Network Firewall and Access Control List (ACL)

Routers and firewalls perform an important security function because access control lists (ACL) are typically configured on them. ACLs are ordered sets of rules that control the traffic that is permitted or denied to use a path through a router. These rules can operate at Layer 3, making these decisions on the basis of IP addresses, or at Layer 4,when only certain types of traffic are allowed. When this is done, the ACL typically references a port number of the service or application that is allowed or denied.

Access lists operate as a series of if/then statements: If a given condition is met, then a given action is taken. If the condition isn’t met, nothing happens, and the next statement is evaluated. Once the lists are built, they can be applied to either inbound or outbound traffic on any interface. Applying an access list causes the router/firewall to analyze every packet crossing that interface in the specified direction and to take the appropriate action.

Several categories of firewalls are available on the market today, and they vary in both price and functionality:

* Packet filtering firewalls simply check the characteristics of each packet against the firewall rules without any additional intelligence. Packet filtering firewall capabilities are typically found in routers and other network devices and are very rudimentary firewalls.

* Stateful inspection firewalls go beyond packet filters and maintain information about the state of each connection passing through the firewall. These are the most basic firewalls sold as stand-alone products.

* Next-generation firewalls (NGFWs) incorporate even more information into their decision-making process, including contextual information about users, applications, and business processes. They are the current state-of-the-art in network firewall protection and are quite expensive compared to stateful inspection devices.

* Web application firewalls (WAFs) are specialized firewalls designed to protect against web application attacks, such as SQL injection and cross-site scripting.

I've initially allowed ICMP or ping from "any" IP address on the Cisco ASA firewall "outside" interface towards the "inside" IP address of 192.168.1.0/24. The network traffic from higher security level (100) towards a lower security level (0) is allowed by default if there are no ACL applied on the "inside" interface.

ciscoasa# show run access-list
access-list OUTSIDE-IN extended permit icmp any 192.168.1.0 255.255.255.0 echo
access-list OUTSIDE-IN extended permit icmp any 192.168.1.0 255.255.255.0 time-exceeded
access-list OUTSIDE-IN extended permit icmp any 192.168.1.0 255.255.255.0 unreachable

ciscoasa# show run access-group
access-group OUTSIDE-IN in interface outside

ciscoasa# show nameif
Interface                Name                     Security
GigabitEthernet0         outside                    0
GigabitEthernet1         inside                   100


R1#ping 192.168.1.3     
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 56/257/628 ms

R1#ping 192.168.1.50
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.50, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 140/392/620 ms

R1#telnet 192.168.1.50 80
Trying 192.168.1.50, 80 ...
% Connection timed out; remote host not responding

R1#telnet 192.168.1.50 3389
Trying 192.168.1.50, 3389 ...
% Connection timed out; remote host not responding


I need to configure the Cisco ASA firewall to allow network traffic from R1 (200.1.1.1) towards 192.168.1.50 using TCP port 80 (HTTP) and TCP port 3389 (RDP).

ciscoasa# configure terminal
ciscoasa(config)# access-list ?

configure mode commands/options:
  WORD < 241 char  Access list identifier
  alert-interval   Specify the alert interval for generating syslog message
                   106001 which alerts that the system has reached a deny flow
                   maximum. If not specified, the default value is 300 sec
  deny-flow-max    Specify the maximum number of concurrent deny flows that can
                   be created. If not specified, the default value is 4096
ciscoasa(config)# access-list OUTSIDE-IN ?

configure mode commands/options:
  deny      Specify packets to reject
  extended  Configure access policy for IP traffic through the system
  line      Use this to specify line number at which ACE should be entered
  permit    Specify packets to forward
  remark    Specify a comment (remark) for the access-list after this keyword
  rename    rename an existing access-list
  standard  Use this to configure policy having destination host or network
            only
  webtype   Use this to configure WebVPN related policy
ciscoasa(config)# access-list OUTSIDE-IN extended ?

configure mode commands/options:
  deny    Specify packets to reject
  permit  Specify packets to forward
ciscoasa(config)# access-list OUTSIDE-IN extended permit ?

configure mode commands/options:
  <0-255>       Enter protocol number (0 - 255)
  ah           
  eigrp        
  esp          
  gre          
  icmp         
  icmp6        
  igmp         
  igrp         
  ip           
  ipinip       
  ipsec        
  nos          
  object        Specify a service object after this keyword
  object-group  Specify a service or protocol object-group after this keyword
  ospf         
  pcp          
  pim          
  pptp         
  snp          
  tcp          
  udp          
ciscoasa(config)# access-list OUTSIDE-IN extended permit tcp ?

configure mode commands/options:
  A.B.C.D            Source IP address
  any                Abbreviation for source address and mask of 0.0.0.0
                     0.0.0.0
  host               Use this keyword to configure source host
  interface          Use interface address as source address
  object             Keyword to enter source object name
  object-group       Network object-group for source address
  object-group-user  User object-group for source address
  user               User for source address [<domain_nickname>\]<user_name>
  user-group         User-group for source address
                     [<domain_nickname>\\]<user_group_name>
ciscoasa(config)# access-list OUTSIDE-IN extended permit tcp host ?

configure mode commands/options:
  A.B.C.D  Source host IP address

ciscoasa(config)# access-list OUTSIDE-IN extended permit tcp host 200.1.1.1 ?

configure mode commands/options:
  A.B.C.D       Destination IP address
  any           Abbreviation for destination address and mask of 0.0.0.0
                0.0.0.0
  eq            Port equal to operator
  gt            Port greater than operator
  host          Use this keyword to configure destination host
  interface     Use interface address as destination address
  lt            Port less than operator
  neq           Port not equal to operator
  object        Keyword to enter destination object name
  object-group  Optional service object-group name for source port or network
                object-group for destination address
  range         Port range operator
ciscoasa(config)# access-list OUTSIDE-IN extended permit tcp host 200.1.1.1 host 192.168.1.50 ?         

configure mode commands/options:
  eq            Port equal to operator
  gt            Port greater than operator
  inactive      Keyword for disabling an ACL element
  log           Keyword for enabling log option on this ACL element
  lt            Port less than operator
  neq           Port not equal to operator
  object-group  Optional service object-group for destination port
  range         Port range operator
  time-range    Keyword for attaching time-range option to this ACL element
  <cr>
ciscoasa(config)# access-list OUTSIDE-IN extended permit tcp host 200.1.1.1 host 192.168.1.50 eq ?

configure mode commands/options:
  <1-65535>        Enter port number (1 - 65535)
  aol             
  bgp             
  chargen         
  cifs            
  citrix-ica      
  cmd             
  ctiqbe          
  daytime         
  discard         
  domain          
  echo            
  exec            
  finger          
  ftp             
  ftp-data        
  gopher          
  h323            
  hostname        
  http            
  https           
  ident           
  imap4           
  irc             
  kerberos        
  klogin          
  kshell          
  ldap            
  ldaps           
  login           
  lotusnotes      
  lpd             
  netbios-ssn     
  nfs             
  nntp            
  pcanywhere-data 
  pim-auto-rp     
  pop2            
  pop3            
  pptp            
  rsh             
  rtsp            
  sip             
  smtp            
  sqlnet          
  ssh             
  sunrpc          
  tacacs          
  talk            
  telnet          
  uucp            
  whois           
  www            
ciscoasa(config)# access-list OUTSIDE-IN extended permit tcp host 200.1.1.1 host 192.168.1.50 eq 80
ciscoasa(config)# access-list OUTSIDE-IN extended permit tcp host 200.1.1.1 host 192.168.1.50 eq 3389
ciscoasa(config)# show run access-list
access-list OUTSIDE-IN extended permit icmp any 192.168.1.0 255.255.255.0 echo
access-list OUTSIDE-IN extended permit icmp any 192.168.1.0 255.255.255.0 time-exceeded
access-list OUTSIDE-IN extended permit icmp any 192.168.1.0 255.255.255.0 unreachable
access-list OUTSIDE-IN extended permit tcp host 200.1.1.1 host 192.168.1.50 eq www
access-list OUTSIDE-IN extended permit tcp host 200.1.1.1 host 192.168.1.50 eq 3389


R1#telnet 192.168.1.50 80
Trying 192.168.1.50, 80 ... Open
^ZHTTP/1.1 400 Bad Request
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Mon, 19 Mar 2018 06:07:54 GMT
Connection: close
Content-Length: 326

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Bad Request - Invalid Verb</h2>
<hr><p>HTTP Error 400. The request verb is invalid.</p>
</BODY></HTML>

[Connection to 192.168.1.50 closed by foreign host]


R1#telnet 192.168.1.50 3389
Trying 192.168.1.50, 3389 ... Open


You can issue a show access-list command on the Cisco ASA firewall to verify the ACL network traffic hit count.

ciscoasa# show access-list
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)
            alert-interval 300
access-list OUTSIDE-IN; 6 elements; name hash: 0x9ccc1a31
access-list OUTSIDE-IN line 1 extended permit icmp any 192.168.1.0 255.255.255.0 echo (hitcnt=10) 0xa036473d
access-list OUTSIDE-IN line 2 extended permit icmp any 192.168.1.0 255.255.255.0 time-exceeded (hitcnt=0) 0x1b7b2c90
access-list OUTSIDE-IN line 3 extended permit icmp any 192.168.1.0 255.255.255.0 unreachable (hitcnt=0) 0x6ded0a34
access-list OUTSIDE-IN line 4 extended permit tcp host 200.1.1.1 host 192.168.1.50 eq www (hitcnt=1) 0x0f6be67a
access-list OUTSIDE-IN line 5 extended permit tcp host 200.1.1.1 host 192.168.1.50 eq 3389 (hitcnt=2) 0x3c3ca9ab

EC-Council Certified Ethical Hacker (CEH)

I took the Certified Ethical Hacker (CEH) version 10 training last month and sit for the exam afterwards. The CEH version 10 (compared to version 9) added new topics such as Internet of Things (IoT), real-world Vulnerability Assessment, New Emerging Attack Vectors (Cloud, AI, ML). You'll need to initially create an Aspen portal account in order to download the Courseware and Tools to be used. There's a total of 20 chapters or modules in version 10 and the course focuses more on the hacking methods and tools and slightly discuss the countermeasures.

This is the Certificate of Attendance I've received after completing the class evaluation.

There's a separate portal that's used for scheduling and taking the EC-Council exam. This is the CEH certificate which is available for download (PDF format) after 4-5 working days in the Aspen portal.

The CEH certificate is valid for 3 years and you'll need to obtain 120 credits within 3 years in order to do a renewal via the EC-Council Continuing Education (ECE) Program.

Viewing System Logs (Syslogs)

Syslog is a standard for logging and is designed to allow logs to be created on an endpoint server, system, or device, and then bestored locally or sent to a central server or storage system. Because syslog is a standardized format, logs sent in syslog format can be more readily analyzed by log analysis packages. However, there is no required standard for content for the actual log message itself, requiring analysis tools to have plug-ins, modules, or rules designed to handle syslog data from each vendor or device that they analyze.

Syslog contains specific codes to provide information about the program that logs a given message (the facility); the severity level of the message, from level 7 debugging messages to level 0
emergency messages; and of course, the actual message that is being sent.

You can view system logs on a Windows machine (in this case a Windows 2012 Server) by typing on the Search bar: event > click Event Viewer.

You'll see different types of logs under Event Viewer such as Windows logs for Application, Security Setup, System, etc.

Double-click a specific log to view more details. In this case I went to Windows Logs > Security.

 

To view System logs in a Linux (in this case on Ubuntu) click on Search (topmost icon) > type log > click System log

 

It will open syslog by default. You can click on the other log types: auth.log (authentication log), dpkg.log (package manager) and Xorg.0.log (server log).

You can view system logs on a network device by issuing the show logging or show log command. The syslog are stored in a buffer memory and will be lost if the device reboots. Below are the show log output from a Cisco router, switch and ASA firewall in my lab.


R1#show logging
Syslog logging: enabled (0 messages dropped, 3 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

No Active Message Discriminator.

No Inactive Message Discriminator.

    Console logging: level debugging, 23 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level debugging, 23 messages logged, xml disabled,
                    filtering disabled
    Exception Logging: size (8192 bytes)
    Count and timestamp logging messages: disabled
    Persistent logging: disabled

No active filter modules.

    Trap logging: level informational, 26 message lines logged
        Logging Source-Interface:       VRF Name:

Log Buffer (8192 bytes):

*Feb 21 11:14:47.803: %IFMGR-7-NO_IFINDEX_FILE: Unable to open nvram:/ifIndex-table No such file or directory
*Feb 21 11:15:04.839: %LINEPROTO-5-UPDOWN: Line protocol on Interface VoIP-Null0, changed state to up
*Feb 21 11:15:04.847: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Feb 21 11:15:04.855: %LINK-3-UPDOWN: Interface FastEthernet1/0, changed state to up
*Feb 21 11:15:04.863: %LINK-3-UPDOWN: Interface FastEthernet1/1, changed state to up
*Feb 21 11:15:05.791: %SYS-5-CONFIG_I: Configured from memory by console
*Feb 21 11:15:06.159: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to down
*Feb 21 11:15:06.163: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/0, changed state to down
*Feb 21 11:15:06.167: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/1, changed state to down
*Feb 21 11:15:06.319: %SYS-5-RESTART: System restarted --
Cisco IOS Software, 7200 Software (C7200-ADVIPSERVICESK9-M), Version 15.2(4)M11, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2016 by Cisco Systems, Inc.
Compiled Sun 16-Oct-16 07:53 by prod_rel_team
*Feb 21 11:15:06.347: %SNMP-5-COLDSTART: SNMP agent on host R1 is undergoing a cold start
*Feb 21 11:15:06.463: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is OFF
*Feb 21 11:15:06.467: %CRYPTO-6-GDOI_ON_OFF: GDOI is OFF
*Feb 21 11:15:07.799: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down
*Feb 21 11:15:07.811: %LINK-5-CHANGED: Interface FastEthernet1/0, changed state to administratively down
*Feb 21 11:15:07.839: %LINK-5-CHANGED: Interface FastEthernet1/1, changed state to administratively down
*Feb 21 11:15:25.487: %LINEPROTO-5-UPDOWN: Line protocol on Interface NVI0, changed state to up
*Feb 21 11:15:39.299: %SYS-5-CONFIG_I: Configured from console by console
*Feb 21 11:17:06.147: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up
*Feb 21 11:17:07.147: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up
*Feb 21 11:17:07.687: %SYS-5-CONFIG_I: Configured from console by console
*Feb 21 11:17:08.975: %LINK-3-UPDOWN: Interface FastEthernet1/1, changed state to up
*Feb 21 11:17:09.975: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet1/1, changed state to up


SW1#show logging
Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)

Active Message Discriminator:
EXCESS    severity group drops    6
          msg-body       drops    EXCESSCOLL

No Inactive Message Discriminator.

    Console logging: level debugging, 62 messages logged, xml disabled,
                     filtering disabled, discriminator(EXCESS),
                     0 messages rate-limited, 1366 messages dropped-by-MD
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging:  level debugging, 1428 messages logged, xml disabled,
                    filtering disabled
    Exception Logging: size (4096 bytes)
    Count and timestamp logging messages: disabled
    Persistent logging: disabled
    Trap logging: level informational, 1428 message lines logged
        Logging Source-Interface:       VRF Name:
         
Log Buffer (50000 bytes):
*Feb 18 02:36:10.265: %LINK-5-CHANGED: Interface Ethernet2/3, changed state to administratively down
*Feb 18 02:36:11.270: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet2/3, changed state to down
*Feb 18 02:36:25.809: %LINK-3-UPDOWN: Interface Ethernet2/3, changed state to up
*Feb 18 02:36:27.820: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet2/3, changed state to up
*Feb 18 02:36:29.510: %SYS-5-CONFIG_I: Configured from console by console
*Feb 18 02:47:00.774: %LINK-5-CHANGED: Interface Ethernet1/1, changed state to administratively down
*Feb 18 02:47:01.778: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet1/1, changed state to down
*Feb 18 02:47:02.886: %SYS-5-CONFIG_I: Configured from console by console
*Feb 18 02:47:03.810: %LINK-3-UPDOWN: Interface Ethernet1/1, changed state to up
*Feb 18 02:47:05.819: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet1/1, changed state to up
*Feb 18 10:34:34.974: %LINK-5-CHANGED: Interface Ethernet1/3, changed state to administratively down
*Feb 18 10:34:35.979: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet1/3, changed state to down
*Feb 18 10:34:38.116: %SYS-5-CONFIG_I: Configured from console by console
*Feb 18 10:34:39.212: %LINK-3-UPDOWN: Interface Ethernet1/3, changed state to up
*Feb 18 10:34:40.216: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet1/3, changed state to up
*Feb 19 12:19:39.277: %SYS-5-CONFIG_I: Configured from console by console
*Feb 19 12:20:49.850: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet1/1, changed state to up
*Feb 19 13:12:48.851: %AMDP2_FE-6-EXCESSCOLL: Ethernet3/3 TDR=0, TRC


ciscoasa# show logging
Syslog logging: enabled
    Facility: 20
    Timestamp logging: disabled
    Standby logging: disabled
    Debug-trace logging: disabled
    Console logging: disabled
    Monitor logging: disabled
    Buffer logging: level informational, 22 messages logged
    Trap logging: disabled
    Permit-hostdown logging: disabled
    History logging: disabled
    Device ID: disabled
    Mail logging: disabled
    ASDM logging: disabled
%ASA-5-111008: User 'enable_15' executed the 'logging buffered 6' command.
%ASA-5-111010: User 'enable_15', running 'CLI' from IP 0.0.0.0, executed 'logging buffered 6'
%ASA-5-111005: console end configuration: OK
%ASA-5-111007: Begin configuration: console reading from terminal
%ASA-5-111008: User 'enable_15' executed the 'configure terminal' command.
%ASA-5-111010: User 'enable_15', running 'CLI' from IP 0.0.0.0, executed 'configure terminal'
%ASA-5-111008: User 'enable_15' executed the 'interface GigabitEthernet 2' command.
%ASA-5-111010: User 'enable_15', running 'CLI' from IP 0.0.0.0, executed 'interface GigabitEthernet 2'
%ASA-5-111008: User 'enable_15' executed the 'shutdown' command.
%ASA-5-111010: User 'enable_15', running 'CLI' from IP 0.0.0.0, executed 'shutdown'
%ASA-4-411002: Line protocol on Interface GigabitEthernet2, changed state to down
%ASA-4-411003: Interface GigabitEthernet2, changed state to administratively up
%ASA-5-111008: User 'enable_15' executed the 'no shutdown' command.
%ASA-5-111010: User 'enable_15', running 'CLI' from IP 0.0.0.0, executed 'no shutdown'
%ASA-4-411001: Line protocol on Interface GigabitEthernet2, changed state to up
%ASA-4-411004: Interface GigabitEthernet2, changed state to administratively down
%ASA-5-111008: User 'enable_15' executed the 'shutdown' command.
%ASA-5-111010: User 'enable_15', running 'CLI' from IP 0.0.0.0, executed 'shutdown'
%ASA-4-411002: Line protocol on Interface GigabitEthernet2, changed state to down
%ASA-5-111005: console end configuration: OK


The Cisco ASA firewall has a graphical user interface (GUI) called Adaptive Security Device Manager (ASDM). To view real-time firewall syslogs, go to Monitoring > Logging > Real-Time Log Viewer > View.

You can click Pause to temporarily stop generating real-time syslogs. Click on a specific log to view more info under Syslog Details.

It's a best practice to send syslogs to a remote syslog server. I used a Kiwi Syslog Server which is free (for 14 days) in my lab. You need to configure the device to send its syslogs to the syslog server's IP address by issuing the command logging host <SYSLOG IP ADDRESS>.

R2#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
R2(config)#logging ?
  Hostname or A.B.C.D  IP address of the logging host
  alarm                Configure syslog for alarms
  buffered             Set buffered logging parameters
  buginf               Enable buginf logging for debugging
  cns-events           Set CNS Event logging level
  console              Set console logging parameters
  count                Count every log message and timestamp last occurance
  delimiter            Append delimiter to syslog messages
  discriminator        Create or modify a message discriminator
  dmvpn                DMVPN Configuration
  esm                  Set ESM filter restrictions
  exception            Limit size of exception flush output
  facility             Facility parameter for syslog messages
  filter               Specify logging filter
  history              Configure syslog history table
  host                 Set syslog server IP address and parameters
  message-counter      Configure log message to include certain counter value
  monitor              Set terminal line (monitor) logging parameters
  on                   Enable logging to all enabled destinations
  origin-id            Add origin ID to syslog messages
  persistent           Set persistent logging parameters
  policy-firewall      Firewall configuration
  queue-limit          Set logger message queue size
  rate-limit           Set messages per second limit
  reload               Set reload logging level
  server-arp           Enable sending ARP requests for syslog servers when
                       first configured
  source-interface     Specify interface for source address in logging
                       transactions
  trap                 Set syslog server logging level
  userinfo             Enable logging of user info on privileged mode enabling

R2(config)#logging host ?
  Hostname or A.B.C.D  IP address of the syslog server
  ipv6                 Configure IPv6 syslog server

R2(config)#logging host 192.168.1.50
R2(config)#log
*Feb 25 20:19:53.650: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 192.168.1.50 port 514 started - CLI initiated
R2(config)#end         
R2#
*Feb 25 20:20:25.414: %SYS-5-CONFIG_I: Configured from console by console


Just follow the Kiwi Syslog Server installation wizard.