CCNP Security FIREWALL 642-618 Official Cert Guide (2012)

---

1. Before you can implement virtual firewalls on the Cisco ASA, you must convert the device into which mode?

a. Virtual firewall mode

b. Multiple mode

c. Advanced mode

d. Virtual mode

2. Which of the following deployment guidelines is not correct?

a. When you use transparent firewall mode and multiple mode, you cannot use shared interfaces.

b. When you use shared interfaces, assign a different MAC address to the interface in each context.

c. Each Security Context can be configured for transparent mode or routed mode.

d. Consider resource management with your Security Contexts to avoid system failures.

3. Which of these is not a valid configuration procedure with virtual firewalls on the Cisco ASA?

a. Map each Security Context to an ASA image file.

b. Configure Security Context resource management.

c. Create Security Contexts.

d. Configure each Security Context as a separate security appliance.

4. Which Security Context does the Cisco ASA create automatically during the conversion for virtual firewalls?

a. Base

b. Main

c. System

d. Admin

5. Which command do you use to view Security Context information, including allocated interfaces, the configuration file URL, and the number of Security Contexts that you have configured?

a. show virtual-firewall

b. show context

c. show partitions

d. show versions

6. Which command do you use to switch from one Security Context to another in the CLI?

a. revert

b. moveto

c. changeto

d. enter-context

7. By default, each Security Context belongs to which resource class?

a. Main

b. Admin

c. Default

d. System

8. Which command displays the resource allocation for each resource across all classes?

a. show usage

b. show resource usage

c. show resource classes

d. show resource allocation

9. Which is not a common command to use when troubleshooting virtual firewalls?

a. show context

b. show interface

c. show resource usage

d. show virtual devices

Foundation Topics

Perhaps you are an Internet service provider and would like to set up multiple firewalls for different customers that use your services. Alternatively, perhaps you are a network engineer for a large enterprise that wants multiple firewalls for different areas of the enterprise network. A powerful option that the Cisco ASA provides is the use of virtual firewalls inside a single Cisco ASA. This configuration is a possibility thanks to what are called Security Contexts, which can be created once the ASA is switched to multiple mode. This chapter provides you with all the information you will need to plan for and implement the use of virtual firewalls inside your Cisco ASA. You will also be able to properly verify and troubleshoot such a configuration.

Cisco ASA Virtualization Overview

Cisco ASA virtualization refers to the capability to create multiple virtual firewalls inside a single Cisco ASA. This can be useful if you have dramatically different security policies and rules that you want to enforce for different customers or different departments within your organization. Through the Cisco ASA virtualization process, you define Security Contexts on the device. You create a separate Security Context to represent each new virtual firewall that you want to create. Before you can create these additional Security Contexts, you must convert the ASA to multiple mode. Once you have done this and have defined your contexts, you can assign interfaces, administrators, and security policies to each context just as though it is an independent firewall device.

The multiple virtual firewalls inside the Cisco ASA have the capability to run most of the features found on the Cisco ASA itself. There are some notable exceptions. The following features are not supported in multiple mode with the different virtual firewalls:

• IP Security (IPsec) VPNs and other IPsec services

• Secure Sockets Layer (SSL) VPNs

• Dynamic routing protocols

• Phone Proxy

• Threat detection

• Multicast IP routing

You might wonder about a key interface on the Cisco ASA in multiple mode. For example, you have an important interface that connects to the Internet. This physical interface can actually be shared across different Security Contexts for use by the different virtual firewalls with different security policies.

A High-Level Examination of a Virtual Firewall’s Configuration

As described in the previous section, in pure Cisco terms, a virtual firewall is called a Security Context. You might think of this Security Context as its own firewall within the Cisco ASA. You can define your own security policy for this virtual firewall. It can possess it own interfaces or even share interfaces with other virtual firewalls (with the exception of transparent mode virtual firewalls). It can even feature its own administrative user accounts. In fact, for those responsible for the device, it will appear to be a fully functional standalone device, and they can even be completely unaware of the fact that it is truly a firewall within another firewall.

As you might expect, to have a Cisco ASA engage in this rather remarkable capability, you must convert the operational mode of the device. Thus, an important first step in the configuration is converting the device to what is termed “multiple mode.”

Once the device is in the correct mode to support virtualization, the job of the administrator is to create the required Security Contexts and assign the required resources. The administrator can also configure important resource limits for the various contexts to ensure the overall Cisco ASA does not have its performance degraded due to resource oversubscription. Finally, the Cisco ASA administrator must configure each context with the required IP addressing and access controls appropriate for each virtual device.

The System Configuration, System Context, and Other Security Contexts

As the previous section described, when you want to partition your single ASA into multiple virtual devices, you do so by creating additional Security Contexts. Each Security Context then becomes akin to a separate ASA, with its own security policy, its own interfaces, and even its own administrators if needed. Obviously, the different Security Contexts that you define as the Cisco ASA administrator are critical for defining the different virtual firewalls. But even more critical is what Cisco terms the system configuration. This critical system configuration defines basic security settings for the Cisco ASA itself and is the entity that stores information about all the other Security Contexts. The system configuration also maintains the settings of the physical interfaces inside the Cisco ASA. As when running your ASA in a single mode of operation, the system configuration resides as the startup configuration in flash memory.

The system administrator adds and manages contexts by configuring each context location and other such parameters. All of this is done in the system configuration. The system configuration does not include any interfaces for the System Contexts. This means that if the System Context needs to access network resources (such as Cisco ASDM), the System Context uses the networking resources assigned to a special Security Context called the admin context. The admin context is just like any other context, except that when a user logs in to this context, they have administrative rights over all the Security Contexts set up on the system.

The individual Security Context configurations that you create and edit can be stored on the local disk (flash memory). They can also be downloaded from external servers, such as TFTP or HTTPS servers.

Packet Classification

Creating a Security Context on the Cisco ASA does not automatically assign interfaces to the context. Note that an exception to this rule is the admin context. All interfaces that were enabled in single mode are available to this important context.

A context can use physical or subinterfaces of the Cisco ASA. In transparent mode, only two interfaces can be used for user traffic, and one additional management interface is supported.

As previously described, in routed mode, an interface can be shared between contexts. Obviously, this might be required when there is a single interface that provides Internet connectivity for multiple virtual firewalls. The Cisco ASA uses a “classifier algorithm” to determine the destination Security Context for an inbound packet on the shared interface. The following criteria are used in this process:

• Unique interfaces: This is the method always used in transparent firewall mode because interfaces cannot be shared between contexts in this mode.

• Unique MAC addresses: The classifier uses the packet destination MAC address and compares it to the interface MAC address for each context sharing the interface. Obviously, you should set a unique MAC address for each context; the Cisco ASA even provides automation of this process should you elect for it.

• Network Address Translation (NAT): If there are not unique MAC addresses configured, the classifier uses the NAT configuration to determine the subnets serviced by each context. The destination IP address is matched to either a global IP address in a static configuration or to an address in the xlate table in the result of a dynamic configuration.