Virtual Private Networks

Case Study 3 Data Center Security with Cisco ASA

SecureMe builds security policies that align asset protection with business goals. To secure its data center, the security administrator defines separate security zones. These zones divide the data center into areas that are logically alienated from one another to contain security threats and anomalies at minimal impact. The individual zones in SecureMe's data center support individual application groups of servers. Each zone is protected by a virtual firewall context on the Cisco ASA 5520s at the data center (DC-5520-1 and DC-5520-2). Figure 22-7 illustrates how each zone is protected by each security context.

Figure 22-7. Data Center Zones and Virtual Contexts

SecureMe's data center has four different zones, corresponding to individual virtual firewall contexts running in transparent mode:

• Authentication servers (authservers context)
• E-commerce applications (e-commerce context)
• MySQL database server and third-party applications (databases context)
• Mail and DNS servers (maildns context)

Communication between applications is limited to specific traffic required for application integration, data warehousing, and web services.

Interfaces cannot be shared in transparent mode, thus creating the need for different subinterfaces for the inside and outside interfaces of each virtual context. Example 22-11 shows the system context configuration and how each separate context is created.

Example 22-11. Admin Context Configuration

!Cisco ASA 5520 running in transparent multi-mode firewall transparent ! !Separate subinterfaces are created and associated to their respective VLANs interface GigabitEthernet0/0 ! interface GigabitEthernet0/0.1 vlan 200 ! interface GigabitEthernet0/0.2 vlan 201 ! interface GigabitEthernet0/0.3 vlan 202 ! interface GigabitEthernet0/0.4 vlan 203 ! interface GigabitEthernet0/1 ! interface GigabitEthernet0/1.1 vlan 100 ! interface GigabitEthernet0/1.2 vlan 101 ! interface GigabitEthernet0/1.3 vlan 102 ! interface GigabitEthernet0/1.4 vlan 103 ! interface GigabitEthernet0/2 ! interface GigabitEthernet0/2.1 vlan 501 ! interface GigabitEthernet0/2.2 vlan 502 ! interface GigabitEthernet0/3.1 vlan 503 ! interface GigabitEthernet0/3.2 vlan 504 ! interface Management0/0 ! enable password 8Ry2YjIyt7RRXU24 encrypted hostname DC-5520-1 ftp mode passive pager lines 24 no failover no asdm history enable arp timeout 14400 console timeout 0 ! !Admin context configuration. Management0/0 interface is allocated for the admin context admin-context admin context admin allocate-interface Management0/0 config-url disk0:/admin.cfg ! ! Virtual context for RADIUS and Domain Controllers context authservers description Virtual context for Radius and Domain Controllers allocate-interface GigabitEthernet0/0.1 allocate-interface GigabitEthernet0/1.1 config-url disk0:/authservers.cfg ! !Virtual context for e-commerce applications context ecommerce description Virtual context for e-commerce applications allocate-interface GigabitEthernet0/0.2 allocate-interface GigabitEthernet0/1.2 config-url disk0:/ecommerce.cfg ! ! Virtual context for databases and third-party application context databases description Virtual context for databases and third-party app allocate-interface GigabitEthernet0/0.3 allocate-interface GigabitEthernet0/1.3 config-url disk0:/databases.cfg ! !Virtual context for email and DNS servers context maildns description Virtual context for email and DNS servers allocate-interface GigabitEthernet0/0.4 allocate-interface GigabitEthernet0/1.4 config-url disk0:/maildns.cfg !Virtual context for active/active failover context FO_context1 allocate-interface GigabitEthernet0/2.1 allocate-interface GigabitEthernet0/3.1 config-url flash:/FO_context1.cfg failover-group 1 ! !Virtual context for active/active failover context FO_context2 allocate-interface GigabitEthernet0/2.2 allocate-interface GigabitEthernet0/3.2 config-url flash:/FO_context2.cfg failover-group 2

The Cisco ASA 5520s at SecureMe's data center include a configuration for each context that identifies the security policy for each zone. Figure 22-8 illustrates one of the security contexts (maildns context) within the respective data center zone.

Figure 22-8. Mail and DNS Server Data Center Zone

Example 22-12 shows the maildns virtual context configuration.

Example 22-12. maildns Context Configuration

DC-5520-1/maildns(config)# show running-config : Saved : ASA Version 7.0(1) firewall transparent names ! interface GigabitEthernet0/1.4 nameif inside security-level 100 ! interface GigabitEthernet0/0.4 nameif outside security-level 0 ! enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted ! !ASA automatically configures the hostname parameters to the context name hostname maildns ! !ACL allowing only mail and DNS traffic to corresponding servers access-list maildns extended permit tcp any host 10.20.4.50 eq smtp access-list maildns extended permit tcp any host 10.20.4.50 eq pop3 access-list maildns extended permit tcp any host 10.20.4.50 eq imap4 access-list maildns extended permit udp any host 10.20.4.98 eq domain access-list maildns extended permit udp any host 10.20.4.99 eq domain pager lines 24 mtu outside 1500 mtu inside 1500 ip address 10.10.1.55 255.255.255.0 no asdm history enable arp timeout 14400 ! !A static NAT is configured to limit the maximum number of connections to 10000 and !maximum embryonic connections to 500. static (inside,outside) 10.20.4.0 10.20.4.0 netmask 255.255.255.0 tcp 10000 500 static (inside,outside) 10.20.4.0 10.20.4.0 netmask 255.255.255.0 udp 10000 500 ! !Access-group for the previously configured access-list access-group maildns in interface outside timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute no snmp-server location no snmp-server contact snmp-server enable traps snmp telnet timeout 5 ssh timeout 5 ! class-map inspection_default match default-inspection-traffic ! ! policy-map global_policy class inspection_default inspect dns maximum-length 512 inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp ! service-policy global_policy global Cryptochecksum:00000000000000000000000000000000 : end [OK] DC-5520-1/maildns(config)#

ESMTP inspection is configured in the maildns context. All other security contexts are configured similarly to the maildns context, except for the appropriate ports and protocols allowed for each application.