Config Cisco ASA as Domestic Broadband Router and NetGear Router as Access Point

For about the last 6 months I have had a Cisco ASA 5505 I have meant to install into my home network, I bought it when I was studying for CCNA Security and it proved to be very useful for testing configurations etc. The plan was to implement it on my home network to provide an IPsec VPN for me, whilst away from home. Having a proper firewall on my broadband connection also allows me to configure proper NAT for servers in my lab.

Today I got round to doing it, the topology looks like this;

Virgin Media Cable Modem
NetGear N300 WNR2000v2 (which was the router) AP
Cisco ASA 5505 Router/Firewall


The cable connection terminated into the Virgin Media box, there is then an Ethernet connection to the "outside" interface on the ASA. The physical interface is configured to receive all configuration from the ISP's DHCP (including the default route). One of the ordinary Ethernet interfaces from the NetGear is then connected to the "inside" Layer 2 broadcast domain.

Configure Dynamic PAT

Dynamic Port Address Translation (PAT) is required to allow internal clients on the "inside" network to share the single public IP address on the "outside" interface of the ASA firewall. This will effectively allow the internal clients to "hide" behind the public IP address when accessing resources on the internet.

Click Configuration and expand Objects and then Network Objects/Groups.

Click Add, and then New Network Object. Change the type to Network to allow an entire network range in the PAT rule, name it something descriptive. Click OK.

Click on NAT Rules from the Firewall settings and select Add/Add NAT Rule After "Network Object" NAT Rules...

Source Interface/Address any/any, Destination Interface/Address any/any. Source NAT Type Dynamic PAT (Hide) out of Source Address outside. Please bare in mind these values are relative to my interface names, if for example your external interface was named "internetinterface" that would be instead of "outside".

Configure "outside" ASA interface DHCP from ISP

Configure the ASA's "outside" interface to use DHCP from the domestic broadband provider. You may have a static in which case you would configure the static details here.

Configure "inside" ASA interface as DHCP server

Configure the ASA's "inside" interface to be a DHCP server, this is because the DHCP server on the NetGear box must be disabled.

Configure NetGear router to operate in only "access point" mode

This may vary slightly depending on your domestic router/AP, on mine it was only a case of clicking on LAN Setup disabling the Router as a DHCP Server and then configuring the LAN TCP/IP Setup to be an available static address which is outside of the new DHCP scope configured on the "inside" interface of the ASA.

Test on wireless device

Now if I connect my laptop to the old network SSID if will get a DHCP address from the new pool created on the ASA firewall.

Cisco ASA's Part 2: Enabling the HTTP Server and Configuring Interfaces

If you are not doing Cisco as your full time job, the chances are you get rusty around the exact commands that are required to perform even the easiest tasks. Luckily with Cisco ASA's you have the option to manage the device using a graphical user interface, known as the Adaptive Security Device Manager (or ASDM). Although the ASDM is a great tool, it does have it's down falls, the biggest one being that it's developed in Java.

If your ASA does not currently have any operating system you may need to boot the ASA into ROMMON mode, which can be done by breaking the boot sequence using the ESC key when the firewall is booting.

You will also need a TFTP Server, http://tftpd32.jounin.net/tftpd32_download.html

When you get your ASDM and ASA images onto the devices flash you can statically set them as the primary images to set a file called asdm.bin for example as the primary use the command asdm image flash:/asdm.bin and use show asdm image to ensure it has set properly.

Configure the logical VLAN 1 interface;

interface vlan 1 nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0

Enable the HTTP server for ASDM access;

http server enable http 192.168.1.0 255.255.255.0 inside

Copy the running config to the startup config;

wr mem

Now cable your laptop or computer onto the same physical Layer 2 broadcast domain as the ASA, you will have to manually configure the network interface card with an IP and Subnet Mask on the same logical network as the ASA.

Open a browser and attempt to connect to the ASA's VLAN  1 interface IP via HTTPS. Install the ASDM Launcher, you require valid credentials before it will allow you to download it from here.

By default blank username and password will successfully log you into the ASA.

From the Home screen click, Configuration.

Click Interfaces from under Device Setup, and then click on the Switch Ports tab.

The physical interfaces you are going to use should be Enabled. Clicking Enable SwitchPort is the equivalent of issuing the no shutdown command at the CLI.

Click on the Interfaces tab, and then click Add. Select the physical interface from the Switch Ports list and use the Add button to move it into the Selected Switch Ports list.

Name the Interface, this is the internet facing WAN port so I have named it outside. The Security Level should be the lowest out of all your networks for the internet facing NIC's.

Depending on your ISP, select Obtain Address via DHCP for the WAN IP config, ensure the Obtain default route using DHCP option is selected.

Cisco ASA's Part 1: Introduction to the Cisco ASA Firewall, Stateful Filtering, Security Levels and Interface Names.

Cisco ASA 5505's are excellent hardware firewalls for home and small office environments. They offer most of the features that are available in enterprise-level Cisco Adaptive Appliances. I had to get this one setup in my home lab network so that I could establish a dedicated site-to-site VPN with Microsoft Azure for testing purposes.

The interfaces on an ASA 5505 are numbered from 0-7 (right to left), the last interfaces (6 + 7) are actually Power over Ethernet capable interfaces. My interfaces are configured in the following way.

• Interface 0 - "inside" with Security Level 100
• Interface 1 - "outside" with Security Level 0
• Interface 2 - "dmz" with Security Level 50

Each of the physical interfaces are assigned a name, either "inside", "outside", or "dmz" you can call these anything you like but more often than not you will see them names something similar to the above. 

Security Levels are assigned to interfaces to determine how "trusted" a particular network is. In this example the "inside" network (which is the internal LAN) is configured with the level of 100, then DMZ 50 and the outside (internet facing) 0. By default traffic can flow from higher to lower but not lower to higher. The best analogy I have heard for this is to think of a waterfall, water flows down but cannot flow upwards.

That being said, State-full Filtering is used to ensure that network connectivity can be established through a firewall. For example if you are on the "inside" network on a PC with the address 192.168.1.50/24 and you visit a website on the internet at 81.58.45.20, there is packets leaving the "inside" network flowing down to the "outside" interface. Most network communications would not work if the session could not be established between the PC and the Web Server, this is because the return traffic back from the Web Server to the PC would be hitting a Security Zone (or Level) with a lower value than the internal network. As we said previously, traffic can flow down from higher to lower, but not lower to higher. Static Filtering makes this possible, a state table is maintained by the Cisco ASA firewall to ensure return traffic is dynamically allowed back to the clients even if they reside in a Security Zone with a higher value that the "outside" interface. 

It is also worth noting that the values used are irrelevant, instead of using 100, 50 and 0 you can use 3,2 and 1 and the effect would be the same. 

Installing the ADFS 3.0 SCOM 2012 R2 Management Pack

There is a freely available Management Pack for OpsMgr to monitor the health of an ADFS services in your organization. You can download the OpsMgr ADFS MP from the following website https://technet.microsoft.com/en-us/library/dd279709.aspx

Open the the Operations Manager console, and click Administration and then Management Packs. Click Import Management Packs... from the Tasks list.

Click Add and Add from Disk....

Point to the .MP file that is extracted when you run the installer you downloaded from Microsoft.

Configuring Self-Service Password Reset in Office 365

Self-Service Password Reset can be attractive to customers utilizing Office 365 as it can dramatically reduce help desk calls from users who have forgotten passwords after extended holidays etc. With this users can reset their passwords much like they would for other websites such as eBay, PayPal etc.

Login to Office 365, expand Service Settings and then Passwords. Click on Azure AD Admin Center this will forward you to a trial subscription of Microsoft Azure, this is required as you need access to the Azure AD Admin Center to enable Self-Service Password Resets.

Sign up for a free trial and ensure that is associated with your Office 365 tenancy. You will need a mobile phone to confirm you are not a robot and a valid credit card to sign up for the trial.

Click on Active Directory from the list of services and then select the Configure tab. Now click Yes from the Users Enabled for Password Reset option. 

You can set the authentication method to Office Phone, Mobile Phone, Alternate E-mail Address and Security question, or a mixture of all four. I have selected Mobile Phone and Alternate E-mail Address.

The Require Users to Register When Signing into Access Panel? option ensure users are prompted to configure their password reset options the next time they login.

It is also recommended that Write Back Passwords to On-Premise Active Directory is enabled to ensure all passwords remain in-sync at all times. Click the Save button on the Azure pane.

Now if you try to login as a user, you will be prompted to configure your alternative password reset routes, click Set it up Now on each of them.

To confirm you Mobile Phone you will require a text or phone call. You will receive a code that you have to enter into the web page to confirm the mobile phone is in working order and belongs to you.

The same goes for the alternate e-mail address, if you enter your personal e-mail address in here you will receive a message from Microsoft with a code in.

Click Finish when everything has been completed.

The password reset experience is outlined below.

How to Configure Office 365 Multi Factor Authentication

Multi Factor Authentication can be attractive to businesses looking to migrate to Office 365, this allows administrators to enforce two methods of authentication on to users. This makes it harder for black hat hackers to compromise corporate data, this is mainly because stolen (or cracked passwords) will not be sufficient to gain access to the Office 365 services. In this example I am going to configure basic MFA with Office 365, there is more advanced features that can be utilized which I will explore in further posts.

Sign in to Office 365 as a Global Administrator, click Active Users and then click Set Up under Set Multi-Factor Authentication Requirements.

Select Users and then click Enable under the Quick Steps pane.

You will be asked to confirm if you want to enable Multi Factor Authentication, click Enable MFA to enable it.

Under the Service Settings tab, ensure Allow users to create app passwords to sign in to non-browser apps this will allow users to create app passwords to ensure they can still use full-functioning clients such as Outlook etc. These app passwords replace the standard passwords in Outlook profiles.

Now if you try to login to Office 365 as a user you will be prompted to complete the setup of MFA. Click Set it up now to continue.

Probably one of the easiest way to integrate MFA, in its most basic fashion with Office 365 is to link user account to company issued mobile phones. Select Authentication Phone and enter your Country Code and Mobile/Cell phone number. I have also selected Send me a code by text message. Click Contact Me.

Within seconds you will receive a 6 digit code from Microsoft.

The screen will automatically refresh allowing you to enter the 6 digit code, once you have done this click Verify.

Take note of this default app password and click Finished.

Now when you try to login as a user you will be prompted with a secondary authentication box for you to populate with the 6 digit code Microsoft will send every time you try to login. As I am connecting via a domain-joined computer ADFS and SSO has passed-through my standard network credentials leaving only the secondary authentication. If you were connecting from an internet computer you would have to enter both sets of credentials.

Another code is sent to my mobile phone to authenticate this login request.

The next step is to create app passwords to ensure users can use full-Outlook etc. Once logged into to Office 365 click on the Settings cog and select Office 365 Settings. You will be faced with this page, Click Additional Security Verification. 

 Click on the App Passwords tab.

Click Create and name the new app password something descriptive.

Office 365 will automatically generate a new app password for you. Select Copy password to clipboard and then Close.

It is within the Outlook profile you should populate with the newly create app password.