> Comprehensive Guide: Beginner to Expert — Cisco ASA 5500-X · Firepower FTD · FMC · AnyConnect · Snort IPS 3

Table of Contents

Part 1 — Cisco ASA

  1. Introduction & ASA Models
  2. Getting Started: CLI & ASDM
  3. Interfaces & Security Levels
  4. NAT & PAT on ASA
  5. ACL & Security Policy
  6. Site-to-Site VPN & AnyConnect
  7. Active/Standby High Availability

Part 2 — ASA to FTD Migration

  1. ASA vs. FTD — Key Differences
  2. Migration Process

Part 3 — Cisco Firepower FTD

  1. FMC + FTD Architecture
  2. Access Control Policies (ACP)
  3. IDS/IPS with Snort 3
  4. VPN on FTD
  5. Monitoring & Events

Part 4 — Advanced Configuration & Security

  1. Object Groups & Named Objects
  2. Advanced Logging & syslog
  3. AAA & RADIUS / Active Directory Authentication
  4. Application Inspection — Modular Policy Framework (MPF)
  5. Certificate Management & PKI for AnyConnect
  6. Troubleshooting — Practical Diagnostics
  7. IP Addressing Plan — Multi-Site Enterprise Network
  8. Hardening — Cisco ASA & FTD
  9. SSL/TLS Decryption Policy (FTD)
  10. File Policy & AMP — Malware Blocking (FTD)
  11. Identity Policy & Cisco ISE (FTD)
  12. FTD High Availability (Active/Standby)

PART 1 — CISCO ASA

1. Introduction & ASA Models

The Cisco ASA (Adaptive Security Appliance) has been the most widely deployed physical firewall in enterprises for over 15 years. It combines stateful firewall, VPN concentrator, and application protection in a single device.

ASA 5500-X Series

Model FW Throughput Sessions Contexts Target
ASA 5506-X 750 Mbps 50,000 2 Small Businesses / Branches
ASA 5508-X 1 Gbps 100,000 2 SMB
ASA 5516-X 1.8 Gbps 250,000 2 SMB+
ASA 5525-X 2 Gbps 500,000 20 Enterprise
ASA 5545-X 3 Gbps 750,000 50 Enterprise
ASA 5555-X 4 Gbps 1,000,000 100 Large Enterprise

> ℹ️ Info — The 5500-X models support the FirePOWER Services (SFR) module, which enables IPS/IDS features without replacing the equipment. This is often the first step toward FTD.

ARCHITECTURE RÉSEAU — CISCO ASA EN BORDER FIREWALL INTERNET ☁ Internet ISP ROUTER FAI Cisco ASA ● Outside Gi0/0 ● Inside Gi0/1 ● DMZ Gi0/2 ● MGMT Gi0/3 Sec-level: 0 (Outside) Sec-level: 100 (Inside) Sec-level: 50 (DMZ) 🔥 Stateful Firewall · NAT · VPN CORE ROUTER Cisco ISR / ASR DIST. SWITCH Catalyst 3750/9300 DMZ Web / Mail / DNS 10.0.10.0/24 LAN USERS 192.168.1.0/24 VLAN 10 SERVERS 10.0.20.0/24 VLAN 20 VPN AnyConnect Télétravail / Remote 172.16.10.0/24 SITE DISTANT IPsec Site-à-Site 192.168.2.0/24 ── Flux interne ── DMZ - - VPN chiffré Sec-level 0 = non-trusted · Sec-level 100 = fully trusted *Fig. 1.1 — Enterprise network architecture with Cisco ASA as a border firewall*

2. Getting Started: CLI & ASDM

The ASA is configured via two interfaces: the CLI (command line interface, recommended for production) and ASDM (Java graphical interface, useful for beginners).

Initial Console Access

! Serial console connection (9600 baud, 8N1)
! Default login: no password

ciscoasa> enable
Password: (blank by default)
ciscoasa# configure terminal
ciscoasa(config)#

CLI Mode Hierarchy

ciscoasa>              ← User EXEC mode (read-only)
ciscoasa# enable       ← Privileged EXEC mode
ciscoasa# conf t       ← Global Configuration mode
ciscoasa(config-if)#   ← Interface mode
ciscoasa(config-crypto-map)# ← Subconfiguration mode

Essential Basic Configuration

! Hostname and domain
ciscoasa(config)# hostname FW-PARIS-01
ciscoasa(config)# domain-name entreprise.local

! Encrypted enable password
ciscoasa(config)# enable password C1sc0S3cur3! encrypted

! Local user with privileges
ciscoasa(config)# username admin privilege 15 password C1sc0@dmin!

! Disable HTTP, enable HTTPS for ASDM
ciscoasa(config)# http server enable
ciscoasa(config)# http 192.168.1.0 255.255.255.0 inside
ciscoasa(config)# no http server enable  ! disable clear HTTP

! SSH on management interface
ciscoasa(config)# crypto key generate rsa modulus 2048
ciscoasa(config)# ssh 192.168.1.0 255.255.255.0 inside
ciscoasa(config)# ssh version 2
ciscoasa(config)# aaa authentication ssh console LOCAL

! NTP
ciscoasa(config)# ntp server 192.168.1.10 source inside

! Backup
ciscoasa# write memory

> ⚠️ Warning — Never leave the enable password blank in a production environment. Configure SSH v2 only — SSHv1 is vulnerable.

HIÉRARCHIE DES MODES CLI — CISCO ASA User EXEC ciscoasa> (lecture) enable Privileged EXEC ciscoasa# (show, debug) conf t Global Config ciscoasa(config)# interface Sub-Config (config-if)# etc. exit / end exit Sauvegarder write memory copy run start *Fig. 2.1 — Cisco ASA CLI Mode Hierarchy*

3. Interfaces & Security Levels

The fundamental concept of the ASA is the security-level (0 to 100). By default, traffic flows freely from higher levels to lower levels and is blocked in the opposite direction.

Security-Level Rules

Security-level 100 (Inside)  →  Can access 50 and 0  ✓
Security-level 50  (DMZ)     →  Can access 0         ✓
Security-level 0   (Outside) →  Cannot access anything    ✗

Interface Configuration

! Outside Interface (WAN)
FW-PARIS-01(config)# interface GigabitEthernet0/0
FW-PARIS-01(config-if)# nameif outside
FW-PARIS-01(config-if)# security-level 0
FW-PARIS-01(config-if)# ip address 203.0.113.1 255.255.255.252
FW-PARIS-01(config-if)# no shutdown
FW-PARIS-01(config-if)# description "ISP Link"

! Inside Interface (LAN)
FW-PARIS-01(config)# interface GigabitEthernet0/1
FW-PARIS-01(config-if)# nameif inside
FW-PARIS-01(config-if)# security-level 100
FW-PARIS-01(config-if)# ip address 192.168.1.1 255.255.255.0
FW-PARIS-01(config-if)# no shutdown

! DMZ Interface
FW-PARIS-01(config)# interface GigabitEthernet0/2
FW-PARIS-01(config-if)# nameif dmz
FW-PARIS-01(config-if)# security-level 50
FW-PARIS-01(config-if)# ip address 10.0.10.1 255.255.255.0
FW-PARIS-01(config-if)# no shutdown

! Verification
FW-PARIS-01# show interface ip brief
FW-PARIS-01# show nameif

> ℹ️ Info — If two interfaces have the same security-level, traffic between them is blocked by default. Use same-security-traffic permit inter-interface to allow it if necessary.

SECURITY-LEVELS — FLUX AUTORISÉS PAR DÉFAUT INSIDE 192.168.1.0/24 Sec-level 100 Gi0/1 DMZ 10.0.10.0/24 Sec-level 50 Gi0/2 OUTSIDE 203.0.113.0/30 Sec-level 0 Gi0/0 ✓ AUTORISÉ ✗ BLOQUÉ 💡 Les ACL permettent d'autoriser du trafic des niveaux bas vers les niveaux hauts (ex: Outside → DMZ pour un serveur web) *Fig. 3.1 — Security-level logic: traffic allowed and blocked by default*

4. NAT & PAT on ASA

The ASA supports several types of NAT. In enterprise environments, dynamic PAT (overload) is primarily used for Internet access, and static NAT is used for servers in the DMZ.

Dynamic NAT (PAT) — Inside to Internet

! Define the LAN network object
FW-PARIS-01(config)# object network LAN_INSIDE
FW-PARIS-01(config-network-object)# subnet 192.168.1.0 255.255.255.0
FW-PARIS-01(config-network-object)# nat (inside,outside) dynamic interface

! Same for internal servers
FW-PARIS-01(config)# object network SERVERS
FW-PARIS-01(config-network-object)# subnet 10.0.20.0 255.255.255.0
FW-PARIS-01(config-network-object)# nat (inside,outside) dynamic interface

Static NAT — Web Server in DMZ

! Expose a DMZ web server on public IP port 443
FW-PARIS-01(config)# object network WEB_SERVER_DMZ
FW-PARIS-01(config-network-object)# host 10.0.10.10
FW-PARIS-01(config-network-object)# nat (dmz,outside) static 203.0.113.5

! Static NAT port forwarding (port 443 only)
FW-PARIS-01(config)# object network WEB_HTTPS
FW-PARIS-01(config-network-object)# host 10.0.10.10
FW-PARIS-01(config-network-object)# nat (dmz,outside) static 203.0.113.5 service tcp 443 443

! Verification
FW-PARIS-01# show nat
FW-PARIS-01# show xlate

> ℹ️ Info — On ASA 8.3+, the NAT syntax has changed (object-based NAT). The commands above are valid for ASA 8.3 and higher — check your version with show version.

5. ACLs & Security Policy

ACLs on ASA filter incoming traffic on an interface. They complement security levels for granular control.

Creating an ACL

! ACL to allow HTTPS from the Internet to the DMZ server
FW-PARIS-01(config)# access-list OUTSIDE_IN extended permit tcp any host 203.0.113.5 eq 443
FW-PARIS-01(config)# access-list OUTSIDE_IN extended permit tcp any host 203.0.113.5 eq 80

! Allow incoming AnyConnect VPN
FW-PARIS-01(config)# access-list OUTSIDE_IN extended permit udp any host 203.0.113.1 eq 443

! Explicitly block everything else (implicit, but logging is good practice)
FW-PARIS-01(config)# access-list OUTSIDE_IN extended deny ip any any log

! Apply the ACL to the outside interface (inbound)
FW-PARIS-01(config)# access-group OUTSIDE_IN in interface outside

ACL between DMZ and Inside

! Allow the DMZ web server to contact the internal database
FW-PARIS-01(config)# access-list DMZ_TO_INSIDE extended permit tcp host 10.0.10.10 host 10.0.20.5 eq 3306
FW-PARIS-01(config)# access-list DMZ_TO_INSIDE extended deny ip any any log
FW-PARIS-01(config)# access-group DMZ_TO_INSIDE in interface dmz

! Verification
FW-PARIS-01# show access-list
FW-PARIS-01# show access-list OUTSIDE_IN

> 🔐 Security — Always end an ACL with an explicit deny ip any any log. This allows blocked packets to be logged, which is essential for auditing and incident detection.

TRAITEMENT ACL — INTERFACE OUTSIDE (ENTRANT) Paquet Internet → ASA ACL OUTSIDE_IN Match ? PERMIT NAT Lookup Translation table ✓ FORWARD → Interface dest. DENY ✗ DROP + LOG deny ip any any log ⚡ Deny implicite final (non loggé) — toujours ajouter deny explicite Les ACL sont évaluées ligne par ligne — première règle correspondante = décision finale *Fig. 5.1 — ACL processing logic on the Outside interface*

6. Site-to-Site VPN & AnyConnect

The ASA is an excellent VPN hub. It supports site-to-site IPsec to connect sites to each other and AnyConnect SSL VPN for remote work.

Site-to-Site IPsec (IKEv2)

! Phase 1 — IKEv2 Policy
FW-PARIS-01(config)# crypto ikev2 policy 10
FW-PARIS-01(config-ikev2-policy)# encryption aes-256
FW-PARIS-01(config-ikev2-policy)# integrity sha256
FW-PARIS-01(config-ikev2-policy)# group 14
FW-PARIS-01(config-ikev2-policy)# prf sha256
FW-PARIS-01(config-ikev2-policy)# lifetime seconds 86400

! Phase 2 — IPsec Transform Set
FW-PARIS-01(config)# crypto ipsec ikev2 ipsec-proposal PROP-AES256
FW-PARIS-01(config-ipsec-proposal)# protocol esp encryption aes-256
FW-PARIS-01(config-ipsec-proposal)# protocol esp integrity sha-256

! Crypto Map
FW-PARIS-01(config)# crypto map VPN_MAP 10 match address ACL_VPN_LYON
FW-PARIS-01(config)# crypto map VPN_MAP 10 set peer 198.51.100.1
FW-PARIS-01(config)# crypto map VPN_MAP 10 set ikev2 ipsec-proposal PROP-AES256
FW-PARIS-01(config)# crypto map VPN_MAP interface outside

! ACL for relevant traffic (Paris ↔ Lyon)
FW-PARIS-01(config)# access-list ACL_VPN_LYON extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

! Enable IKEv2 on outside
FW-PARIS-01(config)# crypto ikev2 enable outside

! Verification
FW-PARIS-01# show crypto ikev2 sa
FW-PARIS-01# show crypto ipsec sa

AnyConnect SSL VPN (Remote Work)

! Address pool for VPN clients
FW-PARIS-01(config)# ip local pool VPN_POOL 172.16.10.1-172.16.10.254 mask 255.255.255.0

! Enable AnyConnect
FW-PARIS-01(config)# webvpn
FW-PARIS-01(config-webvpn)# enable outside
FW-PARIS-01(config-webvpn)# anyconnect image disk0:/anyconnect-win-4.x.pkg 1
FW-PARIS-01(config-webvpn)# anyconnect enable

! Group policy
FW-PARIS-01(config)# group-policy GP_ANYCONNECT internal
FW-PARIS-01(config-group-policy)# vpn-tunnel-protocol ssl-client
FW-PARIS-01(config-group-policy)# split-tunnel-policy tunnelspecified
FW-PARIS-01(config-group-policy)# split-tunnel-network-list value ACL_SPLIT

! Tunnel group
FW-PARIS-01(config)# tunnel-group ANYCONNECT_USERS type remote-access
FW-PARIS-01(config-tunnel-general)# address-pool VPN_POOL
FW-PARIS-01(config-tunnel-general)# default-group-policy GP_ANYCONNECT

! Verification
FW-PARIS-01# show vpn-sessiondb anyconnect

> ℹ️ Info — Split tunneling allows VPN clients to send only traffic destined for the internal network through the tunnel; the rest goes directly to the Internet. This reduces the load on the firewall but decreases security control.

VPN ASA — SITE-À-SITE + ANYCONNECT PARIS — HQ ASA FW-PARIS-01 WAN: 203.0.113.1 LAN: 192.168.1.0/24 ☁ Internet Réseau non-trusted LYON — Agence ASA FW-LYON-01 WAN: 198.51.100.1 LAN: 192.168.2.0/24 🔐 IPsec IKEv2 — AES-256 — PFS G14 Télétravailleur AnyConnect Client 172.16.10.x/24 SSL/TLS 443 Télétravailleur AnyConnect Client 172.16.10.x/24 SSL/TLS 443 💡 IPsec = tunnel permanent entre sites · AnyConnect = accès distant à la demande via SSL port 443 *Fig. 6.1 — ASA VPN Architecture: Site-to-Site IPsec + AnyConnect Telework*

7. Active/Standby High Availability

In production, the ASA is always deployed in an Active/Standby pair. If the active node fails, the standby takes over in less than 30 seconds with the same active sessions.

HA Prerequisites

  • 2 identical ASAs (same model, same IOS version)
  • A dedicated Failover cable (Gi0/3 recommended)
  • Distinct IPs per node + shared virtual IP (like CARP on pfSense)

Active Configuration (primary node)

! Enable failover
FW-PARIS-01(config)# failover
FW-PARIS-01(config)# failover lan unit primary
FW-PARIS-01(config)# failover lan interface FAILOVER GigabitEthernet0/3
FW-PARIS-01(config)# failover lan enable
FW-PARIS-01(config)# failover key cisco123secure

! Failover IPs
FW-PARIS-01(config)# failover interface ip FAILOVER 10.255.255.1 255.255.255.252 standby 10.255.255.2

! Standby IPs for each interface
FW-PARIS-01(config)# interface GigabitEthernet0/0
FW-PARIS-01(config-if)# ip address 203.0.113.1 255.255.255.252 standby 203.0.113.2
FW-PARIS-01(config)# interface GigabitEthernet0/1
FW-PARIS-01(config-if)# ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2

Standby Configuration (secondary node)

! On the secondary node — minimal configuration
FW-PARIS-02(config)# failover lan unit secondary
FW-PARIS-02(config)# failover lan interface FAILOVER GigabitEthernet0/3
FW-PARIS-02(config)# failover lan enable
FW-PARIS-02(config)# failover key cisco123secure
! The rest of the configuration is automatically synchronized from the primary

! HA Verification
FW-PARIS-01# show failover
FW-PARIS-01# show failover state
! Force a failover (test)
FW-PARIS-01# no failover active

> ✅ Good to know — In Active/Active mode, both ASAs process traffic simultaneously (requires multiple contexts). In Active/Standby mode, only one processes traffic — simpler to operate and recommended for most companies.

HAUTE DISPONIBILITÉ ASA — ACTIVE/STANDBY ☁ Internet / ISP IP virtuelle: 203.0.113.1 VIP Outside — 203.0.113.1 (partagée) FW-PARIS-01 ● ACTIVE Outside: 203.0.113.3 Inside: 192.168.1.3 Primary Unit Traite tout le trafic FW-PARIS-02 ○ STANDBY Outside: 203.0.113.4 Inside: 192.168.1.4 Secondary Unit En attente — prêt en <30s Failover Link Config + State sync VIP Inside — 192.168.1.1 (partagée) — Failover < 30 sec *Fig. 7.1 — ASA Active/Standby HA Architecture with State Synchronization*

PART 2 — ASA → FTD MIGRATION

8. ASA vs. FTD — Fundamental Differences

Migrating from ASA to FTD (Firepower Threat Defense) is a significant paradigm shift. FTD unifies ASA and FirePOWER Services into a single OS managed via FMC (Firepower Management Center).

Criterion Cisco ASA Cisco FTD
Management CLI / ASDM FMC (centralized) or FDM (local)
Firewall Policy ACL per interface ACP (Access Control Policy)
Inspection Basic stateful NGFW — DPI, App-ID, URL filtering
IPS Optional SFR module Native integrated Snort 3
VPN Full CLI Supported but less flexible
NAT Very flexible (CLI) Supported via FMC
Logging Syslog / ASDM FMC + Syslog + eStreamer
Multiple contexts Yes (multi-context) No (single context)
Learning curve Average Steeper (FMC)

> ⚠️ Critical Note — FTD does not support all ASA features. Multiple contexts, certain advanced NAT options, and some VPN features are not available on FTD. Audit the ASA configuration before migrating.

COMPARAISON ARCHITECTURE — ASA vs FTD Cisco ASA ASDM / CLI ASA OS — Stateful FW · NAT · VPN · ACL SFR Module (opt.) Hardware ASA 5500-X Gestion locale · Multi-contexte · VPN complet Migration Cisco Tool Cisco FTD FMC — Firepower Management Center FTD OS — NGFW · ACP · App-ID · URL Filter Snort 3 IPS (natif) Hardware FPR / ASA Gestion centralisée · NGFW · DPI · Visibilité applicative *Fig. 8.1 — ASA vs. FTD Architecture Comparison*

9. Migration Process

Cisco provides a free official tool: Cisco Firepower Migration Tool (FMT) that automates the conversion of ASA configurations to FTD.

Migration Steps

  1. Audit — Identify the ASA features in use (contexts, VPN, advanced NAT)
  2. Export — Export the ASA configuration: more system:running-config &gt; tftp://...
  3. Analysis — Use the FMT to analyze incompatibilities
  4. Conversion — The FMT generates the equivalent FTD objects, ACLs, and policies
  5. Import — Import into FMC and validate manually
  6. Test — Validate in a pre-production environment
  7. Switchover — Migrate to production with a rollback plan
! ASA features NOT supported on FTD (must be handled manually)
- Multi-context mode
- Botnet Traffic Filter
- Unified Communications (Phone Proxy)
- Certain NAT hairpinning configurations
- TLS proxy
- IOS-based VPN (EasyVPN, DMVPN)

> ⚠️ Warning — Always have a rollback plan in place with the ASA configuration backed up. A failed FTD migration in production can cut off Internet access for the entire company.

PART 3 — CISCO FIREPOWER FTD

10. FMC + FTD Architecture

The FMC (Firepower Management Center) is the centralized brain that manages one or more FTD devices. It provides security policies, signature updates, and network visibility.

FMC Deployment

! FMC is a physical or virtual appliance (VMware/KVM)
! Physical models: FMC 1000, FMC 2500, FMC 4500
! Virtual FMC: FMCv (up to 25 managed FTDs)

! Initial FMC Access
URL: https://<ip_fmc>
Login: admin
Password: Admin123 (change immediately)

! Register an FTD in FMC
On the FTD (CLI):
&gt; configure manager add <ip_fmc> <clé_registration> <ip_ftd>

On FMC: Devices &gt; Device Management &gt; Add Device
- Host: <ip_ftd>
- Registration Key:<même clé="">
- Group: Production
ARCHITECTURE FMC + FTD — GESTION CENTRALISÉE FMC — Management Center Politiques · Signatures · Logs Mises à jour Snort · URL DB HTTPS 8305 (management) Virtuel ou Physique Admin HTTPS Browser → FMC UI Cisco Talos Intelligence Cloud Signatures / URLs FTD — PARIS FPR-2110 Border Firewall HQ 1,9 Gbps FW FTD — LYON FPR-1120 Border Firewall Agence 1,5 Gbps FW FTD — MARSEILLE FTDv (virtuel) Border Firewall Agence VMware ESXi 💡 Un seul FMC peut gérer jusqu'à 300 FTD physiques ou 25 FTDv selon le modèle *Fig. 10.1 — Centralized FMC architecture managing multiple multi-site FTDs*

11. Access Control Policies (ACP)

The Access Control Policy replaces the ASA’s ACLs. It is much more powerful: it can filter by application, user, URL, and geolocation in addition to traditional IPs and ports.

Structure of an ACP

FMC &gt; Policies &gt; Access Control &gt; New Policy

Name: ACP_ENTERPRISE
Default Action: Block All Traffic (recommended)

! Rules (order = priority)
Rule 1: Allow_HTTPS_Outbound
  - Source: LAN_NETWORKS
  - Destination: Any
  - Application: SSL, HTTP
  - Action: Allow + Log

Rule 2: Allow_DNS
  - Source: LAN_NETWORKS
  - Destination: DNS_SERVERS
  - Port: DNS (53)
  - Action: Allow

Rule 3: Allow_VPN_AnyConnect
  - Source: Any
  - Destination: FTD_OUTSIDE_IP
  - Port: HTTPS (443)
  - Action: Allow

Rule 4: DMZ_to_DB
  - Source: WEB_SERVER_DMZ
  - Destination: DB_SERVER
  - Port: MySQL (3306)
  - Action: Allow + IPS Inspection

! Default: Block All (log)

> ℹ️ Info — Unlike ASA ACLs, ACP rules can embed IPS inspection (Snort), URL filtering, and application identification directly within the rule. This is the strength of the NGFW.

12. IDS/IPS with Snort 3

FTD natively integrates Snort 3, the world’s most widely used open-source IPS engine. It performs deep traffic analysis and can block attacks in real time.

Configuring an IPS Policy

FMC &gt; Policies &gt; Intrusion &gt; Create Policy

Name: IPS_ENTERPRISE
Base Policy: Balanced Security and Connectivity
  (Connectivity over Security = fewer false positives)
  (Security over Connectivity = stricter)

! Enable in an ACP rule
Rule &gt; Inspection Tab:
  Intrusion Policy: IPS_ENTREPRISE
  Variable Set: Default-Set (adjust the $HOME_NET values)

Critical variables to configure

FMC &gt; Objects &gt; Object Management &gt; Variable Sets

$HOME_NET     = 192.168.0.0/16, 10.0.0.0/8, 172.16.0.0/12
$EXTERNAL_NET = !$HOME_NET
$HTTP_SERVERS = 10.0.10.0/24  (DMZ servers)
$SQL_SERVERS  = 10.0.20.5/32  (DB server)
$DNS_SERVERS  = 192.168.1.10/32

> ⚠️ Warning — As with Suricata on pfSense, start in Detect Only (IDS) mode before switching to Inline (blocking IPS). Analyze false positives for at least 2 weeks before enabling blocking

PIPELINE SNORT 3 — IDS/IPS INTÉGRÉ FTD Trafic Entrant / Sortant ACP Rule Match App-ID URL Category User Identity Geolocation Snort 3 Engine Talos Rules Community Rules Custom Rules Deep Packet Inspect Clean Threat ✓ FORWARD + Log event IDS: Alert IPS: DROP + FMC Event FMC Events Connection Events Intrusion Events File / Malware Events → Syslog / eStreamer 💡 Snort 3 analyse chaque flux : 1 règle peut déclencher sur l'ensemble de la session, pas seulement le premier paquet .*Fig. 12.1 — Snort 3 inspection pipeline integrated into FTD*

13. VPN on FTD

FTD supports Site-to-Site IKEv2 and AnyConnect Remote Access VPNs configurable via FMC.

Site-to-Site VPN via FMC

FMC &gt; Devices &gt; VPN &gt; Site To Site &gt; + Topology

Name: VPN_PARIS_LYON
Type: Point to Point
IKE Version: IKEv2

Endpoint A: FTD-PARIS
  - Interface: Outside
  - IP: 203.0.113.1
  - Network: 192.168.1.0/24

Endpoint B: FTD-LYON (or third-party device)
  - IP: 198.51.100.1
  - Network: 192.168.2.0/24

! IKEv2 Settings
Encryption: AES-256
Integrity: SHA-256
PRF: SHA-256
DH Group: 14

! IPsec Settings
Encryption: AES-256-GCM
PFS: Group 14

AnyConnect Remote Access VPN

FMC &gt; Devices &gt; VPN &gt; Remote Access &gt; + New

! Connection Profile
Name: ANYCONNECT_ENTERPRISE
Protocol: SSL + IKEv2

! AAA — Authentication
Authentication: RADIUS / AD via ISE
  (or PKI certificate for MFA)

! Address Pool
IPv4 Pool: 172.16.10.0/24

! Split Tunneling
Traffic destined to: 192.168.0.0/16, 10.0.0.0/8
  → Tunnel
Rest → Direct Internet

! Deploy to FTD-PARIS
Deploy &gt; FTD-PARIS-01

> ℹ️ Info — For maximum security, combine AnyConnect with Cisco ISE (Identity Services Engine) for MFA authentication and posture control (verify that the PC is up to date before authorizing the VPN connection).

14. Monitoring & Events

FMC centralizes all security events. For comprehensive enterprise monitoring, integrate FMC with an external SIEM.

Essential FMC Dashboards

FMC &gt; Overview &gt; Dashboards
  - Summary Dashboard     : overall view of traffic + events
  - Network Dashboard     : top talkers, protocols, geo
  - Threat Dashboard      : intrusions, malware, IOC

FMC &gt; Analysis &gt; Connections &gt; Events
  → Filter: Action = Block, last 24 hours
  → Export CSV for SIEM analysis

FMC &gt; Analysis &gt; Intrusions &gt; Events
  → Sort by Impact Flag (1 = critical)
  → Correlate with internal addresses

Export Syslog to SIEM

FMC &gt; System &gt; Logging &gt; Syslog Servers
  - IP: 10.0.10.50 (SIEM / Graylog)
  - Port: 514 UDP
  - Facility: LOCAL4

! Enable logging on ACP rules
Rule &gt; Logging:
  Log at Beginning: Yes
  Log at End: Yes
  Send Connection Events to: Syslog
STACK DE SUPERVISION — CISCO FTD + FMC FMC Connection Events Intrusion Events File / Malware Events Dashboard · Reports · Correlation SIEM Splunk / Graylog Syslog + eStreamer Cisco SecureX XDR Platform Threat Intelligence Cisco Talos Threat Intel Feed Signatures auto-update Alertes Email / Syslog Impact Flag 1 + 2 FTD — Paris → FMC FTD — Lyon → FMC FTD — Marseille → FMC *Fig. 14.1 — FMC monitoring ecosystem: SIEM, Talos, alerts, and multi-site correlation*

15. Object groups & named objects

Why is this essential?

Imagine being asked to find and modify the rule that grants access to the payroll server in an ACL containing 200 lines filled with raw IP addresses like 10.0.20.47. Impossible to read, impossible to audit, and the slightest typo can open a security hole.

Object groups are the solution: we give a human-readable name to each IP, network, or port, then write the ACLs using those names. The result: a rule that says permit tcp any DMZ_SERVERS WEB_PORTS is immediately understandable, even six months later.

Step 1 — Create the individual objects (hosts & subnets)

We start by declaring every server and network that matters in our infrastructure. This is a one-time task, to be done before writing any ACLs.

! ── DMZ SERVERS ──────────────────────────────────────────
FW-PARIS-01(config)# object network WEB_SERVER
FW-PARIS-01(config-network-object)# host 10.0.10.10
FW-PARIS-01(config-network-object)# description &quot;Apache web server - Paris DMZ&quot;

FW-PARIS-01(config)# object network MAIL_SERVER
FW-PARIS-01(config-network-object)# host 10.0.10.11
FW-PARIS-01(config-network-object)# description &quot;Postfix mail server - Paris DMZ&quot;

FW-PARIS-01(config)# object network DNS_SERVER_DMZ
FW-PARIS-01(config-network-object)# host 10.0.10.12
FW-PARIS-01(config-network-object)# description &quot;Public DNS - Paris DMZ&quot;

! ── INTERNAL SERVERS ────────────────────────────────────
FW-PARIS-01(config)# object network DB_SERVER
FW-PARIS-01(config-network-object)# host 10.0.20.5
FW-PARIS-01(config-network-object)# description &quot;MySQL Server - Internal LAN&quot;

FW-PARIS-01(config)# object network AD_SERVER
FW-PARIS-01(config-network-object)# host 192.168.1.10
FW-PARIS-01(config-network-object)# description &quot;AD Domain Controller&quot;

FW-PARIS-01(config)# object network RADIUS_PRIMARY
FW-PARIS-01(config-network-object)# host 192.168.1.50
FW-PARIS-01(config-network-object)# description &quot;Primary NPS/RADIUS Server&quot;

! ── NETWORKS (SUBNETS) ────────────────────────────────────
FW-PARIS-01(config)# object network LAN_PARIS
FW-PARIS-01(config-network-object)# subnet 192.168.1.0 255.255.255.0
FW-PARIS-01(config-network-object)# description &quot;Paris User LAN&quot;

FW-PARIS-01(config)# object network LAN_LYON
FW-PARIS-01(config-network-object)# subnet 192.168.2.0 255.255.255.0
FW-PARIS-01(config-network-object)# description &quot;Lyon User LAN&quot;

FW-PARIS-01(config)# object network DMZ_SUBNET
FW-PARIS-01(config-network-object)# subnet 10.0.10.0 255.255.255.0
FW-PARIS-01(config-network-object)# description &quot;Paris DMZ&quot;

Step 2 — Create service objects (ports)

! Web ports
FW-PARIS-01(config)# object service HTTP
FW-PARIS-01(config-service-object)# service tcp destination eq 80

FW-PARIS-01(config)# object service HTTPS
FW-PARIS-01(config-service-object)# service tcp destination eq 443

FW-PARIS-01(config)# object service SMTP
FW-PARIS-01(config-service-object)# service tcp destination eq 25

FW-PARIS-01(config)# object service SMTPS
FW-PARIS-01(config-service-object)# service tcp destination eq 465

FW-PARIS-01(config)# object service MYSQL_PORT
FW-PARIS-01(config-service-object)# service tcp destination eq 3306

FW-PARIS-01(config)# object service RDP
FW-PARIS-01(config-service-object)# service tcp destination eq 3389

Step 3 — Group into object-groups

An object-group brings together several objects of the same type under a single name. This is where the magic happens.

! ── GROUP: all servers exposed in the DMZ ────────────
FW-PARIS-01(config)# object-group network DMZ_SERVERS
FW-PARIS-01(config-network-object-group)# description &quot;Servers accessible from the Internet&quot;
FW-PARIS-01(config-network-object-group)# network-object host 10.0.10.10
FW-PARIS-01(config-network-object-group)# network-object host 10.0.10.11
FW-PARIS-01(config-network-object-group)# network-object host 10.0.10.12
! → If a new server arrives in the DMZ, add it here.
! → ALL ACLs that use this group are automatically applied
!   to the new server. No oversights.

! ── GROUP: all company sites ──────────────
FW-PARIS-01(config)# object-group network ALL_SITES
FW-PARIS-01(config-network-object-group)# description &quot;All internal LANs (Paris + Lyon + Marseille)&quot;
FW-PARIS-01(config-network-object-group)# network-object 192.168.1.0 255.255.255.0
FW-PARIS-01(config-network-object-group)# network-object 192.168.2.0 255.255.255.0
FW-PARIS-01(config-network-object-group)# network-object 192.168.3.0 255.255.255.0

! ── GROUP: Web ports (HTTP + HTTPS) ────────────────────
FW-PARIS-01(config)# object-group service WEB_PORTS tcp
FW-PARIS-01(config-service-object-group)# description &quot;Standard web ports&quot;
FW-PARIS-01(config-service-object-group)# port-object eq 80
FW-PARIS-01(config-service-object-group)# port-object eq 443
FW-PARIS-01(config-service-object-group)# port-object eq 8080

! ── GROUP: mail ports ───────────────────────────────────
FW-PARIS-01(config)# object-group service MAIL_PORTS tcp
FW-PARIS-01(config-service-object-group)# description &quot;Mail Ports&quot;
FW-PARIS-01(config-service-object-group)# port-object eq 25
FW-PARIS-01(config-service-object-group)# port-object eq 465
FW-PARIS-01(config-service-object-group)# port-object eq 587
FW-PARIS-01(config-service-object-group)# port-object eq 993

Step 4 — Write the ACLs using groups

Compare these two versions, which do exactly the same thing:

! ❌ Version without object groups — impossible to maintain
FW-PARIS-01(config)# access-list OUTSIDE_IN extended permit tcp any host 10.0.10.10 eq 80
FW-PARIS-01(config)# access-list OUTSIDE_IN extended permit tcp any host 10.0.10.10 eq 443
FW-PARIS-01(config)# access-list OUTSIDE_IN extended permit tcp any host 10.0.10.11 eq 80
FW-PARIS-01(config)# access-list OUTSIDE_IN extended permit tcp any host 10.0.10.11 eq 443
FW-PARIS-01(config)# access-list OUTSIDE_IN extended permit tcp any host 10.0.10.11 eq 25
FW-PARIS-01(config)# access-list OUTSIDE_IN extended permit tcp any host 10.0.10.11 eq 465
! ... and so on for each server × each port

! ✅ Version with object groups — readable, maintainable, auditable
FW-PARIS-01(config)# access-list OUTSIDE_IN extended permit tcp any object-group DMZ_SERVERS object-group WEB_PORTS
FW-PARIS-01(config)# access-list OUTSIDE_IN extended permit tcp any object WEB_SERVER object-group MAIL_PORTS
FW-PARIS-01(config)# access-list OUTSIDE_IN extended deny ip any any log

! DMZ → Internal DB traffic (the web server accesses the database)
FW-PARIS-01(config)# access-list DMZ_TO_INSIDE extended permit tcp object WEB_SERVER object DB_SERVER eq 3306
FW-PARIS-01(config)# access-list DMZ_TO_INSIDE extended deny ip any any log

! Apply the ACLs
FW-PARIS-01(config)# access-group OUTSIDE_IN in interface outside
FW-PARIS-01(config)# access-group DMZ_TO_INSIDE in interface dmz

Verification

! List all objects
FW-PARIS-01# show object-group

! Details of a specific group
FW-PARIS-01# show object-group id DMZ_SERVERS

! See how an object is used in ACLs
FW-PARIS-01# show object-group id DMZ_SERVERS | include access-list

! Count hits on each ACL rule
FW-PARIS-01# show access-list OUTSIDE_IN

> ℹ️ Naming convention — In a corporate setting, adopt a convention from the start and never change it. For example: SITE_ROLE_TYPE → PARIS_WEB_HOST, CORP_ADMIN_SUBNET, STD_HTTPS_PORT. A clear convention transforms a 500-line configuration into something readable

OBJECT-GROUPS — ORGANISATION DES OBJETS ASA ❌ Sans object-groups permit tcp any host 10.0.10.10 eq 443 permit tcp any host 10.0.10.11 eq 443 permit tcp any host 10.0.10.11 eq 80 Difficile à maintenir · Erreurs fréquentes object-group object-group DMZ_SERVERS ● host 10.0.10.10 (web) ● host 10.0.10.11 (mail) ● host 10.0.10.12 (dns) + ajouter un host = 1 ligne toutes les ACL se mettent à jour object-group WEB_PORTS ● tcp eq 80 ● tcp eq 443 ● tcp eq 8080 ✅ Avec object-groups permit tcp any object-group DMZ_SERVERS object-group WEB_PORTS 1 ligne · Auto-mis à jour · Lisible · Auditable .*Fig. 15.1 — Object groups: simplifying and maintaining ACLs in production*

16. Advanced Logging & syslog

Why configure logging correctly?

A firewall without usable logs is like a surveillance camera without recording: useless after an incident. In practice, logging serves three purposes: detecting attacks in real time, investigating after an incident, and proving compliance (PCI-DSS and ISO 27001 require a minimum retention period of 90 days).

By default on the ASA, logging is disabled or limited to the local buffer, which is cleared upon reboot. It must be explicitly configured.

The 8 severity levels — which one to choose?

Level Name What it shows In production?
0 Emergencies System unusable ✅ always
1 Alerts Immediate action required ✅ always
2 Critical System crash, hardware failure ✅ always
3 Errors Configuration errors, authentication failures ✅ always
4 Warnings Suspicious attempts, near-misses ✅ recommended
5 Notifications VPN connections, status changes ✅ recommended
6 Informational Traffic accepted/denied, NAT ✅ standard production level
7 Debugging Everything, absolutely everything ❌ lab only

> ⚠️ Golden Rule — In production, use level 6 (informational) to the SIEM. Level 7 (debugging) can overload the firewall’s CPU and cause a service outage.

Step 1 — Configure logging on the ASA

! ── BASIC ACTIVATION ───────────────────────────────────
FW-PARIS-01(config)# logging enable

! Precise timestamp — REQUIRED for log correlation
! Without a timestamp, it is impossible to know when an event occurred
FW-PARIS-01(config)# logging timestamp
FW-PARIS-01(config)# logging device-id hostname
! → Each log line will contain: &quot;FW-PARIS-01: Mar 13 2026 14:32:01 ...&quot;

! ── LOCAL BUFFER (backup if SIEM is unavailable) ──────────
! 1 MB buffer — the most recent logs are retained
FW-PARIS-01(config)# logging buffered informational
FW-PARIS-01(config)# logging buffer-size 1048576

! ── SYSLOG TO EXTERNAL SIEM (Graylog/Splunk) ───────────
! 10.0.10.50 = IP address of your Graylog server on the DMZ
FW-PARIS-01(config)# logging host inside 10.0.10.50
FW-PARIS-01(config)# logging trap informational
! facility 16 = local0 (Cisco convention)
FW-PARIS-01(config)# logging facility 16

! Second syslog destination (redundancy)
FW-PARIS-01(config)# logging host inside 10.0.10.51

! ── LOGGING ON ACLs ──────────────────────────────────
! Without the word &quot;log&quot; at the end, deny rules do not generate any logs !
! interval 1 = log at most once per second (prevents flooding)
FW-PARIS-01(config)# access-list OUTSIDE_IN extended deny ip any any log interval 1

! Also log established connections (useful for audits)
FW-PARIS-01(config)# logging flow-export-v9 enable

! ── DO NOT DO THIS IN PRODUCTION ─────────────────────────────────
! logging console debugging  ← guaranteed CPU saturation
! logging monitor 7          ← same via terminal monitor

Step 2 — Read and interpret the logs

! Display the local buffer (latest logs)
FW-PARIS-01# show logging

! Filter only denied connections
FW-PARIS-01# show logging | include Deny
FW-PARIS-01# show logging | include denied

! Filter by suspicious source IP
FW-PARIS-01# show logging | include 1.2.3.4

! Example of a typical log to know how to read:
! %ASA-4-106023: Deny tcp src outside:1.2.3.4/54321
!   dst inside:192.168.1.100/22 by access-group &quot;OUTSIDE_IN&quot;
!
! Decoding:
! ASA-4     → Level 4 (Warning)
! 106023    → Syslog message ID (available on cisco.com)
! Deny tcp  → protocol denied
! src outside:1.2.3.4/54321 → source: IP:port
! dst inside:192.168.1.100/22 → destination: IP:port
! access-group &quot;OUTSIDE_IN&quot; → the ACL that blocked it

! Clear the local buffer (after analysis)
FW-PARIS-01# clear logging buffer

! View logging statistics
FW-PARIS-01# show logging statistics

Step 3 — Configure Graylog to receive ASA logs (optional)

If you don’t yet have a Graylog server, here are the minimum steps to quickly get one up and running on Ubuntu Server:

# On the Ubuntu server (10.0.10.50)
# 1. Install Java (prerequisite)
sudo apt install -y openjdk-17-jre-headless

# 2. Install MongoDB (Graylog database)
wget -qO - https://www.mongodb.org/static/pgp/server-6.0.asc | sudo apt-key add -
echo &quot;deb [ arch=amd64 ] https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/6.0 multiverse&quot; \
  | sudo tee /etc/apt/sources.list.d/mongodb-org-6.0.list
sudo apt update &amp;&amp; sudo apt install -y mongodb-org
sudo systemctl enable --now mongod

# 3. Install OpenSearch (search engine)
# → Follow the official Graylog documentation for the current version

# 4. Install Graylog
wget https://packages.graylog2.org/repo/packages/graylog-5.2-repository_latest.deb
sudo dpkg -i graylog-5.2-repository_latest.deb
sudo apt update &amp;&amp; sudo apt install -y graylog-server

# 5. Configure /etc/graylog/server/server.conf
# password_secret= (generate with: pwgen -N 1 -s 96)
# root_password_sha2= (echo -n &quot;Password&quot; | sha256sum)

# 6. Start Graylog
sudo systemctl enable --now graylog-server
# Web interface available at http://10.0.10.50:9000

# 7. In Graylog: System &gt; Inputs &gt; Launch new input
# Type: Syslog UDP, Port: 514, Bind address: 0.0.0.0
# → ASA logs arrive automatically

> ℹ️ Info — Once Graylog is configured, create automatic alerts: for example, if more than 100 deny messages come from the same IP in less than a minute, it’s likely a port scan. Graylog can send an email or a Slack webhook in real time.

17. AAA & RADIUS / Active Directory Authentication

Why not use local accounts?

By default, administrators log in to the ASA using a local account (username admin password ...). The problem: if 5 admins share this account, it’s impossible to know who did what. If an admin leaves the company, you have to manually change the password on every network device. And if there are 50 switches and firewalls, good luck.

The professional solution: RADIUS + Active Directory. A single location to manage accounts, groups, and permissions. Access is revoked by disabling the AD account, and everything is logged centrally.

Solution Architecture

SSH Admin → ASA → RADIUS (NPS on Windows Server) → Active Directory
                     ↓
              Valid: username in AD?
              Member of the &quot;FW_Admins&quot; group?
              → Access-Accept or Access-Reject

Step 1 — Prepare Active Directory

Before touching the firewall, create the necessary elements in AD.

On the domain controller (Windows Server):

# Open &quot;Active Directory Users and Computers&quot;

# 1. Create an OU dedicated to network accounts
OU: Corp &gt; IT &gt; Network &gt; Firewall_Accounts

# 2. Create the security groups
Group: GRP_FW_ADMINS        → full access to the firewall (privilege 15)
Group: GRP_FW_READONLY      → read-only access (privilege 5)
Group: GRP_VPN_USERS        → authorized to connect via AnyConnect

# 3. Create user accounts
User: fw-admin1   → member of GRP_FW_ADMINS
User: fw-readonly → member of GRP_FW_READONLY
User: john.doe    → member of GRP_VPN_USERS

Step 2 — Install and configure NPS (Windows Server)

NPS (Network Policy Server) is the RADIUS server built into Windows Server. It acts as the link between the ASA and Active Directory.

# On Windows Server (192.168.1.50)
# 1. Install the NPS role
Server Manager &gt; Add Roles and Features
  → Network Policy and Access Services
  → Network Policy Server ✓
  → Click Install

# 2. Open NPS (Network Policy Server) in Administrative Tools

# 3. Register NPS in Active Directory
  Right-click &quot;NPS (Local)&quot; → Register server in Active Directory
  → Confirm: NPS can now read AD attributes

# 4. Register the ASA as a RADIUS client
NPS &gt; RADIUS Clients and Servers &gt; RADIUS Clients &gt; New
  Friendly name:   ASA-FW-PARIS-01
  Address (IP):    192.168.1.1    ← IP of the ASA&#x27;s inside interface
  Shared secret:   Rad1usS3cr3t! ← same secret as in the ASA configuration
  Confirm:       Rad1usS3cr3t!
  → OK

# Repeat for the Lyon ASA (if applicable)
  Friendly name:   ASA-FW-LYON-01
  Address (IP):    192.168.2.1
  Shared secret:   Rad1usS3cr3t!

Step 3 — Create the NPS policies

Two policies: one for full-access admins, one for read-only admins.

# ── POLICY 1: Full-access admins (privilege 15) ────
NPS &gt; Policies &gt; Network Policies &gt; New

  Name: POLICY_FW_ADMINS
  
  Conditions:
    User Groups: GRP_FW_ADMINS  ← members of this AD group only
    NAS Port Type: Virtual (VTY) ← SSH connections
  
  Access Permission: Access granted ✓
  
  Settings &gt; RADIUS Attributes &gt; Standard:
    Service-Type: Login ✓
  
  Settings &gt; RADIUS Attributes &gt; Vendor Specific &gt; Add:
    Vendor: Cisco
    Attribute: cisco-av-pair
    Value: shell:priv-lvl=15   ← privilege 15 = full access
  
  → Finish

# ── POLICY 2: Read-only Admins (privilege 5) ────────
NPS &gt; Policies &gt; Network Policies &gt; New

  Name: POLICY_FW_READONLY
  
  Conditions:
    User Groups: GRP_FW_READONLY
    NAS Port Type: Virtual (VTY)
  
  Access Permission: Access granted ✓
  
  Settings &gt; RADIUS Attributes &gt; Vendor Specific &gt; Add:
    Vendor: Cisco
    Attribute: cisco-av-pair
    Value: shell:priv-lvl=5    ← privilege 5 = read-only

# ── POLICY 3: Deny everything else ─────────────────
NPS &gt; Policies &gt; Network Policies &gt; New

  Name: POLICY_DENY_ALL
  Conditions: (no specific conditions)
  Access Permission: Access denied ✓
  → This rule catches everything not in the groups above

Step 4 — Configure the ASA on the RADIUS side

Now that NPS is ready, we’ll configure the ASA to use it.

! ── DECLARE THE RADIUS SERVER GROUP ────────────────
FW-PARIS-01(config)# aaa-server RADIUS_CORP protocol radius
FW-PARIS-01(config-aaa-server-group)# accounting-mode simultaneous

! Primary RADIUS server (NPS on Windows Server)
FW-PARIS-01(config)# aaa-server RADIUS_CORP (inside) host 192.168.1.50
FW-PARIS-01(config-aaa-server-host)# key Rad1usS3cr3t!
FW-PARIS-01(config-aaa-server-host)# timeout 10
FW-PARIS-01(config-aaa-server-host)# retry-interval 3

! Secondary RADIUS server (NPS on the secondary DC)
FW-PARIS-01(config)# aaa-server RADIUS_CORP (inside) host 192.168.1.51
FW-PARIS-01(config-aaa-server-host)# key Rad1usS3cr3t!
FW-PARIS-01(config-aaa-server-host)# timeout 10

! ── ENABLE AAA AUTHENTICATION ──────────────────────
! SSH: try RADIUS first, then fallback to LOCAL if RADIUS is unreachable
FW-PARIS-01(config)# aaa authentication ssh console RADIUS_CORP LOCAL

! ASDM WebGUI: same
FW-PARIS-01(config)# aaa authentication http console RADIUS_CORP LOCAL

! Enable password (switch to privileged mode)
FW-PARIS-01(config)# aaa authentication enable console RADIUS_CORP LOCAL

! ── ACCOUNTING: log all admin actions ─────────
! Every command entered is logged in NPS/AD
FW-PARIS-01(config)# aaa accounting command RADIUS_CORP
FW-PARIS-01(config)# aaa accounting ssh console RADIUS_CORP

! ── LOCAL BACKUP ACCOUNT (MANDATORY) ────────────────
! If NPS goes down, this account allows you to regain control
! The password MUST be stored in a secure vault (Passbolt, etc.)
FW-PARIS-01(config)# username fw-breakglass privilege 15 password Br3@kGl@ss2026!

Step 5 — Test Before Validating

Never close your current SSH session before testing! If the RADIUS configuration is incorrect and you close the session, you may find yourself locked out.

! Test from the ASA — without opening a new session
FW-PARIS-01# test aaa-server authentication RADIUS_CORP inside host 192.168.1.50 username fw-admin1 password MyPassword
! Expected result: INFO: Authentication Successful

! Test with an incorrect password — should fail
FW-PARIS-01# test aaa-server authentication RADIUS_CORP inside host 192.168.1.50 username fw-admin1 password wrongpassword
! Expected result: ERROR: Authentication Rejected

! Check the statistics
FW-PARIS-01# show aaa-server RADIUS_CORP
! Look for: Requests Sent, Responses Received, Successes, Errors

! If errors &gt; 0: check the shared secret and UDP 1812 connectivity
FW-PARIS-01# ping inside 192.168.1.50

Step 6 — Configure RADIUS for AnyConnect VPN

! VPN authentication via AD (VPN users authenticate
! with their Windows login)
FW-PARIS-01(config)# tunnel-group ANYCONNECT_USERS general-attributes
FW-PARIS-01(config-tunnel-general)# authentication-server-group RADIUS_CORP
FW-PARIS-01(config-tunnel-general)# accounting-server-group RADIUS_CORP
FW-PARIS-01(config-tunnel-general)# default-group-policy GP_ANYCONNECT

! Authorization: retrieve AD attributes via RADIUS
! (allows assigning different VLANs or ACLs per AD group)
FW-PARIS-01(config-tunnel-general)# authorization-server-group RADIUS_CORP
FW-PARIS-01(config-tunnel-general)# authorization-required

! In NPS, create a VPN_USERS policy:
! Condition: User Groups = GRP_VPN_USERS
! Attribute: Tunnel-Type = Virtual (PPP) or L2TP
! Access: Granted

Common Errors and Solutions

Symptom Probable Cause Solution
Authentication Rejected Incorrect shared secret Verify that the secret is identical in NPS and ASA
No response from server UDP 1812 blocked Check the ACL between the ASA and the NPS server
Authentication Rejected after correct password User not in the correct AD group Verify group membership in AD
Privilege 1 instead of 15 cisco-av-pair attribute missing Recheck the NPS policy → Vendor Specific Attributes
Timeout then LOCAL fallback NPS unreachable Verify that the NPS service is runningon Windows

> 🔐 Security — The fw-breakglass account must have a unique, complex password that is different from all others. Store it in a dedicated vault (Passbolt, CyberArk, or even a physically sealed envelope for critical environments). Audit its use: any login with this account must trigger an immediate alert.</même></ip_ftd></ip_ftd></clé_registration></ip_fmc></ip_fmc>

AAA — AUTHENTIFICATION CENTRALISÉE VIA RADIUS Admin SSH Poste Windows User VPN AnyConnect Cisco ASA 1. Reçoit credentials 2. Forward → RADIUS 3. RADIUS → Accept/Reject 4. Ouvre/Refuse session Fallback → LOCAL si RADIUS KO Accounting → RADIUS RADIUS Server Cisco ISE / NPS 192.168.1.50 RADIUS Backup 192.168.1.51 Active Directory Validation identité Groupes AD → Policies VPN Attributs RADIUS (VLAN, ACL) LDAP / Kerberos 💡 Conserver un compte LOCAL privilege 15 dans un coffre-fort (Passbolt) en cas de panne RADIUS

Fig. 17.1 — AAA Architecture: Centralized ASA Authentication via RADIUS and Active Directory

18. Application Inspection — Modular Policy Framework (MPF)

Why Inspect Application Protocols?

A traditional stateful firewall detects that port 53 is open for DNS. But it does not examine whatis in the DNS request. An attacker can use DNS to exfiltrate data from your network (DNS tunneling)—each DNS request contains a piece of encoded data, and the response serves as a return channel. Without application inspection, the ASA lets all of this pass through without batting an eye.

The MPF (Modular Policy Framework) fixes this: it inspects protocol content and can block abnormal behavior.

The 3 building blocks of MPF

class-map      → &quot;what traffic?&quot;  (identify what to inspect)
policy-map     → &quot;what to do?&quot;   (inspect, drop, rate-limit)
service-policy → &quot;where to apply?&quot; (interface or global)

Complete Step-by-Step Configuration

! ── STEP 1: Default Traffic Class ───────────────
! &quot;inspection_default&quot; identifies standard protocols
! This is the class-map provided by Cisco; we use it as-is
FW-PARIS-01(config)# class-map inspection_default
FW-PARIS-01(config-cmap)# match default-inspection-traffic
! This class automatically includes: DNS, FTP, HTTP, SMTP,
! ICMP, SIP, H.323, TFTP, SNMP, SQL*Net, etc.

! ── STEP 2: HTTP Inspection Policy ────────────────
! Create a sub-policy specific to HTTP
FW-PARIS-01(config)# policy-map type inspect http HTTP_STRICT
FW-PARIS-01(config-pmap)# parameters
! Block requests that do not comply with the HTTP RFC
FW-PARIS-01(config-pmap-p)# protocol-violation action drop-connection log
! Limit the size of request bodies (to prevent mass uploads)
FW-PARIS-01(config-pmap-p)# body-match-maximum 8192
! Block URL encodings that bypass ACLs
FW-PARIS-01(config-pmap-p)# no request-method post

! ── STEP 3: DNS Inspection Policy ─────────────────
! Protection against DNS tunneling
FW-PARIS-01(config)# policy-map type inspect dns DNS_STRICT
FW-PARIS-01(config-pmap)# parameters
! Maximum DNS response size: 512 bytes (standard), 4096 with EDNS
! DNS tunneling uses abnormally large responses
FW-PARIS-01(config-pmap-p)# message-length maximum 512
! Block DNS requests to suspicious domains (optional)
FW-PARIS-01(config-pmap-p)# id-randomization

! ── STEP 4: Global policy — put it all together ────────────
FW-PARIS-01(config)# policy-map global_policy
FW-PARIS-01(config-pmap)# class inspection_default
! Inspect FTP — automatically handles active/passive mode
! (without FTP inspection, passive mode does not work through NAT)
FW-PARIS-01(config-pmap-c)# inspect ftp
! Inspect SMTP — blocks dangerous commands (VRFY, EXPN)
FW-PARIS-01(config-pmap-c)# inspect smtp
! Inspect DNS with our strict policy
FW-PARIS-01(config-pmap-c)# inspect dns DNS_STRICT
! Inspect ICMP — allows ICMP responses to pass through the firewall
FW-PARIS-01(config-pmap-c)# inspect icmp
! Inspect HTTP with our strict policy
FW-PARIS-01(config-pmap-c)# inspect http HTTP_STRICT
! Inspect SIP/VoIP if you have IP telephony
FW-PARIS-01(config-pmap-c)# inspect sip
! Inspect NetBIOS/NBSS (Windows file sharing)
FW-PARIS-01(config-pmap-c)# inspect netbios

! ── STEP 5: Apply the policy ─────────────────────
! &quot;global&quot; = applies to all interfaces in both directions
FW-PARIS-01(config)# service-policy global_policy global

! If you want to apply it only to the outside interface:
! FW-PARIS-01(config)# service-policy global_policy interface outside

Verification and Monitoring

! Overview of all active policies
FW-PARIS-01# show service-policy

! HTTP inspection statistics (number of connections, violations)
FW-PARIS-01# show service-policy inspect http

! DNS statistics
FW-PARIS-01# show service-policy inspect dns

! Connections currently being inspected
FW-PARIS-01# show conn detail | include HTTP

! View drops related to inspection
FW-PARIS-01# show asp drop | include inspect

> ℹ️ Real-world example — DNS tunneling — Without DNS inspection, an attacker who has compromised an internal workstation can use DNS queries to exfiltrate 1 file every 30 seconds to an external server, indefinitely, without triggering any standard firewall alerts. The message-length maximum 512 option drastically reduces this risk because DNS tunnels require long responses encoded in base64.

19. Certificate Management & PKI for AnyConnect

Why are self-signed certificates unacceptable in production?

When AnyConnect connects to a firewall with a self-signed certificate, the client sees a security warning. The user clicks "Accept Anyway" — and this is exactly the behavior that man-in-the-middle attacks exploit. If users are accustomed to accepting warnings, a real attacker can easily intercept the VPN.

There are two solutions: an internal Windows CA (free, for managed enterprise fleets) or a public certificate (paid, for access from unmanaged machines).

Option A — Use the internal Windows CA (recommended for enterprises)

Step 1 — Install the CA roles on Windows Server

# On Windows Server (domain controller or dedicated server)
# Server Manager &gt; Add Roles and Features

Roles to install:
  ✓ Active Directory Certificate Services (AD CS)
    → Certification Authority
    → Certificate Enrollment Web Service  ← for SCEP
    → Network Device Enrollment Service (NDES) ← for SCEP on network devices

# During AD CS configuration:
Setup Type:    Enterprise CA (not Standalone)
CA Type:       Root CA (if first CA) or Subordinate CA
Key length:    4096 bits (RSA) or P-384 (ECDSA)
Hash:          SHA-256
CA Name:       CA-ENTREPRISE-PARIS
Validity:      10 years for the Root CA

# Enable IIS if not already done (for SCEP)
Server Manager &gt; Add Roles &gt; Web Server (IIS)

Step 2 — Configure NDES (SCEP intermediary)

NDES is the gateway that allows the ASA to automatically request a certificate via SCEP, without human intervention.

# In Server Manager &gt; AD CS &gt; Configure Active Directory Certificate Services
  ✓ Network Device Enrollment Service

# NDES service account (create in AD):
User: svc-ndes
Group: IIS_IUSRS

# Automatically generated SCEP URL:
# http://ca.entreprise.local/certsrv/mscep/mscep.dll
# → This is the URL we will use in the ASA configuration

# Test SCEP access from a browser:
# http://ca.entreprise.local/certsrv/mscep/mscep.dll?operation=GetCACert
# → Should return the CA certificate (no error)

Step 3 — Configure the ASA to request a certificate via SCEP

! ── GENERATE THE RSA KEY PAIR ────────────────────────
! Do this first — the private key never leaves the ASA
FW-PARIS-01(config)# crypto key generate rsa label RSA_FW_PARIS modulus 2048
! Expected result:
! INFO: The name for the keys will be: RSA_FW_PARIS
! Keypair generation process begin. Please wait...

! ── CREATE THE TRUSTPOINT (certificate profile) ───────────
FW-PARIS-01(config)# crypto ca trustpoint CA_CORP
! URL of the SCEP service on your Windows server
FW-PARIS-01(config-ca-trustpoint)# enrollment url http://ca.entreprise.local/certsrv/mscep/mscep.dll
! Certificate identity (what will appear in the certificate)
FW-PARIS-01(config-ca-trustpoint)# subject-name CN=fw-paris-01.entreprise.local,OU=IT,O=Entreprise,C=FR
! FQDN = firewall DNS name (must match the AnyConnect URL)
FW-PARIS-01(config-ca-trustpoint)# fqdn fw-paris-01.entreprise.local
! Use the RSA key generated above
FW-PARIS-01(config-ca-trustpoint)# keypair RSA_FW_PARIS
! Check for revocation via the Windows CA&#x27;s CRL
FW-PARIS-01(config-ca-trustpoint)# revocation-check crl

! ── RETRIEVE THE CA ROOT CERTIFICATE ──────────────
! The ASA downloads the CA certificate so it can trust it
FW-PARIS-01(config)# crypto ca authenticate CA_CORP
! The ASA displays the certificate and requests confirmation
! Do you accept this certificate? [yes/no]: yes
! → The root certificate is now stored in the ASA

! ── REQUEST THE CERTIFICATE FOR THE ASA ────────────────────
FW-PARIS-01(config)# crypto ca enroll CA_CORP
! The ASA sends a CSR (Certificate Signing Request) to the CA via SCEP
! Expected result:
! % Start certificate enrollment ..
! % Certificate request successfully submitted.
! % The certificate enrollment is pending approval from the CA.
! (on an Enterprise CA, it is auto-approved)

! ── ASSIGN THE CERTIFICATE TO ANYCONNECT ──────────────────
! The certificate is used to secure VPN connections
FW-PARIS-01(config)# ssl trust-point CA_CORP outside

! ── VERIFICATION ─────────────────────────────────────────
FW-PARIS-01# show crypto ca certificates
! Should display:
! Certificate
!   Status: Available
!   Certificate Serial Number: xxxx
!   Subject Name: CN=fw-paris-01.entreprise.local
!   Validity Date:
!     start date: 13:00:00 UTC Mar 13 2026
!     end   date: 13:00:00 UTC Mar 13 2028
!   Associated Trustpoints: CA_CORP

FW-PARIS-01# show ssl
! Should display: outside: CA_CORP

Step 4 — Distribute the root certificate to client machines

To ensure AnyConnect does not display any alerts, client machines must trust your CA. On an AD domain, this is automatic via GPO.

# On the domain controller:
# Group Policy Management &gt; Default Domain Policy &gt; Edit
# Computer Configuration &gt; Windows Settings &gt; Security Settings
# &gt; Public Key Policies &gt; Trusted Root Certification Authorities
# &gt; Import... → select your CA’s .cer file
# Apply

# Result: all computers in the domain automatically
# trust your CA → AnyConnect displays no alerts

Option B — Import a public certificate (external access)

If users connect with unmanaged devices (personal phones, non-domain PCs), a certificate issued by a recognized public CA (DigiCert, Sectigo, Let's Encrypt) is required.

# ── STEP 1: Generate a CSR on the ASA ─────────────────
FW-PARIS-01(config)# crypto key generate rsa label RSA_PUBLIC_VPN modulus 2048

FW-PARIS-01(config)# crypto ca trustpoint CERT_PUBLIC
FW-PARIS-01(config-ca-trustpoint)# enrollment terminal   ← enter the CSR manually
FW-PARIS-01(config-ca-trustpoint)# subject-name CN=vpn.entreprise.com,O=Company,C=FR
FW-PARIS-01(config-ca-trustpoint)# fqdn vpn.entreprise.com
FW-PARIS-01(config-ca-trustpoint)# keypair RSA_PUBLIC_VPN

! Generate the CSR (Certificate Signing Request)
FW-PARIS-01(config)# crypto ca enroll CERT_PUBLIC
! The ASA displays a block of text beginning with:
! -----BEGIN CERTIFICATE REQUEST-----
! MIICvDCCAaQCAQAwXzELMAkGA1UEBhMCRlIx...
! -----END CERTIFICATE REQUEST-----
! → Copy this block and submit it to your certificate provider

# ── STEP 2: After receiving the certificate (.pfx/.p12) ─
# The provider sends you a .pfx file containing:
# - Your signed certificate
# - The intermediate CA chain
# - Your private key (password-protected)

! Copy the .pfx file to a TFTP server on your internal network
! then import it into the ASA:
FW-PARIS-01(config)# crypto ca import CERT_PUBLIC pkcs12 tftp://192.168.1.10/vpn-cert.pfx
! Enter the passphrase for the PKCS12 file: PFXPassword

! Assign to the outside interface for AnyConnect
FW-PARIS-01(config)# ssl trust-point CERT_PUBLIC outside

! Verify
FW-PARIS-01# show crypto ca certificates CERT_PUBLIC

Monitor certificate expiration

An expired certificate = all VPN users disconnected simultaneously at the time of expiration. This is one of the most embarrassing and preventable service interruptions.

! Check expiration dates
FW-PARIS-01# show crypto ca certificates | include end date

! Example result:
! end date: 13:00:00 UTC Mar 13 2028
! → Create an alert in your SIEM/monitoring system 60 days in advance

! Automatic renewal script (via SCEP, internal CA only)
FW-PARIS-01(config)# crypto ca trustpoint CA_CORP
FW-PARIS-01(config-ca-trustpoint)# auto-enroll 70 regenerate
! → The ASA automatically renews the certificate when 30% of its validity period remains

> 🔐 Security — Never export the ASA’s private key (the crypto ca export command with private key). If an attacker obtains your private key, they can impersonate your VPN and intercept all AnyConnect connections without clients seeing any alerts.

20. Troubleshooting — Practical Diagnostics

Methodology — Never Start at Random

When facing a connectivity issue through the ASA, the approach is always the same, in this order:

1. Does the packet reach the ASA?      → packet-tracer / capture
2. Is it blocked by the ACL?                     → show access-list + packet-tracer
3. Is NAT configured correctly?        → show xlate / show nat
4. Is routing correct?                  → show route
5. Is there an inspection blocking it?         → show asp drop

Tool 1 — packet-tracer (essential)

packet-tracer simulates a packet without actually sending it. It tells you exactly which stage is blocking the packet and why, without affecting production traffic.

! ── SYNTAX ──────────────────────────────────────────────
! packet-tracer input <interface-entrée> <proto> <ip-src> <port-src> <ip-dst><port-dst>

! ── CASE 1: An Internet user cannot reach the web server ──
FW-PARIS-01# packet-tracer input outside tcp 1.2.3.4 12345 203.0.113.5 443

! Typical result if everything is OK:
! Phase 1: ROUTE-LOOKUP        Subtype: Resolve Egress Interface  Result: ALLOW
! Phase 2: ACCESS-LIST         Result: ALLOW  access-group OUTSIDE_IN
! Phase 3: NAT                 Result: ALLOW  static (dmz,outside) 203.0.113.5 → 10.0.10.10
! Phase 4: FLOW-CREATION       Result: ALLOW
! Result: input-interface: outside
!         output-interface: dmz
!         Action: allow

! Result if the ACL blocks:
! Phase 1: ROUTE-LOOKUP        Result: ALLOW
! Phase 2: ACCESS-LIST         Result: DROP   Implicit Rule
! Result: Action: drop  Drop-reason: (acl-drop) Flow is denied by configured rule

! → Immediate diagnosis: the OUTSIDE_IN ACL does not allow this flow
! → Solution: add a permit rule for this traffic

! ── CASE 2: A LAN client cannot access the Internet ────────
FW-PARIS-01# packet-tracer input inside tcp 192.168.1.100 54321 8.8.8.8 443

! If NAT is missing:
! Phase 3: NAT                 Result: DROP
! Drop-reason: (nat-no-xlate-to-pat-pool) Untranslated packet

! → Diagnosis: PAT is not configured for this source network
! → Solution: Check the LAN_PARIS network object + NAT (inside, outside) dynamic interface

! ── CASE 3: AnyConnect VPN fails to establish ──────────────
FW-PARIS-01# packet-tracer input outside tcp 5.6.7.8 12345 203.0.113.1 443

! If this succeeds but the VPN still fails → authentication issue
! → Check: show aaa-server RADIUS_CORP statistics

Tool 2 — packet capture

When packet-tracer isn’t enough (intermittent issue, complex protocol), capture the actual traffic.

! ── CAPTURE TRAFFIC FROM A SUSPECT IP ────────────────
! Start the capture BEFORE reproducing the problem
FW-PARIS-01# capture CAP_DEBUG interface outside match ip host 1.2.3.4 any

! Reproduce the problem (attempt the connection that fails)

! View the capture
FW-PARIS-01# show capture CAP_DEBUG
! Typical result:
!    1: 14:32:01.123456 1.2.3.4.54321 &gt; 203.0.113.5.443: S (SYN)
!    2: 14:32:01.123789 203.0.113.5.443 &gt; 1.2.3.4.54321: S A (SYN-ACK)
!    3: 14:32:01.124012 1.2.3.4.54321 &gt; 203.0.113.5.443: A (ACK)
! → The TCP connection is established correctly on the network side

! If you only see SYN packets without SYN-ACK:
! → The packet arrives but the response does not go out → return routing issue

! ── CAPTURE ON TWO INTERFACES SIMULTANEOUSLY ───────────
! Useful for checking if the packet enters but does not exit
FW-PARIS-01# capture CAP_IN  interface outside match ip host 1.2.3.4 any
FW-PARIS-01# capture CAP_OUT interface dmz    match ip host 10.0.10.10 any
! → If CAP_IN receives the packet but CAP_OUT is empty:
!    the problem is WITHIN the ASA (ACL, NAT, inspection)

! ── EXPORT TO WIRESHARK ──────────────────────────────
! For in-depth analysis with filters and protocol decoding
FW-PARIS-01# copy /pcap capture:CAP_DEBUG tftp://192.168.1.10/debug.pcap
! Open debug.pcap in Wireshark → complete graphical analysis

! ── CLEANUP (always do this afterward) ─────────────────────
FW-PARIS-01# no capture CAP_DEBUG
FW-PARIS-01# no capture CAP_IN
FW-PARIS-01# no capture CAP_OUT

Tool 3 — show asp drop (invisible drops)

asp drop shows the packets that the ASA silently drops without logging them in the ACLs. This is often where mysterious problems hide.

FW-PARIS-01# show asp drop

! Example of revealing results:
! Frame drop:
!   Invalid TCP flags (invalid-tcp-hdr-flags)          452
!   TCP RST/FIN out of order (tcp-rst-fin-ooo)          38
!   Flow is denied by configured rule (acl-drop)       1204
!   No valid adjacency (no-adjacency)                    12  ← routing issue
!   NAT failed (nat-no-xlate-to-pat-pool)                5  ← Missing PAT

! If you see a large number of &quot;acl-drop&quot; entries → check the ACLs
! If &quot;nat-no-xlate&quot; → a source network has no NAT rule
! If &quot;no-adjacency&quot; → incomplete routing table or interface down

! Reset counters after analysis
FW-PARIS-01# clear asp drop

Tool 4 — Common System Diagnostics

! ── CHECK GENERAL STATUS ──────────────────────────────
! Uptime, version, license
FW-PARIS-01# show version

! Interface status (all must be &quot;up up&quot;)
FW-PARIS-01# show interface ip brief
! Interface         IP-Address      OK? Method Status Protocol
! GigabitEthernet0/0  203.0.113.1   YES  manual up     up
! GigabitEthernet0/1  192.168.1.1   YES  manual up     up
! GigabitEthernet0/2  10.0.10.1     YES  manual up     up
! If an interface is &quot;down down&quot; → faulty cable or module
! If &quot;up down&quot; → negotiation issue (speed/duplex)

! CPU and memory performance
FW-PARIS-01# show cpu usage
! CPU Usage: 8% 1 sec, 6% 5 sec, 5% 1 min
! If CPU &gt; 80% continuously → possible DDoS attack or debug forgotten

FW-PARIS-01# show memory
! If memory &gt; 90% → possible reboot → investigate connections

! ── ACTIVE CONNECTIONS ────────────────────────────────────
! Total number of connections
FW-PARIS-01# show conn count
! 1842 in use, 8921 most used

! Connections from a specific IP (e.g., a user experiencing issues)
FW-PARIS-01# show conn address 192.168.1.100
! TCP outside 1.2.3.4:443 inside 192.168.1.100:54321, idle 0:00:03, ...

! ── VPN ──────────────────────────────────────────────────
! Summary of active VPN sessions
FW-PARIS-01# show vpn-sessiondb summary
! Sessions: 12 AnyConnect, 3 IPsec LAN-to-LAN

! Details of a specific AnyConnect session
FW-PARIS-01# show vpn-sessiondb anyconnect filter name john.doe@entreprise.local

! Status of IPsec tunnels (site-to-site)
FW-PARIS-01# show crypto ikev2 sa
FW-PARIS-01# show crypto ipsec sa

! ── ACL — COUNTING HITS ───────────────────────────────
! Each rule has a hit counter — useful for determining if a rule is being used
FW-PARIS-01# show access-list OUTSIDE_IN
! access-list OUTSIDE_IN line 1 extended permit tcp any object-group DMZ_SERVERS ...
!   hitcnt=45872    ← this rule has been matched 45,872 times
! access-list OUTSIDE_IN line 2 extended deny ip any any log
!   hitcnt=1247     ← 1,247 connections have been blocked

! If a rule has had hitcnt=0 for days → it may be unnecessary
! Reset the counters to zero to start a new observation
FW-PARIS-01# clear access-list counters OUTSIDE_IN

Quick Troubleshooting Guide — Common Symptoms

Symptom Diagnostic Command Probable Cause
A user cannot pass through the firewall packet-tracer input inside tcp ... Missing ACL or NAT
Web server inaccessible from the Internet packet-tracer input outside tcp ... OUTSIDE_IN ACL or static NAT
AnyConnect VPN "connection failed" show vpn-sessiondb anyconnect + show logging RADIUS or certificate authentication
IPsec tunnel not establishing show crypto ikev2 sa IKEv2 policy mismatch or ACL
Degraded performance show cpu + show asp drop DDoS, debug enabled, or connection table full
Pings go through but TCP does not show conn + capture TCP inspection blocking (MPF)
"Working but slow" show interface → look for errors/drops Network negotiation issue

> ⚠️ Golden Rule — Never enable debug crypto isakmp 255 or debug crypto ipsec 255 in production without being ready to disable it within 30 seconds. These debug commands generate so much output that they can crash the ASA. Always use undebug all after use.

PACKET-TRACER — PIPELINE DE DÉCISION ASA Paquet simulé packet-tracer ① ROUTE Table de routage Interface de sortie show route ② ACL Access-list check Permit / Deny show access-list DENY ✗ DROP ③ NAT Translation table Xlate check show xlate ④ VPN Crypto check Tunnel lookup show crypto sa ⑤ FLOW Connexion créée State table show conn ✓ ALLOW Paquet transféré 💡 packet-tracer indique exactement quelle phase bloque le paquet — sans envoyer de vrai trafic réseau

Fig. 20.1 — Packet-tracer pipeline: identifying the exact phase blocking traffic

21. IP Addressing Plan — Multi-site Enterprise Network

This table is the common reference used throughout the series of guides (Firewall, Routers, Switches). All configuration examples are based on this plan.

Site Role Network VLAN Equipment
Paris HQ LAN Users 192.168.1.0/24 10 ASA FW-PARIS-01
Paris HQ DMZ Servers 10.0.10.0/24 20 ASA FW-PARIS-01
Paris HQ Internal Servers 10.0.20.0/24 30 ASA FW-PARIS-01
Paris HQ OOB Management 172.16.0.0/24 99 ASA FW-PARIS-01
Paris HQ AnyConnect VPN pool 172.16.10.0/24 — ASA FW-PARIS-01
Paris HQ WAN (ISP) 203.0.113.0/30 — Outside Interface
Lyon Branch LAN Users 192.168.2.0/24 10 ASA FW-LYON-01
Lyon Branch Servers 10.0.21.0/24 30 ASA FW-LYON-01
Lyon Branch WAN (ISP) 198.51.100.0/30 — Outside Interface
Marseille LAN Users 192.168.3.0/24 10 FTDv ESXi
Marseille Servers 10.0.22.0/24 30 FTDv ESXi
Marseille WAN (ISP) 203.0.113.4/30 — Outside Interface
Inter-site Paris ASA Failover 10.255.255.0/30 — Dedicated Cable
Inter-site IPsec VPN Paris↔Lyon — — Logical tunnel
Inter-site IPsec VPN Paris↔Marseille — — Logical tunnel

> ℹ️ Info — This diagram complies with RFC 1918 for private addresses. The WAN addresses used (203.0.113.x, 198.51.100.x) are RFC 5737 documentation addresses — replace them with your actual ISP IPs in production.

22. Hardening — Cisco ASA & FTD

Domain Action Priority
Authentication Centralized RADIUS AAA + LOCAL fallback 🔴 CRITICAL
WebGUI / ASDM Access Restrict to MGMT IPs only 🔴 CRITICAL
SSH Version 2 only, RSA key 2048+, 5-minute timeout 🔴 CRITICAL
Certificates Enterprise PKI or public CA — never self-signed 🔴 CRITICAL
ACL deny ip any any log at the end of each ACL 🔴 CRITICAL
Protocols Disable Telnet, HTTP, SNMP v1/v2 🟠 HIGH
SNMP SNMPv3 with authPriv (authentication + encryption) 🟠 HIGH
NTP Authenticated internal NTP source (MD5/SHA) 🟠 HIGH
Logging Syslog to external SIEM, min. 90-day retention 🟠 HIGH
Passwords Type 8 (PBKDF2) or Type 9 (scrypt) encryption 🟠 HIGH
Updates Regular ASA/FTD patching, test in lab first 🟡 STANDARD
Config backup Daily encrypted export to secure TFTP/FTP server 🟡 STANDARD
Session timeout exec-timeout 5 on all lines 🟡 STANDARD
Banner Login banner with legal notice 🟡 STANDARD

Essential Hardening Commands

! Password encryption (type 8 = PBKDF2)
FW-PARIS-01(config)# password encryption aes
FW-PARIS-01(config)# key config-key password-encrypt MonMasterKey!

! Mandatory legal banner
FW-PARIS-01(config)# banner login &quot;Access restricted to authorized personnel. Any unauthorized connection is a criminal offense.&quot;

! Session timeouts (5 min)
FW-PARIS-01(config)# console timeout 5
FW-PARIS-01(config)# ssh timeout 5

! Disable unnecessary services
FW-PARIS-01(config)# no snmp-server enable traps
FW-PARIS-01(config)# no service tcp-small-servers
FW-PARIS-01(config)# no service udp-small-servers

! Secure SNMPv3
FW-PARIS-01(config)# snmp-server group SNMPV3_GROUP v3 priv
FW-PARIS-01(config)# snmp-server user snmp_admin SNMPV3_GROUP v3 auth sha AuthPass123! priv aes 128 PrivPass456!
FW-PARIS-01(config)# snmp-server host inside 10.0.10.50 version 3 priv snmp_admin

! Overall security check
FW-PARIS-01# show run | include password
FW-PARIS-01# show run | include snmp
FW-PARIS-01# show run | include banner
FW-PARIS-01# show run | include timeout
RÉDUCTION SURFACE D'ATTAQUE — CISCO ASA/FTD HARDENING 🛡 Cisco ASA FTD Hardened ⛔ WebGUI MGMT uniquement 🔐 AAA RADIUS + AD 🔒 SSH v2 + RSA 2048 🔑 PKI Certificats 💾 Backup config chiffré 📋 Syslog SIEM 90j 🔄 ACL deny any any log 🌐 SNMPv3 authPriv Appliquer en priorité les mesures CRITIQUES (rouge) — elles réduisent 80% de la surface d'attaque

Fig. 22.1 — Cisco ASA/FTD Hardening Wheel — Reducing the Attack Surface

23. SSL/TLS Decryption Policy (FTD)

HTTPS traffic now accounts for over 90% of web traffic. Without TLS decryption, Snort 3 IPS is blind to this traffic. The SSL Policy allows FTD to inspect encrypted traffic.

How TLS Decryption Works

FMC &gt; Policies &gt; SSL &gt; New Policy

Name: SSL_DECRYPT_POLICY

! Rule 1 — Do not decrypt banking and medical sites
Rule 1: No-Decrypt-Sensitive
  - URL Category: Financial Services, Health and Medicine
  - Action: Do Not Decrypt

! Rule 2 — Do not decrypt OS updates
Rule 2: No-Decrypt-Updates
  - Application: Windows Update, Apple Update
  - Action: Do Not Decrypt

! Rule 3 — Decrypt the rest of the outbound HTTPS traffic
Rule 3: Decrypt-Outbound
  - Source: LAN_NETWORKS
  - Destination: any
  - Port: HTTPS (443)
  - Action: Decrypt (Resign) ← uses the internal CA certificate

! Assign the SSL Policy to the ACP
FMC &gt; Policies &gt; Access Control &gt; Edit ACP
Advanced &gt; SSL Policy: SSL_DECRYPT_POLICY

> ⚠️ Legal Notice — TLS decryption involves intercepting communications. In France, this requires prior notification to users (included in the IT policy) and cannot be applied to personal sessions if they are distinguishable. Consult your DPO before deployment.

24. File Policy & AMP — Malware Blocking (FTD)

The File Policy allows FTD to analyze files in transit and submit them to Cisco AMP (Advanced Malware Protection) for malware detection.

FMC &gt; Policies &gt; Files &gt; New File Policy

Name: FILE_POLICY_ENTREPRISE

! Rule 1 — Block known malicious executables
Rule 1:
  Application Protocol: HTTP, HTTPS (after decryption)
  File Type: Executables (PE, ELF, Mach-O)
  Action: Block Malware
  Store Files: Malware (for forensic analysis)

! Rule 2 — Log PDFs and Office files
Rule 2:
  File Type: PDF, Office Documents
  Action: Detect Files
  Store Files: Malware + Unknown

! Enable in an ACP rule
ACP Rule &gt; Inspection Tab:
  File Policy: FILE_POLICY_ENTREPRISE
  Intrusion Policy: IPS_ENTREPRISE

! Verification in FMC
FMC &gt; Analysis &gt; Files &gt; File Events
FMC &gt; Analysis &gt; Files &gt; Malware Events

25. Identity Policy & Cisco ISE (FTD)

The Identity Policy allows you to associate ACP rules with Active Directory users rather than IP addresses. This is the NGFW feature that truly sets it apart from a traditional firewall.

ISE + FTD Architecture

! ISE collects user identities via:
- Active Directory (Windows login → ISE → FMC)
- 802.1X authentication (switches)
- AnyConnect VPN (ISE as RADIUS)
- ISE captive portal

! FMC &gt; Policies &gt; Identity &gt; New Policy
Name: IDENTITY_POLICY

Rule 1: AD_Authentication
  - Realm: AD_ENTREPRISE (LDAP connection configured)
  - Active Authentication: Kerberos (transparent for Windows)
  - Passive Authentication: User-Agent (ASA)
  - Action: Active Authentication

! Use in ACP rules
ACP Rule:
  Users: AD_FINANCE_GROUP  (instead of an IP address!)
  Destination: FINANCE_SERVERS
  Action: Allow

ACP Rule:
  Users: AD_IT_GROUP
  Destination: any
  Action: Allow + IPS Inspection

! Verification
FMC &gt; Analysis &gt; Users &gt; Active Sessions

> ℹ️ Info — With ISE + FTD, if a user switches workstations, their access rights follow them automatically. No need to update IP-based ACLs—the policy follows the identity, not the machine.

26. FTD High Availability (Active/Standby)

HA on FTD works differently from ASA. It is configured via FMC and not via CLI.

! On FMC: Devices &gt; Device Management &gt; Add High Availability
Type: Firewall High Availability

Primary FTD:   FTD-PARIS-01
Secondary FTD: FTD-PARIS-02

! HA Interfaces
Failover Link: dedicated interface (e.g., Management1/1)
State Link: same interface or dedicated

! HA IPs (configured in FMC)
Primary Failover IP:   10.255.0.1/30
Secondary Failover IP: 10.255.0.2/30

! Standby IPs for each data interface
Outside: Standby IP 203.0.113.2/30
Inside:  Standby IP 192.168.1.2/24
DMZ:     Standby IP 10.0.10.2/24

! Deploy the HA configuration
FMC &gt; Deploy &gt; Deploy All

! Verification from FTD CLI
&gt; show high-availability config
&gt; show high-availability state

> ℹ️ Info — Unlike the ASA, FTD HA configuration is managed entirely via FMC. Do not attempt to configure HA via the FTD CLI — this can desynchronize the FMC. The FMC deployment automatically synchronizes the entire configuration to the secondary node

HAUTE DISPONIBILITÉ FTD — PILOTÉ PAR FMC FMC — Gère la HA Déploie config · Monitore état · Déclenche failover Sync automatique Primary → Standby ☁ Internet · VIP Outside FTD-PARIS-01 ● ACTIVE Outside: 203.0.113.1 (VIP) Inside: 192.168.1.1 (VIP) Traite tout le trafic FTD-PARIS-02 ○ STANDBY Outside: 203.0.113.2 Inside: 192.168.1.2 Prêt — failover < 30s HA Failover Link Config + State sync ⚠️ Toujours configurer la HA via FMC — ne jamais modifier directement via CLI FTD

.Fig. 26.1 — FMC-driven FTD Active/Standby HA Architecture

Cisco®, ASA®, Firepower®, AnyConnect®, FMC®, ISE®, and AMP® are registered trademarks of Cisco Systems, Inc. This tutorial is provided for educational purposes.</interface-entrée>