Upload
g3000lee
View
82
Download
1
Tags:
Embed Size (px)
DESCRIPTION
CIsco ASA lab which you can do in GNS3 or on real hardware
Citation preview
Cisco Certified Security Professional
SNAF
Securing Networks with ASA Fundamentals
Lab Manual
Developed by M. Irfan Ghauri
M. Tanzeel Nasir
C-32/1 Block-5 Gulshan-e-Iqbal, Karachi ESP Press Ph #021-6034003 Copyrights 2011
ASA Lab Manual
1
LAB. LABS DESCRIPTION PAGE
NO. 1
ASA Basic & Accessing ASA through Telnet/SSH/HTTP
3
2
NETWORK ADDRESS TRANSLATION
• Nat Control • Static NAT • Dynamic NAT • PAT • STATIC PAT • POLICY NAT • NAT 0
8
3
Fitering ACTIVEX Objects and JAVA Applets
17
4
Transparent Firewall
18
5
Syslog server
20
6
Cut through proxy through LOCAL database & AAA server
21
7
Downloadable Acl
24
8
Tcp intercept Max connection
29
9
Object Grouping and Time-based Acl
30
10
Routing a.Static Routing b.Dynamic Routing
32
ASA Lab Manual
2
11
Dynamic Host Configuration Protocol
34
12
Demilitarized Zone
37
13
Intervlan Routing with ASA
39
14
Modular Policy Framework
41
15
Virtual Private Network Site to Site VPN Web VPN Remote Access VPN
42
ASA Lab Manual
3
Lab # 1
ASA Basic Configuration How to verify Version ciscoasa(config)# sh version How to Set Hostname ciscoasa(config)# hostname ESP How to Set Time & Date ciscoasa# clock set 03:40:50 29 december 2010 How to Set Desired Banners ciscoasa(config)# banner exec "you are off" How to Configure a particular Interface ciscoasa(config)# interface ethernet 0/0
• Assign IP ciscoasa(config-if)# ip address 20.0.0.10
• Alive Interface ciscoasa(config-if)# no shutdown
• Set Speed ciscoasa(config-if)# speed auto
• Give Label ciscoasa(config-if)# nameif outside
• Mention Security Level ciscoasa(config-if)# security-level 0 ciscoasa(config)# interface ethernet 0/1 ciscoasa(config-if)# ip address 10.0.0.10 ciscoasa(config-if)# no shutdown ciscoasa(config-if)# speed auto
ASA Lab Manual
4
ciscoasa(config-if)# nameif inside ciscoasa(config-if)# security-level 100
How to check Particular Interface information ciscoasa# sh interface ethernet 0/0 ciscoasa# sh interface ethernet 0/1 How to check the applied IP Addresses on the Device ciscoasa# sh ip addresses How to check interface Labels & Security Levels ciscoasa# sh nameif How to check Interfaces summary ciscoasa(config)# sh interface ip brief How to Save Configuration ciscoasa(config)# copy running-config start How to check state table ciscoasa(config)# sh conn How to check memory status ciscoasa# sh memory How to restrict access on Privilege mode ciscoasa(config)# enable password cisco How to check running configuration ciscoasa(config)# sh run How to check History of CLI ciscoasa# sh history
ASA Lab Manual
5
Accessing ASA through Telnet/HTTP/SSH
Configuration Assigning Speed & IP Address on Inside & Outside Interfaces. ciscoasa(config)# interface ethernet 0/0 ciscoasa(config-if)# ip address 20.0.0.10 ciscoasa(config-if)# no shutdown ciscoasa(config-if)# speed auto ciscoasa(config-if)# nameif outside ciscoasa(config)# interface ethernet 0/1 ciscoasa(config-if)# ip address 10.0.0.10 ciscoasa(config-if)# no shutdown ciscoasa(config-if)# speed auto ciscoasa(config-if)# nameif inside How to Telnet Adaptive Security Appliance ciscoasa(config)# telnet 10.0.0.4 255.255.255.255 inside ciscoasa(config)# passwd cisco ciscoasa(config)# enable password cisco (Telnet only allow from inside) How to HTTP Adaptive Security Appliance ciscoasa(config)#http server enable ciscoasa(config)#http 10.0.0.1 255.255.255.255 inside How to SSH Adaptive Security Appliance ciscoasa(config)# crypto key generate rsa modulus 1024 ciscoasa(config)# ssh 10.0.0.1 255.255.255.255 inside ciscoasa(config)# ssh 20.0.0.4 255.255.255.255 outside Authentication With local database ciscoasa(config)#username tanzeel password cisco123 ciscoasa(config)# aaa authentication ssh console LOCAL
ASA Lab Manual
6
At Machine 10.0.0.1:
ASA Lab Manual
7
Verification Commands: ciscoasa(config)# show ssh ciscoasa(config)# show ssh session ciscoasa(config)# ssh disconnect session_id ciscoasa(config)# show crypto key mypubkey rsa
ASA Lab Manual
8
Lab # 2
NETWORK ADDRESS TRANSLATION Network Address Translation allows to translate Private Addresses into Public Addresses
• Nat Control • Static NAT • Dynamic NAT • PAT • STATIC PAT • POLICY NAT • NAT 0
Configuration Assigning Speed & IP Address on Inside & Outside Interfaces. ciscoasa(config)# interface ethernet 0/0 ciscoasa(config-if)# ip address 20.0.0.10 ciscoasa(config-if)# no shutdown ciscoasa(config-if)# speed auto ciscoasa(config-if)# nameif outside ciscoasa(config)# interface ethernet 0/1 ciscoasa(config-if)# ip address 10.0.0.10 ciscoasa(config-if)# no shutdown ciscoasa(config-if)# speed auto ciscoasa(config-if)# nameif inside ciscoasa (config)#nat-control
ciscoasa (config)# access-list 1 permit ip any any ciscoasa (config)# access-group 1 in interface outside
ASA Lab Manual
9
STATIC NETWORK ADDRESS TRANSLATION
Configuration Establish Static NAT & ACLs. ciscoasa (config)# static (inside,outside) 20.0.0.51 10.0.0.1 ciscoasa (config)# static (inside,outside) 20.0.0.52 10.0.0.2
Verify Configuration by using following commands. ciscoasa (config)# show running-config nat ciscoasa (config)# show xlate ciscoasa (config)# show access-list 1
ASA Lab Manual
10
DYNAMIC NETWORK ADDRESS
TRANSLATION
Configuration Establish Dynamic NAT, POOL & ACLss on Inside Interfaces. ciscoasa (config)# nat (inside) 1 0 0 ciscoasa (config)# global (outside) 1 20.0.0.51-20.0.0.60 Verify Configuration by using following commands. ciscoasa (config)# show running-config global ciscoasa (config)# show running-config nat ciscoasa (config)# show xlate ciscoasa (config)# show access-list 1
ASA Lab Manual
11
DYNAMIC PORT ADDRESS TRANSLATION
Configuration Establish Dynamic PAT, POOL & ACLs ciscoasa (config)# nat (inside) 1 0 0 ciscoasa (config)# global (outside) 1 20.0.0.51
OR Establish Dynamic PAT by assigning Outside Interface IP Address to POOL ciscoasa (config)# nat (inside) 1 0 0 ciscoasa (config)# global (outside) 1 interface ciscoasa (config)# access-list 1 permit ip any any ciscoasa (config)# access-group 1 in interface outside
ASA Lab Manual
12
Verify Configuration by using following commands. ciscoasa (config)# show running-config global ciscoasa (config)# show running-config nat ciscoasa (config)# show xlate ciscoasa (config)# show access-list 1
ASA Lab Manual
13
STATIC PAT
Configuration Establish Port Redirection & ACLs ciscoasa (config)# static (inside,outside) tcp 20.0.0.50 http 10.0.0.1 80 Verify results by browsing 20.0.0.50 from outside machine.
(Outside Machine will successfully access local Web Server) Verify Configuration by using following commands. ciscoasa (config)# show running-config nat ciscoasa (config)# show running-config xlate
ASA Lab Manual
14
POLICY NAT
Configuration Apply ACLs & NAT POLICY ciscoasa (config)# access-list 101 permit ip 10.0.0.0 255.0.0.0 host 20.0.0.1 ciscoasa (config)# access-list 102 permit ip 10.0.0.0 255.0.0.0 host 20.0.0.2 ciscoasa (config)# nat (inside) 1 access-list 101 ciscoasa (config)# global (outside) 1 20.0.0.51 ciscoasa (config)# nat (inside) 2 access-list 102 ciscoasa (config)# global (outside) 2 20.0.0.52
ASA Lab Manual
15
Verify Configuration by using following commands. ciscoasa (config)# show running-config nat ciscoasa (config)# show xlate ciscoasa (config)# show running-config global
ASA Lab Manual
16
NAT CONTROL
AND NAT 0
Configuration Enable Nat control. ciscoasa (config)# nat-control Apply NAT 0 Policy for ATIF. ciscoasa (config)# nat (inside) 0 10.0.0.2 255.255.255.255 Verify Configuration by using following commands. ciscoasa (config)# show xlate ciscoasa (config)# show running-config global
IP Address 10.0.0.1
IP Address 20.0.0.2
ATIF using NAT0 policy
10.0.0.2→10.0.0.2
IP Address 20.0.0.1
IP Address 10.0.0.2
ALI requires a NAT rule
IP Address 10.0.0.10 IP Address
20.0.0.10
E1 EO
ASA Lab Manual
17
Lab # 3
FILTERING ACTIVEX OBJECTS AND
JAVA APPLETS
Configuration Apply Filters. ciscoasa (config)# filter java 80 0 0 0 0 ciscoasa (config)# filter activex 80 0 0 0 0 Verify results by browsing outside machine from any inside machine.
(Host will successfully access the HTML page )
ASA Lab Manual
18
Lab # 4 TRANSPARENT FIREWALL
Configuration Assigning Speed & no Shut Inside & Outside Interfaces. ciscoasa (config)# firewall transparent ciscoasa (config)# interface ethernet 0/0 ciscoasa (config-if)# no shutdown ciscoasa (config-if)# speed auto ciscoasa (config-if)# nameif outside ciscoasa (config)# interface ethernet 0/1 ciscoasa (config-if)# no shutdown ciscoasa (config-if)# speed auto ciscoasa (config-if)# nameif inside
IP Address 10.0.0.1
IP Address 10.0.0.2
IP Address 10.0.0.3
ASA Lab Manual
19
ciscoasa (config)# access-list 1 permit ip any any ciscoasa (config)# access-group 1 in interface outside ciscoasa (config)# ip address 10.0.0.10 255.255.255.0 Verify results by IOS commands. ciscoasa (config)# show firewall ciscoasa (config)# show mac-address-table
ASA Lab Manual
20
Lab # 5
SYSLOG SERVER
Configuration: ciscoasa(config)# logging on ciscoasa(config)# logging host inside 10.0.0.2 ciscoasa(config)# logging trap 7 Verification Commands: ciscoasa(config)# show logging
IP Address 10.0.0.1
IP Address 20.0.0.2
IP Address 20.0.0.1
SYSLOG IP Address
10.0.0.2
IP Address 10.0.0.10 IP Address
20.0.0.10
E1 EO
ASA Lab Manual
21
Lab # 6 Cut through proxy through LOCAL database
& AAA server
Configuration Cut through Proxy through Local database ciscoasa(config)# username admin password admin ciscoasa(config)# aaa authentication include any inside 0 0 0 0 LOCAL Cut through Proxy with AAA server ciscoasa(config)# aaa-server esp protocol tacacs+ ciscoasa(config-aaa-server-group)# aaa-server esp host 10.0.0.1 cisco123 ciscoasa(config)# aaa authentication include any inside 0 0 0 0 esp
IP Address 10.0.0.2
IP Address 20.0.0.2
IP Address 20.0.0.1
IP Address 10.0.0.3
IP Address 10.0.0.10 IP Address
20.0.0.10
E1 EO
AAA SERVER IP Address
10.0.0.1
ASA Lab Manual
22
Configuration on ACS server
ASA Lab Manual
23
User accounts on AAA
Verification Commands: ciscoasa(config)# show uauth ciscoasa(config)# clear uauth
ASA Lab Manual
24
Lab # 7 Downloadable Acl
Cisco Secure ACS allows to create downloadable ACLs. By this various ACLs can be formed for different users. Downloadable ACL will be activated only when the particular user sign in. Step 1:Configure AAA server using Radius Protocol. ciscoasa(config)# aaa-server esp protocol radius ciscoasa(config-aaa-server-group)# aaa-server esp host 10.0.0.4 cisco ciscoasa(config-aaa-server-host)# aaa authentication include any inside 0 0 0 0 esp
IP Address 10.0.0.2
IP Address 20.0.0.2
ATIF
IP Address 20.0.0.1
IP Address 10.0.0.3
ALI
IP Address 10.0.0.10 IP Address
20.0.0.10
E1 EO
AAA SERVER IP Address
10.0.0.1
ASA Lab Manual
25
Configuration on ACS server
Step 2:Form Downloadable ACL through Shared profile Components (if Downloadable option is not available then click on Interface Configuration. )
ASA Lab Manual
26
ASA Lab Manual
27
Now option is added in Shared Profile Components
ASA Lab Manual
28
Step 3: Add User “Ali” and apply Downloadable ACL on users profile.
Step 3: Verify results.
( Atif can successfully browse & ftp outside network) BUT
( Ali can only successfully ftp outside network) Verification Commands: ciscoasa(config)# show uauth ciscoasa(config)# clear uauth ciscoasa(config)# show conn
ASA Lab Manual
29
Lab # 8 TCP Intercept Maximum Connection
Configuration: ciscoasa(config)# static (inside,outside) 20.0.0.50 10.0.0.1 1 0 ciscoasa(config)# access-list 1 permit ip any any ciscoasa(config)# access-group 1 in interface outside Verification Commands: ciscoasa(config)# show running-config static ciscoasa(config)# show local-host ciscoasa(config)# show xlate ciscoasa(config)# show conn
IP Address 10.0.0.1
IP Address 20.0.0.2
IP Address 20.0.0.1
FTP & WEB SERVER
IP Address 10.0.0.2
IP Address 10.0.0.10 IP Address
20.0.0.10
E1 EO
ASA Lab Manual
30
Lab # 9
Object Grouping
Configuration: Create network object ciscoasa(config)# object-group network esp ciscoasa(config-network)# network-object host 20.0.0.1 ciscoasa(config-network)# network-object host 20.0.0.2 ciscoasa(config-network)# network-object host 20.0.0.3 ciscoasa(config-network)# exi Create service object ciscoasa(config)# object-group service httpftp tcp ciscoasa(config-service)# port-object eq 80 ciscoasa(config-service)# port-object eq 21 ciscoasa(config-service)# exi
IP Address 10.0.0.1
IP Address 20.0.0.2
IP Address 20.0.0.1
FTP & WEB SERVER
IP Address 10.0.0.2
IP Address 10.0.0.10 IP Address
20.0.0.10
E1 EO
ASA Lab Manual
31
Calling object in ACL ciscoasa(config)# access-list 101 extended permit tcp object-group esp host 10.0.0.1 object-group httpftp ciscoasa(config)# access-group 101 in interface outside
Time-based Acl Configuration: ciscoasa(config)#time-range test ciscoasa(config-time-range)#periodic daily 15:00 to 15:30 ciscoasa(config-time-range)#exit
ciscoasa(config)# access-list 101 permit ip any any time-range test ciscoasa(config)#access-group 101 in interface outside Verifying commands ciscoasa(config)# show access-list ciscoasa(config)# show run object-group
ASA Lab Manual
32
Lab # 10 Routing
Configuration : ciscoasa(config)# interface ethernet 0/0 ciscoasa(config-if)# ip address 15.0.0.1 ciscoasa(config-if)# no shutdown ciscoasa(config-if)# nameif outside ciscoasa(config-if)# security-level 0 ciscoasa(config)# interface ethernet 0/1 ciscoasa(config-if)# ip address 10.0.0.10 ciscoasa(config-if)# no shutdown ciscoasa(config-if)# speed auto
R2
IP Address 15.0.0.2 Fa0/0 IP Address 15.0.0.1
E0
IP Address 10.0.0.10
Ethernet 1
Host A IP Address
10.0.0.1
FTP Server Host B
IP Address 10.0.0.2
WEB Server
IP Address 20.0.0.1
IP Address 20.0.0.10
Fa0/1
IP Address 20.0.0.2
ASA Lab Manual
33
ciscoasa(config-if)# nameif inside ciscoasa(config-if)# security-level 100
• Static Routing • Dynamic Routing • RIP • OSPF • EIGRP
Static Routes Commands on Asa ciscoasa(config)#route outside 20.0.0.0 255.0.0.0 15.0.0.2
Rip Commands on Asa ciscoasa(config)#router rip ciscoasa(config-router)#network 15.0.0.0 ciscoasa(config-router)#network 10.0.0.0 Ospf Commands on Asa ciscoasa(config)#router ospf 64 ciscoasa(config-router)#network 15.0.0.0 255.0.0.0 area 0 ciscoasa(config-router)#network 10.0.0.0 255.0.0.0 area 0 Eigrp Commands on Asa ciscoasa(config)#router eigrp 10 ciscoasa(config-router)#network 15.0.0.0 ciscoasa(config-router)#network 10.0.0.0 ciscoasa(config-router)#exit Verifying Commands ciscoasa(config)#sh route ciscoasa(config)#sh rip database ciscoasa(config)#sh ospf interface ciscoasa(config)#sh ospf neighbor ciscoasa(config)# sh eigrp interfaces ciscoasa(config)# sh eigrp neighbors
ASA Lab Manual
34
Lab # 11 DYNAMIC HOST CONFIGURATION PROTOCOL ASA Firewall has features that let it be Configured as a
• DHCP SERVER • DHCP CLIENT •
DHCP SERVER
Configuration Create POOL for Inside Hosts. ciscoasa(config)# dhcpd address 10.0.0.51-10.0.0.61 inside Enable DHCP on the ASA Firewall. ciscoasa(config)#dhcpd enable inside
ASA Lab Manual
35
Verify Configuration by using following commands. ciscoasa(config)# show dhcpd binding ciscoasa(config)# show dhcpd state ciscoasa(config)# clear dhcpd bindings ciscoasa(config)# debug dhcpd events ciscoasa(config)# debug dhcpd packet
DHCP CLIENT
Configuration Step 1: Enable DHCP Client. ciscoasa(config)#int e0/0 ciscoasa(config)# ip address dhcp
ASA Lab Manual
36
Step 2: Define new scope for IP addresses range.
Step 3: Verify Configuration by using following commands. ciscoasa(config)#debug dhcpd events ciscoasa(config)#debug dhcpd packet
ASA Lab Manual
37
Lab # 12
Demilitarized Zone
Configuration Step 1:Assign IPs and Define Security Levels. ciscoasa(config)# interface ethernet 0/0 ciscoasa(config-if)# ip address 20.0.0.10 ciscoasa(config-if)# no shutdown ciscoasa(config-if)# speed auto ciscoasa(config-if)# nameif outside ciscoasa(config)# interface ethernet 0/1 ciscoasa(config-if)# ip address 10.0.0.10 ciscoasa(config-if)# no shutdown ciscoasa(config-if)# speed auto ciscoasa(config-if)# nameif inside
ASA Lab Manual
38
ciscoasa(config)# interface ethernet 0/2 ciscoasa(config-if)# ip address 30.0.0.10 ciscoasa(config-if)# no shutdown ciscoasa(config-if)# speed auto ciscoasa(config-if)# nameif dmz Apply PAT for inside Users & Static Nat for server on DMZ Interface. ciscoasa(config)# nat (inside) 1 0 0 ciscoasa(config)# global (outside) 1 interface ciscoasa(config)# static (dmz,outside) 40.0.0.51 30.0.0.1 ciscoasa(config)# static (dmz,outside) 40.0.0.52 30.0.0.2 Establish ACL to allow traffic from lower security level to servers. ciscoasa(config)# access-list 101 permit tcp any host 40.0.0.51 eq www ciscoasa(config)# access-list 101 permit tcp any host 40.0.0.52 eq ftp ciscoasa(config)# access-group 1 in interface outside Verifying Commands ciscoasa(config)#sh run access-list ciscoasa(config)#sh run interface
ASA Lab Manual
39
Lab # 13 INTER-VLAN ROUTING WITH ASA
Configuration ciscoasa(config)#Interface Ethernet0/2 ciscoasa(config-if)#no shut ciscoasa(config-if)#no ip add ciscoasa(config-if)#exit
Vlan 30 Vlan 40
FTP Server 40.0.0.1/8 40.0.0.10
WEB Server 30.0.0.1/8 30.0.0.10
2950 Fa 0/4 Fa 0/3
E 0 / 2.30 30.0.0.10 / 8
E 0 / 2.40 40.0.0.10 / 8
Fa 0/24
Security-level 30 Security-level 40
IP Address 10.0.0.10
Ethernet 0/1 IP Address 20.0.0.10
Ethernet 0/0
IP Address 20.0.0.1 IP Address 10.0.0.1
ASA Lab Manual
40
ciscoasa(config)#Interface Ethernet0/2.30 ciscoasa(config-if)#vlan 30 ciscoasa(config-if)#no shutdown ciscoasa(config-if)#nameif www ciscoasa(config-if)#security-level 30 ciscoasa(config-if)#ip address 30.0.0.10 255.0.0.0 ciscoasa(config)#Interface Ethernet0/2.40 ciscoasa(config-if)#vlan 40 ciscoasa(config-if)#no shutdown ciscoasa(config-if)#nameif ftp ciscoasa(config-if)#security-level 40 ciscoasa(config-if)#ip address 40.0.0.10 255.0.0.0 After Configuration inside(100) users access ftp(40) and web(30) service now if u want to allow outside users to access ftp and web service make an access-list to allow them ciscoasa(config)# access-list 101 permit tcp any host 30.0.0.1 eq ftp ciscoasa(config)#access-group 101 in interface outside Switch configuration Switch(config)#vlan 30 Switch(config-vlan)#name www Switch(config)#vlan 40 Switch(config-vlan)#name ftp Switch(config)#interface fa0/3 Switch(config-if)#switchport mode access Switch(config-if)#switchport access vlan 30 Switch(config)#interface fa0/4 Switch(config-if)#switchport mode access Switch(config-if)#switchport access vlan 40 Switch(config)#interface fa0/24 Switch(config-if)#switchport mode trunk Verifying Commands ciscoasa(config)#sh run access-list ciscoasa(config)#sh run interface
ASA Lab Manual
41
Lab # 14 MODULAR POLICY FRAMEWORK
Configuration Step 1:Define Class Name. ASA(config)# class-map http ASA(config-cmap)# match port tcp eq 80 Step 2:Define Classes to the Policy Map ASA(config)# policy-map esp ASA(config-pmap)# class-map http ASA(config-pmap-c)# priority-queue inside ASA(config)# service-policy esp interface inside Step 3:Verify Results by IOS commands. ASA# show service-policy
ASA Lab Manual
42
Lab # 15 SITE TO SITE VPN
Configuration Site-to-Site Vpn Configuration on Asa ciscoasa(config)#crypto isakmp enable outside ciscoasa(config-isakmp-policy)#crypto isakmp policy 10 ciscoasa(config)# authen pre-share ciscoasa(config)# hash md5 ciscoasa(config)# encrypt des ciscoasa(config)# group 2 ciscoasa(config)# tunnel-group 15.0.0.2 type ipsec-l2l ciscoasa(config)# tunnel-group 15.0.0.2 ipsec-attributes ciscoasa(config-tunnel-ipsec)# pre-shared-key cisco123
WAN RmtRouter
IP Address 15.0.0.2 Fa0/0 IP Address 15.0.0.1
E0
IP Address 10.0.0.10
Ethernet 1
Host A IP Address
10.0.0.1
FTP Server
Host B IP Address
10.0.0.2
WEB Server IP Address
20.0.0.1
IP Address 20.0.0.10
Fa0/1
IP Address 20.0.0.2
Rmt Users
ASA Lab Manual
43
ciscoasa(config)# access-list 101 permit ip 10.0.0.0 255.0.0.0 20.0.0.0 255.0.0.0 ciscoasa(config)# crypto ipsec transform-set aset esp-des esp-md5-hmac ciscoasa(config)# crypto map outside_map 1 set peer 15.0.0.2 ciscoasa(config)# crypto map outside_map 1 set transform-set aset ciscoasa(config)#crypto map outside_map 1 match address 101 ciscoasa(config)# crypto map outside_map interface outside
ASA Lab Manual
44
IPsec(Site-to-Site) VPN Wizard
ASA Lab Manual
45
ASA Lab Manual
46
ASA Lab Manual
47
ASA Lab Manual
48
CLIENT LESS WEB VPN
Unlike a standard IPSec VPN which requires specific client software, Web VPN is a clientless Remote-Access VPN that uses a web browser to access a Corporate Network.
Configuration SSL VPN Wizard
WAN IP Address 20.0.0.10
E0
IP Address 10.0.0.10
Ethernet 1
Host A IP Address
10.0.0.1
IP Address 20.0.0.1 With no Vpn client
Local web Server IP Address 10.0.0.2
Local FTP Server IP Address 10.0.0.3
IP Address 20.0.0.5 With no Vpn client
ASA Lab Manual
49
ASA Lab Manual
50
ASA Lab Manual
51
ASA Lab Manual
52
ASA Lab Manual
53
ASA Lab Manual
54
Verify results by accessing Corporate Network. Type username and password .
ASA Lab Manual
55
Step 3(A): Verify results by IOS commands. ciscoasa# show running-config webvpn
ASA Lab Manual
56
REMOTE-ACCESS VPN
Access VPN provides secure communication with remote users who are working from home and connect through modem or mobile but they should have client Hardware & client Software running on there computers.
Configuration IPsec(Remote-access) VPN Wizard
WAN IP Address 20.0.0.10
E0
IP Address 10.0.0.10
Ethernet 1
Host A IP Address
10.0.0.1
IP Address 20.0.0.1 With Vpn client
Local web Server IP Address 10.0.0.2
Local FTP Server IP Address 10.0.0.3
IP Address 20.0.0.5 With Vpn client
ASA Lab Manual
57
ASA Lab Manual
58
ASA Lab Manual
59
ASA Lab Manual
60
ASA Lab Manual
61