CCNP Security FIREWALL 642-618 Official Cert Guide (2012)

Admittedly, the Cisco IPS SSP line of modules, while exciting, is not without its limitations. For example,

• The IPS SSP devices require the installation of the Firewall/VPN SSP.

• All traffic must flow through the firewall/VPN SSP, which must be installed in the bottom slot of your Cisco ASA. After traffic passes through this device, it can be redirected to the Cisco IPS SSP installed in the top slot.

• Cisco IPS SSP interfaces are down during resets of the module.

• Cisco IPS SSPs cannot be hot swapped. To replace the module, you must issue the hw-module shutdown command.

General Deployment Guidelines

Although you will need to master specific details about each SSC and SSM for the FIREWALL exam, there are some general deployment guidelines that you should understand. For example, you should connect to the management port of an SSM from a management network. This will allow you to configure the module using the Cisco Adaptive Security Device Manager (ASDM) or the Cisco IPS Device Manager (IDM) Software. In the case of the Cisco CSC-SSM, connecting to this management interface from the management network allows you to use the Cisco ASDM or theTrend Micro InterScan GUI.

You should also consider integrating your SSMs with management and reporting tools. You can add the CSC-SSM to the Trend Micro Control Manager. This permits you to manage multiple Trend Micro devices and monitor various activities such as security violations and virus events. You can integrate the AIP-SSM with the Cisco IPS Manager Express (IME) or with the Cisco Security Monitoring, Analysis, and Response System (MARS).

Overview of the Cisco ASA Content Security and Control SSM

This powerful module runs the popular and powerful Trend Micro InterScan for CSCSSM software. The CSC-SSM provides protection against malware through its antivirus, antispyware, and antispam features. It performs content control by engaging in URL blocking and filtering, antiphishing, HTTP and FTP file blocking, and email content filtering. The CSC-SSM also features a management interface that is simple to use, and a system of automatic updates to ensure proper operation and the best rate of true positives.

Cisco Content Security and Control SSM Licensing

The SSM-10 and SSM-20 modules are options for Cisco CSC-SSM functionality. The key difference between the two modules is scalability. For example, the Base license for the SSM-10 allows 50 users, whereas the Base license for the SSM-20 allows 500 users.

There are two types of licenses for the Cisco CSC-SSM: the Base license and optional licenses. The optional licenses come in several varieties and can be used to add more features to the module or to upgrade the number of users supported. For example, the SSM-20 can use an optional upgrade license to raise the number of supported users from 500 users to 1000 users. This license is often called a Plus license.

With a Base license, users can take advantage of antivirus, antispyware, and file blocking capabilities. With a feature upgrade license, users can take advantage of antispam, e-mail content control, URL filtering, URL blocking, and antiphishing capabilities.

Overview of the Cisco ASA Advanced Inspection and Prevention SSM and SSC

These powerful modules and cards can offload the processing and memory requirements for either Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS). Intrusion Detection can notify an administrator that an attack against the network is taking place, whereas Intrusion Prevention can actually stop the attack. The Cisco Intrusion Prevention System (IPS) Software used in the modules and cards permits the intrusion detection or prevention to use signature-, anomaly-, and reputation-based prevention algorithms. This makes for an extremely robust and more foolproof implementation.

With the signature-based approach, network traffic is compared to a database of well-known attacks. With the anomaly-based approach, network traffic is compared to a statistical profile of normal baseline usage. Finally, with the reputation-based approach, the source of network traffic is compared to a reputation database that determines the reputation of the source of traffic. Reputation analysis is facilitated by a global correlation feature that Cisco uses. This allows the Cisco IPS device to participate in a centralized threat database called SensorBase.

Inline Operation

Typically, you configure the AIP-SSM or AIP-SSC in inline mode of operation. This means that the original packets that a source on the network is sending travel through the IPS device. In this configuration, the module or card is in the data forwarding path, allowing intrusion prevention to take place in the system. If a malicious packet is detected, the system can drop the packet before it is permitted to reach the intended target. After the drop, the system can alert management through various alarm configurations. Figure 15-1 illustrates this inline placement.

Figure 15-1. Inline Mode

Promiscuous Operation

The promiscuous mode of operation copies the packets moving through the ASA and sends them to the module or card for analysis. Under this deployment, the original packets still flow through the ASA and reach their target. This mode is used for intrusion detection as opposed to intrusion prevention. Figure 15-2 illustrates this configuration.

Figure 15-2. Promiscuous Mode

Supported Cisco IPS Software Features

The AIP-SSC-5 can support the following Cisco IPS Software features:

• Passive operating system fingerprinting

• Risk Rating System

• Enhanced password recovery

The AIP-SSMs support the aforementioned features and more, including

• Sensor virtualization

• Cisco Global Correlation support

• Custom signature support

• Anomaly detection

• External management interface

Installing the ASA AIP-SSM and AIP-SSC

This section details the steps you take to implement the various modules and cards.

Installing the Cisco ASA AIP-SSC or AIP-SSM involves completing the following steps:

Step 1. Power down the Cisco ASA.

Step 2. Remove the slot cover.

Step 3. Insert the Cisco AIP-SSC or the AIP-SSM into the appropriate slot.

Step 4. Attach the screws.

Step 5. Power up the Cisco ASA.

Step 6. Check the LEDs on the card for status information. The LED on the card will flash green when the card is booting and then turn solid green when the system passes its diagnostics. An amber color for the status LED indicates that there is a problem with the device’s initialization process.

The Cisco AIP-SSM and AIP-SSC Ethernet Connections

The AIP-SSM features the following Ethernet connections:

• Internal control channel: This Fast Ethernet interface is used to access the module CLI via the ASA CLI.

• Internal data channel: This Gigabit Ethernet interface is used to redirect packets that need to be inspected by the module.

• Out-of-band management channel: This Gigabit Ethernet interface is used for management access and for downloading the appropriate ASA AIP-SSM software.

The AIP-SSC features the following Ethernet connections:

• Internal control channel: This Fast Ethernet interface is used for management access and downloading the AIP-SSC software.

• Internal data channel: This Fast Ethernet interface is used to redirect packets that are to be inspected by the module.

Failure Management Modes

When you are deploying your AIP-SSM or your AIP-SSCs, you will need to decide on your failure mode. These modes are available in the inline and promiscuous modes of operation. In the Fail Open mode, if the card or module fails, traffic is permitted to flow through the Cisco ASA as normal. In the Fail Closed mode, traffic will no longer flow if that traffic is to be inspected by the module or card.

Managing Basic Features

To manage the modules and cards, you need to perform the following steps:

Step 1. On the AIP-SSC only, configure a VLAN management interface.

Step 2. Upload the Cisco IPS software to the module.

Step 3. Administer the module.

Example 15-1 demonstrates configuring the management interface for the AIP-SSC.

Example 15-1. Configuring the Management Interface for the AIP-SSC