A firewall is a network security system that takes actions on the ingoing or outgoing packets based on the defined rules on the basis of IP address, port numbers. Cisco calls its firewall Adaptive Security Appliance (ASA).
The Cisco ASA 5500 series has models :
Cisco ASA 5505, Cisco ASA 5510, Cisco ASA 5515-X, Cisco ASA 5520, Cisco ASA 5525-X, Cisco ASA 5540, Cisco ASA 5550, Cisco ASA 5555-X, Cisco ASA 5585-X.
The Cisco ASA is a security device with many features.
* Adaptive Security Appliance (ASA) : ASA is a Cisco security device that can perform basic firewall capabilities with VPN capabilities, antivirus, and many other features. Some of the features of ASA are:
* Packet filtering : Packet filtering is a simple process of filtering the incoming or outgoing packet on the basis of rules defined on the ACL which has been applied to the device. It consists of various permit or deny conditions. If the traffic matches one of the rules, no other rule is matched and the matched rule is executed.
* Stateful filtering : By default, ASA performs stateful tracking of the packet if the packet is generated from a higher security level to a lower security level.
By default, if the traffic is initiated by the devices in higher security levels for lower security levels device (as destination), TCP and UDP reply traffic will be allowed and will able to, say, telnet the other device in Lower security level. This is because a stateful database is maintained (in which an entry about the source and destination device information such as IP address, port numbers are maintained) as stateful inspection is enabled by default.
* Routing support : ASA can perform static routing, Default routing also dynamic routing protocols like EIGRP, OSPF, and RIP.
Transparent firewall :
ASA can operate in two modes:
* Routed mode : In this mode, ASA acts like a layer 3 device (router hop) and needs to have two different IP addresses (means two different subnets) on its interface.
* Transparent mode : In this mode, ASA operates at layer 2 and only a single IP address is needed to manage ASA management purpose as both the interfaces (inside and outside) act as a bridge.
* AAA support : ASA supports AAA services either using its local database or using an external server like ACS (Access Control Server).
* VPN support : ASA supports policy-based VPNs like point-to-point IPsec VPN(site-to-site VPN and remote-access VPN) and SSL-based VPNs.
* Supports IPv6 : ASA (new versions) supports IPv6 routing such as static, dynamic.
* VPN load Balancing : It is a Cisco proprietary feature of Cisco ASA. Multiple clients can be shared across multiple ASA units at the same time.
* Stateful failover : ASA supports the high availability of pair of Cisco ASA devices. If one of the ASA goes down, the other ASA device will perform the operations without any interruption. When stateful failover is enabled, the active unit continuously passes connection state information to the backup device. After the failover occurs, the same connection information is available on the new active unit.
* Clustering : Cisco ASA lets us configure multiple ASA devices as a single logical device. The cluster can consist of a maximum of 8 cohesive units. This results in high throughput and at the same time provides redundancy.
* Advanced Malware Protection (AMP) : Cisco ASA provides support for Next-Generation firewall features which can provide protection advanced malware protection in a single device as the classic firewall features are combined with NGFWs features.
* Modular Policy Framework (MPF) : MPF is used to define policies for different traffic flows. It is used in ASA to utilize advanced firewall features like QoS, Policing, prioritizing, etc.
For using MPF, we define Class-map for identifying the type of traffic, policy-map for identifying what action should be taken like prioritize, and service-policy for where it should be applied.
