-2 nat (dmz,outside) source dynamic obj interface 41
42 Troubleshooting Step #2 %ASA : Built dynamic TCP translation from dmz: /37116 to outside: /23384 %ASA : Built outbound TCP connection 54 for outside: /80 ( /80) to dmz: /37116 ( /23384) to / /24 ASA# show conn long TCP outside: /80 ( /80) dmz: /37116 ( /23384), flags U, idle 9s, uptime 9s, timeout 1h0m, bytes 0 ASA# show xlate local global in use, 4 most used Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice TCP PAT from dmz: /37116 to outside: /23384 flags ri idle 0:02:03 timeout 0:00:30 42
43 Troubleshooting Step #3 Hmm This is strange. It seems that dynamic PAT (rule #3) takes precedence over static NAT (rule #1) to /24 ASA# debug nat 255 nat: policy lock 0x73a1cb40, old count is 1 nat: translation - dmz: /37116 to outside: / / ASA# show nat detail Manual NAT Policies (Section 1) 1 (dmz) to (outside) source static obj obj translate_hits = 0, untranslate_hits = 0 Source - Origin: /32, Translated: /32 2 (dmz) to (outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet-2 translate_hits = 0, untranslate_hits = 0 Source - Origin: /24, Translated: /24 Destination - Origin: /24, Translated: /24 3 (dmz) to (outside) source dynamic obj interface translate_hits = 1, untranslate_hits = 0 Source - Origin: /24, Translated: /24 43
44 Troubleshooting Step #4 ASA# packet-tracer input dmz tcp Phase: 1 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in outside Phase: 2 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information: to / /24 Phase: 3 Type: NAT Subtype: Result: ALLOW Config: This again confirms that traffic is processed by dynamic PAT rule, instead of static NAT rule nat (dmz,outside) source dynamic obj interface Additional Information: Dynamic translate /1234 to /
45 Troubleshooting Step #5 ASA# packet-tracer input dmz tcp detail Phase: 1 to /24 Phase: Phase: 3 Type: NAT Subtype: Result: ALLOW /24 Config: nat (dmz,outside) source dynamic obj interface Additional Information: Dynamic translate /1234 to /12386 Forward Flow based lookup yields rule: in id=0x73a1de50, priority=6, domain=nat, deny=false hits=5, user_data=0x73a1cb40, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside The following command can be used to look at this NAT rule in Accelerated Security Path (ASP) table: show asp table classify domain nat 45
46 Troubleshooting Step #6 ASP tables are used to classify traffic in data-path and apply different security policies to it to /24 ASA# show asp table classify domain nat Input Table in id=0x , priority=6, domain=nat, deny=false hits=0, user_data=0x73a1ca98, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port= /24 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=outside, output_ifc=dmz in id=0x73a1de50, priority=6, domain=nat, deny=false hits=5, user_data=0x73a1cb40, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside in id=0x739f84d8, priority=6, domain=nat, deny=false hits=0, user_data=0x , cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside in id=0x , priority=6, domain=nat, deny=false hits=0, user_data=0x73a1c608, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside 46
47 Troubleshooting Step # nat (dmz,outside) source static obj obj nat (dmz,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet-2 nat (dmz,outside) source dynamic obj interface ASA# show asp table classify domain nat Input Table in id=0x , priority=6, domain=nat, deny=false hits=0, user_data=0x73a1ca98, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=outside, output_ifc=dmz in id=0x73a1de50, priority=6, domain=nat, deny=false hits=5, user_data=0x73a1cb40, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 Incorrect order! dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside in id=0x739f84d8, priority=6, domain=nat, deny=false hits=0, user_data=0x , cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 Incorrect order! dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside in id=0x , priority=6, domain=nat, deny=false hits=0, user_data=0x73a1c608, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside 47
48 Troubleshooting Root Cause to /24 It was found that the problem was caused by editing of NAT lines as shown below / no nat (dmz,outside) source static obj obj nat (dmz,outside) 1 source static obj obj New bug was opened: CSCtt11890 ASA: Manual NAT rules inserted above others may fail to match traffic which was fixed in 8.4(4) 48
49 Troubleshooting Solution to /24 Clearing and re-entering configuration resolves the problem (see next slide) ASA(config)# clear conf nat / ASA(config)# nat (dmz,outside) source static obj obj ASA(config)# nat (dmz,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet-2 ASA(config)# nat (dmz,outside) source dynamic obj interface ASA(config)# exit ASA# 49
50 Troubleshooting Solution Verification nat (dmz,outside) source static obj obj nat (dmz,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet-2 nat (dmz,outside) source dynamic obj interface ASA# show asp table classify domain nat Input Table in id=0x739f84d8, priority=6, domain=nat, deny=false hits=0, user_data=0x73a1e480, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 Order is now correct! input_ifc=dmz, output_ifc=outside in id=0x73982f98, priority=6, domain=nat, deny=false hits=0, user_data=0x73a1e8f8, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=outside, output_ifc=dmz in id=0x73a1fbd8, priority=6, domain=nat, deny=false hits=0, user_data=0x73a1e9a0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside in id=0x739696a0, priority=6, domain=nat, deny=false hits=0, user_data=0x73a1e528, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside 50
51 Troubleshooting Solution Verification ASA# packet-tracer input dmz tcp detail Phase: 1 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in outside Phase: 3 Type: NAT Subtype: Result: ALLOW Config: to / /24 nat (dmz,outside) source static obj obj Additional Information: Static translate /1234 to /1234 Forward Flow based lookup yields rule: in id=0x739f84d8, priority=6, domain=nat, deny=false hits=2, user_data=0x73a1e480, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 1 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside Now the correct rule is hit and static NAT works as expected for traffic DMZ: > Internet 51
52 Troubleshooting Solution Verification nat (dmz,outside) source static obj obj nat (dmz,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet-2 nat (dmz,outside) source dynamic obj interface ASA# show asp table classify domain nat Input Table in id=0x739f84d8, priority=6, domain=nat, deny=false hits=0, user_data=0x73a1e480, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside in id=0x73982f98, priority=6, domain=nat, deny=false hits=0, user_data=0x73a1e8f8, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=outside, output_ifc=dmz in id=0x73a1fbd8, priority=6, domain=nat, deny=false hits=0, user_data=0x73a1e9a0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside in id=0x739696a0, priority=6, domain=nat, deny=false hits=0, user_data=0x73a1e528, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside Hmm why was it placed here? Will Identity NAT work? 52
53 Troubleshooting Identity NAT ASA# packet-tracer input dmz tcp detail Phase: 1 Type: UN-NAT Subtype: static Result: ALLOW Config: nat (dmz,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet-2 Additional Information: NAT divert to egress interface outside Untranslate /80 to /80 Phase: 3 Type: NAT Subtype: Result: ALLOW Config: nat (dmz,outside) source static obj obj Additional Information: Static translate /1234 to /1234 Forward Flow based lookup yields rule: in id=0x739f84d8, priority=6, domain=nat, deny=false 1 Note that destination IP is now, so Identity NAT rule (rule #2) should be hit but we see that static NAT rule is hit instead at step 3, which doesn t look correct hits=3, user_data=0x73a1e480, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside 53
54 Troubleshooting Identity NAT ASA# packet-tracer input dmz tcp detail Phase: 1 Type: UN-NAT Subtype: static Result: ALLOW Config: nat (dmz,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet-2 Additional Information: NAT divert to egress interface outside Untranslate /80 to /80 Phase: 3 Type: NAT Subtype: Result: ALLOW Config: nat (dmz,outside) source static obj obj Additional Information: Static translate /1234 to /1234 Forward Flow based lookup yields rule: in id=0x739f84d8, priority=6, domain=nat, deny=false 1 but, on the other hand, syslog message confirms that Identity NAT rule #1 is hit %ASA : Built outbound TCP connection 60 for outside: /80 ( /80) to 2 dmz: /1234 ( /1234) hits=3, user_data=0x73a1e480, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside 54
55 Troubleshooting Identity NAT ASA# packet-tracer input dmz tcp detail Phase: 1 Type: UN-NAT Subtype: static Result: ALLOW Config: nat (dmz,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet-2 Additional Information: NAT divert to egress interface outside Untranslate /80 to /80 Phase: 3 Type: NAT Subtype: Result: ALLOW Config: nat (dmz,outside) source static obj obj Additional Information: Static translate /1234 to /1234 Forward Flow based lookup yields rule: in id=0x739f84d8, priority=6, domain=nat, deny=false In fact, NAT decision at step #3 is ignored as UN- NAT at step #1 takes precedence over NAT Note this line hits=3, user_data=0x73a1e480, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=dmz, output_ifc=outside 55
56 Troubleshooting Identity NAT nat (dmz,outside) source static obj obj nat (dmz,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet-2 nat (dmz,outside) source dynamic obj interface ASA# show nat divert-table UN-NAT uses NAT divert table to classify traffic Divert Table id=0x73aea970, domain=divert-route type=static, hits=0, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=outside, output_ifc=dmz id=0x73aebc00, domain=divert-route type=static, hits=0, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=dmz, output_ifc=outside id=0x73aedbc8, domain=divert-route type=dynamic, hits=0, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=outside, output_ifc=dmz id=0x73aebb58, domain=divert-route type=static, hits=0, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=outside, output_ifc=dmz This rule classifies traffic and routes it to outside interface 56
57 Troubleshooting Scenario #2 Cisco Support Community 2010 Cisco and/or its affiliates. All rights reserved. Cisco Public 57
58 Security Policy Example Corporate Network Destination IP is NATed to Remote Office /24.2 inside ASA outside IPSec tunnel /24 dmz Internet Remote office server needs to talk to inside server , but has default route via some internal router x and cannot have routes through the ASA due to security reasons. So, the decision was made to NAT all incoming requests, coming from , to Other hosts in /24 and /24 should be able to communicate without NAT. 58
59 ASA Interface Configuration interface GigabitEthernet0/0.1 vlan 99 nameif inside security-level 100 ip address interface GigabitEthernet0/0.2 vlan 98 nameif dmz security-level 50 ip address interface GigabitEthernet0/1 nameif outside security-level 0 ip address route outside
60 ASA NAT Configuration 8.3+ object network obj subnet object network obj host /24.2 IPSec /24 object network RemoteOfficeNet subnet Internet object network RemoteServer host nat (outside,inside) source static RemoteServer obj nat (inside,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet nat (inside,outside) source dynamic any interface 60
61 Customer Symptom Remote office server cannot access inside server Connection is created, but is not NATed to /24.2 IPSec Internet /24 ASA# show conn long TCP outside: /31444 ( /31444) inside: /80 ( /80), flags SaAB, idle 6s, uptime 12s, timeout 30s, bytes 0 %ASA : Built inbound TCP connection 198 for outside: /31444 ( /31444) to inside: /80 ( /80) 61
62 Troubleshooting Step #1 It seems that first NAT rule is not hit /24.2 IPSec /24 ASA# debug nat 255 nat: untranslation - outside: /80 to inside: /80 Internet ASA# show nat detail Manual NAT Policies (Section 1) 1 (outside) to (inside) source static RemoteServer obj translate_hits = 0, untranslate_hits = 0 Source - Origin: /32, Translated: /32 2 (inside) to (outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet translate_hits = 0, untranslate_hits = 1 Source - Origin: /24, Translated: /24 Destination - Origin: /24, Translated: /24 3 (inside) to (outside) source dynamic any interface translate_hits = 0, untranslate_hits = 0 Source - Origin: /0, Translated: /24 62
63 Troubleshooting Step # /24.2 IPSec /24 ASA# packet-tracer input outside tcp detail Internet Phase: 1 Type: UN-NAT Subtype: static Result: ALLOW Config: nat (inside,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet Additional Information: NAT divert to egress interface inside Untranslate /80 to /80 Phase: 4 Type: NAT Subtype: Result: ALLOW Config: nat (outside,inside) source static RemoteServer obj UN-NAT chose another rule at step #1, so static NAT rule was ignored and NAT at step #4 wasn't performed 63
64 Troubleshooting Step #3 ASA# show nat divert-table.2 Divert Table id=0x73a92fc0, domain=divert-route /24 type=static, hits=0, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=inside, output_ifc=outside id=0x73a944a0, domain=divert-route type=static, hits=3, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=outside, output_ifc=inside IPSec Internet /24 ASA# show run nat nat (outside,inside) source static RemoteServer obj nat (inside,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet nat (inside,outside) source dynamic any interface There is only one rule for outside interface in NAT divert table. This rule was created from NAT rule #2 and blocked execution of NAT rule #1 64
65 Troubleshooting Workaround object network obj subnet object network obj host object network RemoteOfficeNet subnet object network RemoteServer host object network LocalServer host object network LocalServer-2 host /24.2 IPSec Internet /24 The root cause of the problem is that NAT divert table is not populated with an entry for 1st NAT rule. So, we can try to reconfigure 1st NAT rule and correct entry will be installed into the NAT divert table. nat (outside,inside) source static RemoteServer obj destination static LocalServer LocalServer-2 nat (inside,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet nat (inside,outside) source dynamic any interface Note that it is necessary to use two different object names here: LocalServer and LocalServer-2, otherwise NAT divert rule will not be installed 65
66 Troubleshooting Verification ASA# show nat divert-table.2 Divert Table id=0x739f6ea8, domain=divert-route /24 type=static, hits=0, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=inside, output_ifc=outside id=0x73a92fc0, domain=divert-route type=static, hits=1, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=outside, output_ifc=inside id=0x72f21768, domain=divert-route type=static, hits=0, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=outside, output_ifc=inside IPSec Internet /24 ASA# show run nat nat (outside,inside) source static RemoteServer obj destination static LocalServer LocalServer-2 nat (inside,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet nat (inside,outside) source dynamic any interface 66
67 Troubleshooting Verification ASA# packet-tracer input outside tcp detail Phase: 1 Type: UN-NAT Subtype: static.2 IPSec Result: ALLOW /24 Config: nat (outside,inside) source static RemoteServer obj destination static LocalServer LocalServer-2 Additional Information: NAT divert to egress interface inside Untranslate /80 to /80 Phase: 4 Type: NAT Subtype: Result: ALLOW Config: Internet Correct rule is hit at both UN-NAT and NAT steps nat (outside,inside) source static RemoteServer obj destination static LocalServer LocalServer-2 Additional Information: Static translate /1234 to /1234 Forward Flow based lookup yields rule: in id=0x6dec91a0, priority=6, domain=nat, deny=false hits=1, user_data=0x739f6ea8, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=outside, output_ifc=inside /24 67
68 Troubleshooting Verification /24.2 IPSec /24 Internet Correct rule is hit at both UN-NAT and NAT steps ASA# show nat detail Manual NAT Policies (Section 1) 1 (outside) to (inside) source static RemoteServer obj destination static LocalServer LocalServer-2 translate_hits = 1, untranslate_hits = 1 Source - Origin: /32, Translated: /32 Destination - Origin: /32, Translated: /32 2 (inside) to (outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet translate_hits = 0, untranslate_hits = 0 Source - Origin: /24, Translated: /24 Destination - Origin: /24, Translated: /24 3 (inside) to (outside) source dynamic any interface translate_hits = 0, untranslate_hits = 0 Source - Origin: /0, Translated: /24 68
69 Troubleshooting Permanent Fix Permanent fix is available in 8.4(4.2) CSCtq47028 ASA: Manual NAT rules are not processed in order /24.2 IPSec /24 Internet The CSCtq47028 fix made above workaround unnecessary. NAT rules are installed automatically into both NAT divert and NAT tables. This is a huge change in NAT implementation! ASA# show run nat nat (outside,inside) source static RemoteServer obj nat (inside,outside) source static obj obj destination static RemoteOfficeNet RemoteOfficeNet nat (inside,outside) source dynamic any interface 69
70 Troubleshooting Permanent Fix ASA# show asp table classify domain nat Input Table in id=0x6decad08, priority=6, domain=nat, deny=false hits=0, user_data=0x6deca528, cs_id=0x0, flags=0x0, protocol=0.2 src ip/id= , mask= , port=0 1 dst ip/id= , mask= , port=0, dscp=0x /24 input_ifc=outside, output_ifc=inside in id=0x6decaf80, priority=6, domain=nat, deny=false hits=0, user_data=0x6deca5d0, cs_id=0x0, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=inside, output_ifc=outside in id=0x739c64f8, priority=6, domain=nat, deny=false hits=0, user_data=0x739c0378, cs_id=0x0, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=inside, output_ifc=outside in id=0x739c6770, priority=6, domain=nat, deny=false hits=0, user_data=0x6decd9f8, cs_id=0x0, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=outside, output_ifc=inside in id=0x6decc5f0, priority=6, domain=nat, deny=false hits=0, user_data=0x7307e530, cs_id=0x0, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=inside, output_ifc=outside in id=0x6decc9d8, priority=6, domain=nat, deny=false hits=0, user_data=0x7307e3e0, cs_id=0x0, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=outside, output_ifc=inside IPSec Internet /24 Rule (1) in ASP NAT table is used to classify traffic, coming from , and translate source IP from to
71 Troubleshooting Permanent Fix ASA# show nat divert-table Divert Table id=0x6deca528, domain=divert-route type=static, hits=0, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=inside, output_ifc=outside id=0x6deca5d0, domain=divert-route type=static, hits=0, flags=0x1, protocol=0 1 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=outside, output_ifc=inside id=0x739c0378, domain=divert-route type=static, hits=0, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=outside, output_ifc=inside id=0x6decd9f8, domain=divert-route type=static, hits=0, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=inside, output_ifc=outside id=0x7307e530, domain=divert-route type=dynamic, hits=0, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=outside, output_ifc=inside id=0x7307e3e0, domain=divert-route type=static, hits=0, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=inside, output_ifc=outside /24.2 IPSec Internet Rule (1) in ASP NAT divert table is used to classify traffic, coming from , and translate destination IP from a.b.c.d (i.e. any IP) to itself /24 71
72 Troubleshooting Permanent Fix ASA# packet-tracer input outside tcp detailed Phase: 2 Type: UN-NAT Subtype: static Result: ALLOW Config: nat (outside,inside) source static RemoteServer obj Additional Information: NAT divert to egress interface inside Untranslate /80 to /80 Phase: 5 Type: NAT Subtype: Result: ALLOW Config: /24 nat (outside,inside) source static RemoteServer obj Additional Information: Static translate /1234 to /1234 Forward Flow based lookup yields rule: in id=0x6decad08, priority=6, domain=nat, deny=false hits=1, user_data=0x6deca528, cs_id=0x0, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=outside, output_ifc=inside.2 IPSec Internet Correct rule is hit at both UN-NAT and NAT steps /24 72
73 CSCtq47028 Fix More Info In many customer cases problems were seen when asymmetric or overlapping NAT rules were configured Definition of asymmetric If an outbound packet matches a specific NAT rule and the return packet matches a different NAT rule in the table, then they are called asymmetric NAT rules. Most common with usage of 'dynamic' or 'unidirectional' NAT. Definition of overlapping If two or more NAT rules matches both source and destination (ports included) in the table, then they are called overlapping rules. This also involves usage of 'any' keyword as source or destination network. In this case Twice NAT rules may not be processed in order 73
74 CSCtq47028 Fix More Info This behavior is fixed by CSCtq47028 in 8.4(4.2) For a Twice NAT rule, if the destination is not explicitly specified, ASA implicitly adds destination static any any This populates NAT divert table with required rules and NAT rules order is strictly enforced This change may affect existing configurations! 74
75 Impact on Existing Configurations object network obj host object network RemoteServer host /24.2 IPSec Internet /24 nat (inside,outside) source dynamic obj interface nat (outside,inside) source static RemoteServer obj Dynamic PAT is placed above static NAT and Identity NAT is removed. In 8.4(3) this works (unidirectionally). I.e. it s possible to connect to from inside host Destination IP is UN-NATed to according to 2 nd NAT rule: %ASA : Built outbound TCP connection 3 for outside: /80 ( /80) to inside: /1234 ( /1234) 75
76 Impact on Existing Configurations ASA# packet-tracer input inside tcp detailed Phase: 1 Type: UN-NAT.2 Subtype: static Result: ALLOW /24 Config: nat (outside,inside) source static RemoteServer obj Additional Information: NAT divert to egress interface outside Untranslate /80 to /80 Phase: 3 Type: NAT Subtype: Result: ALLOW Config: IPSec Internet nat (inside,outside) source dynamic obj interface Additional Information: Forward Flow based lookup yields rule: in id=0x6e1f6bf8, priority=6, domain=nat, deny=false hits=2, user_data=0x73433dc0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=inside, output_ifc=outside /24 UN-NAT chose static NAT rule at step #1 and NAT decision at step #3 was ignored. So, order of NAT rules is violated, but customer configuration works. 76
77 Impact on Existing Configurations /24 ASA# show nat detail Manual NAT Policies (Section 1) 1 (inside) to (outside) source dynamic obj interface translate_hits = 0, untranslate_hits = 0 Source - Origin: /24, Translated: /24 2 (outside) to (inside) source static RemoteServer obj translate_hits = 0, untranslate_hits = 1 Source - Origin: /32, Translated: /32 ASA# show nat divert-table Divert Table id=0x73433dc0, domain=divert-route type=dynamic, hits=0, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=outside, output_ifc=inside id=0x73addc00, domain=divert-route type=static, hits=1, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=inside, output_ifc=outside.2 IPSec Internet Root cause: dynamic PAT didn t create a rule in NAT Divert table. Rule, created by static NAT, is there /24 77
78 Impact on Existing Configurations object network obj host object network RemoteServer host /24.2 IPSec Internet /24 nat (inside,outside) source dynamic obj interface nat (outside,inside) source static RemoteServer obj This configuration no longer works after upgrade, as dynamic PAT installs its own rule into the NAT divert table for inside interface %ASA : Built dynamic TCP translation from inside: /1234 to outside: /1234 %ASA : Built outbound TCP connection 1 for outside: /80 ( /80) to inside: /1234 ( /1234) 78
79 Impact on Existing Configurations ASA# packet-tracer input inside tcp detailed Phase: 2 Type: UN-NAT.2 Subtype: static Result: ALLOW /24 Config: nat (inside,outside) source dynamic obj interface Additional Information: NAT divert to egress interface outside Untranslate /80 to /80 Phase: 4 Type: NAT Subtype: Result: ALLOW Config: nat (inside,outside) source dynamic obj interface Additional Information: Dynamic translate /1234 to /1234 Forward Flow based lookup yields rule: in id=0x739a6878, priority=6, domain=nat, deny=false hits=1, user_data=0x7324c4e0, cs_id=0x0, flags=0x0, protocol=0 src ip/id= , mask= , port=0 dst ip/id= , mask= , port=0, dscp=0x0 input_ifc=inside, output_ifc=outside IPSec Internet /24 79
80 Impact on Existing Configurations ASA# show nat detail /24 Manual NAT Policies (Section 1) 1 (inside) to (outside) source dynamic obj interface translate_hits = 1, untranslate_hits = 1 Source - Origin: /24, Translated: /24 2 (outside) to (inside) source static RemoteServer obj translate_hits = 0, untranslate_hits = 0 Source - Origin: /32, Translated: /32 ASA# show nat divert-table Divert Table id=0x7324c588, domain=divert-route type=static, hits=1, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=inside, output_ifc=outside id=0x739a80d8, domain=divert-route type=static, hits=0, flags=0x1, protocol=0 src ip/id= , mask= port=0-0 dst ip/id= , mask= port=0-0 input_ifc=inside, output_ifc=outside.2 IPSec Internet /24 80
81 Final Recommendations Cisco Support Community 2010 Cisco and/or its affiliates. All rights reserved. Cisco Public 81
82 Final Recommendations KISS: Keep It Simple, Stupid Use Object NAT whenever possible, use Twice NAT when Policy NAT is really needed Design your network carefully, don t use NAT to workaround routing problems Don t use NAT for policy control, use ACLs instead Remember that ASA is not a IOS router; learn how NAT and routing interoperate on this platform 82
83 Final Recommendations Always issue no nat-control prior to upgrading to 8.3+ Don t upgrade to 8.3 on a Friday night just as you are getting ready to go out of town for the weekend Test upgrade in a lab first (if you have one) Read documentation and Cisco Support Community documents with ASA and nat tags Call in to the TAC in case of a trouble 83
84 FIN, ACK [ Thank you! ] 84
85 Опрос #3 Какие темы семинаров по безопасности Вам интересны? 1. Построение Remote Access VPN с помощью ASA 2. Построение Site-to-Site VPN на маршрутизаторах 3. DMVPN и GETVPN на маршрутизаторах Cisco 4. Использование платформы ASR1k для VPN 5. Любые вопросы использования Cisco ASA в качестве межсетевого экрана 6. IOS Zone-based Firewall 7. Система обнаружения атак IPS Продукты IronPort 85
86 Q & A Эксперт ответит на некоторые Ваши вопросы. Используйте Q&A панель, чтобы задать еще вопросы Cisco Support Community 2010 Cisco and/or its affiliates. All rights reserved. Cisco Public 86
87 Вторник, 9 октября 10:00 по московскому времени Эксперт Cisco: Amit Singh Расскажет об архитектуре лицензирования Cisco Unified Call Manager (CUCM) версии 9.0х. Регистрация: на английском Тема: Licensing Architecture: Cisco Unified Call Manager Version 9.x ETHOD=E&LANGUAGE_ID=E&PRIORITY_CODE= 4&SEMINAR_CODE=S
88 Тема: Troubleshooting SSL VPN on ASA на английском Вторник, 30 октября 18:00 по московскому времени Эксперт Cisco: Jazib Frahim Расскажет о том как решать проблемы с SSL VPN на Cisco Adaptive Security Appliance (ASA) Регистрация ert-corner#view=webcasts 88
89 Получить дополнительную информацию, а также задать вопросы экспертам в рамках данной темы вы можете в течение двух недель, на странице, доступной по ссылке Вы можете получить видеозапись данного семинара и текст сессии Q&A в течение ближайших 5 дней по следующей ссылке 89
90 Приглашаем Вас активно участвовать в Cisco Support Community и социальных сетях Newsletter Subscription: HYSICAL%20FULFILLMENT%20Y/N=NO&SUBSCRIPTION%20CENTER=YES 90
91 Спасибо за Ваше время Пожалуйста, участвуйте в опросе Cisco Support Community 2010 Cisco and/or its affiliates. All rights reserved. Cisco Public 91
92
ASA with CX/FirePower Module and CWS Connector Configuration Example
ASA with CX/FirePower Module and CWS Connector Configuration Example Document ID: 118687 Contributed by Jennifer Halim, Ashok Sakthivel, and Chirag Saxena, Cisco TAC Engineers. Dec 23, 2014 Contents Introduction
Google Cloud VPN Interop Guide
Google Cloud VPN Interop Guide Using Cloud VPN With Cisco ASA Courtesy of Cisco Systems, Inc. Unauthorized use not permitted. Cisco is a registered trademark or trademark of Cisco Systems, Inc. and/or
CISCO EXAM QUESTIONS & ANSWERS
CISCO 642-618 EXAM QUESTIONS & ANSWERS Number: 642-618 Passing Score: 800 Time Limit: 120 min File Version: 39.6 http://www.gratisexam.com/ CISCO 642-618 EXAM QUESTIONS & ANSWERS Exam Name: Deploying Cisco
Expert Reference Series of White Papers. Cisco Security Troubleshooting: Part I Connectivity Through ASA or PIX Firewalls
Expert Reference Series of White Papers Cisco Security Troubleshooting: Part I Connectivity Through ASA or PIX Firewalls 1-800-COURSES www.globalknowledge.com Cisco Security Troubleshooting: Part I Connectivity
Firewall Core for CCIE Candidates By Rafael Leiva-Ochoa
Firewall Core for CCIE Candidates By Rafael Leiva-Ochoa BRKCCIE-3203 2013 Cisco Systems, Inc. Introduction Rafael Leiva-Ochoa @Cisco since Oct 2000 Works in the TS Training Group (Part of Learning@Cisco)
ASA 7.x/PIX 6.x and Above: Open/Block the Ports Configuration Example
ASA 7.x/PIX 6.x and Above: Open/Block the Ports Configuration Example Contents Introduction Prerequisites Requirements Components Used Related Products Conventions Configure Network Diagram Blocking the
NAT Examples and Reference
The following topics provide examples for configuring NAT, plus information on advanced configuration and troubleshooting. Examples for Network Object NAT, page 1 Examples for Twice NAT, page 7 NAT in
Contents. Introduction
Contents Introduction Prerequisites Requirements Components Used Configure Network Diagram ISE - Configuration Steps 1. SGT for Finance and Marketing 2. Security group ACL for traffic Marketing ->Finance
NAT Examples and Reference
The following topics provide examples for configuring NAT, plus information on advanced configuration and troubleshooting. Examples for Network Object NAT, on page 1 Examples for Twice NAT, on page 6 NAT
Deploying and Troubleshooting Network Address Translation
Deploying and Troubleshooting Network Address Translation Session mihollow@cisco.com 2 Copyright Printed in USA. Agenda The WWW of NAT The Why, the What, and the Where Pitfalls and How to Avoid Tools for
DOWNLOAD PDF CISCO ASA 5505 CONFIGURATION GUIDE
Chapter 1 : Cisco ASA DMZ Configuration Example â Speak Network Solutions Cisco ASA Quick Start Guide. Step 1 Connect the power supply adaptor to the power cable.. Step 2 Connect the rectangular connector
Access Rules. Controlling Network Access
This chapter describes how to control network access through or to the ASA using access rules. You use access rules to control network access in both routed and transparent firewall modes. In transparent
Applying Application Layer Protocol Inspection
CHAPTER 21 This chapter describes how to configure application layer protocol inspection. Inspection engines are required for services that embed IP addressing information in the user data packet or that
Configure the ASA for Dual Internal Networks
Configure the ASA for Dual Internal Networks Document ID: 119195 Contributed by Dinkar Sharma, Bratin Saha, and Prashant Joshi, Cisco TAC Engineers. Aug 05, 2015 Contents Introduction Prerequisites Requirements
Troubleshooting. Testing Your Configuration CHAPTER
82 CHAPTER This chapter describes how to troubleshoot the ASA and includes the following sections: Testing Your Configuration, page 82-1 Reloading the ASA, page 82-8 Performing Password Recovery, page
PIX/ASA : Port Redirection(Forwarding) with nat, global, static and access list Commands
PIX/ASA : Port Redirection(Forwarding) with nat, global, static and access list Commands Document ID: 63872 Introduction Prerequisites Requirements Components Used Related Products Conventions Network
Migration Best Practices for ASA 8.3/8.4
Cisco Support Community Presents : Tech-Talk Series Migration Best Practices for ASA 8.3/8.4 With, Glenn Baptist Customer Support Engineer, Cisco TAC CCIE Security (#32835) 2011 Cisco and/or its affiliates.
CertifyMe. CertifyMe
CertifyMe Number: 642-618 Passing Score: 825 Time Limit: 120 min File Version: 9.0 http://www.gratisexam.com/ CertifyMe 642-618 Sections 1. Section1 (1-10) 2. Section2 (11-20) 3. Section3 (21-30) 4. Section4
Configuration and Operation of FTD Prefilter
Configuration and Operation of FTD Prefilter Policies Contents Introduction Prerequisites Requirements Components Used Background Information Configure Pre-filter Policy Use Case 1 Pre-filter Policy Use
Deploying Cisco ASA Firewall Solutions (FIREWALL v1.0)
Cisco 642-617 Deploying Cisco ASA Firewall Solutions (FIREWALL v1.0) Version: 4.8 QUESTION NO: 1 Which Cisco ASA feature enables the ASA to do these two things? 1) Act as a proxy for the server and generate
Cisco ASA 5500 LAB Guide
INGRAM MICRO Cisco ASA 5500 LAB Guide Ingram Micro 4/1/2009 The following LAB Guide will provide you with the basic steps involved in performing some fundamental configurations on a Cisco ASA 5500 series
Exam Actual. Higher Quality. Better Service! QUESTION & ANSWER
Higher Quality Better Service! Exam Actual QUESTION & ANSWER Accurate study guides, High passing rate! Exam Actual provides update free of charge in one year! http://www.examactual.com Exam : 642-617 Title
v Number: Passing Score: 800 Time Limit: 120 min File Version: 12.39
642-618.v12.39 Number: 642-618 Passing Score: 800 Time Limit: 120 min File Version: 12.39 http://www.gratisexam.com/ Copyright @2006-2011 Lead2pass.com, All Rights Reserved. Vendor: Cisco Exam Code: 642-618
Configuring Static and Dynamic NAT Translation
This chapter contains the following sections: Network Address Translation Overview, page 1 Information About Static NAT, page 2 Dynamic NAT Overview, page 4 Timeout Mechanisms, page 4 NAT Inside and Outside
Configuring Static and Dynamic NAT Translation
This chapter includes the following sections: Network Address Translation Overview, on page 1 Information About Static NAT, on page 2 Dynamic NAT Overview, on page 3 Timeout Mechanisms, on page 3 NAT Inside
PrepKing. PrepKing
PrepKing Number: 642-618 Passing Score: 800 Time Limit: 120 min File Version: 9.10 http://www.gratisexam.com/ PrepKing 642-618 Exam A QUESTION 1 On the Cisco ASA, tcp-map can be applied to a traffic class
Troubleshooting Adaptive Security Appliances (ASA), Private Internet Exchange (PIX), and Firewall Service Modules (FWSM)
Cisco Support Community Expert Series Webcast: Troubleshooting Adaptive Security Appliances (ASA), Private Internet Exchange (PIX), and Firewall Service Modules (FWSM) Kureli Sankar Customer Support Engineer
Chapter 10 Configure AnyConnect Remote Access SSL VPN Using ASDM
Chapter 10 Configure AnyConnect Remote Access SSL VPN Using ASDM Topology Note: ISR G1 devices use FastEthernet interfaces instead of GigabitEthernet interfaces. 2015 Cisco and/or its affiliates. All rights
H3C SecPath Series High-End Firewalls
H3C SecPath Series High-End Firewalls NAT and ALG Configuration Guide Hangzhou H3C Technologies Co., Ltd. http://www.h3c.com Software version: SECPATHF1000SAI&F1000AEI&F1000ESI-CMW520-R3721 SECPATH5000FA-CMW520-F3210
Configuration Examples
CHAPTER 4 Before using this chapter, be sure that you have planned your site s security policy, as described in Chapter 1, Introduction, and configured the PIX Firewall, as described in Chapter 2, Configuring
Exam Name: Implementing Cisco Edge Network Security Solutions
Vendor: Cisco Exam Code: 300-206 Exam Name: Implementing Cisco Edge Network Security Solutions Version: Demo QUESTION 1 The Cisco ASA must support dynamic routing and terminating VPN traffic. Which three
Transparent or Routed Firewall Mode
This chapter describes how to set the firewall mode to routed or transparent, as well as how the firewall works in each firewall mode. You can set the firewall mode independently for each context in multiple
SecBlade Firewall Cards NAT Configuration Examples
SecBlade Firewall Cards NAT Configuration Examples Keywords: NAT, PAT, private IP address, public IP address, IP address pool Abstract: This document describes the characteristics, applications scenarios,
Multihoming with BGP and NAT
Eliminating ISP as a single point of failure www.noction.com Table of Contents Introduction 1. R-NAT Configuration 1.1 NAT Configuration 5. ISPs Routers Configuration 3 15 7 7 5.1 ISP-A Configuration 5.2
Troubleshooting the Security Appliance
CHAPTER 43 This chapter describes how to troubleshoot the security appliance, and includes the following sections: Testing Your Configuration, page 43-1 Reloading the Security Appliance, page 43-6 Performing
HP A-F1000-A-EI_A-F1000-S-EI VPN Firewalls
HP A-F1000-A-EI_A-F1000-S-EI VPN Firewalls NAT Configuration Guide Part number:5998-2649 Document version: 6PW100-20110909 Legal and notice information Copyright 2011 Hewlett-Packard Development Company,
Transparent or Routed Firewall Mode
This chapter describes how to set the firewall mode to routed or transparent, as well as how the firewall works in each firewall mode. You can set the firewall mode independently for each context in multiple
ASA 8.X and later: Add or Modify an Access List through the ASDM GUI Configuration Example
ASA 8.X and later: Add or Modify an Access List through the ASDM GUI Configuration Example Contents Introduction Prerequisites Requirements Components Used Conventions Background Information Configure
LAN to LAN IPsec Tunnel Between a Cisco VPN 3000 Concentrator and Router with AES Configuration Example
LAN to LAN IPsec Tunnel Between a Cisco VPN 3000 Concentrator and Router with AES Configuration Example Document ID: 26402 Contents Introduction Prerequisites Requirements Components Used Conventions Configure
ASACAMP - ASA Lab Camp (5316)
ASACAMP - ASA Lab Camp (5316) Price: $4,595 Cisco Course v1.0 Cisco Security Appliance Software v8.0 Based on our enhanced FIREWALL and VPN courses, this exclusive, lab-based course is designed to provide
Information About NAT
CHAPTER 26 This chapter provides an overview of how Network Address Translation (NAT) works on the ASA and includes the following sections: Introduction to NAT, page 26-1 NAT Types, page 26-2 NAT in Routed
PrepAwayExam. High-efficient Exam Materials are the best high pass-rate Exam Dumps
PrepAwayExam http://www.prepawayexam.com/ High-efficient Exam Materials are the best high pass-rate Exam Dumps Exam : 642-618 Title : Deploying Cisco ASA Firewall Solutions (FIREWALL v2.0) Vendors : Cisco
Chapter 10 Configure Clientless Remote Access SSL VPNs Using ASDM
Chapter 10 Configure Clientless Remote Access SSL VPNs Using ASDM Topology Note: ISR G1 devices use FastEthernet interfaces instead of GigabitEthernet Interfaces. 2016 Cisco and/or its affiliates. All
CISCO EXAM QUESTIONS & ANSWERS
CISCO 642-618 EXAM QUESTIONS & ANSWERS Number: 642-618 Passing Score: 800 Time Limit: 120 min File Version: 23.4 http://www.gratisexam.com/ CISCO 642-618 EXAM QUESTIONS & ANSWERS Exam Name: Deploying Cisco
Implementing Firewall Technologies
Implementing Firewall Technologies Network firewalls separate protected from non-protected areas preventing unauthorized users from accessing protected network resources. Technologies used: ACLs Standard,
Chapter 10 - Configure ASA Basic Settings and Firewall using ASDM
Chapter 10 - Configure ASA Basic Settings and Firewall using ASDM This lab has been updated for use on NETLAB+ Topology Note: ISR G1 devices use FastEthernet interfaces instead of GigabitEthernet interfaces.
ASA Access Control. Section 3
[ 39 ] CCNP Security Firewall 642-617 Quick Reference Section 3 ASA Access Control Now that you have connectivity to the ASA and have configured basic networking settings on the ASA, you can start to look
Table of Contents. Cisco IPSec Tunnel through a PIX Firewall (Version 7.0) with NAT Configuration Example
Table of Contents IPSec Tunnel through a PIX Firewall (Version 7.0) with NAT Configuration Example...1 Document ID: 63881...1 Introduction...1 Prerequisites...2 Requirements...2 Components Used...2 Conventions...2
Cisco CCNP Security Exam
Cisco CCNP Security 642-618 Exam Vendor:Cisco Exam Code: 642-618 Exam Name: Deploying Cisco ASA Firewall Solutions (FIREWALL v2.0) QUESTION 1 On the Cisco ASA, tcp-map can be applied to a traffic class
Chapter 9 Lab A: Configuring ASA Basic Settings and Firewall Using CLI
A: Configuring ASA Basic Settings and Firewall Using CLI This lab has been updated for use on NETLAB+ Topology Note: ISR G2 devices use GigabitEthernet interfaces instead of FastEthernet interfaces. 2018
UniNets CCNA Security LAB MANUAL UNiNets CCNA Cisco Certified Network Associate Security LAB MANUAL UniNets CCNA LAB MANUAL
UNiNets CCNA Cisco Certified Network Associate Security LAB MANUAL Contents: UniNets CCNA Security LAB MANUAL Section 1 Securing Layer 2 Lab 1-1 Configuring Native VLAN on a Trunk Links Lab 1-2 Disabling
Network Address Translation (NAT)
The following topics explain and how to configure it. Why Use NAT?, page 1 NAT Basics, page 2 Guidelines for NAT, page 6 Dynamic NAT, page 12 Dynamic PAT, page 18 Static NAT, page 29 Identity NAT, page
Permitting PPTP Connections Through the PIX/ASA
Permitting PPTP Connections Through the PIX/ASA Contents Introduction Prerequisites Requirements Components Used Background Theory Conventions PPTP with the Client Inside and the Server Outside Network
Interchassis Asymmetric Routing Support for Zone-Based Firewall and NAT
Interchassis Asymmetric Routing Support for Zone-Based Firewall and NAT The Interchassis Asymmetric Routing Support for Zone-Based Firewall and NAT feature supports the forwarding of packets from a standby
Chapter 10 Configure Clientless Remote Access SSL VPNs Using ASDM
Chapter 10 Configure Clientless Remote Access SSL VPNs Using ASDM This lab has been updated for use on NETLAB+ Topology Note: ISR G1 devices use FastEthernet interfaces instead of GigabitEthernet Interfaces.
Cisco - ASA Lab Camp v9.0
Cisco - ASA Lab Camp v9.0 Code: 0007 Lengt h: 5 days URL: View Online Based on our enhanced SASAC v1.0 and SASAA v1.2 courses, this exclusive, lab-based course, provides you with your own set of equipment
ActualTorrent. Professional company engaging Providing Valid Actual Torrent file for qualification exams.
ActualTorrent http://www.actualtorrent.com/ Professional company engaging Providing Valid Actual Torrent file for qualification exams. Exam : 300-206 Title : Implementing Cisco Edge Network Security Solutions
Policy Based Routing:
This chapter describes how to configure the Cisco ASA to support policy based routing (PBR). The following sections describe policy based routing, guidelines for PBR, and configuration for PBR. About,
Junos Security. Chapter 4: Security Policies Juniper Networks, Inc. All rights reserved. Worldwide Education Services
Junos Security Chapter 4: Security Policies 2012 Juniper Networks, Inc. All rights reserved. www.juniper.net Worldwide Education Services Chapter Objectives After successfully completing this chapter,
CCNA Discovery 3 Chapter 8 Reading Organizer
Name Date Chapter 8 Reading Organizer After completion of this chapter, you should be able to: Describe traffic filtering and explain how Access Control Lists (ACLs) can filter traffic at router interfaces.
Fundamentals of Network Security v1.1 Scope and Sequence
Fundamentals of Network Security v1.1 Scope and Sequence Last Updated: September 9, 2003 This document is exclusive property of Cisco Systems, Inc. Permission is granted to print and copy this document
Configure FTD Interfaces in Inline-Pair Mode
Configure FTD Interfaces in Inline-Pair Mode Contents Introduction Prerequisites Requirements Components Used Background Information Configure Inline Pair Interface on FTD Network Diagram Verify Verify
ASA/PIX Security Appliance
I N D E X A AAA, implementing, 27 28 access to ASA/PIX Security Appliance monitoring, 150 151 securing, 147 150 to websites, blocking, 153 155 access control, 30 access policies, creating for web and mail
Introduction to the ASA
CHAPTER 1 The ASA combines advanced stateful firewall and VPN concentrator functionality in one device, and for some models, an integrated intrusion prevention module called the AIP SSM/SSC or an integrated
Web server Access Control Server
2 You can use access lists to control traffic based on the IP address and protocol. However, you must use authentication and authorization in order to control access and use for specific users or groups.
Lab 6: Access Lists. Device Interface IP Address Subnet Mask Gateway/Clock Rate Fa 0/ R1
Lab 6: Access Lists Network Topology:- Device Interface IP Address Subnet Mask Gateway/Clock Rate Fa 0/0 192.168.0.1 255.255.255.0 ----- R1 Fa 0/1 192.168.10.1 255.255.255.0 ----- Se 0/0/0 10.0.0.1 255.255.255.252
New Features for ASA Version 9.0(2)
FIREWALL Features New Features for ASA Version 9.0(2) Cisco Adaptive Security Appliance (ASA) Software Release 9.0 is the latest release of the software that powers the Cisco ASA family. The same core
Network Address Translation (NAT)
The following topics explain and how to configure it. Why Use NAT?, page 1 NAT Basics, page 2 Guidelines for NAT, page 7 Dynamic NAT, page 12 Dynamic PAT, page 21 Static NAT, page 40 Identity NAT, page
HP Firewalls and UTM Devices
HP Firewalls and UTM Devices NAT and ALG Configuration Guide Part number: 5998-4166 Software version: F1000-A-EI: Feature 3722 F1000-S-EI: Feature 3722 F5000: Feature 3211 F1000-E: Feature 3174 Firewall
Clarify Firepower Threat Defense Access Control Policy Rule Actions
Clarify Firepower Threat Defense Access Control Policy Rule Actions Contents Introduction Prerequisites Requirements Components Used Background Information How ACP is Deployed Configure ACP Available Actions
Migrating to the Cisco ASA Services Module from the FWSM
Migrating to the Cisco ASA Services Module from the FWSM Contents Information About the Migration, page 1 Migrating the FWSM Configuration to the ASA SM, page 2 Unsupported Runtime Commands, page 4 Configuration
Stateful Network Address Translation 64
The feature provides a translation mechanism that translates IPv6 packets into IPv4 packets and vice versa. The stateful NAT64 translator algorithmically translates the IPv4 addresses of IPv4 hosts to
VPN Between Sonicwall Products and Cisco Security Appliance Configuration Example
VPN Between Sonicwall Products and Cisco Security Appliance Configuration Example Document ID: 66171 Contents Introduction Prerequisites Requirements Components Used Related Products Conventions Configure
Table of Contents. Cisco Enhanced Spoke to Client VPN Configuration Example for PIX Security Appliance Version 7.0
Table of Contents Enhanced Spoke to Client VPN Configuration Example for PIX Security Appliance Version 7.0...1 Document ID: 64693...1 Introduction...1 Prerequisites...1 Requirements...1 Components Used...1
Lab 8: Firewalls ASA Firewall Device
Lab 8: Firewalls ASA Firewall Device 8.1 Details Aim: Rich Macfarlane 2015 The aim of this lab is to investigate a Cisco ASA Firewall Device, its default traffic flows, its stateful firewalling functionality,
Testing and Troubleshooting
This chapter describes how to troubleshoot the Cisco ASA and test basic connectivity. View Debugging Messages, page 1 Packet Capture, page 1 View the Crash Dump, page 6 View the Coredump, page 6 vcpu Usage
Routing Overview. Information About Routing CHAPTER
21 CHAPTER This chapter describes underlying concepts of how routing behaves within the ASA, and the routing protocols that are supported. This chapter includes the following sections: Information About
co Configuring PIX to Router Dynamic to Static IPSec with
co Configuring PIX to Router Dynamic to Static IPSec with Table of Contents Configuring PIX to Router Dynamic to Static IPSec with NAT...1 Introduction...1 Configure...1 Components Used...1 Network Diagram...1
This document is intended to give guidance on how to read log entries from a Cisco PIX / ASA. The specific model in this case was a PIX 501.
1.0 Overview This document is intended to give guidance on how to read log entries from a Cisco PIX / ASA. The specific model in this case was a PIX 501. 2.0 PIX Config The following is the PIX config
Information About Routing
19 CHAPTER This chapter describes underlying concepts of how routing behaves within the adaptive security appliance, and the routing protocols that are supported. The chapter includes the following sections:,
Completing Interface Configuration (Transparent Mode)
CHAPTER 9 Completing Interface Configuration (Transparent Mode) This chapter includes tasks to complete the interface configuration for all models in transparent firewall mode. This chapter includes the
Object Groups for ACLs
The feature lets you classify users, devices, or protocols into groups and apply these groups to access control lists (ACLs) to create access control policies for these groups. This feature lets you use
Configuring an IP ACL
9 CHAPTER This chapter describes how to configure IP access control lists (ACLs). This chapter includes the following sections: Information About ACLs, page 9-1 Prerequisites for IP ACLs, page 9-5 Guidelines
VLAN Access Control Lists
VLAN access control lists (ACLs) or VLAN maps access-control all packets (bridged and routed). You can use VLAN maps to filter traffic between devices in the same VLAN. VLAN maps are configured to provide
Configuring Interfaces (Transparent Mode)
8 CHAPTER This chapter includes tasks to complete the interface configuration in transparent firewall mode. This chapter includes the following sections: Information About Completing Interface Configuration
Downloaded from: justpaste.it/i2os
: Saved : ASA Version 9.1(2) hostname ciscoasa enable password xxx encrypted names ip local pool poolvpn 192.168.20.10-192.168.20.30 mask 255.255.255.0 interface GigabitEthernet0/0 nameif inside security-level
Release Notes for the Cisco ASA Services Module, Version 8.5(x)
Release s for the Cisco ASA Services Module, Version 8.5(x) Released: July 7, 2011 Updated: September 4, 2012 This document contains release information for the Cisco ASA Services Module (ASASM) Version
Actual4Test. Actual4test - actual test exam dumps-pass for IT exams
Actual4Test http://www.actual4test.com Actual4test - actual test exam dumps-pass for IT exams Exam : 642-617 Title : Deploying Cisco ASA Firewall Solutions (FIREWALL v1.0) Vendor : Cisco Version : DEMO
Appendix B Policies and Filters
Appendix B Policies and Filters NOTE: This appendix does not describe Access Control Lists (ACLs) or IPX SAP ACLs, which are additional methods for filtering packets. See Software-Based IP Access Control
Router and ACL ACL Filter traffic ACL: The Three Ps One ACL per protocol One ACL per direction One ACL per interface
CCNA4 Chapter 5 * Router and ACL By default, a router does not have any ACLs configured and therefore does not filter traffic. Traffic that enters the router is routed according to the routing table. *
Configuration Example of ASA VPN with Overlapping Scenarios Contents
Configuration Example of ASA VPN with Overlapping Scenarios Contents Introduction Prerequisites Requirements Components Used Background Information Translation on both VPN Endpoints ASA 1 Create the necessary
Implementing Traffic Filtering with ACLs
Implementing Traffic Filtering with ACLs Managing Network Device Security 2013 Cisco Systems, Inc. ICND1 3-36 How can you restrict Internet access for PC2? 2013 Cisco Systems, Inc. ICND1 3-37 ACL operation
Configuring Firepower Threat Defense interfaces in Routed mode
Configuring Firepower Threat Defense interfaces in Routed mode Contents Introduction Prerequisites Requirements Components Used Background Information Configure Network Diagram Configure a Routed Interface
Mediant MSBR. Version 6.8. Security Setup. Configuration Guide. Version 6.8. AudioCodes Family of Multi-Service Business Routers (MSBR)
Configuration Guide AudioCodes Family of Multi-Service Business Routers (MSBR) Mediant MSBR Security Setup Version 6.8 Version 6.8 May 2014 Document # LTRT-31640 Configuration Guide Contents Table of
Access Control Lists. About ACLs. ACL Types
Access control lists (ACLs) are used by many different features. When applied to interfaces or globally as access rules, they permit or deny traffic that flows through the appliance. For other features,
upgrade-mp through xlate-bypass Commands
CHAPTER 33 upgrade-mp To upgrade the maintenance partition software, use the upgrade-mp command. upgrade-mp {http[s]://[user:password@]server[:port]/pathname tftp[://server/pathname]} tftp http[s] server
Network Address Translation (NAT)
The following topics explain and how to configure it. Why Use NAT?, page 1 NAT Basics, page 2 Guidelines for NAT, page 8 Configure NAT, page 12 Translating IPv6 Networks, page 40 Monitoring NAT, page 51
Multiple Context Mode
This chapter describes how to configure multiple security contexts on the Cisco ASA. About Security Contexts, page 1 Licensing for, page 12 Prerequisites for, page 13 Guidelines for, page 14 Defaults for,
HOME-SYD-RTR02 GETVPN Configuration
GETVPN OVER DMVPN Topology Details HOME-SYD-RTR02 is GETVPN KS. R2 & R3 are GETVPN Members. R2 is DMVPN Hub. R3 is DMVPN Spoke. HOME-PIX01 is Firewall between R2 and R3. IP Addressing Details HOME-SYD-RTR01
Troubleshooting Firewalls
Troubleshooting Firewalls BRKSEC-3020 www.ciscolivevirtual.com Agenda Understanding the Architecture Packet Flow Failover Troubleshooting Case Studies Additional references 2 Understanding the Architecture