CloudLabBox
Try the free demo

Cisco ASA lab 7 of 15

Modular Policy Framework: inspection, connection limits, HTTP policy and threat detection

Use the Modular Policy Framework to make HQ-FW visible in traceroute, protect the published web server with connection limits, drop dangerous HTTP requests with an application inspection policy, and watch attacks with threat detection and shun.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 3,584 MB in total. That fits the free demo too.

In your workspace: Shared, then Cisco ASA Firewall SCOR 350-701 guided labs, then 07 - Modular Policy Framework - inspection connection limits HTTP policy and threat detection

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 75 minutes
Nodes need
4 vCPU, 3,584 MB
Smallest plan
Lite

The scenario

HQ-FW runs the NAT and ACLs from labs 3 to 5, and the web server is published at 203.0.113.10. Three tickets are open:

  1. Operations: "The firewall is invisible in traceroute and traceroute to the internet shows nothing but stars after the first hop." Make HQ-FW show up as a hop and make traceroute work through PAT.
  2. Web team: "A SYN flood last month took WEB down." Limit connections to the web server: at most 200 connections and 50 half-open ones in total, 20 and 10 per client, half-open connections dropped after 20 seconds.
  3. Security team: "Scanners keep probing /admin on our web site, and the pen test flagged the TRACE method." Drop both at the firewall and log them. Also turn on threat-detection statistics and block a known attacker, 198.51.100.66, immediately.

What you’ll practise

  • Read the default global_policy and explain class-map, policy-map and service-policy
  • Add ICMP error inspection and TTL decrement so the firewall appears in traceroute through PAT
  • Apply per-interface connection limits and timeouts to a published server
  • Write an HTTP inspection policy-map that drops requests by URI and method
  • Use threat-detection statistics and shun, and explain DNS inspection against tunnelling

The tasks

  1. Read the defaults
  2. Traceroute
  3. Protect the web server
  4. Drop /admin and TRACE
  5. Threat detection and shun
  6. DNS inspection review

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Modular Policy Framework - inspection connection limits HTTP policy and threat detection4 nodes, 3 links. Every link is listed as text below the diagram.HQ-FWPC1WEBISPGi0/1Gi0/0Gi0/0Gi0/0Gi0/2Gi0/0
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HQ-FW Gi0/0 to PC1 Gi0/0
  • HQ-FW Gi0/1 to ISP Gi0/0
  • HQ-FW Gi0/2 to WEB Gi0/0
Nodes in Modular Policy Framework: inspection, connection limits, HTTP policy and threat detection, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQ-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
PC1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
WEBCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco ASA Firewall SCOR 350-701 guided labs.

  3. Open 07 - Modular Policy Framework - inspection connection limits HTTP policy and threat detection and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco ASA labs

All Cisco ASA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.