CCNP Security FIREWALL 642-618 Official Cert Guide (2012)

Click the OK button to return to the Add Regular Expression dialog box, and then click the OK button to add the new regular expression to the list that is available to ASDM. In Figure 9-31, the newly defined regular expression named Customer-URI has been added to the bottom of the list. Click the OK button to return to the HTTP Inspect Map dialog box.

Figure 9-31. New Regular Expression Added to ASDM

In the Add HTTP Inspect dialog box, you can click Regular Expression and choose the new regular expression from the drop-down list. In Figure 9-32, the Customer-URI regular expression is selected as the match criteria value. Because only connections that do not contain the matching string are to be dropped, the match criteria has been changed to No Match, and the action has been set to Drop Connection. Click OK to add the new inspect policy to the HTTP inspect policy map.

Figure 9-32. Matching Against a Regular Expression in an HTTP Inspect Policy

Now suppose you need to define an HTTP inspection policy that detects GET requests that include request arguments that contain external links to other, possibly malicious, locations. You can define a regular expression called Embedded-link that matches against the string “http://” or “https://”. In Figure 9-33, the character string “https://” has been entered and appended to the regular expression. Because the letter s might or might not appear to match the two target strings, it can appear zero or one time in the HTTP request text. To set up the regular expression, you would select the letter s, choose the Zero or One Times (?) option, and then click the Apply to Selection button.

Figure 9-33. Defining a Regular Expression to Match Either http:// or https://

Because the regular expression is slightly more complex than a simple text string, you should click the Test button to verify that it works properly. In Figure 9-34, the regular expression “https?://” is being tested, to make sure that it matches against the string “http://”. After you click the Test button, ASDM runs the test and returns the test result Match Succeeded.

Figure 9-34. Testing a Regular Expression to Verify the Results

Click the OK button in the test dialog box, and then click OK in the Build Regular Expression dialog box. Finally, complete the Add HTTP Inspect dialog box by specifying the regular expression you want to use for matching. In Figure 9-35, the previously configured Embedded-link regular expression will be used as a matching criteria; connections that match and have the prohibited external link string will be dropped.

Figure 9-35. Specifying the Regular Expression for an HTTP Signature Inspection Policy

Click OK to complete the inspection policy configuration. As each policy is completed, it is listed as part of the HTTP inspect map, as shown in Figure 9-36.

Figure 9-36. Displaying the Inspection Policies Within an HTTP Inspect Map

Step 4: Apply the HTTP Inspection Policy Map

After you configure an HTTP inspection policy map, you apply it to an HTTP inspection within a service policy rule. Any traffic that is classified or matched by the service policy rule will be sent through the customized inspection.

First, navigate to Configuration > Firewall > Service Policy Rules and select a service policy rule to edit. On the Traffic Classification tab, configure the traffic match criteria. Then click the Rule Actions tab. Make sure the HTTP check box is checked on the Protocol Inspection tab. At this point, only the default HTTP inspection will be used. Click the Configure button beside HTTP, and then click the Select an HTTP Inspect Map for Fine Control over Inspection radio button. Make sure the HTTP inspection policy map name is selected in the list and click OK.

In Figure 9-37, the inspection policy map named HTTP_MAP_1 is being applied to HTTP inspection for the service policy rule.

Figure 9-37. Applying an HTTP Inspection Policy Map to a Service Policy Rule

Configuring FTP Inspection

The File Transfer Protocol (FTP) is used between clients and servers. Clients can open FTP connections to servers and perform several different file-oriented operations. The ASA offers an FTP application inspector that must sit between the client and server to work properly. The FTP inspector offers the following functions:

• Protocol verification: Drop any FTP sessions that do not adhere to the FTP protocol specification and log the URI of all accessed FTP objects. FTP protocol verification is enabled by default and cannot be disabled.

• Protocol minimization: Allow only specific FTP commands and functions to be passed on to the protected client or server. For example, any FTP connections that use any request commands other than GET could be dropped.

• Payload minimization: Allow only specific FTP payloads to be delivered to the protected server. For example, an ASA can filter FTP connections according to filenames, file types, server names, and usernames.

• Application layer signatures: Identify and drop specific FTP payloads.

Configuring FTP Inspection Using the CLI

You can use the CLI to configure an FTP inspection policy map that is applied to the FTP inspector process. The policy map can use various matching criteria to detect conditions within FTP connections. In case of a match, the FTP connections can be reset.

You can use the following steps to build and apply an FTP inspection policy map:

Step 1. Define the FTP inspection policy map.

Step 2. Mask FTP server information.

Step 3. Configure an FTP minimization or detection policy, along with an action.

Step 4. Apply the FTP inspection policy map.

The sections that follow describe what is involved with each step.

Step 1: Define the FTP Inspection Policy Map

Use the following command to define and name the policy map:

ciscoasa(config)# policy-map type inspect ftp ftp-map-name

As an example, suppose you need to define an FTP inspection policy map called FTP_MAP_1. You could enter the following command:

ciscoasa(config)# policy-map type inspect ftp FTP_MAP_1

Step 2: Mask FTP Server Information

When a client opens a connection to an FTP server, the server often displays information about itself in a banner message or in its reply when the client sends the FTP SYST command. Malicious hosts might use this information to fingerprint the server’s operating system so that known vulnerabilities can be leveraged.

You can configure the ASA to mask the FTP server’s banner or its SYST reply with the following commands:

ciscoasa(config-pmap)# parameters
ciscoasa(config-pmap-p)# mask-banner
ciscoasa(config-pmap-p)# mask-syst-reply
ciscoasa(config-pmap)# exit

Step 3: Configure an FTP Minimization or Detection Policy, Along with an Action

You can define any protocol or payload minimization or FTP signature by selecting a matching criteria from Table 9-14 and entering the corresponding command. The match command will match against exactly the parameters you enter, whereas the match not command will match against anything other than the parameters you enter.

Table 9-14. Configuration Commands for Matching Against FTP Content

You can build up a set of inspection policies by configuring multiple match and action pairs in a single FTP inspection policy map. If a match command drops or resets an FTP connection, then no further matches are checked; otherwise, an FTP packet can be matched by subsequent matchcommands in the policy map.

By default, no action will be taken. You can use the following command to cause the matching FTP connection to be reset by sending a TCP RST:

ciscoasa(config-pmap-c)# reset

As an example, suppose you need to add a security policy to minimize the FTP protocol such that only GET, PUT, and HELP request commands will be permitted. As well, connections that involve filenames ending with “.exe” will be reset. You can use the following command:

ciscoasa(config)# regex FTP_BADNAMES \.exe
ciscoasa(config)# policy-map type inspect ftp FTP_MAP_1
ciscoasa(config-pmap)# match not request-command get put help
ciscoasa(config-pmap-c)# reset
ciscoasa(config-pmap)# match filename regex FTP_BADNAMES

Step 4: Apply the FTP Inspection Policy Map

After you have configured an FTP inspection policy map, you apply it to an FTP inspection within a service policy rule using the following command syntax:

ciscoasa(config-pmap-c)# inspect ftp ftp-map-name

Any traffic that is classified or matched by the service policy rule will be sent through the customized inspection.

Configuring FTP Inspection Using ASDM

You can also use ASDM to configure an FTP inspection policy map. Navigate to Configuration > Firewall > Objects > Inspect Maps and select FTP.

As with the CLI configuration, you can accomplish the ASDM configuration with the following steps:

Step 1. Define the FTP inspection policy map.

Step 2. Configure a minimization or signature detection, along with an action.

Step 3. Apply the FTP inspection policy map.

The sections that follow describe what is involved with each step.

Step 1: Define the FTP Inspection Policy Map

Click the Add button to add a new inspection policy map. Enter an arbitrary name for the map, as well as an optional description. Figure 9-38 shows a new policy map called FTP_MAP_1.

Figure 9-38. Adding a New FTP Inspect Map in ASDM

The Add FTP Inspect Map dialog box initially shows a Security Level slider that you can use to quickly set up some basic FTP inspection parameters. By sliding the pointer up or down, you can choose between the following security levels:

• Low: URI logging is enabled.

• High: URI logging is enabled; mask the FTP server banner and server replies to the FTP SYST command.

FTP protocol verification is always enabled, regardless of the slider setting. You can click the File Type Filtering button to define inspection rules that filter on FTP filenames.

Step 2: Configure a Minimization or Signature Detection, Along with an Action

Click the Inspections tab to see a list of any FTP inspection policies that have been configured. To add a new inspection, click the Add button.

Configuration begins in the Parameters tab, as shown in Figure 9-39. You can enable server information masking by checking the Mask Greeting Banner from the Server and the Mask Reply to SYST Command check boxes.

Figure 9-39. Configuring FTP Server Information Masking

Next, you can click the Inspections tab to list any configured FTP security policies. Click the Add button to add a new policy.

In the Add HTTP Inspect dialog box, click the Single Match radio button to define a single matching condition. Then click Match or No Match and choose a criterion type from the Criterion drop-down list. The options displayed in the Value section will change depending on the criterion you select. At the bottom of the dialog box, choose the actions that will be taken on the matching FTP connection. Click the OK button to add the new inspection to the FTP inspection policy map.

As an example, suppose that only the FTP GET, PUT, and HELP request commands are to be permitted; all other request methods should have their FTP connections reset. As shown in Figure 9-40, click No Match and choose the criterion Request Command. The check boxes next to values GET, HELP, and PUT are checked. In other words, if a client sends any FTP command other than these three, the connection will be reset. For FTP inspection, notice that the reset action is mandatory and cannot be disabled.

Figure 9-40. Defining an FTP Request Command Policy

As a second example, suppose that any FTP connections that involve filenames ending in .exe should be reset. In Figure 9-41, a regular expression called FTP_BADNAMES has been configured and applied to a new policy that uses a single match on the FTP File Name criterion.

Figure 9-41. Defining a Policy to Match Against FTP Filenames

Step 3: Apply the FTP Inspection Policy Map

After you have configured an FTP inspection policy map, you apply it to an FTP inspection within a service policy rule. Any traffic that is classified or matched by the service policy rule will be sent through the customized inspection.

First, navigate to Configuration > Firewall > Service Policy Rules and select a service policy rule to edit. On the Traffic Classification tab, configure the traffic match criteria. Then click the Rule Actions tab. Make sure FTP is checked on the Protocol Inspection tab.

At this point, only the default FTP inspection will be used. Click the Configure button beside FTP, and then click the Select an FTP Inspect Map for Fine Control over Inspection radio button. Make sure the FTP inspection policy map name is selected in the list and click OK.

In Figure 9-42, the inspection policy map named FTP_MAP_1 is being applied to FTP inspection for the service policy rule.

Figure 9-42. Applying an FTP Inspection Policy Map to a Service Policy Rule

Configuring DNS Inspection

An ASA can inspect the Domain Name Service (DNS) protocol that is used between clients and servers, as long as the clients and servers are located on opposite sides of the ASA. The DNS inspector offers the following functions:

• Application of NAT rules to the contents of DNS replies

• DNS protocol verification

• Randomization of DNS ID values to protect against DNS spoofing attacks

• DNS Guard, which closes a DNS UDP connection as soon as the first DNS reply is received

• Granular inspection and matching of DNS requests and replies

You can use the CLI to configure a DNS inspection policy map that is applied to the DNS inspector process. The policy map can use various matching criteria to detect conditions within DNS transactions. In case of a match, individual DNS packets can be dropped, the whole DNS connection can be dropped, and control over the TSIG parameter can be enforced. By leveraging a DNS inspection policy map, you can mitigate DNS threats such as reconnaissance with nslookup, DoS, cache poisoning, and so on.

Creating and Applying a DNS Inspection Policy Map Using the CLI

You can use the following steps to build and apply a DNS inspection policy map:

Step 1. Define the DNS inspection policy map.

Step 2. Inspect DNS parameters.

Step 3. Define a DNS inspection rule and an action.

Step 4. Apply the DNS inspection policy map.

Step 1: Define the DNS Inspection Policy Map

Use the following command to define and name the policy map:

ciscoasa(config)# policy-map type inspect dns dns-map-name

As an example, suppose you need to define a DNS inspection policy map called DNS_MAP_1. You could enter the following command:

ciscoasa(config)# policy-map type inspect dns DNS_MAP_1

Step 2: Inspect DNS Parameters

You can configure several different DNS inspection functions that control DNS connections and their content. Begin by using the following command to enter the policy map parameter configuration mode:

ciscoasa(config-pmap)# parameters

Next, choose and enter one or more commands from Table 9-15.

Table 9-15. DNS Parameter Inspection Commands

As an example, DNS protocol verification and DNS Guard are enabled, along with DNS ID randomization and NAT rewrite. The commands listed in Example 9-25 are used.

Example 9-25. Enabling DNS Parameter Inspection