CloudLabBox
Try the free demo

Cisco ASA lab 2 of 15

Secure management: out-of-band access, SSH, NTP authentication, syslog and SNMPv3

Build a hardened management plane on HQ-FW: an out-of-band management interface, local admin accounts with SSH, authenticated NTP from the ISP, syslog to a collector and SNMPv3 with authentication and encryption.

Run this lab

It needs Lite: its 4 nodes are set to 4 vCPU and 3,584 MB in total. That fits the free demo too.

In your workspace: Shared, then Cisco ASA Firewall SCOR 350-701 guided labs, then 02 - Secure management - out-of-band access SSH NTP authentication syslog and SNMPv3

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Beginner
Time
About 60 minutes
Nodes need
4 vCPU, 3,584 MB
Smallest plan
Lite

The scenario

HQ-FW from lab 1 is in production (as in lab 1, the ISP still routes the office range back to it; NAT arrives in lab 4). The security team's audit found the usual gaps: nobody can manage the firewall except from its console, the clock drifts, logs go nowhere and there is no monitoring. Kestrel's policy is that firewalls are managed out of band, from the management network 192.168.100.0/24 where the NMS server lives, and that every management protocol is authenticated and, where possible, encrypted.

ItemValue
Management0/0name management, 192.168.100.1/24
Admin accountadmin, password Kestrel-Admin-26, privilege 15 (you choose Kestrel-Admin-27 at its first login)
Helpdesk accounthelpdesk, password Kestrel-Help-26, privilege 1 (Kestrel-Help-27 after its first login)
NTP server198.51.100.10, MD5 key 1 = Kestrel-NTP-26
Syslog collectorNMS 192.168.100.50, UDP 514, level informational
SNMPv3group KESTREL-NMS (authPriv), user nms-poller, auth SHA Kestrel-Auth-26, priv AES-128 Kestrel-Priv-26, manager NMS

What you’ll practise

  • Configure the ASAv Management0/0 interface as an out-of-band, management-only interface
  • Create local administrator accounts and enable SSH with AAA authentication
  • Configure NTP with MD5 key authentication and accept only authenticated time
  • Send syslog to a collector and choose sensible logging levels
  • Configure SNMPv3 with authPriv security
  • Explain in-band versus out-of-band management and the matching CIS hardening points

The tasks

  1. Bring up the out-of-band interface
  2. Accounts and SSH
  3. Authenticated NTP
  4. Syslog to the collector
  5. SNMPv3
  6. Review the hardening
  7. Save

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Secure management - out-of-band access SSH NTP authentication syslog and SNMPv34 nodes, 3 links. Every link is listed as text below the diagram.HQ-FWPC1ISPNMSGi0/1Gi0/0Gi0/0Gi0/0Mgmt0/0eth0
4 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • HQ-FW Gi0/0 to PC1 Gi0/0
  • HQ-FW Gi0/1 to ISP Gi0/0
  • HQ-FW Mgmt0/0 to NMS eth0
Nodes in Secure management: out-of-band access, SSH, NTP authentication, syslog and SNMPv3, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
HQ-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
PC1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
ISPCisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
NMSAlpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco ASA Firewall SCOR 350-701 guided labs.

  3. Open 02 - Secure management - out-of-band access SSH NTP authentication syslog and SNMPv3 and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco ASA labs

All Cisco ASA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.