Taking stock of an existing ASA Firewall

Question

Imagine you are given an existing network using an ASA firewall. The network works, but you aren't sure of anything else. The firewall may be completely improperly configured, with "outside" actually being inside and "inside" actually being outside, for all you know.

My question is this: what are the commands to take stock of an existing ASA firewall setup? With only CLI access, how do I figure out:

1. What interfaces are available
2. The names of the interfaces
3. The security levels attached to the interfaces
4. The access-lists attached to the interfaces, including rules and directions

I know how to set these things (interface, nameif, security-level, and access-list/access-group), but I don't know how to figure them out given an existing system.

On a related note, is there anything else that I should worry about checking to make sure that the network isn't wide open?

Thanks!

Answer 1

Once you're on the command-line, do a "show run." Then look for the interfaces section. Here's an example:

interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address (outside ip address) 255.255.255.0 
 ospf cost 10
!
interface GigabitEthernet0/1
 speed 1000
 duplex full
 nameif inside
 security-level 100
 ip address (inside ip address) 255.255.240.0 
 ospf cost 10
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 security-level 100
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 shutdown
 nameif management
 security-level 100
 ip address (mgmt ip address) 255.255.255.0 
 ospf cost 10
 management-only

That tells you the port, the name, the security level, and the ip address.

Access lists are a little tricker, since there may be just two or three or potentially hundreds of access lists. Again, "show run" will give you the complete configuration, and you'll have to read through it.

A NAT will look like this:

nat (inside) 0 access-list inside_nat0_outbound

That's inside-to-outside.

A static is usually set to NAT a specific inside server to an outside ip address, like this:

static (inside,outside) (public ip address) (inside ip address) netmask 255.255.255.255

And last, an access list allows the outside public internet to get in for a specified ip or port.

Hope this helps!

Answer 2

The answer to all of the above questions can be summarized with one command: show running-config. This will output the current configuration file which will include the interfaces, their names and addresses, security levels, ACLs, and routing. This should give you all of the information you need to start doing an inventory on the device.

I'd actually also recommend taking a cursory look at ASDM if you don't have much experience with ASAs; some of the commands that make wide-sweeping changes to how the system behaves (NAT control, same-security-level traffic) aren't necessarily intuitive when you see them in a command line config.