Commit 5d035637 authored by O'Reilly Media, Inc.'s avatar O'Reilly Media, Inc.
Browse files

Initial commit

parents
Loading
Loading
Loading
Loading

README.md

0 → 100644
+15 −0
Changes for README.md: 15 added lines, 0 removed lines.
Original line number Diff line number Diff line
## Example files for the title:  
  
# Understanding the Cisco ASA Firewall, by Jimmy Larsson
  
[![Understanding the Cisco ASA Firewall, by Jimmy Larsson](http://akamaicovers.oreilly.com/images/9781491969649/cat.gif)](https://www.safaribooksonline.com/library/view/title/9781491969656//)
  
The following applies to example files from material published by O’Reilly Media, Inc. Content from other publishers may include different rules of usage. Please refer to any additional usage rights explained in the actual example files or refer to the publisher’s website.
  
O'Reilly books are here to help you get your job done. In general, you may use the code in O'Reilly books in your programs and documentation. You do not need to contact us for permission unless you're reproducing a significant portion of the code. For example, writing a program that uses several chunks of code from our books does not require permission. Answering a question by citing our books and quoting example code does not require permission. On the other hand, selling or distributing a CD-ROM of examples from O'Reilly books does require permission. Incorporating a significant amount of example code from our books into your product's documentation does require permission.
  
We appreciate, but do not require, attribution. An attribution usually includes the title, author, publisher, and ISBN.
  
If you think your use of code examples falls outside fair use or the permission given here, feel free to contact us at <permissions@oreilly.com>.
  
Please note that the examples are not production code and have not been carefully testing. They are provided "as-is" and come with no warranty of any kind.
+7 −0
Changes for Understanding the Cisco ASA Firewall - Working Files/Chapter 1/No Work Files.rtf: 7 added lines, 0 removed lines.
Original line number Diff line number Diff line
{\rtf1\ansi\ansicpg1252\cocoartf1038\cocoasubrtf350
{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
{\colortbl;\red255\green255\blue255;}
\margl1440\margr1440\vieww9000\viewh8400\viewkind0
\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\ql\qnatural\pardirnatural

\f0\fs24 \cf0 No work files for this lesson...}
 No newline at end of file
+7 −0
Changes for Understanding the Cisco ASA Firewall - Working Files/Chapter 2/No Work Files.rtf: 7 added lines, 0 removed lines.
Original line number Diff line number Diff line
{\rtf1\ansi\ansicpg1252\cocoartf1038\cocoasubrtf350
{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
{\colortbl;\red255\green255\blue255;}
\margl1440\margr1440\vieww9000\viewh8400\viewkind0
\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\ql\qnatural\pardirnatural

\f0\fs24 \cf0 No work files for this lesson...}
 No newline at end of file
+7 −0
Changes for Understanding the Cisco ASA Firewall - Working Files/Chapter 3/No Work Files.rtf: 7 added lines, 0 removed lines.
Original line number Diff line number Diff line
{\rtf1\ansi\ansicpg1252\cocoartf1038\cocoasubrtf350
{\fonttbl\f0\fswiss\fcharset0 Helvetica;}
{\colortbl;\red255\green255\blue255;}
\margl1440\margr1440\vieww9000\viewh8400\viewkind0
\pard\tx720\tx1440\tx2160\tx2880\tx3600\tx4320\tx5040\tx5760\tx6480\tx7200\tx7920\tx8640\ql\qnatural\pardirnatural

\f0\fs24 \cf0 No work files for this lesson...}
 No newline at end of file
+222 −0
Changes for Understanding the Cisco ASA Firewall - Working Files/Chapter 4/Final configuration after chapter 4.txt: 222 added lines, 0 removed lines.
Original line number Diff line number Diff line
ciscoasa# sh run
: Saved

: 
: Serial Number: 9A4SWQTRK7W
: Hardware:   ASAv, 2048 MB RAM, CPU Pentium II 2794 MHz
:
ASA Version 9.4(1)200 
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 10.192.168.200 255.255.255.0 
!
interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 10.0.0.1 255.255.255.0 
!
interface GigabitEthernet0/2
 nameif dmz
 security-level 50
 ip address 172.16.1.1 255.255.255.0 
!
interface GigabitEthernet0/3
 nameif guestnet
 security-level 20
 ip address 192.168.1.1 255.255.255.0 
!
interface GigabitEthernet0/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/7
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/8
 shutdown
 no nameif
 no security-level
 no ip address
!             
interface Management0/0
 management-only
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network insidenet
 subnet 10.0.0.0 255.255.255.0
object network dmz
 subnet 172.16.1.0 255.255.255.0
object network guestnet
 subnet 192.168.1.0 255.255.255.0
object network dmz100
 host 172.16.1.100
object network dmz200
 host 172.16.1.200
object network webserver8010
 host 172.16.1.10
object network webserver8011
 host 172.16.1.10
access-list acl_inside extended permit tcp any any eq www 
access-list acl_inside extended permit tcp any any eq https inactive 
access-list acl_inside extended permit udp any any eq domain 
access-list acl_inside extended permit icmp any any 
access-list acl_outside extended permit tcp any object webserver8010 eq 8010 
access-list acl_outside extended deny ip any any 
pager lines 23
logging enable
logging monitor errors
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu guestnet 1500
no failover
no monitor-interface service-module 
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network insidenet
 nat (inside,outside) dynamic interface
object network vpnclients
 nat (outside,outside) dynamic interface
access-group acl_outside in interface outside
access-group acl_inside in interface inside
route outside 0.0.0.0 0.0.0.0 10.192.168.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL 
aaa authentication enable console LOCAL 
aaa authentication http console LOCAL 
http server enable
http 10.192.168.0 255.255.255.0 outside
no snmp-server location
no snmp-server contact
telnet timeout 5
ssh stricthostkeycheck
ssh 10.192.168.0 255.255.255.0 outside
ssh timeout 60
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd address 10.0.0.200-10.0.0.254 inside
dhcpd dns 8.8.8.8 8.8.4.4 interface inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
 enable outside
 anyconnect image disk0:/anyconnect-linux-64-3.1.06073-k9.pkg 1
 anyconnect image disk0:/anyconnect-macosx-i386-3.1.06073-k9.pkg 2
 anyconnect image disk0:/anyconnect-win-3.1.06073-k9.pkg 3
 anyconnect profiles MyTestProfileFile disk0:/mytestprofilefile.xml
 anyconnect enable
 error-recovery disable
group-policy DfltGrpPolicy attributes
 dns-server value 10.0.0.100
 vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value split-tunnel
 address-pools value vpnpool
 webvpn
  anyconnect profiles value MyTestProfileFile type user
dynamic-access-policy-record DfltAccessPolicy
username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15
t!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect ip-options 
  inspect netbios 
  inspect rtsp 
  inspect sunrpc 
  inspect tftp 
  inspect xdmcp 
  inspect icmp 
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect esmtp 
  inspect sqlnet 
  inspect sip  
  inspect skinny  
policy-map type inspect dns migrated_dns_map_1
 parameters   
  message-length maximum client auto
  message-length maximum 512
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly 25
  subscribe-to-alert-group configuration periodic monthly 25
  subscribe-to-alert-group telemetry periodic daily
 profile License
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination transport-method http
Cryptochecksum:86a6391d4985aefc39a7c8891380d9df
: end
ciscoasa#    
Loading