November 5, 2020. Chandrodaya Prasad. FTD 6.7 maintains your at-risk security policies in a TLS 1.3 world. FTD 6.7 enhances Cisco firewalls. Cisco ASAv can also scale up/down to meet the needs of dynamic environments. High availability provides resilience. Consistent security everywhere. Gain consistent security policies, enforcement and protection across your physical, virtual, and cloud environments. Cisco ASAv provides advanced protocol inspection, including voice and video.

We’ve likely all heard of Cisco even if we haven’t used it, that’s just how big they are in the networking world — that is until it comes to public cloud. It came as a surprise to me when I could only find sparse snippets of information available online; Cisco’s documentation is there but leaves a little to be desired and a few PDFs from what looks like a Cisco conference but sometimes that’s enough to get started.

So today that’s what I’m going to write about;

How to deploy Cisco ASAv in Azure and the gotchas discovered during setup.

Cisco, like many vendors, do have a marketplace image available to deploy, so this was an obvious starting point for us to test from. Deployment is simple as ever with some basic information needed, subnets, credentials, version etc.

Deployment via any method will result in an image with SSH already enabled and ready to use from anywhere you have a connection to the new VM.
For those that prefer a friendly GUI the ASDM software is available to download from the management IP you created during the deployment:

Anyone who has worked with ASDM before will know this isn’t enough, you’re going to need a version of Java installed locally before you can open the app. I found Java 8 to be the most compatible.
Now you will need to enable the ASDM feature, using SSH you can run the following commands to enable everything necessary for ASDM to connect.

First, I will need to enter administration mode:

This will prompt for a password update to the default admin password, this can be different to the one you used for SSH access.

Now I need to enable the configuration terminal, this allows for commands to be entered that enable services or changes to the ASAv:

Finally, I can enable the ASDM feature by first setting authentication, then starting a http service and finally allowing access to the ASA via the management interface from anywhere (you can change the IP and subnet to lock this down to increase your security measures):

The program is a graphical user interface that automates the process ofcreating surfaces via wire meshes, while providing visual feedback on thestructure, sources, networks, and field points. Antenna modeling software. The program has a parallel execution option.It makes use of MatLab 5.2 to run the program and avails itself of MatLab'smany input and output facilities, such as the use of MatLab languageassemblies that users may add to or modify. A version (SuperNEC Lite) which isrestricted to 300 segments and 3 GTD objects is available at a student price,and a demo is available at the web site.produces a specialized user interface for NEC called ' WireGrid.'

Once everything is complete ASDM should now be able to connect using the management IP and the credentials created during deployment.

By default the ASAv is barely configured and will require the interfaces to be setup and routes to be added for each interface.

The interfaces should receive an IP from Azure via DHCP and unlike other VMs it is best to make these static within the VM as well as at the Azure level.

Something you will likely have noticed during the marketplace deployment is the requirement for 4 NICs, this is mainly forced by the marketplace template but isn’t strictly necessary.
I found that 4 NICs was 1 too many and decided to customise the template for my own needs. The template is available to download from the marketplace and comes in the standard Azure RM template format.

Be mindful that if you are deploying via Azure RM Templates that you will need to accept the Terms and Conditions of the marketplace image, this is normal a tick box via the portal but it will cause your deployment to fail if you don’t do this first:

Run this command using the Azure CLI to find the string value of the terms:

Once complete, take the returned value and use it in the below command to accept the terms, this is at the subscription so be mindful of what you are accepting

Taking the template, I was able to strip out the unnecessary resources including public IPs (this is an internal firewall after all). So now I have a template that can deploy a 3 NIC ASAv into my existing Azure infrastructure.

Deploying the code via Azure CLI or PowerShell is easy enough and there’s plenty of documentation available for that so I’m going to skip over it but here are a few links that might help:

This 3 NIC setup was created to allow the following interfaces:

Management
A connection to a management subnet which I can use to connect to the device from inside the network (unless you are adding a public IP, I don’t advise you do that)

Trusted
The inside interface, this is where all Azure services will forward traffic to get outside Azure or to other environments depending on how you utilise the ASAv.

Untrusted
The outside interface, anything that wants to communicate with Azure must enter the platform through this interface. In this case the traffic is coming via ExpressRoute or Virtual Network Gateway from an on-premise environment.

With these 3 interfaces I now have a very sturdy gateway between Azure and everything else but Azure by default allows traffic to flow everywhere (ignoring NSGs for now). All of my VMs can still go directly to the internet and my Virtual Network peering connections allow traffic to communicate between environments… this defeats the purpose of the ASAv! What I need now is to control my traffic flow and that’s were Azure Route Tables comes in. Azure Route Tables are a very simple concept, but one wrong move and you can break everything!
Azure route tables allow us to forward all traffic for a network range to a virtual appliance, in this case my ASAv.

Ignoring HA for now, we’ll get to that later, all of my traffic will flow to the ASAv on its trusted network interface and now I can add rules in the trusted ACL. This is very useful for inter-vnet traffic and brings vnet peering under the control of the new firewall.

Static routes will need to be added to allow traffic from the Untrusted networks to the trusted networks and vice versa. By default, the ASA sends all internet bound traffic out via the management interface, not beneficial if you plan to make the untrusted interface public facing. You can override this but you will need to be mindful of how your traffic flows in and out of the device, traffic can’t go out one interface and back in another.

So what about NSGs, well I still needed them and one of the biggest discoveries I had was how to surround the ASAv. No matter where your ASA exists it needs to have its own NSG that is not shared with any of your infrastructure even if it’s all in the same vnet.

Azure traffic is inspected at the NSG level BEFORE the routing level and this caused endless problems as I never really had a great picture of how the traffic flowed.

This discovery was an important step in getting all traffic to flow correctly. By creating a new NSG and moving my ASA into that I could segregate it completely and manage the ASA on its own.

Now the silly stuff, HA with the Cisco ASAv is… acceptable. The configuration will allow you to setup HA between to ASAv devices, it will work in Active:Standby and it will failover to the second device as it needs to.

However, Cisco documentation for HA in cloud requires that you give the ASAv access to your cloud platform to allow it to manage your route tables, when the device fails over it updates the route tables with the IP of the secondary device, only for the routes and route tables you’ve told it. In Azure a service principal covers this access and the normal process applies for creating service principal, how you manage its permissions is up to you but limiting to route tables only is a good idea!

Now I know what you’re thinking, why not use load balancers and I did on one side of the ASAv because sadly the HA agent is unable to respond to different HA probes from multiple load balancers… Not for the lack of trying trust me!

Note: Azure itself has a limitation on VMs within an Availability Set, which you should be using for HA devices, all VMs within the set can only be associated with two load balancers, 1 public and 1 private.

Cisco documentation show

Cisco Asav