-
Device Configuration Guide for Cisco Security MARS, Release 6.x
-
Preface
- Part 1: Concepts
- Part 2: Intrusion Detection and Prevention (Network based)
- Part 3: Vulnerability Assessment
- Part 4: Switches
- Part 5: Routers
- Part 6: Firewalls
- Part 7: Network Access Control
- Part 8: Virtual Private Network Gateways
- Part 9: WLAN Controller
- Part 10: AAA Servers
- Part 11: Intrusion Detection and Prevention (Host based)
- Part 12: Virus Protection
- Part 13: Content Management
- Part 14: Database Applications
- Part 15: Web Servers
- Part 16: Web Proxies
- Part 17: Host Nodes
-
Index
-
Feedback
Table Of Contents
Configuring Cisco Firewall Devices
Cisco Firewall Devices (PIX, ASA, and FWSM)
Bootstrap the Cisco Firewall Device
Enable Telnet Access on a Cisco Firewall Device
Enable SSH Access on a Cisco Firewall Device
Send Syslog Files From Cisco Firewall Device to MARS
Device-Side Tuning for Cisco Firewall Device Syslogs
List of Cisco Firewall Message Events Processed by MARS
Add and Configure a Cisco Firewall Device in MARS
Add Security Contexts Manually
Edit Discovered Security Contexts
Failover Considerations for PIX, ASA, and Modules in ASA
Configuring Cisco Firewall Devices
Revised: July 31, 2008
This chapter describes how to bootstrap Cisco firewall devices and add them to MARS as reporting devices. Firewall devices come in several form factors: hardware appliances, software applications running on a host, modules that are installed in switches and routers, and modules that install in multifunction security devices.
Multifunction security devices, such as the Cisco Adaptive Security Appliance (ASA), also support non-firewall modules, such as intrusion detection or prevention systems (IDS/IPS) and Content Security and Control Security Services (CSC-SSM). This chapter does not focus on configuring non-firewalling modules. Instead, they are discussed in Chapter 9, "Cisco IPS Modules" and Chapter 32, "Cisco CSC SSM".
This chapter contains the following topics:
•
Cisco Firewall Devices (PIX, ASA, and FWSM)
•
Cisco Firewall Devices (PIX, ASA, and FWSM)
MARS support for Cisco firewall devices includes the following:
•
•
•
For the complete list of supported software releases by platform, refer to the latest Supported and Interoperable Devices and Software for Cisco Security MARS Local Controller document.
Because these PIX software is mostly backward compatible, the commands required to bootstrap PIX security appliance remain consistent across the releases. In addition, Cisco ASA and FWSM have much in common with PIX command set.
The taskflow required to configure MARS to monitor a Cisco firewall device is as follows:
1.
For Cisco ASA, PIX 7.0, 7.2, and 8.0, and FWSM device types, you configure the admin context to accept these sessions.
Note
2.
For Cisco ASA, PIX 7.0, 7.2, and 8.0, and FWSM device types, you must configure the admin context and each security context.
Note
3.
Note
For Cisco ASA, PIX 7.0, 7.2, and 8.0, and FWSM, the basic device type represents the admin context. However you must also define or discover each security context and any installed Advanced Inspection and Prevention (AIP) modules running IPS 5.0.
To configure MARS to accept syslog event data and to pull device configurations settings from a Cisco firewall device, you must perform the following tasks:
•
•
Bootstrap the Cisco Firewall Device
You should configure your Cisco firewall devices to act as reporting devices and manual mitigation devices because they perform multiple roles on your network. MARS can benefit from the proper configuration of specific features:
•
•
•
–
–
–
To bootstrap the Cisco firewall device, you must identify the MARS Appliance as an administrative host Enabling administrative access allows MARS to discover the Cisco firewall device configuration settings. To enable administrative access, you must make sure that the MARS Appliance is granted Telnet or SSH administrative access to the firewall device. If you use FTP access type, make sure that you have added its configuration file to an FTP server to allow MARS access to the FTP server.
In addition to configuring specific event types and administrative access, syslog messages should be sent to the MARS Appliance. To prepare the Cisco firewall device to send these messages to the MARS Appliance, you must configure the logging settings associated with each firewall device on your network. To prepare a firewall device to generate the syslog messages and direct them to a specific MARS Appliance, you must:
1.
Before a firewall device can generate syslog messages, you must enable logging for one or more interfaces. In addition, if you configured your firewall device in a failover pair, you can specify the standby firewall device to generate syslog messages as well. You can enable the device to ensure that the standby unit's syslog messages stay synchronized if failover occurs. However, this option results in twice as much traffic on the MARS Appliance.
2.
To generate meaningful reports about the network activity of a firewall device and to monitor the security events associated with that device, you must select the appropriate logging level. The logging level generates the syslog details required to track session-specific data. After you select a logging level, you can define a syslog rule that directs traffic to the MARS Appliance.
3.
–
–
The debug log level generates syslog messages that assist you in debugging. it also generates logs that identify the commands issued during FTP sessions and the URLs requested during HTTP sessions. It includes all emergency, alert, critical, error, warning, notification, and information messages. Alternatively, you can change the severity level of the required messages using the logging message command described in Device-Side Tuning for Cisco Firewall Device Syslogs.
Note
4.
By directing syslog messages generated by a firewall device to MARS, you can process and study the messages.
Tip
To enable administrative connections to the firewall device, select from the following options:
•
•
•
To configure log settings, see Send Syslog Files From Cisco Firewall Device to MARS.
Enable Telnet Access on a Cisco Firewall Device
Step 1
Step 2
telnet <MARS IP address> <netmask of MARS IP address> <interface name>where interface name can be inside, outside, DMZ.
Enable SSH Access on a Cisco Firewall Device
Step 1
Step 2
ssh <MARS IP address> <netmask of the MARS IP address> <interface name>where interface name can be inside, outside, DMZ.
Send Syslog Files From Cisco Firewall Device to MARS
To send syslog messages to the MARS Appliance, you must enable logging, select the log facility and queue size, and specify the log level to debug.
Before You Begin
When preparing a Cisco firewall device to publish syslog messages, consider the following restrictions:
•
•
logging host <interface name> <PN-MARS's IP address> format EMBLEMTo configure the firewall device to forward syslog message to MARS, follow these steps:
Step 1
Step 2
•
•
Step 3
logging host <interface name> <MARS IP address>Step 4
logging trap debugging
Tip
The debug messages contain the HTTP URL address information. Therefore, you can create keyword-based rules matching against the firewall message itself. For example, if the debug messages are enabled and users were logging to "http://mail.cisco.com", you could create keyword-based rules that matched against "mail.yahoo.com."
Note
Debug messages are also preferred for troubleshooting. You can define inspection rules that match on on debug-level keywords, which send notifications to the appropriate group. Refer to PIX debug messages for interesting keywords.
Cisco recommends enabling debug for optimal use of your STM solution. If a Cisco firewall device is unable to sustain debug-level messages due to performance reasons, the informational level should be used. In non-debug mode, the URL information is not available; only the 5 tuple is available for queries and reports.
Step 5
logging rate-limit <eps rate desired> 1Step 6
Step 7
Device-Side Tuning for Cisco Firewall Device Syslogs
The default level for many of the events that are studied by MARS is the debug level, which can generate a high volume of additional events that are not used by MARS. If you are experiencing an influx of these other events, you can use the logging message command to either turn off events or change the severity level of the event to a level that generates required messages but not as many as debug.
This topic identifies the commands to use to change the log level from the command line, as well as identifies those messages consumed by MARS and their default severity level.
Logging Message Command
The following references provide details for using the logging message command on the appropriate firewall device:
Cisco ASA and Cisco PIX
•
http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/monitor.html#wp1065731
•
http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/monitor.html#wp1065706
•
http://www.cisco.com/en/US/docs/security/asa/asa72/command/reference/l2_72.html#wp1689570
•
http://www.cisco.com/en/US/docs/security/asa/asa72/system/message/logmsgs.html
Cisco FWSM
•
http://www.cisco.com/en/US/docs/security/fwsm/fwsm32/configuration/guide/monitr_f.html#wp1099894
•
http://www.cisco.com/en/US/docs/security/fwsm/fwsm31/configuration/guide/monitr_f.html#wp1099869
•
http://www.cisco.com/en/US/docs/security/fwsm/fwsm31/command/reference/l2.html#wp1565791
•
http://www.cisco.com/en/US/docs/security/fwsm/fwsm31/system/message/fwsm_log.html
List of Cisco Firewall Message Events Processed by MARS
The following list of events are processed by MARS. By changing the severity level for these events to ensure they are within the logging level you have selected, you can typically reduce the load on your firewall logging by 5-15%. However, the primary consumer of resources will remain the session detail events, which are processed and analyzed by MARS.
Starting with MARS version, the system can correctly parse syslogs at customized logging levels. Therefore, you can move the syslogs processed by MARS to a lower level and then set the log to that level, for example logging level 6. Use the command logging messagemessage-id level level on the ASA, or PIX, to move a syslog message to a new level.
The following syslog message IDs are those required for proper sessionization. If you change the logging level of the firewall, ensure that the following messages IDs are generated at the new level so the MARS Appliance receives them.
Note
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Add and Configure a Cisco Firewall Device in MARS
The process of adding a PIX security appliance, Cisco ASA, or FWSM to MARS involves many of the same steps, regardless of the version of software that is running. The process is exactly the same for PIX software versions 6.0, 6.1, 6.2, and 6.3. However, Cisco ASA, PIX 7.0, 7.2, and 8.0, and FWSM provide the ability to define multiple security contexts, or virtual firewalls.
Adding a Cisco ASA, PIX 7.0, 7.2, and 8.0, and FWSM to MARS has two distinct steps. First, you must define the settings for the admin context. Then, if multiple context mode is enabled, you define or discover the settings for its security contexts. These Cisco firewall device have two type of contexts: one admin context, which is used for configuration of the device itself, and one or more security contexts. For Cisco ASA, you can also define or discover any modules that are installed in the appliance.
To be monitored by MARS, the Cisco ASA, PIX 7.0, 7.2, and 8.0, and FWSM device types have the following additional requirements:
•
•
Note
To add and configure a Cisco firewall device, follow these steps:
Step 1
•
–
–
–
–
–
•
–
–
–
–
–
–
–
–
–
–
Step 2
MARS maps this name to the reporting IP address. This name is used in topology maps, queries, and in the Security and Monitoring Device list. For devices that support the discovery operation, such as routers and firewalls, MARS renames this field's value to match the name discovered in the device configuration, which typically uses the hostname.domain format. For devices that cannot be discovered, such as Windows and Linux hosts and host applications, MARS uses the provided value.
Step 3
Note
To learn more about the access IP address, its role, and dependencies, see Understanding Access IP, Reporting IP, and Interface Settings, page 1-10.
Step 4
Note
To learn more about the reporting IP address, its role, and dependencies, see Understanding Access IP, Reporting IP, and Interface Settings, page 1-10.
Step 5
•
•
•
Note
For more information on determining the access type, see Selection of the Access Type, page 1-11.
Step 6
Before you can specify the SNMP RO string, you must define an access IP address. MARS uses the SNMP RO string to read MIBs related to a reporting device's CPU usage, network usage, and device anomaly data and to discover device and network settings.
Step 7
MARS monitors the device for anomalous consumption of resources, such as memory and CPU. If anomalies are detected, MARS generates an incident. Resource utilization statistics are also used to generate reports. For more information, see Configuring Resource Usage Data, page 1-23.
Step 8
•
•
For PIX and FWSM, you can add one or more security contexts. For Cisco ASA, you can add one or more security contexts or Advanced Inspection and Prevention (AIP) modules, running the Cisco IPS 5.x software.
Step 9
If the username and password are correct and the MARS Appliance is configured as an administrative host for the device, the "Discovery is done." dialog box appears when the discovery operation completes. Otherwise, an error message appears. After the initial pull, the MARS Appliance pulls based on the schedule that you define. For more information, see Scheduling Topology Updates, page 1-20.
Step 10
The submit operation records the changes in the database tables. However, it does not load the changes into working memory of the MARS Appliance. The activate operation loads submitted changes into working memory.
Step 11
MARS begins to sessionize events generated by this device and evaluate those events using the defined inspection and drop rules. Any events published by the device to MARS before activation can be queried using the reporting IP address of the device as a match criterion. For more information on the activate action, see Activate the Reporting and Mitigation Devices, page 1-15.
Add Security Contexts Manually
You can manually define security contexts in PIX 7.0, 7.2, and 8.0, Cisco ASA, or FWSM.
Step 1
•
•
Step 2
•
•
•
Step 3
MARS maps this name to the reporting IP address. This name is used in topology maps, queries, and in the Security and Monitoring Device list. For devices that support the discovery operation, such as routers and firewalls, MARS renames this field's value to match the name discovered in the device configuration, which typically uses the hostname.domain format. For devices that cannot be discovered, such as Windows and Linux hosts and host applications, MARS uses the provided value.
Step 4
This name must exactly match the context name defined on the device.
Step 5
To learn more about the reporting IP address, its role, and dependencies, see Understanding Access IP, Reporting IP, and Interface Settings, page 1-10.
Step 6
Before you can specify the SNMP RO string, you must define an access IP address. MARS uses the SNMP RO string to read MIBs related to a security context's CPU usage, network usage, and device anomaly data and to discover device and network settings.
Step 7
This discovery collects all of the route, NAT, and ACL-related information. In addition, the name of the device may change to the hostname.domain format if it was not already entered as such.
Step 8
Add Discovered Contexts
When you select Discover on a Cisco ASA, PIX 7.0, 7.2, and 8.0 or FWSM, MARS discovers the contexts that are defined for that firewall device. However, you must still manually add discovered contents.
Note
Step 1
•
•
Step 2
Step 3
Step 4
Step 5
After you add discovered contexts, you must edit them to provide the contact information required by MARS. Continue with Edit Discovered Security Contexts.
Edit Discovered Security Contexts
Note
Step 1
•
•
Step 2
Step 3
Before you can specify the SNMP RO string, you must define an access IP address. MARS uses the SNMP RO string to read MIBs related to a reporting device's CPU usage, network usage, and device anomaly data and to discover device and network settings.
Step 4
MARS monitors the device for anomalous consumption of resources, such as memory and CPU. If anomalies are detected, MARS generates an incident. Resource utilization statistics are also used to generate reports. For more information, see Configuring Resource Usage Data, page 1-23.
Step 5
Step 6
Failover Considerations for PIX, ASA, and Modules in ASA
When monitoring a failover pair of Cisco firewall devices (PIX or ASA), you should designate the primary Cisco firewall device as the device to be monitored. If failover occurs, the secondary device assumes the IP address of the primary, which ensures that session correlation is maintained after the failover. The same focus on the primary is true for performing any bootstrap operations. The secondary device will synchronize with the configuration settings of the primary.
While this is true for the actual firewalls, it is not true for AIP-SSM modules. AIP-SSM modules do not swap IP addresses in the event of a failover. Therefore, to ensure that MARS receives uninterrupted IPS event data, you must configure both the primary and secondary AIP-SSM modules as child modules of the same ASA device that represents the Active/Standby pair. In this configuration, MARS will likely generate "Inactive Reporting Device" messages on the hour for the non-active AIP-SSM module.
