Once deployed, authentication is handled by the appliances own internal user database, in larger organisations this is a little impractical. So the ability to create an Active Directory Group, and delegate access to Firesight to members of that group is a little more versatile.
Solution
I’m making the assumption that the appliance does not already have external authentication setup at all, so I’ll cover everything from start to finish.
Newer Versions
Logon to the Appliance > System >Users > External Authentication > Add External Authentication Object
Older Versions
Logon to the Appliance > System > Local User Management > External Authentication > Create External Authentication Object.
Authentication Method: LDAP
Name: Chose a sensible name for the connection.
Server Type: MS Active Directory
Host Name/IP Address: the IP of your domain controller
Port:389 (this is standard LDAP)
If you have a second Domain Controller enter the details here.
Note: In Active Directory, I’ve created a USER to make the connection to Active Directory with, and I’ve also created a SECURITY GROUP that my administrators will be in.
You can use the ldp.exe tool to locate and find the correct LDAP path for the user you created, (and the group because you will need that in a minute as well).
Base DN: Usually the root of the domain, in standard LDAP format.
Username: The LDAP path to the user you created.
Password: For the user above.
UI Access Attribute: sAMAccountName
Shell Access Attribute: sAMAccountName
I’m simply having one administrative group, if you have a granular RBAC requirement, there are a number of pre-configured roles you can assign your AD groups to, (or you can create custom ones). So I’m adding the LDAP path of my administrators group to the ‘Administrator’ role.
Also set the default role to ‘Security Analyst (Read Only).
Group Member Attribute: member.
Username: A user in the AD Administrative group you created.
Password: Password for the above account.
Press ‘Test’
All being well you should see a success, Press Save.
Newer Versions
Switch the ‘slider’ to enabled > Save > Save and Apply. (Now skip to All Systems below).
Older Versions
You now need to add this to the policy being applied to this appliance. System > Local System Policy > Select the policy in use >Edit.
External Authentication
Status: Enabled
Default User Role: System Analyst (Read Only)
Finally change the slider button and ensure it is ticked. Save policy and exit.
Now apply the policy (green tick).
Tick the appliance > Apply.
Success.
All Systems
Now you can login with your administrative AD accounts.
You can also create a local user to match an AD account.
And get the appliance to use AD for authentication of this user.
Related Articles, References, Credits, or External Links
Both the 5506-X (rugged version and wireless), and 5508-X now come with a FirePOWER services module inside them. This can be managed from either ASDM* (with OS and ASDM upgraded to the latest version), and via the FireSIGHT management software/appliance.
Related Articles, References, Credits, or External Links
*UPDATE: All ASA ‘Next-Gen’ firewalls can now have their Firepower Service Module managed from the ASDM.
Solution
1. The first thing to do is cable the management interface and the interface you are going to use as the ‘inside’ (LAN) into the same network (VLAN).
2. The next step might seem strange if you are used to working with Cisco firewalls, but you need to make sure there is no IP address configured on the management interface. Try to think of it as just the hole that the FirePOWER services module (which will get its own IP) speaks out though.
[box]
Petes-ASA# configure terminal
Petes-ASA(config)# interface Management1/1
Petes-ASA(config-if)# no nameif
WARNING: DHCPD bindings cleared on interface 'management', address pool removed
Petes-ASA(config-if)# no security-level
Petes-ASA(config-if)# no ip address
[/box]
3. So it should look like this;
[box]
Petes-ASA(config-if)# show run
: Saved
ASA Version 9.3(2)2
!
----Output removed for the sake of brevity----
!
interface Management1/1
management-only
no nameif
no security-level
!
----Output removed for the sake of brevity----
[/box]
4. Lets make sure the FirePOWER service module is ‘up’ and healthy.
[box]
Petes-ASA(config)# show module
Mod Card Type Model Serial No.
---- -------------------------------------------- ------------------ -----------
1 ASA 5506-X with FirePOWER services, 8GE, AC, ASA5506 JAD19090XXX
sfr FirePOWER Services Software Module ASA5506 JAD19090XXX
Mod MAC Address Range Hw Version Fw Version Sw Version
---- --------------------------------- ------------ ------------ ---------------
1 a46c.2a99.eec5 to a46c.2a99.eece 1.0 1.1.1 9.3(2)2
sfr a46c.2a99.eec4 to a46c.2a99.eec4 N/A N/A 5.4.1-211
Mod SSM Application Name Status SSM Application Version
---- ------------------------------ ---------------- --------------------------
sfr ASA FirePOWER Up 5.4.1-211
Mod Status Data Plane Status Compatibility
---- ------------------ --------------------- -------------
1 Up Sys Not Applicable
sfr Up Up
[/box]
5. The SFR module is actually a Linux box that’s running within the firewall, to connect to it you issue a ‘session sfr’ command.
Default Username: admin
Default Password: Sourcefire (capital S)
Default Password (after version 6.0.0): Admin123 (capital A)
As this is the first time you have entered the SFR you need to page down (press space) though the sizable EULA, then accept it.
[box]
Petes-ASA(config)# session sfr
Opening command session with module sfr.
Connected to module sfr. Escape character sequence is 'CTRL-^X'.
Cisco ASA5506 v5.4.1 (build 211)
Sourcefire3D login: admin
Password: Sourcefire
Copyright 2004-2015, Cisco and/or its affiliates. All rights reserved.
Cisco is a registered trademark of Cisco Systems, Inc.
All other trademarks are property of their respective owners.
Cisco Linux OS v5.4.1 (build 12)
Cisco ASA5506 v5.4.1 (build 211)
You must accept the EULA to continue.
Press <ENTER> to display the EULA:
END USER LICENSE AGREEMENTIMPORTANT: PLEASE READ THIS END USER LICENSE AGREEMENT CAREFULLY. IT IS VERY
----Output removed for the sake of brevity----
Product warranty terms and other information applicable to Cisco products are
available at the following URL: http://www.cisco.com/go/warranty.
----Output removed for the sake of brevity----
Please enter 'YES' or press <ENTER> to AGREE to the EULA: YES
[/box]
6. Set a new password.
[box]
System initialization in progress. Please stand by.
You must change the password for 'admin' to continue.
Enter new password: Password123
Confirm new password: Password123
[/box]
7. Set up all the IP and DNS settings, then exit from the module session.
[box]
You must configure the network to continue.
You must configure at least one of IPv4 or IPv6.
Do you want to configure IPv4? (y/n) [y]: y
Do you want to configure IPv6? (y/n) [n]: n
Configure IPv4 via DHCP or manually? (dhcp/manual) [manual]: manual
Enter an IPv4 address for the management interface [192.168.45.45]: 192.168.100.22
Enter an IPv4 netmask for the management interface [255.255.255.0]: 255.255.255.0
Enter the IPv4 default gateway for the management interface []: 192.168.100.1
Enter a fully qualified hostname for this system [Sourcefire3D]: SFire
Enter a comma-separated list of DNS servers or 'none' []: 192.168.100.10,192.168.100.11
Enter a comma-separated list of search domains or 'none' [example.net]: petenetlive.com,pnl.net
If your networking information has changed, you will need to reconnect.
For HTTP Proxy configuration, run 'configure network http-proxy'
Applying 'Default Allow All Traffic' access control policy.
You can register the sensor to a Defense Center and use the Defense Center
----Output removed for the sake of brevity----
sensor to the Defense Center.
> exit
Remote card closed command session. Press any key to continue.
[/box]
8. Now you need to ‘send’ traffic though the module, in this case I’m going to send all IP traffic though, I’m also going to set it to ‘fail open’, If you set it to fail closed then traffic will cease to flow though the firewall if the FirePOWER services module goes off-line. I’m making the assumption you have a default policy-map applied.
[box]
Petes-ASA(config)# access-list SFR extended permit ip any any
Petes-ASA(config)# class-map SFR
Petes-ASA(config-cmap)# match access-list SFR
Petes-ASA(config-cmap)# exit
[/box]
9. Add that new class-map to the default policy-map.
WARNING: If you are going to set ‘fail-close‘ then make sure your SFR module is operating normally, or you will cause downtime, best to do this in a maintenance window!)
Petes-ASA(config)# write mem
Building configuration...
Cryptochecksum: 72c138e3 1fa6ec32 31c35497 621cff02
35819 bytes copied in 0.210 secs
[OK]
[/box]
11. At this point the firewall should be able to ping the management IP of the SFR module.
[box]
Petes-ASA# ping 192.168.100.22
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.100.22, timeout is 2 seconds:
!!!!!Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms
Petes-ASA#
[/box]
12. Now when you connect to the ASDM you can manage the FirePOWER services module.Note: I have seen some firewalls that flatly refuse to connect to the Firepower Services Module, and give an error ‘unable to connect on port 443’ every time you launch ASDM. I just re-image the module and load in a fresh install (40 mins to an hour), and start again.
Code to Copy & Paste
If you are lazy like me!
[box]
access-list ACL-FirePOWER extended permit ip any any
class-map CM-SFR
match access-list ACL-FirePOWER
exit
policy-map global_policy
class CM-SFR
sfr fail-open
exit
exit
write mem
[/box]
Note If you get an unable to connect error see the following article;
13. I suggest you update everything first, the ASA will configure an access control policy set to allow and inspect all traffic by default, which we will edit, set everything to update on a schedule, (rule updates and geolocation info).
Cisco FirePOWER Services Adding Licences (ASDM)
In the box with the firewall, you will have an envelope, you don’t need to open it (as below) because the PAK number you need is printed on the outside anyway. This is the firewalls CONTROL LICENCE, it allows it to be managed, we will install it into the ASDM, if you have a SourceFIRE appliance to manage the firewall you would install it there. You need two bits of information the PAK and the LICENCE KEY of the FirePOWER module, (See Below).
The Licence Key is the MAC address of the Module, (Not the ASA). You can find it at Configuration > ASA FirePOWER Configuration > Licence. This is also where you will add all the licences. Go to www.cisco.com/go/licence and register the licence (and any additional licences i.e. AMP, Web filtering, etc.)
The Licence(s) will be emailed to you open them in a text editor and copy the text of each licence. You can see I’ve indicated below what you should be copying.
Paste that into the ASDM > Submit Licence.
It should say success, if it fails you’ve pasted to much text, or there’s a problem with the licence.
Review you licences, here Ive added AMP and web filtering but Ive yet to add the control licence. If you don’t add the control licence then when you try and edit the access control policy it will say you need a PROTECTION LICENCE (confusingly!)
FirePOWER Services Setup IPS
Disclaimer: These settings, (and allotters below,) are to get you up and running, As with any security device, you need to tune settings accordingly. Please don’t follow these instructions, then email me with complaints that you been attacked by ISIS/Scammers/Bots etc.
You get an IPS/IDS Licence with any of the subscription based licences, its less hassle to set this up before the the access control policy. Configuration > ASA FirePOWER Configuration > Policies > Intrusion Policy > Create Policy > Give it a name > I tend to use ‘Balanced Security and connectivity’ look at the other options and choose whichever you prefer > Create and Edit Policy.
Give the policy a name > Commit changes (I accept all the defaults).
FirePOWER Services Enable Malware Inspection and Protection
Note: Obviously this needs you to have added an AMP Licence!
Configuration > ASA FirePOWER Configuration > Policies > Intrusion Policy > Files > New File Policy > Give it a name > Store FirePOWER Changes.
Add new file rule > I add everything > and Set it to ‘Block Malware’ > Store FirePOWER Changes.
“Store ASA FirePOWER Changes”.
Warning: Nothing will be inspected, until you add this file policy to an access control policy.
ASA FirePOWER Services Edit / Create Access Control Policy
I renamed the default policy, Note: Even though I’ve called it ‘Base-Access-Control-Policy’ you can only apply one policy, you just add different rules to the policy as required. Add Rule.
In Source Networks > Add in ‘Private Networks’ (See Warning Below).
Inspection Tab > Add in the IPS and file policy you created above (That’s why I’ve done it in this order).
I set it to log at the end of the connection > Add.
“Store ASA FirePOWER Changes”.
FirePOWER Private Networks Warning
Private networks only cover RFC1918 addresses, if you LAN/DMZ etc subnets are different you should create a new Network object, then add the subnets for your network. If you do this, then substitute your network object every time I mention the Private Networks object.
Blocking a Particular URL with FirePOWER Services
Even if you don’t have a Web Filtering licence you can block particular URL’s here Im going to block access to Facebook. Configuration > ASA FirePOWER Configuration > Object Management > URL > Individual Objects > Add URL > Note Im adding http and https.
Then add a rule to your existing access control policy ABOVE the permit all rule, (they are processed like ACLS from the top down). Set the source network to your private subnets.
On the URLs tab add in your URL objects and set the action to block with reset, or Interactive block with reset if you want to let the users proceed to Facebook after a warning.
Note: If you have a Web filtering Licence you can select ‘Social Networking’ from the Categories tab, and that would also block Facebook, and Twitter etc.
ASA FirePOWER Services Commit and Deploy The Changes
FirePOWER services behaves the same on-box as it does when you use the SourceFIRE Appliance, you can make changes but nothing gets deployed until you commit the changes. If you have made a change then there will be a ‘Store ASA FirePOWER services button active. Then you need to select File > Deploy FirePOWER Changes.
Note: You will only see the Deploy option on SFR modules running 6.0.0 or newer.
Deploy.
Even now its not deployed, it takes a while, to see progress navigate to Monitoring > ASA FirePOWER Monitoring > Task Status > It will probably have a ‘running’ task.
Wait until the policy deployment says completed before testing.
Related Articles, References, Credits, or External Links
To save you creating multiple users on your FireSIGHT appliance, and assigning roles to them you can utilise your existing Active Directory. In fact FireSIGHT does a good job of enabling granular administration based on AD Groups, by assigning them to ‘roles’ on the appliance.
Below I’m just going to create one AD group and assign the administrator role to that group,as you would in a small organisation. but I will point out how to enable RBAC on the appliance.
I had to work out how to do this, because the official documentation just does not work? Or at least it did not work for me with my 2012 R2 domain controller.
Solution
1. Log into FireSIGHT > System > Local > User Management > Create External Authentication Object.
2. Authentication Method = LDAP > Name = Something descriptive > Description = {optional} > Primary Server IP = IP of you Domain Controller > Port = 389.
Note: If you change the authentication method below to SSL the port will automatically change to 636 (LDAPS).
3. Enter a secondary domain controller IP if you have one.
4. In my AD I’ve created a user for the appliance to connect to AD with (svc_sourcefire), and a group called Sourcefire-Admins that I’ve put my administrative users in.
5. In the FireSIGHT console you have to enter domain objects by their DN. If you’re unused to using DN notation, on the domain controller run LDP (Connection > Connect > Server=Localhost > OK > Connection > Bind > OK > View > Tree > OK) In the left window you can expand and navigate up and down your domain tree. When you find th group/user you want right click copy DN, Then you can paste it into FireSIGHT without having to write it out.
6. Set the Base DN (usually the root of the domain) e.g.
[box]DC=petenetlive,DC=com[/box]
Enter the DN for the user the appliance will use to bind to Active Directory, e.g.
Enter the user (above) password. Set the UIAccess Attribute and the Shell Access Attribute to;
[box]sAMAccountName[/box]
Note: The drop down arrow unlocks the advanced options if you wanted to use LDAPS then this is where you would select it and upload the root CA certificate.
7. Expand Group Controlled Access Roles (Optional) > Enter your AD group against the role you want to assign to it e.g.
Note: These are the built in roles, you can clone and create new ones. (System > Local > User Management > User Roles).
Set the Default user role to ‘Security Analyst (Read Only)’.
8. Group Member attribute = member > Shell Access Filter = ‘Same as Base Filter’ > Username enter an administrative username form the group you specified above > Password = password for the user you are testing > Test.
Note: Shell Access Filter wont actually do anything in this instance.
9.You will get a lot of info, but hopefully you will see ‘Success’.
10. Now you need to use this authentication method for the appliance. System > Local > System Policy > Select the policy in use > Edit, (pencil icon).
11. External Authentication > Status = Enabled > Default User Role = Security Analyst (read Only), No I don’t know why you do this twice > Change the ‘slider button’ to enabled > Save Policy and Exit.
12. Because the policy has changed and not updated > Update.
13. Select All > Apply.
14. Success.
15. You can not log in with your administrative AD accounts.
16. You will also notice the users appear under local user management > Users.
17. You could, (if you wished) Untick the ‘Use External Authentication Method’ option and turn this user into a ‘local’ user.
Related Articles, References, Credits, or External Links
