Network Wizkid's Technical Knowledge Base

In this article, I would like to demonstrate by video how we can lab with the virtual Adaptive Security Appliance (ASAv) by just the use of VMware Workstation. We will achieve this by creating virtual networks in VMware Workstation and then connecting to the Adaptive Security Device Manager (ASDM) using our physical machine. As mentioned in the video, I have attached the example topology used below. Please review the tutorial in the video below and if you have any questions, feel free to leave a comment.    

You may have found that trying to get the ASAv to work in GNS3 isn’t the easiest thing to do and in order for it to function correctly, we have a few tweaks we need to make to the QEMU. NOTE: I will not provide the file, you will need to obtain this. The instructions I have prepared below should be enough to get going, if you have any further questions please reach out to me 1. Install Cisco ASAv appliance from the GNS3 Marketplace 2. When promoted for the missing file, create a new version and insert the .qcow file and add your file 3. Go to the QEMU settings and change console type to “VNC” 4. Click on “Advanced Settings” and insert one of the following based on your CPU FOR INTEL CPU -cpu Nehalem -smp 4,sockets=4,cores=1,threads=1 or -cpu SandyBridge -smp 4,sockets=4,cores=1,threads=1 FOR AMD CPU -cpu Opteron_G5 -smp 4,sockets=4,cores=1,threads=1   5. Untick option “Use as a linked base VM” 6. Run the ASAv and select the 1st option – the device should reboot after fir...

In this article, I will demonstrate how to configure the ASAv so that you use a virtual serial port. This article assumes that you have installed the virtual Cisco Adaptive Security Appliance using VMware workstation or it’s equivalent and that you can only access the ASAv CLI via the VMware client. By default, the virtual serial console on the ASAv is disabled, so that it can be enabled, a few commands are required. Use Case At present, I only have access to the ASAv CLI using VMware Fusion but I want to use my computers terminal software to access the CLI for use with GNS3. The following steps assume you have already installed the ASAv Steps Power on the ASAv and access the CLI via VMware workstation or it’s equivalent Enter the following commands on the ASAv Enable Configure terminal cd coredumpinfo Copy coredump.cfg disk0:/use_ttyS0 – This will enable the serial console once saved to Disk0:/ Now shutdown the ASAv and upon reloading the ASAv will now send its output to the s...

If you’re a firewall engineer or work closely with the Cisco ASA then no doubt you will often find yourself troubleshooting and verifying reachability of packets on a network. One great feature that the ASA has to test reachability is the ‘packet-tracer’ command which when given an input will provide you with a very handy output that shows how the packet would be processed through the ASA. In this article, I will show you how we can use the packet-tracer command to verify ICMP reachability and we will also take a look at the process in which the ASA uses. For this demonstration, I am using an ASAv version (9.8) code. By default, ICMP is not inspected on the ASA and therefore all ICMP traffic will be dropped. In order to the allow ICMP, you need to inspect it and to do this we can add the following command to the ‘global_policy’ policy-map; class inspection_defaultinspect icmp Once you have configured the policy-map you can then configure ACL’s to permit ICMP traffic as you desire. In t...

In this article, I will share my notes on the ASA packet process for version 8.3+. Domain 1.0 off the CCIE Security version blueprint focuses on perimeter security and intrusion prevention, both of which include the ASA. In order to understand the ASA and how it works, it is important to understand how packets are processed as they enter the ASA. The packet comes into the ingress interface and the ASA checks to see if there are any existing connections. If a connection already exists, ACL’s are bypassed and the packet is sent straight to the packet inspection, this is also known as the fast path. If a connection doesn’t currently exist then the packet needs to be checked against ACL’s for any matches, we can also see by looking at the diagram above, that the packet will be untranslated before it is matched against the ACL rules. If an ACL match is found and it is permitted, the packet will be inspected, likewise, if the packet is not permitted it is dropped. When a connection doe...