Table of Contents

apic_qsg

Quick Start Guide

Cisco ASA Integration with the APIC

Version 1.0(1)

About the ASA Integration with the APIC

Deploy the ASA

Configure Management Access to the ASA

Install the ASA Device Package

Updated December 1, 2014

About the ASA Integration with the APIC

The Cisco Application Policy Infrastructure Controller (APIC) automates insertion of services (such as an ASA firewall) northbound between applications, also called End Point Groups (EPGs). The APIC uses northbound APIs for configuring the network and services. You use these APIs to create, delete, and modify a configuration using managed objects.

commands, are also available through the CLI.

Note With APIC integration, you can only use ASDM for monitoring purposes. You cannot change the configuration using ASDM.

Note With APIC integration, you can only use ASDM for monitoring purposes. You cannot change the configuration using ASDM.

for the specified feature and release that you are using.

Service Function Insertion

When a service function is inserted in the service graph between applications, traffic from these applications is classified by the APIC and identified using a tag in the overlay network. Service functions use the tag to apply policies to the traffic. For the ASA integration with the APIC, the service function forwards traffic using either routed or transparent firewall operation.

guide.

.

Supported ASA Models and Features

The following table lists the supported ASA models.

ASA Model

Software Version

ASA 5585-X (SSP 10 through SSP 60)

ASA software Version 8.4(x) and later

ASAv

The following table lists the supported features for the ASAv and the ASA 5585-X.

Feature

ASAv Support (Yes/No)

ASA 5585-X Support (Yes/No)

Access Control Policies

Yes

Yes

Access Lists and Groups

Yes

Yes

Application Inspection

Yes

Yes

Clustering

No

Yes

Connection Limits

Yes

Yes

DNS Clients

Yes

Yes

EtherChannels

No

Yes

High Availability (Active/Active, Active/Standby)

Active/Standby only

Yes

Interface Configuration

Yes

Yes

IP Audit

Yes

Yes

IPv6

Yes

Yes

Logging

Yes

Yes

NAT/Twice NAT

Yes

Yes

Netflow

Yes

Yes

Network and Service Objects and Groups

Yes

Yes

NTP

Yes

Yes

Protocol Timeouts

Yes

Yes

Shared AnyConnect Premium Licenses

No

Yes

Smart Call Home Enable

Yes

Yes

Static Routing

Yes

Yes

TCP Intercept (Embryonic Connection Limits)

Yes

Yes

Threat Detection

Yes

Yes

Deploy the ASA

- ASAv—See the Cisco Adaptive Security Virtual Appliance (ASAv) Quick Start Guide for installation procedures, at the following URL:

Note During ASAv deployment, you must define the value of the nameif property for the management interface as management. If you define the interface name as anything other than management, the device cluster will be stuck in AuditRequested/AuditPending state, and the fault will indicate that the read operation timed out. The management interface and default gateway configuration are deleted from the ASAv, and the interface is shut down.

Note During ASAv deployment, you must define the value of the nameif property for the management interface as management. If you define the interface name as anything other than management, the device cluster will be stuck in AuditRequested/AuditPending state, and the fault will indicate that the read operation timed out. The management interface and default gateway configuration are deleted from the ASAv, and the interface is shut down.

- ASA 5585-X—See the Cisco ASA 5585-X Quick Start Guide for installation procedures, at the following URL:

Configure Management Access to the ASA

You must configure management access to the ASA so that the APIC can manage the ASA.

To configure management access to the ASAv, see Deploy the ASA.

To configure management access to the ASA 5585-X, see the following procedure:

Step 1 Remove any existing configuration:

ciscoasa(config)# clear configure all

Step 2 (Optional) Set the firewall mode to transparent firewall mode:

ciscoasa(config)# firewall transparent

Step 3 Configure the IP address and subnet mask on the management interface. The ASA needs to be on the same subnet as the APIC:

ciscoasa(config)# interface management {0/0 | 0/1}

ciscoasa(config-subif)# ip address ip_address subnet_mask

Step 4 Name the interface “management:”

ciscoasa(config-subif)# nameif management

Step 5 Enable the interface:

ciscoasa(config-if)# no shutdown

Step 6 Enable the ASA HTTPS server:

ciscoasa(config)# http server enable

Step 7 Enable an APIC to access the ASA. Repeat this step for each APIC in the APIC cluster:

ciscoasa(config)# http apic_address 255.255.255.255 management

Step 8 Create the user, “management-user,” which the APIC uses to access the ASA:

ciscoasa(config)# username management-user password password privilege 15

Install the ASA Device Package

Each service node type must provide a device package, which includes two parts: a device specification and a device script. Service nodes of the same type are bound to a single device package.

The ASA device package enables you to perform the following tasks:

- Configure an ASA.

- Register the ASA with the APIC.

Step 1 Review the prerequisites for installing device packages.

.

Step 2 Download the ASA device package, a .zip file that is available from Cisco.com, at the following URL:

Step 3 Install the ASA device package.

.

Step 4 Register the ASA with the APIC.

.

Configure the ASA within the APIC

Use the northbound API to configure the security policy, specifically for service graphs.

.

.