Configuring Azure Site to Site VPN with Cisco ASA 9.x Firewall

It is highly likely you will be required to create a site to site VPN from your on-premises network to the Azure public cloud. In order to do this you must have a compatible VPN peer that is capable of terminating the IPsec VPN. All of the main network vendors have supported devices such as Cisco, Juniper and Palo Alto etc. You can consult the following website to see what devices are supported;

https://azure.microsoft.com/en-us/documentation/articles/vpn-gateway-about-vpn-devices/

Windows Server 2012/2012 R2 is also a supported configuration with the Routing and Remote Access (RRAS) role installed, this however when I tried to do it behind my Cisco ASA I could not get it to work. If you research around some forums etc most people only get RRAS to work with Azure if it is directly connected to the internet without any kind of NAT in-between. Most enterprises won’t be using RRAS anyway.

This example will cover setting up an Azure vNet with an Azure Gateway that is connected to a Cisco ASA 5505 firewall. At the time of writing Azure automatically generated configuration scripts for Cisco and Juniper devices, although these sometimes need tweaking before they work correctly, I cover this further down.

Define Local Network

The first stage is to define the Local Network, which is the network space in which your on premise environment works with. It is with the Local Network you also specify the outside global address that your VPN device has on its outside (or public) interface.

Open the Azure Management console, click New then Network Services, Virtual Network and then Custom Create.

Input a name for the local network, something descriptive is best and then enter the VPN Device IP as stated above.

You must then specify the address space that is being used within your on premise network, the address spaces used on premise and the cloud cannot overlap. Therefore you cannot have 192.168.1.0/24 on site and in the cloud.

Define DNS Servers

The next step is to define the name resolution servers, you require at least one on premise and in the cloud, click New > Network Services > Virtual Network > Register DNS Server and define the DNS servers.

Create Virtual Network

Now create a new Virtual Network click New > Network Services > Virtual Network > Custom Create. The vNet is the logical entity that the VM instances connect to.

Enter a descriptive name for the vNet and set the location. 

From the next pane click the DNS Servers that were defined in the previous step. Tick Configure site-to-site VPN and then select the Local Network object that was defined in a previous step.

Now configure the address spaces you intend to use for your cloud based instances. Also click Add Gateway Subnet this will provision a small subnet to be used for the inter-tunnel communications. 

When the network is created the next step is to create a Virtual Gateway, which is assigned a public address. This process can take around 15-20 minutes to complete.  Click Create Gateway and select the Routing type, the Cisco ASA actually only supports Static Routing. Consult the following document to check if dynamic routing is supported for your VPN device 

https://azure.microsoft.com/en-us/documentation/articles/vpn-gateway-about-vpn-devices/

Click Yes to confirm you want to create a gateway.

The interface will appear like it is below, the VPN cannot be formed until the VPN device is up dated with the configuration script. Unfortunately if you do not have a Cisco or Juniper firewall device you may have to do some manual configuration.

Click Download VPN Device Script from under Quick Glance. You can then select what options suit your environment, I hope Microsoft increase the number of devices and operating systems. The current options do not come close to what Amazon Web Services offers, they have pre-created scripts for almost all of the networking vendors I can name, with multiple different operating system versions.

Something that is not obvious when you download the configuration script for the Cisco ASA is that it assumes your firewall's interfaces are called inside/outside, for example some environments use private/public, this is not obvious if you are not a familiar with firewall scripts. I have highlighted everything below that must be changed to reflect your exact firewall configurations.

! Microsoft Corporation ! Windows Azure Virtual Network ! This configuration template applies to Cisco ASA 5500 Series Adaptive Security Appliances running ASA Software 8.3. ! It configures an IPSec VPN tunnel connecting your on-premise VPN device with the Azure gateway. ! --------------------------------------------------------------------------------------------------------------------- ! ACL and NAT rules ! ! Proper ACL and NAT rules are needed for permitting cross-premise network traffic. ! You should also allow inbound UDP/ESP traffic for the interface which will be used for the IPSec tunnel. object-group network azure-networks  network-object 172.16.0.0 255.240.0.0  exit object-group network onprem-networks  network-object 10.0.0.0 255.0.0.0  exit access-list azure-vpn-acl extended permit ip object-group onprem-networks object-group azure-networks nat (inside,outside) source static onprem-networks onprem-networks destination static azure-networks azure-networks ! --------------------------------------------------------------------------------------------------------------------- ! Internet Key Exchange (IKE) configuration ! ! This section specifies the authentication, encryption, hashing, Diffie-Hellman, and lifetime parameters for the Phase ! 1 negotiation and the main mode security association. We have picked an arbitrary policy # "10" as an example. If ! that happens to conflict with an existing policy, you may choose to use a different policy #. crypto isakmp enable outside crypto isakmp policy 10  authentication pre-share  encryption aes-256  hash sha  group 2  lifetime 28800  exit ! --------------------------------------------------------------------------------------------------------------------- ! IPSec configuration ! ! This section specifies encryption, authentication, and lifetime properties for the Phase 2 negotiation and the quick ! mode security association. crypto ipsec transform-set azure-ipsec-proposal-set esp-aes-256 esp-sha-hmac crypto ipsec security-association lifetime seconds 3600 crypto ipsec security-association lifetime kilobytes 102400000 ! --------------------------------------------------------------------------------------------------------------------- ! Crypto map configuration ! ! This section defines a crypto map that binds the cross-premise network traffic to the ! IPSec transform set and remote peer. We have picked an arbitrary ID # "10" as an example. If ! that happens to conflict with an existing crypto map, you may choose to use a different ID #. crypto map azure-crypto-map 10 match address azure-vpn-acl crypto map azure-crypto-map 10 set peer x.x.x.x crypto map azure-crypto-map 10 set transform-set azure-ipsec-proposal-set ! Note that you can only bind one crypto map to the "outside" interface. You can, however, define ! different peer/transform-set within a crypto map and identify them with different IDs. crypto map azure-crypto-map interface outside ! --------------------------------------------------------------------------------------------------------------------- ! Tunnel configuration ! ! This section defines an IPSec site-to-site tunnel connecting to the Azure gateway and specifies the pre-shared key ! value used for Phase 1 authentication.  tunnel-group x.x.x.x type ipsec-l2l tunnel-group x.x.x.x ipsec-attributes  pre-shared-key xxxxxxxxx  exit ! --------------------------------------------------------------------------------------------------------------------- ! TCPMSS clamping ! ! Adjust the TCPMSS value properly to avoid fragmentation sysopt connection tcpmss 1350 exit

For example if you see my interfaces on my home ASA are inside/outside so the script is fine for me, but if your interfaces are different you will have to edit the script. My ASA is also running IOS 9.3 and the script is for 8.3, the difference is how the static NAT statement is written.

You can use the ASDM or an SSH session to your firewall to input the script, if you are using ASDM click Tools and Command Line Interface...

Select Multiple Lines and copy and paste the lines of code into the box, I have found the exit statements in the script get returned by the ASA as none executable code, so I edit them out.

Return to the vNet page and click Connect. If everything has been completed successfully your VPN should form correctly, all of the routes etc should automatically be in place therefore when you ping an on premise server it should get all the way to your Azure instances.

Cloud Security Alliance CCSK Exam Experience

This evening I passed the Cloud Security Alliance CCSK exam, version 3.0. I studied for around a week reading the two documents multiple times that the certification is based on.

https://cloudsecurityalliance.org/wp-content/uploads/2013/02/CCSK-V3-FAQ.pdf

If you have been operating in the cloud space for any time, and have some experience with authentication, key management etc you are probably about half way to passing the exam, this is mainly because some of the questions are common sense.

The pass mark is 80% so you will notice I just passed with 82%, you have 90 minutes to answer 60 questions. Most of the questions are only a couple of sentences, not like some Microsoft certifications where you have a couple of paragraphs to read and digest. Luckily I passed on my first attempt but the $345 (£230) does entitle you to having two attempts.

 If you read over the two study guides a couple of times and understand the content you should have no problems passing CCSK. 

Azure Site to Site VPN Hangs “Disconnecting Local Site” & Azure VM Provisioning Hangs “Creating Windows Server 2012 R2 Datacenter” for 1+ Hour

When you try to drop the Site to Site VPN connection from your data centre to the Azure cloud, it hangs for 30-40 minutes stating “Disconnecting local site….”. It normally only takes a couple of minutes to complete.

The disconnect was performed using the Preview Portal. The only way to force the disconnect is to use PowerShell.

Set-AzureVNetGateway –Disconnect –VNetName networkname –LocalNetworkSiteName sitename

You must do this from an Administrative Azure Powershell prompt. You can authenticate to the tenancy using the;

Get-AzurePublishSettingsFile and Import-AzurePublishSettingsFile

Azure VM Provisioning Hangs “Creating Windows Server 2012 R2 Datacenter” for 1+ Hour

When you provision a new Windows Server 2012 R2 it hangs at the creating VM stage. It sits on “Creating Windows Server 2012 R2 Datacenter” for over an hours.

The following command can be used to force the VM provisioning to be stopped. The –Force switch de-provisions the VM therefore the IP’s etc is released.

Stop-AzureVM -Name vm-name -ServiceName cloud-server-for-vm -Force

Cisco ASA 9.x Static NAT with ASDM “Unable to Reserve Port 443”

I was trying to configure a static NAT rule to allow HTTPS traffic to a hosted web server. When I entered the last command I received “Unable to Reserve Port 443”, this was because another service was currently using TCP port 443.

object network Outside_to_Inside_WS host 192.168.1.166 nat (inside,outside) static interface service tcp 80 80 nat (inside,outside) static interface service tcp 443 443

It was Cisco AnyConnect that was causing the problem as the AnyConnect portal was being published on the HTTPS port. I disabled it from Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles. This is a solution provided you are not using AnyConnect for user VPN. 

If you are you can change the port configured to host AnyConnect by clicking Port Settings…

Config Cisco ASA as Domestic Broadband Router and NetGear Router as Access Point

For about the last 6 months I have had a Cisco ASA 5505 I have meant to install into my home network, I bought it when I was studying for CCNA Security and it proved to be very useful for testing configurations etc. The plan was to implement it on my home network to provide an IPsec VPN for me, whilst away from home. Having a proper firewall on my broadband connection also allows me to configure proper NAT for servers in my lab.

Today I got round to doing it, the topology looks like this;

Virgin Media Cable Modem
NetGear N300 WNR2000v2 (which was the router) AP
Cisco ASA 5505 Router/Firewall


The cable connection terminated into the Virgin Media box, there is then an Ethernet connection to the "outside" interface on the ASA. The physical interface is configured to receive all configuration from the ISP's DHCP (including the default route). One of the ordinary Ethernet interfaces from the NetGear is then connected to the "inside" Layer 2 broadcast domain.

Configure Dynamic PAT

Dynamic Port Address Translation (PAT) is required to allow internal clients on the "inside" network to share the single public IP address on the "outside" interface of the ASA firewall. This will effectively allow the internal clients to "hide" behind the public IP address when accessing resources on the internet.

Click Configuration and expand Objects and then Network Objects/Groups.

Click Add, and then New Network Object. Change the type to Network to allow an entire network range in the PAT rule, name it something descriptive. Click OK.

Click on NAT Rules from the Firewall settings and select Add/Add NAT Rule After "Network Object" NAT Rules...

Source Interface/Address any/any, Destination Interface/Address any/any. Source NAT Type Dynamic PAT (Hide) out of Source Address outside. Please bare in mind these values are relative to my interface names, if for example your external interface was named "internetinterface" that would be instead of "outside".

Configure "outside" ASA interface DHCP from ISP

Configure the ASA's "outside" interface to use DHCP from the domestic broadband provider. You may have a static in which case you would configure the static details here.

Configure "inside" ASA interface as DHCP server

Configure the ASA's "inside" interface to be a DHCP server, this is because the DHCP server on the NetGear box must be disabled.

Configure NetGear router to operate in only "access point" mode

This may vary slightly depending on your domestic router/AP, on mine it was only a case of clicking on LAN Setup disabling the Router as a DHCP Server and then configuring the LAN TCP/IP Setup to be an available static address which is outside of the new DHCP scope configured on the "inside" interface of the ASA.

Test on wireless device

Now if I connect my laptop to the old network SSID if will get a DHCP address from the new pool created on the ASA firewall.

Cisco ASA's Part 2: Enabling the HTTP Server and Configuring Interfaces

If you are not doing Cisco as your full time job, the chances are you get rusty around the exact commands that are required to perform even the easiest tasks. Luckily with Cisco ASA's you have the option to manage the device using a graphical user interface, known as the Adaptive Security Device Manager (or ASDM). Although the ASDM is a great tool, it does have it's down falls, the biggest one being that it's developed in Java.

If your ASA does not currently have any operating system you may need to boot the ASA into ROMMON mode, which can be done by breaking the boot sequence using the ESC key when the firewall is booting.

You will also need a TFTP Server, http://tftpd32.jounin.net/tftpd32_download.html

When you get your ASDM and ASA images onto the devices flash you can statically set them as the primary images to set a file called asdm.bin for example as the primary use the command asdm image flash:/asdm.bin and use show asdm image to ensure it has set properly.

Configure the logical VLAN 1 interface;

interface vlan 1 nameif inside security-level 100 ip address 192.168.1.1 255.255.255.0

Enable the HTTP server for ASDM access;

http server enable http 192.168.1.0 255.255.255.0 inside

Copy the running config to the startup config;

wr mem

Now cable your laptop or computer onto the same physical Layer 2 broadcast domain as the ASA, you will have to manually configure the network interface card with an IP and Subnet Mask on the same logical network as the ASA.

Open a browser and attempt to connect to the ASA's VLAN  1 interface IP via HTTPS. Install the ASDM Launcher, you require valid credentials before it will allow you to download it from here.

By default blank username and password will successfully log you into the ASA.

From the Home screen click, Configuration.

Click Interfaces from under Device Setup, and then click on the Switch Ports tab.

The physical interfaces you are going to use should be Enabled. Clicking Enable SwitchPort is the equivalent of issuing the no shutdown command at the CLI.

Click on the Interfaces tab, and then click Add. Select the physical interface from the Switch Ports list and use the Add button to move it into the Selected Switch Ports list.

Name the Interface, this is the internet facing WAN port so I have named it outside. The Security Level should be the lowest out of all your networks for the internet facing NIC's.

Depending on your ISP, select Obtain Address via DHCP for the WAN IP config, ensure the Obtain default route using DHCP option is selected.

Cisco ASA's Part 1: Introduction to the Cisco ASA Firewall, Stateful Filtering, Security Levels and Interface Names.

Cisco ASA 5505's are excellent hardware firewalls for home and small office environments. They offer most of the features that are available in enterprise-level Cisco Adaptive Appliances. I had to get this one setup in my home lab network so that I could establish a dedicated site-to-site VPN with Microsoft Azure for testing purposes.

The interfaces on an ASA 5505 are numbered from 0-7 (right to left), the last interfaces (6 + 7) are actually Power over Ethernet capable interfaces. My interfaces are configured in the following way.

• Interface 0 - "inside" with Security Level 100
• Interface 1 - "outside" with Security Level 0
• Interface 2 - "dmz" with Security Level 50

Each of the physical interfaces are assigned a name, either "inside", "outside", or "dmz" you can call these anything you like but more often than not you will see them names something similar to the above. 

Security Levels are assigned to interfaces to determine how "trusted" a particular network is. In this example the "inside" network (which is the internal LAN) is configured with the level of 100, then DMZ 50 and the outside (internet facing) 0. By default traffic can flow from higher to lower but not lower to higher. The best analogy I have heard for this is to think of a waterfall, water flows down but cannot flow upwards.

That being said, State-full Filtering is used to ensure that network connectivity can be established through a firewall. For example if you are on the "inside" network on a PC with the address 192.168.1.50/24 and you visit a website on the internet at 81.58.45.20, there is packets leaving the "inside" network flowing down to the "outside" interface. Most network communications would not work if the session could not be established between the PC and the Web Server, this is because the return traffic back from the Web Server to the PC would be hitting a Security Zone (or Level) with a lower value than the internal network. As we said previously, traffic can flow down from higher to lower, but not lower to higher. Static Filtering makes this possible, a state table is maintained by the Cisco ASA firewall to ensure return traffic is dynamically allowed back to the clients even if they reside in a Security Zone with a higher value that the "outside" interface. 

It is also worth noting that the values used are irrelevant, instead of using 100, 50 and 0 you can use 3,2 and 1 and the effect would be the same. 

Installing the ADFS 3.0 SCOM 2012 R2 Management Pack

There is a freely available Management Pack for OpsMgr to monitor the health of an ADFS services in your organization. You can download the OpsMgr ADFS MP from the following website https://technet.microsoft.com/en-us/library/dd279709.aspx

Open the the Operations Manager console, and click Administration and then Management Packs. Click Import Management Packs... from the Tasks list.

Click Add and Add from Disk....

Point to the .MP file that is extracted when you run the installer you downloaded from Microsoft.

Configuring Self-Service Password Reset in Office 365

Self-Service Password Reset can be attractive to customers utilizing Office 365 as it can dramatically reduce help desk calls from users who have forgotten passwords after extended holidays etc. With this users can reset their passwords much like they would for other websites such as eBay, PayPal etc.

Login to Office 365, expand Service Settings and then Passwords. Click on Azure AD Admin Center this will forward you to a trial subscription of Microsoft Azure, this is required as you need access to the Azure AD Admin Center to enable Self-Service Password Resets.

Sign up for a free trial and ensure that is associated with your Office 365 tenancy. You will need a mobile phone to confirm you are not a robot and a valid credit card to sign up for the trial.

Click on Active Directory from the list of services and then select the Configure tab. Now click Yes from the Users Enabled for Password Reset option. 

You can set the authentication method to Office Phone, Mobile Phone, Alternate E-mail Address and Security question, or a mixture of all four. I have selected Mobile Phone and Alternate E-mail Address.

The Require Users to Register When Signing into Access Panel? option ensure users are prompted to configure their password reset options the next time they login.

It is also recommended that Write Back Passwords to On-Premise Active Directory is enabled to ensure all passwords remain in-sync at all times. Click the Save button on the Azure pane.

Now if you try to login as a user, you will be prompted to configure your alternative password reset routes, click Set it up Now on each of them.

To confirm you Mobile Phone you will require a text or phone call. You will receive a code that you have to enter into the web page to confirm the mobile phone is in working order and belongs to you.

The same goes for the alternate e-mail address, if you enter your personal e-mail address in here you will receive a message from Microsoft with a code in.

Click Finish when everything has been completed.

The password reset experience is outlined below.