Monthly Archives: February 2015

OpenWRT: Spinning up Authoritative DNS server

Introduction

During last few months my small home infrastructure has grown in numbers. First there came a beefe virtualization host with 2x AMD Opteron CPUs and 48 GB RAM which runs all labs and is awesome for learning. I named it Sonic after the hedgehog. Then the idea for centralized storage was born, and Synology DS213J together with 2x WD 3TB REDs came on board and is packed with features. My popular ones are Download Station, File Station and Integrated IPSec VPN Server.

As the Internet of Things rises, I bought couple of Raspberry Pi, which one of them runs Openelec as home media center. The others are waiting for new exciting projects that will soon come.

Besides the physical infrastructure, the virtual one have grown even faster with more and more complex labs. Overall there was a need to manage all this stuff more easily and provide layer of abstraction, and home DNS service would make that happen.

After reading number of resources that explained the basics about DNS such as what is the difference between Authoritative, Cache and Forward server, I was confident enough to begin the process of changing the default combined DHCP+DNS service (dnsmasq) in my home router running Openwrt with more capable software. I have chosen bind for the job.

Installing packages

The installation process is very easy, first log into your router via SSH. I am running Barrier Breaker 14.07 on TP-LINK TL-WR941ND. Then using the package manager, install bind-server, bind-tools and isc-dhcp-server-ipv4.

By default, Openwrt includes vi test editor by default, if you are more a nano person, install that package as well. We will use to edit the configuration files later.

BusyBox v1.22.1 (2014-09-20 22:01:35 CEST) built-in shell (ash)
Enter ‘help’ for a list of built-in commands.

  _______                     ________        __
 |       |.—–.—–.—–.|  |  |  |.—-.|  |_
 |   –   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 —————————————————–
 BARRIER BREAKER (14.07, r42625)
 —————————————————–
  * 1/2 oz Galliano         Pour all ingredients into
  * 4 oz cold Coffee        an irish coffee mug filled
  * 1 1/2 oz Dark Rum       with crushed ice. Stir.
  * 2 tsp. Creme de Cacao
 —————————————————–

root@soultrap:~# opkg update
Downloading http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/packages/base/Packages.gz.
Updated list of available packages in /var/opkg-lists/barrier_breaker_base.
Downloading http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/packages/luci/Packages.gz.
Updated list of available packages in /var/opkg-lists/barrier_breaker_luci.
Downloading http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/packages/packages/Packages.gz.
Updated list of available packages in /var/opkg-lists/barrier_breaker_packages.
Downloading http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/packages/routing/Packages.gz.
Updated list of available packages in /var/opkg-lists/barrier_breaker_routing.
Downloading http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/packages/telephony/Packages.gz.
Updated list of available packages in /var/opkg-lists/barrier_breaker_telephony.
Downloading http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/packages/management/Packages.gz.
Updated list of available packages in /var/opkg-lists/barrier_breaker_management.
Downloading http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/packages/oldpackages/Packages.gz.
Updated list of available packages in /var/opkg-lists/barrier_breaker_oldpackages.

root@soultrap:~# opkg install bind-server bind-tools Installing bind-server (9.9.4-1) to root... Downloading http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/pa ckages/oldpackages/bind-server_9.9.4-1_ar71xx.ipk. Installing bind-libs (9.9.4-1) to root... Downloading http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/pa ckages/oldpackages/bind-libs_9.9.4-1_ar71xx.ipk. Installing libopenssl (1.0.2-1) to root... Downloading http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/pa ckages/base/libopenssl_1.0.2-1_ar71xx.ipk. Installing zlib (1.2.8-1) to root... Downloading http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/packages/base/zlib_1.2.8-1_ar71xx.ipk. Installing bind-tools (9.9.4-1) to root... Downloading http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/packages/oldpackages/bind-tools_9.9.4-1_ar71xx.ipk. Configuring zlib. Configuring libopenssl. Configuring bind-libs. Configuring bind-tools. Configuring bind-server.
root@soultrap:~# opkg install isc-dhcp-server-ipv4 Installing isc-dhcp-server-ipv4 (4.2.4-3) to root... Downloading http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/packages/oldpackages/isc-dhcp-server-ipv4_4.2.4-3_ar71xx.ipk. Configuring isc-dhcp-server-ipv4.

root@soultrap:~# opkg install nano
Installing nano (2.3.6-1) to root...
Downloading http://downloads.openwrt.org/barrier_breaker/14.07/ar71xx/generic/packages/packages/nano_2.3.6-1_ar71xx.ipk.
Configuring nano.

Dnsmasq is a combined DHCP and DNS server and it would interfere with bind by default. To still have DHCP capabilities, we will configure the isc-dhcp server. But first uninstall dnsmasq. Clean up by removing the old dhcp leases file.

root@soultrap:~# /etc/init.d/dnsmasq stop
root@soultrap:~# opkg remove dnsmasq
Removing package dnsmasq from root...
Not deleting modified conffile /etc/config/dhcp.
root@soultrap:~# mv /etc/config/dhcp /etc/config/dhcp.backup
root@soultrap:~# rm /var/dhcp.leases

Configuring dhcp and bind

After package installation, we are going to configure dhcpd daemon, and the right place to do that is at /etc/dhcpd.conf.

root@soultrap:~# nano /etc/dhcpd.conf
# dhcpd.conf

authoritative;

default-lease-time 3600;
max-lease-time 86400;

option domain-name-servers 10.0.2.1, 8.8.8.8;
option domain-search “papuckovo.home”;

subnet 10.0.2.0 netmask 255.255.255.0 {
  range 10.0.2.128 10.0.2.191;
  option routers 10.0.2.1;
}

Then enable automatic service start after reboot and start the service.

root@soultrap:~# /etc/init.d/dhcpd enable
root@soultrap:~# /etc/init.d/dhcpd start

We will now focus on bind configuration and the main file to look at is located under /etc/bind/ directory.  The file named.conf will be in our particular interest.

First we will configure DNS forwarders that will be used when looking for something outside our authoritative domain. Popular choices are OpenDNS servers or Google Public DNS Servers, I will use the later one.

Next, we will add one forward and one reverse zone for our home domain papuckovo.home. As you can see they will point to files that will hold our records, and we need to create them.

root@soultrap:~# cat /etc/bind/named.conf
// This is the primary configuration file for the BIND DNS server named.
acl “RFC1918” {
        10.0.0.0/8;
};

options {
        directory “/tmp”;
        recursion yes;
        allow-recursion { RFC1918; };
        allow-transfer { none; };
        // If your ISP provided one or more IP addresses for stable
        // nameservers, you probably want to use them as forwarders.  
        // Uncomment the following block, and insert the addresses replacing
        // the all-0’s placeholder.

        forwarders {
                8.8.8.8;
                8.8.4.4;
        };

        auth-nxdomain no;    # conform to RFC1035
};
// prime the server with knowledge of the root servers
zone “.” {
        type hint;
        file “/etc/bind/db.root”;
};

// be authoritative for the localhost forward and reverse zones, and for
// broadcast zones as per RFC 1912

zone “localhost” {
        type master;
        file “/etc/bind/db.local”;
};
zone “papuckovo.home” {
        type master;
        file “/etc/bind/zones/db.papuckovo.home”;
};
zone “127.in-addr.arpa” {
        type master;
        file “/etc/bind/db.127”;
};
zone “0.in-addr.arpa” {
        type master;
        file “/etc/bind/db.0”;
};
zone “255.in-addr.arpa” {
        type master;
        file “/etc/bind/db.255”;
};
zone “2.0.10.in-addr.arpa” {
        type master;
        file “/etc/bind/zones/db.2.0.10”;
}

Now we will create new folder zones and copy example files from main bind directory.

root@soultrap:~# mkdir /etc/zones
root@soultrap:~# cp /etc/bind/db.local /etc/bind/zones/db.papuckovo.home
root@soultrap:~# cp /etc/bind/db.127 /etc/bind/zones/db.2.0.10

Edit the copied files to suit your needs. The SOA record needs to include domain name and the administrator’s email. You should also increment the Serial number after each change to zone files.

root@soultrap:~# nano /etc/bind/zones/db.papuckovo.home
;
; BIND data file for local loopback interface
;
$TTL    604800
@       IN      SOA     papuckovo.home. root.papuckovo.home. (
                              5         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      soultrap.papuckovo.home.
@       IN      A       10.0.2.1
soultrap        IN     A       10.0.2.1
www01           IN     A       10.0.2.2

Do the same thing for reverse zone

root@soultrap:~# nano /etc/bind/zones/db.2.0.10
;
; BIND reverse data file for local loopback interface
;
$TTL    604800
@       IN      SOA     papuckovo.home. root.papuckovo.home. (
                              5         ; Serial
                         604800         ; Refresh
                          86400         ; Retry
                        2419200         ; Expire
                         604800 )       ; Negative Cache TTL
;
@       IN      NS      soultrap.papuckovo.home.
1       IN      PTR     soultrap.papuckovo.home.
2       IN      PTR     www01.papuckovo.home.

Finally, enable automatic service start after boot and start the service

root@soultrap:~# /etc/init.d/named start
Starting isc-bind
root@soultrap:~# /etc/init.d/named enable

Verification

You can verify the operations of DHCP server by jumping on an internal client and issues ipconfig /renew. Or directly from the router listing dhcpd leases.

root@soultrap:~# head /var/dhcpd.leases
# The format of this file is documented in the dhcpd.leases(5) manual page.
# This lease file was written by isc-dhcp-4.2.4

lease 10.0.2.129 {
  starts 1 2015/02/23 08:19:57;
  ends 1 2015/02/23 08:21:57;
  tstp 1 2015/02/23 08:21:57;
  cltt 1 2015/02/23 08:19:57;
  binding state free;
  hardware ethernet 14:7d:c5:11:19:7f;

You can also verify that DNS server is operating correctly using nslookup or dig.

root@soultrap:~# dig ANY papuckovo.home @localhost
; <<>> DiG 9.9.4 <<>> ANY papuckovo.home @localhost
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 53030
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;papuckovo.home.                        IN      ANY

;; ANSWER SECTION:
papuckovo.home.         604800  IN      SOA     papuckovo.home. root.papuckovo.home. 5 604800 86400 2419200 604800
papuckovo.home.         604800  IN      NS      soultrap.papuckovo.home.
papuckovo.home.         604800  IN      A       10.0.2.1

;; ADDITIONAL SECTION:
soultrap.papuckovo.home. 604800 IN      A       10.0.2.1

;; Query time: 74 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Feb 24 16:04:56 CET 2015
;; MSG SIZE  rcvd: 139

Troubleshooting

Sometimes, things do not go as we expected, it would be great to narrow down the problem.

root@soultrap:~# /etc/init.d/named start
Starting isc-bind
  isc-bind failed to start

The default error message is not very useful and you can investigate further in log file. In this case I have mistyped the allow-transfer keyword in the main configuration file.

root@soultrap:~# logread
Tue Feb 24 16:20:30 2015 daemon.notice named[13361]: BIND 9 is maintained by Internet Systems Consortium,
Tue Feb 24 16:20:30 2015 daemon.notice named[13361]: Inc. (ISC), a non-profit 501(c)(3) public-benefit
Tue Feb 24 16:20:30 2015 daemon.notice named[13361]: corporation.  Support and training for BIND 9 are
Tue Feb 24 16:20:30 2015 daemon.notice named[13361]: available at https://www.isc.org/support
Tue Feb 24 16:20:30 2015 daemon.notice named[13361]: —————————————————-
Tue Feb 24 16:20:30 2015 daemon.info named[13361]: using 1 UDP listener per interface
Tue Feb 24 16:20:30 2015 daemon.info named[13361]: using up to 4096 sockets
Tue Feb 24 16:20:30 2015 daemon.info named[13361]: loading configuration from ‘/etc/bind/named.conf’
Tue Feb 24 16:20:30 2015 daemon.err named[13361]: /etc/bind/named.conf:10: unknown option ‘allow-trasfer’
Tue Feb 24 16:20:30 2015 daemon.crit named[13361]: loading configuration: failure
Tue Feb 24 16:20:30 2015 daemon.crit named[13361]: exiting (due to fatal error)

MACs – Moved Adds and Changes

When adding new records in reverse and forward zone files it is needed to increase the serial number and then reload bind with new configuration.

root@soultrap:~# /etc/init.d/named reload
Stopping isc-bind
Starting isc-bind

Conclusion

Adding name resolution service to your home router will give you great flexibility and easy to use, your everyday users won’t need to be bothered with IP addresses, they can simple type names.

Further Reading

https://www.digitalocean.com/community/tutorials/an-introduction-to-dns-terminology-components-and-concepts

Advertisements

Cisco ASAv firewall REST API: Bulk Requests

Introduction

Continuing on the same track with ASA REST API we are going to explore how to be more efficient when firing up the json code toward our firewalls. In previous example we created a small number of service and network objects and groups, today we are going to experiment with larger number of objects created by smaller number of calls. Lets get the ball rolling.

Bulk service object creation

To create a bulk request we need to adjust some parameters such as API endpoint URL. As you recall, when we created a new service object we were pointing to this URL: https://<management-ip>/api/objects/networkservices.

Now we are going to redesign the call a little bit and will always point to same endpoint regardless of object type. We will simply use https://<management-ip>/api and the more specific resource URI will be part request body. This allows us for example create bulk of service and network objects in one call.

[
  {
    "resourceUri": "/api/objects/networkservices",
    "data": {     
  "kind": "object#TcpUdpServiceObj",
  "name": "TCP-21",
  "value": "tcp/21"
}, "method": "Post" }, { "resourceUri": "/api/objects/networkservices",    "data": {
  "kind": "object#TcpUdpServiceObj",
  "name": "TCP-22",
  "value": "tcp/22"
}, "method": "Post" }, { "resourceUri": "/api/objects/networkservices",    "data": {
  "kind": "object#TcpUdpServiceObj",
  "name": "TCP-23",
  "value": "tcp/23"
}, "method": "Post" }, { "resourceUri": "/api/objects/networkservices", "data": {
  "kind": "object#TcpUdpServiceObj",
  "name": "TCP-24",
  "value": "tcp/24"
}, "method": "Post" }
]

If everything is hunky dory you will receive a Status Code 200 OK and response body will contain additional details.

{
"entryMessages":
[
     {
     "resourceUri":"/api/objects/networkservices",
     "method":"POST",
     "selfLink":"http://10.201.230.5/api/objects/networkservices/TCP-21",
     "messages":
     [
         {
         "level":"Info",
         "code":"201",
         "details":"Created (201) - The request has been fulfilled and resulted in a new resource being created"
          }
     ]
     },
     {
     "resourceUri":"/api/objects/networkservices",
     "method":"POST",
     "selfLink":"http://10.201.230.5/api/objects/networkservices/TCP-22",
     "messages":
     [
         {
         "level":"Info",
         "code":"201",
         "details":"Created (201) - The request has been fulfilled and resulted in a new resource being created"
         }
     ]
     },
     {
     "resourceUri":"/api/objects/networkservices",
     "method":"POST",
     "selfLink":"http://10.201.230.5/api/objects/networkservices/TCP-23",
     "messages":
     [
         {
         "level":"Info",
         "code":"201",
         "details":"Created (201) - The request has been fulfilled and resulted in a new resource being created"
         }
     ]
     },
     {
     "resourceUri":"/api/objects/networkservices",
     "method":"POST",
     "selfLink":"http://10.201.230.5/api/objects/networkservices/TCP-24",
     "messages":
     [
         {
         "level":"Info",
         "code":"201",
         "details":"Created (201) - The request has been fulfilled and resulted in a new resource being created"
         }
     ]
     }
],
"commonMessages":[]
}

Ideally your deployment script would examine the response and capture the self links that can be used to un-deploy this call. Also the message details are important to verify if objects were successfully created.

Now we are going to look at error handling by creating another request that will have one already existing object and one new in it.

[
  {
    "resourceUri": "/api/objects/networkservices",
    "data": {     
  "kind": "object#TcpUdpServiceObj",
  "name": "TCP-24",
  "value": "tcp/24"
}, "method": "Post" }, { "resourceUri": "/api/objects/networkservices", "data": {
  "kind": "object#TcpUdpServiceObj",
  "name": "TCP-25",
  "value": "tcp/25"
}, "method": "Post" }
]

The response header will contain 400 Bad Request status code and body will reveal some clues.

{
"entryMessages":
[
     {
     "resourceUri":"/api/objects/networkservices",
     "method":"POST",
     "messages":
     [
         {
         "level":"Error",
         "code":"DUPLICATE",
         "context":"objectId",
         "details":"TCP-24"
         }
     ]
     },
     {
     "resourceUri":"/api/objects/networkservices",
     "method":"POST"
     }
],
"commonMessages":[]
}

The result result is that even the second object did not exists it was not created. When you reverse the object order in request, it will not help either. This means that the entire request need to create unique objects otherwise it will fail. So watch for return codes.

I have tried to create 103 unique objects in one request and I have found that the upper limit for single request is 100 entries.

{
"commonMessages":
[
     {
     "level":"Error",
     "code":"MAX-ENTRIES-LIMIT-EXCEEDED",
     "details":"The number of entries found are, 103. The bulk entries limit:100"
     }
]
}

Lets go back to our first four service objects and undeploy them using four unique DELETE Requests. The resource URIs are as follows:

Note: So far I have not found way of performing multiple object removal in single request. It seems that bulk operation only supports POST method toward service objects at the moment. The following below did not work.

[
  {
    "resourceUri": "/api/objects/networkservices/TCP-21",
    "method": "Delete"
  },
  {
    "resourceUri": "/api/objects/networkservices/TCP-21",
    "method": "Delete"
  }
]

Response had status code 400 Bad Request even if those URI are indeed valid and you can query them with GET request.

{
"entryMessages":
[
     {
     "resourceUri":"/api/objects/networkservices/TCP-21",
     "method":"DELETE",
     "messages":
     [
         {
         "level":"Error",
         "code":"INVALID-INPUT",
         "details":"Invalid resourceUri:/api/objects/networkservices/TCP-21"
         }
     ]
     },
     {
     "resourceUri":"/api/objects/networkservices/TCP-21",
     "method":"DELETE",
     "messages":
     [
         {
         "level":"Error",
         "code":"INVALID-INPUT",
         "details":"Invalid resourceUri:/api/objects/networkservices/TCP-21"
         }
     ]
     }
],
"commonMessages":[]
}

The 100 objects limitations also affect how are the responses constructed. When you query the following resource https://<management-ip>/api/objects/networkservices you will see that the body contains only 100 items even if 110 exists. You can see this by examining the offset, limit and total fields on body.

{
   "kind": "collection#NetworkServiceObjects",
   "selfLink": "https://10.201.230.5/api/objects/networkservices",
   "rangeInfo":
   {
       "offset": 0,
       "limit": 100,
       "total": 110
   },

Funny enough, the list will not start with the first configure service objects, but started from TCP-100 up till TCP-200. To see other items you need to manipulate the offset value. We can demonstrate this using API Console at documentation page.

rest-api-offset

Now the item list will start from TCP-110 and will include our older objects such as TCP-21, TCP-22 etc. You can also play with the limit parameter to constrain number of returned objects. If you look at Inspector, you will see the request parameters have been modified to include our query parameters.

rest-api-offset-body

Conclusion

Bulk object creation and retrieval handling should help you build more efficient communication patters between the firewall and automation tool or network controller.

Cisco ASAv firewall HA Pair

Introduction

In previous post I have introduced and demonstrated the ASA in virtual form factor. This post will built on top of previous that one and will show you how to setup redundant high available pair of these firewalls.

The HA setup is ideal in situations where you are building virtual infrastructure hosted on private or public cloud that needs to be available all the time, surviving failure of one of the firewalls that run as virtual machines. Standard vSphere VM placement best practices should be also considered, such as anti-affinity rules and resource allocation. Consult these with you VMware administrators.

The following diagram outlines the final setup. My home lab only has one ESXi hosts, so everything is running over there.

ASAv HA Setup

Active Firewall rollout

Start with the deployment of first firewall which will be the active one. After downloading the OVA package from Cisco go to vSphere\Virtual Machines\Right Click on Cluster\Deploy OVF Template.

asav-ha-step1

After browsing and selecting the OVA package, I am using asav931.ova, you will be ask to accept the extra configuration options and estimated disk size requirements.

asav-ha-step2

Next, accept the license agreement and and click next. You will have an option to select the name of the new primary ASA which will be ASAv03-Active and the location of the VM.

asav-ha-step3

You will now have a choice to select deployment size, from 1vCPU Standalone all the way up to 4vCPU. If you are deploying in production, you should consult the deployment guide for the right flavor. I am deploying in lab, therefore I have selected 1vCPU HA Primary.

asav-ha-step4

After selecting the deployment size, we need to specify the resource that ASAv will consume. If you select a cluster DRS can automatically place the VM to least utilized hypervisor. You can also specify certain ESXi hosts. I have just one ESXi host, so the choice will be obvious.

asav-ha-step5

To same some storage space, change the default virtual disk format from Thick Provisioned to Thin Provision.

On the next page, we need to configure network mapping. ASAv has by default 10 vNIC adapters which first of them is the Management and the last Gig0/8 is used by HA Heartbeat. Remaining interfaces can be used for production traffic. We leave unused interface in DMZ for now.

asav-ha-step6

Now you have an option to Customize the template by typing configuration parameters such as Management Interface Settings, Device Manager IP Settings and HA Connection Settings.

The Management address of Primary Unit will be 172.16.2.1/24 and Secondary will be 172.16.2.2/24. The default gateway will not be required at this moment, our management station sits on the same virtual switch. To allow remote access from day 1, specify that the allowed management subnet is 172.16.2.0/24

The Primary Unit HA address will be 172.16.3.1/24 and the Secondary will be 172.16.3.2/24.

asav-ha-step7

In Ready to Complete page, you get the summary of all configuration options, and you will have a choice to Power VM after deployment. Congratulations you just deployed your first HA Pair Firewall. After first power on, ASAv will perform initial configuration and reboot.

If everything worked as expected, you should be able to log in from management station via SSH.

asav-ha-step8

By default, however, not username was configured in template therefore it is still needed to jump to virtual console and create one and point the AAA authentication for SSH to local user database.

It is also worth to mention that although ASDM https access was enable, it would still need to have an account and aaa authentication configured properly to work.

ciscoasa(config)# username admin password cisco privilege 15
ciscoasa(config)# enable password cisco
ciscoasa(config)# aaa authentication ssh console LOCAL

Now you can actually connect to the ASA remotely. If you examine the configuration a little bit you find that it has setup the failover interface and peer and currently shows that its mate is down/unknown.

ciscoasa# sh failover
Failover On
Failover unit Primary
Failover LAN Interface: fover GigabitEthernet0/8 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 1 of 61 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.3(1), Mate Unknown
Last Failover at: 10:16:56 UTC Feb 20 2015
        This host: Primary – Active
                Active time: 873 (sec)
                slot 0: empty
                  Interface management (172.16.2.1): Unknown (Waiting)
        Other host: Secondary – Failed
                Active time: 0 (sec)
                  Interface management (172.16.2.2): Unknown (Waiting)
 

ciscoasa# show failover state

State          Last Failure Reason      Date/Time
This host  –   Primary
Active         None
Other host –   Secondary
Failed         Comm Failure             10:17:13 UTC Feb 20 2015

====Configuration State===
====Communication State===

Standby Firewall rollout

Before we are going to configure the other interfaces, lets set up the secondary unit. Again we are going to start by deploying a template from .OVA. To save some space, I will only show difference from deploying the primary unit.

The VM name will be set to ASAv03-Standby, and the deployment configuration will be set to 1vCPU HA Secondary. Selecting the right resource in production should be also considered to minimize that a single hypervisor failure will cause both firewalls go down. Therefore I recommended anti-affinity rules so those two VMs will never run on same machine.

The interface mapping will be exactly same as with primary unit. See the reference above. In the customization template page, enter the Management IP address and HA IP address settings for this unit.

asav-ha-step9

Deployment of this small flavor took no longer than 30 seconds, and after the initial reboot the Standby firewall is up an running.

While still setting remotely on primary unit we are going to check the failover pair state again.

Beginning configuration replication: Sending to mate.
ciscoasa# show failover
Failover On
Failover unit Primary
Failover LAN Interface: fover GigabitEthernet0/8 (up)
Unit Poll frequency 1 seconds, holdtime 15 seconds
Interface Poll frequency 5 seconds, holdtime 25 seconds
Interface Policy 1
Monitored Interfaces 1 of 61 maximum
MAC Address Move Notification Interval not set
Version: Ours 9.3(1), Mate 9.3(1)
Last Failover at: 10:16:56 UTC Feb 20 2015
        This host: Primary – Active
                Active time: 2111 (sec)
                slot 0: empty
                  Interface management (172.16.2.1): Normal (Monitored)
        Other host: Secondary – Standby Ready
                Active time: 0 (sec)
                  Interface management (172.16.2.2): Normal (Waiting)

ciscoasa# sh failover state

               State          Last Failure Reason      Date/Time
This host  –   Primary
               Active         None
Other host –   Secondary
               Standby Ready  Comm Failure             10:17:13 UTC Feb 20 2015

====Configuration State===
        Sync Done
====Communication State===
        Mac set

====VM Properties Compatibility===
vCPUs – This host:  1
        Other host: 1
Memory – This host:  2048 Mhz
         Other host: 2048 Mhz
Interfaces – This host:  9
             Other host: 9

Looking much better now. To see failover in action, lets first complete the configuration of other interfaces to get some traffic flowing through the firewall

prompt hostname priority state
!
interface GigabitEthernet0/0
 description OUTSIDE
 nameif outside
 security-level 0
 ip address 10.0.2.91 255.255.255.0 standby 10.0.2.92
!
interface GigabitEthernet0/1
 description INSIDE
 nameif inside
 security-level 100
 ip address 172.16.0.1 255.255.255.0 standby 172.16.0.2
!
interface GigabitEthernet0/2
 description DMZ
 nameif dmz
 security-level 50
 ip address 172.16.1.1 255.255.255.0 standby 172.16.1.2
!
monitor-interface outside
monitor-interface inside
monitor-interface dmz
!
route outside 0 0 10.0.2.1
!
policy-map global_policy
 class inspection_default
  inspect icmp

My outside router does not have static routes to these private network behind ASA so a object NAT will help to mitigate that.

object network inside_net
 subnet 172.16.0.0 255.255.255.0
nat (inside,outside) source dynamic inside_net interface

Now we should have connectivity from inside host to Internet. We get verify that by pulling google web page from client and also checking the NAT or connection table.

ciscoasa# sh nat detail
Manual NAT Policies (Section 1)
1 (inside) to (outside) source dynamic inside_net interface
    translate_hits = 12, untranslate_hits = 0
    Source – Origin: 172.16.0.0/24, Translated: 10.0.2.91/24

Now start continuous ping from inside machine and power off the primary firewall.

root@deb01:~# ping -c 100 8.8.8.8
100 packets transmitted, 85 received, 15% packet loss, time 99250ms
rtt min/avg/max/mdev = 10.771/11.988/21.956/2.426

From the output, I examined that from 100 packets, 15 was lost during switchover. With default pool and hold times it was not amazingly fast. We can do better.

failover polltime unit 1 holdtime 3
failover polltime interface 1 holdtime 5

Repeat the 100 ping test again and examine the results.

Now with adjusted timers, from 100 packets we lost 4 during switchover. Getting better :-). Lets see how this HA pair will cope with TCP sessions.

We are going to initiate a large file download from inside host and then shutdown the secondary (now active) ASA and examine the result on traffic flow.

The primary ASA took back the role of Active Firewall, but the TCP session has died. There is one another parameter that we need to tweak for HTTP sessions and to explicitly enable them.

ciscoasa/pri/act(config)# failover replication http
Now initiate the download again, and check that it will be re-established after failover.

Conclusion

After tweaking some default settings you have a highly available firewall cluster running in fully visualized environment.

s

Cisco ASAv firewall REST API – Resource Manipulation

Introduction

After the initial article about ASAv REST API we are going to explore how we can granularity manipulate various resources such as objects and object-groups. You will learn how to create modify, verify and delete each object type.

This can be useful when building an automation tool that needs to perform various configuration changes programmatically.

Service Object

Service objects are one of the most common objects types used in firewall. They can define OSI Layer 4 TCP and UDP ports as well as other protocols such as ARP, or GRE. We are going to demonstrate some basic operations that can be carried out with this type of object. CLI reference is also provided for comparison with REST API.

Create

CLI Reference

object service UDP-88
 service udp destination eq 80

Request Format

Header:
URL: https//<management-ip>/api/object/networkservices
Method: POST

Body:

{
  "kind": "object#TcpUdpServiceObj",
  "name": "UDP-88",
  "value": "udp/80"
}

Response Format

Header:
Status Code: 201 Created
Accept-Ranges: bytes
Content-Length: 0
Date: Wed, 18 Feb 2015 09:52:01 GMT
Server: CiscoASARestApiServer
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept

As you can see, when we created new object we got its location URI. We will reference this address when doing changes or object removal. For service object the reference name is the object ID.

Modify

CLI Reference

object service UDP-88
 service udp destination eq 88

Request Format

Header:
URL: https//<management-ip>/api/objects/networkservices/UDP-88
Method: PATCH

Body:

{
  “kind”: “object#TcpUdpServiceObj“,
  “name”: “UDP-88“,
  “value”: “udp/88
}

Response Header Format

Header:
Status Code: 204 No Content
Accept-Ranges: bytes
Content-Length: 0
Date: Wed, 18 Feb 2015 09:52:48 GMT
Server: CiscoASARestApiServer
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept
Patch request can be used to change resource attributes such as value or name.

Retrieve

CLI Reference

show run | be object service UDP-88
 Note: As ASA CLI does not include show object id command, this was the easiest way how to list object in running configuration.

Request Format

Header:

URL: https://<management-ip>>/api/objects/networkservices/UDP-88
Method: GET

Body: Empty

Response Format

Header:
Status Code: 200 OK
Accept-Ranges: bytes
Content-Length: 158
Content-Type: application/json; charset=UTF-8
Date: Wed, 18 Feb 2015 09:58:14 GMT
Server: CiscoASARestApiServer
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept
Body:
{
   “kind”: “object#TcpUdpServiceObj“,
   “name”: “UDP-88“,
   “value”: “udp/88“,
   “objectId”: “UDP-80
}

GET request does not require anything in request body and when referencing certain object ID such as UDP-88 it will return just single resource. To get list of all resources under parent resource just remove the ID from the end of URL.

Delete

CLI Reference

no object service UDP-88

Request Format

Header
URL: https://<management-ip>/api/objects/networkservices/TCP-88
Method: DELETE

Body: Empty

Response Format

Header:
Status Code: 204 No Content
Accept-Ranges: bytes
Content-Length: 0
Date: Wed, 18 Feb 2015 10:02:05 GMT
Server: CiscoASARestApiServer

With REST API Delete request, rules still apply that you cannot remove an object that is being used or referenced elsewhere in configuration.

Service Object Group

As name implies service object groups glue together multiple objets. This eases the configuration and provides a little abstraction and simplification when constructing access rules.

Create

CLI Reference

object-group service krb5-udp
 description Default Kerberos UDP port
 service-object object UDP-88

Request Format

(Object within object group)

Header:
URL: https://<management-ip>/api/objects/networkservicegroups
Method: POST

Body:

{
"kind": "object#NetworkServiceGroup",
"name": "krb5-udp",
"members":
[
{
"kind": "objectRef#TcpUdpServiceObj",
"objectId": "UDP-88"
}
],
"description": "Default Kerberos UDP port"
}

Response Format

Header:
Status Code: 200 OK
Accept-Ranges: bytes
Content-Length: 124
Content-Type: application/json; charset=UTF-8
Date: Wed, 18 Feb 2015 10:35:10 GMT
Server: CiscoASARestApiServer
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept

Request Format

(Object group within another object group)

CLI Reference

object-group service krb5-udp
 group-object krb5-udp

Header:

URL: https://<management-ip>/api/objects/networkservicegroups
Method: POST

Body:

{
"kind": "object#NetworkServiceGroup",
"name": "active-directory",
"members":
[
{
"kind": "objectRef#NetworkServiceGroup",
"objectId": "krb5-udp"
}
],
"description": "Default Active Directory ports"
}

Response Format

Header:
Status Code: 201 Created
Accept-Ranges: bytes
Content-Length: 0
Date: Wed, 18 Feb 2015 11:06:44 GMT
Server: CiscoASARestApiServer
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept

Modify

CLI Reference

object-group service krb5-udp
 group-object krb5-udp
 group-object krb5-tcp

Request Format

(To change/add objects withing a group)

URL: https://<management-ip>/api/objects/networkservicegroups/active-directory
Method: PATCH

Body:

{
"kind": "object#NetworkServiceGroup",
"name": "active-directory",
"members":
[
{
"kind": "objectRef#NetworkServiceGroup",
"objectId": "krb5-udp"
},
{ "kind": "objectRef#NetworkServiceGroup", "objectId": "krb5-tcp" } ], "description": "Default Active Directory ports" }

Response Format

Header:
Status Code: 204 No Content
Content-Length: 0
Location: https://10.201.230.5/api/objects/networkservicegroups/active-directory
Server: CiscoASARestApiServer
Accept-Ranges: bytes
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept
Date: Wed, 18 Feb 2015 11:57:32 GMT

Retrieve

CLI Reference

show object-group id active-directory

Request Format

 

URL: https://<management-ip>>/api/objects/networkservicegroups/active-directory
Method: GET

Body: Empty

Response Format

Header:

Status Code: 200 OK
Accept-Ranges: bytes
Content-Length: 512
Content-Type: application/json; charset=UTF-8
Date: Wed, 18 Feb 2015 12:01:52 GMT
Server: CiscoASARestApiServer
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept
Body:
{
   “kind”: “object#NetworkServiceGroup“,
   “name”: “active-directory“,
   “members”:
   [
       {
           “kind”: “objectRef#NetworkServiceGroup“,
           “objectId”: “krb5-tcp
       },
       {
           “kind”: “objectRef#NetworkServiceGroup“,
           “objectId”: “krb5-udp
       }
   ],
   “description”: “Default Active Directory ports“,
   “objectId”: “active-directory
}

Delete

(Entire object group)

CLI Reference

no object-group service active-directory

Request Format

URL: https://<management-ip>/api/objects/networkservicegroups/active-directory

Method: DELETE

Body: Empty

Response Format

Header:
Status Code: 204 No Content
Accept-Ranges: bytes
Content-Length: 0
Date: Wed, 18 Feb 2015 12:11:13 GMT
Server: CiscoASARestApiServer
(Delete Object within a object group)

CLI Reference

object-group service active-directory
 no  group-object krb5-tcp

Request Format

Header:

URL: https://<management-ip>/api/objects/networkservicegroups/active-directory
Method: PATCH

Body:

{
     “kind”: “object#NetworkServiceGroup“,
     “name”: “active-directory“,
     “members”:
     [
         {
             “kind”: “objectRef#NetworkServiceGroup“,
             “objectId”: “krb5-udp
         }
      ],
      “description”: “Default Active Directory ports
}

Note: To delete an object within an object group, you can use Put operation with all existing objects except the ones you need to delete.In this particular example I am only leaving krb5-udp in the group.

Response Format

Header:
Status Code: 200 OK
Accept-Ranges: bytes
Content-Length: 374
Content-Type: application/json; charset=UTF-8
Date: Wed, 18 Feb 2015 12:07:46 GMT
Server: CiscoASARestApiServer
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept

Object Network

Create

CLI Reference (host)

object network win-dc-01
 host 10.0.0.10

REST Request Format (host)

 

URL: https://<management-ip>/api/objects/networkobjects

Method: POST

Body:

{
  “host”: {
    “kind”: “IPv4Address“,
    “value”: “10.0.0.10
  },
  “kind”: “object#NetworkObj“,
  “name”: “win-dc-01
}

REST Response Header Format

Header:
Status Code: 201 Created
Accept-Ranges: bytes
Content-Length: 0
Date: Wed, 18 Feb 2015 14:40:47 GMT
Server: CiscoASARestApiServer
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept

CLI Reference (network)

object network web-tier
 subnet 172.16.0.0 255.255.255.0

REST Request Format

Method: POST
Body:
{
  “host”: {
    “kind”: “IPv4Network“,
    “value”: “172.16.0.0/24
  },
  “kind”: “object#NetworkObj“,
  “name”: “web-tier
}

REST Response Header Format

Header:
Status Code: 201 Created
Accept-Ranges: bytes
Content-Length: 0
Date: Wed, 18 Feb 2015 14:48:08 GMT
Server: CiscoASARestApiServer
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept

Modify

CLI Reference (host)

object network win-dc-01
 host 10.0.0.11

Request Format

(To change/add objects withing a group)

Header

URL: https://<management-ip>/api/objects/networkobjects/win-dc-01
Method: PATCH

Body:

{
  “host”: {
    “kind”: “IPv4Address“,
    “value”: “10.0.0.11
  },
  “kind”: “object#NetworkObj“,
  “name”: “win-dc-01
}

Response Format

Header:
Status Code: 204
Content-Length: 0
Location: https://10.201.230.5/api/objects/networkobjects/win-dc-01
Server: CiscoASARestApiServer
Accept-Ranges: bytes
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept
Date: Wed, 18 Feb 2015 14:43:44 GMT

Retrieve

CLI Reference

show run | be object network win-dc-01

Request Format

Method: GET
Body: Empty

Response Format

Header:

Status Code: 200 OK
Accept-Ranges: bytes
Content-Length: 191
Content-Type: application/json; charset=UTF-8
Date: Wed, 18 Feb 2015 14:49:59 GMT
Server: CiscoASARestApiServer
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept
Body:
{
   “kind”: “object#NetworkObj“,
   “name”: “win-dc-01“,
   “host”:
   {
       “kind”: “IPv4Address“,
       “value”: “10.0.0.11
   },
   “objectId”: “win-dc-01
}

Delete

CLI Reference

no object network win-dc-01
Request Format
Method: DELETE
Body: Empty

Response Format

Header:
Status Code: 204 No Content
Accept-Ranges: bytes
Content-Length: 0
Date: Wed, 18 Feb 2015 14:52:26 GMT
Server: CiscoASARestApiServer

Network Object Group

Create

CLI Reference

object-group network dc-win-servers
 network-object object dc-win-01

REST Request Format (host)

URL: https://<management-ip>/api/objects/networkobjectgroups
Method: POST

Body:

{
     “kind”: “object#NetworkObjGroup“,
     “name”: “dc-win-servers“,
     “members”:
     [
         {
             “kind”: “objectRef#NetworkObj“,
             “objectId”: “win-dc-01
         }
     ],
     “description”: “Corporate AD Servers
}

REST Response Header Format

Header:
Status Code: 201 Created
Accept-Ranges: bytes
Content-Length: 0
Date: Wed, 18 Feb 2015 15:02:28 GMT
Server: CiscoASARestApiServer
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept

Modify

CLI Reference (host)

object-group network dc-win-servers
 network-object object dc-win-01
 network-object object dc-win-02

Request Format

(To change/add objects withing a group)
Header:
Method: PATCH

 

Body:

{
           “kind”: “object#NetworkObjGroup“,
           “name”: “dc-win-servers“,
           “members”:
           [
               {
                   “kind”: “objectRef#NetworkObj“,
                   “objectId”: “win-dc-01
               },
               {
                   “kind”: “objectRef#NetworkObj“,
                   “objectId”: win-dc-02
               }
           ],
           “description”: “Corporate AD Servers
}

Response Format

Header:
Status Code: 204
Content-Length: 0
Location: https://10.201.230.5/api/objects/networkobjectgroups/dc-win-servers
Server: CiscoASARestApiServer
Accept-Ranges: bytes
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept
Date: Wed, 18 Feb 2015 15:09:07 GMT

Retrieve

 

CLI Reference

show object-group id dc-win-servers

Request Format

 
Method: GET
Body: Empty

Response Format

Header:

Status Code: 200 OK
Accept-Ranges: bytes
Content-Length: 465
Content-Type: application/json; charset=UTF-8
Date: Wed, 18 Feb 2015 15:12:39 GMT
Server: CiscoASARestApiServer
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept
Body:
{
   “kind”: “object#NetworkObjGroup“,
   “name”: “dc-win-servers“,
   “members”:
   [
       {
           “kind”: “objectRef#NetworkObj“,
           “refLink”: “https://10.201.230.5/api/objects/networkobjects/win-dc-01“,
           “objectId”: “win-dc-01
       },
       {
           “kind”: “objectRef#NetworkObj“,
           “refLink”: “https://10.201.230.5/api/objects/networkobjects/win-dc-02“,
           “objectId”: “win-dc-02
       }
   ],
   “description”: “Corporate AD Servers“,
   “objectId”: “dc-win-servers
}

Delete

CLI Reference

no object-group network dc-win-servers

Request Format

Header:
Method: DELETE
Body: Empty

Response Format

Header:
Status Code: 204 No Content
Accept-Ranges: bytes
Content-Length: 0
Date: Wed, 18 Feb 2015 15:16:43 GMT
Server: CiscoASARestApiServer

To delete an object within an object group you can use the same approach with Patch operations and listing only objects that you want to keep in object group.

Access Control List

Create

CLI Reference

access-list global_access remark Allow web-tier to Domain Controllers
access-list global_access extended permit object-group active-directory object-group web-and-db-tier object-group dc-win-servers log
access-group global_access global

REST Request Format (host)

Header:
Method: POST
Body:
{
        “sourceAddress”: {
        “kind”: “objectRef#NetworkObjGroup“,
        “objectId”: “web-and-db-tier
      },
      “destinationAddress”: {
        “kind”: “objectRef#NetworkObjGroup“,
        “objectId”: “dc-win-servers
      },
      “sourceService”: {
        “kind”: “objectRef#NetworkServiceGroup“,
        “objectId”: “active-directory
      },
      “destinationService”: {
        “kind”: “objectRef#NetworkServiceGroup“,
        “objectId”: “active-directory
      },
      “permit”: true,
      “active”: true,
      “remarks”: [“Allow web-tier to Domain Controllers“],
      “ruleLogging”: {
        “logInterval”: 300,
        “logStatus”: “Informational
      }
}
To create another line in same global ACL just modify the Request body and a new line will be added in the end of ACL. A reference value will be returned.

REST Response Header Format

Header:
Status Code: 201 Created
Accept-Ranges: bytes
Content-Length: 0
Date: Wed, 18 Feb 2015 15:35:20 GMT
Server: CiscoASARestApiServer
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept

Modify

CLI Reference

access-list global_access remark Allow Domain Controllers to Web-Tier
access-list global_access extended permit object-group active-directory object-group dc-win-servers object-group web-and-db-tier log
access-group global_access global

Request Format

(To change/add objects withing a group)
Header:
URL: https://<management-ip>/api/access/global/rules/3028343169
Method: PATCH

Body:

{
        “sourceAddress“: {
        “kind”: “objectRef#NetworkObjGroup“,
        “objectId”: “dc-win-servers
      },
      “destinationAddress“: {
        “kind”: “objectRef#NetworkObjGroup“,
        “objectId”: “web-and-db-tier
      },
      “sourceService”: {
        “kind”: “objectRef#NetworkServiceGroup“,
        “objectId”: “active-directory
      },
      “destinationService”: {
        “kind”: “objectRef#NetworkServiceGroup“,
        “objectId”: “active-directory
      },
      “permit”: true,
      “active”: true,
      “remarks”: [“Allow Domain Controllers to Web Tier“],
      “ruleLogging”: {
        “logInterval”: 300,
        “logStatus”: “Informational
      }
}

Response Format

Header:
Status Code: 204
Content-Length: 0
Location: https://10.201.230.5/api/access/global/rules/2372118638
Server: CiscoASARestApiServer
Accept-Ranges: bytes
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept
Date: Wed, 18 Feb 2015 15:44:50 GMT

Retrieve

 

CLI Reference

show access-list global_access

Request Format

 
Method: GET
Body: Empty

Response Format

Header:

Status Code: 200 OK
Accept-Ranges: bytes
Content-Length: 2088
Content-Type: application/json; charset=UTF-8
Date: Wed, 18 Feb 2015 15:55:03 GMT
Server: CiscoASARestApiServer
Vary: Accept-Charset, Accept-Encoding, Accept-Language, Accept
Body:
{
   “kind”: “collection#ExtendedACE“,
   “rangeInfo”:
   {
       “offset”: 0,
       “limit”: 2,
       “total”: 2
   },
   “items”:
   [
       {
           “kind”: “object#ExtendedACE“,
           “selfLink”: “https://10.201.230.5/api/access/global/rules/3028343169“,
           “permit”: true,
           “sourceAddress”:
           {
               “kind”: “objectRef#NetworkObjGroup“,
               “objectId”: “web-and-db-tier
           },
           “destinationAddress”:
           {
               “kind”: “objectRef#NetworkObjGroup“,
               “refLink”: “https://10.201.230.5/api/objects/networkobjectgroups/dc-win-servers“,
               “objectId”: “dc-win-servers
           },
           “sourceService”:
           {
               “kind”: “objectRef#NetworkServiceGroup“,
               “objectId”: “active-directory
           },
           “destinationService”:
           {
               “kind”: “objectRef#NetworkServiceGroup“,
               “objectId”: “active-directory
           },
           “active”: true,
           “remarks”:
           [
               “Allow web-tier to Domain Controllers
           ],
           “ruleLogging”:
           {
               “logInterval”: 300,
               “logStatus”: “Informational
           },
           “isAccessRule”: true,
           “position”: 1,
           “objectId”: “3028343169
       },
       {
           “kind”: “object#ExtendedACE“,
           “selfLink”: “https://10.201.230.5/api/access/global/rules/2372118638“,
           “permit”: true,
           “sourceAddress”:
           {
               “kind”: “objectRef#NetworkObjGroup“,
               “refLink”: “https://10.201.230.5/api/objects/networkobjectgroups/dc-win-servers“,
               “objectId”: “dc-win-servers
           },
           “destinationAddress”:
           {
               “kind”: “objectRef#NetworkObjGroup“,
               “objectId”: “web-and-db-tier
           },
           “sourceService”:
           {
               “kind”: “objectRef#NetworkServiceGroup“,
               “objectId”: “active-directory
           },
           “destinationService”:
           {
               “kind”: “objectRef#NetworkServiceGroup“,
               “objectId”: “active-directory
           },
           “active”: true,
           “remarks”:
           [
               “Allow Domain Controllers to Web Tier
           ],
           “ruleLogging”:
           {
               “logInterval”: 300,
               “logStatus”: “Informational
           },
           “isAccessRule”: true,
           “position”: 2,
           “objectId”: “2372118638
       }
   ]
}

Delete

CLI Reference

no access-list global_access remark Allow Domain Controllers to Web Tier
no access-list global_access extended permit object-group active-directory object-group dc-win-servers object-group web-and-db-tier log

Request Format

Header:
Method: DELETE
Body: Empty

Response Format

Header:
Status Code: 204 No Content
Accept-Ranges: bytes
Content-Length: 0
Date: Wed, 18 Feb 2015 15:52:34 GMT
Server: CiscoASARestApiServer

Conclusion

ASA REST API is a very powerful interface, and as times goes I am sure that for customers that invested in this firewall product it will be the preferred way how to program their security policies automatically during application deployment.

Saving time with VM templates

Image that you need to provision 1000 virtual machines for new web server farm. Doing this manually can be boring and can take long time answering all installation questions, patching and updating base OS to get it in right shape.

There is a better way by utilizing VM templates. Templates are like golden images, you install the OS once, do all changes you need to and than you convert it into a template that can be later used to create identical clones.

There is however one problem with clones, and that is that they are same in almost every way. We need to modify these clones to include some uniqueness such as hostnames, ip addresses, public/private keys. Some operating system such as Windows support sysprep which are set of scripts that can modify the Operating System as it being deployed, which makes it easy to perform changes during deployment.

The support for most linux operating systems customization wizard was discontinued in vSphere 5. So you need to look at another way like Puppet or Chef.

Converting a virtual machine into a template is easy, just right click on it and select Clone to Template.  In this example I am using the previously updated Debian 7.8 guest that has open VM tools installed.

vm-templates

The vCenter will mark the virtual machine as a template and will remove it from the main Hosts and Clusters window to VMs and Templates. Browser to that location and highlight the newly created template.

You will now have an option to either Deploy Virtual Machine form this Template or Convert back to Virtual Machine.

vm-templates-1

We are going to select the first option, and after answering questions like how to name the new VM, and where to place it, validation check occurs and the new guest will be deployed.

This is also the one of the places to make changes virtual disk, such as migrating from Thick to Thin provisioning.

After switching to new VM Console, you will be be presented by deb01 login prompt. You can use the following script to rename the box to deb02. Execute and then do a quick reboot.

#!/bin/bash
# 
usage() {
   echo "usage : $0 <new hostname>"
   exit 1
}

[ "$1" ] || usage

old=$(hostname)
new=$1

for file in \
   /etc/exim4/update-exim4.conf.conf \
   /etc/printcap \
   /etc/hostname \
   /etc/hosts \
   /etc/ssh/ssh_host_rsa_key.pub \
   /etc/ssh/ssh_host_dsa_key.pub \
   /etc/motd \
   /etc/ssmtp/ssmtp.conf
do
   [ -f $file ] && sed -i.old -e "s:$old:$new:g" $file
done
Depending on our network configuration, you may also need to change IP addresses if you are not using DHCP to avoid collisions. And also shuffling SSH keys would be a good idea too.
Anyway, this is a great way for home lab when you want to create lots of test machines and test features like load balancing. You can create various flavors from the vanilla template like web server or database server.
Resources

Open VM Tools on Debian 7

Introduction

Open VM tools are a set of open source programs based on original VMware Tools that greatly enhanced the performance and experience when interacting with virtual machine. They are also required when you want to use  features like balloon driver to reclaim non-used guest memory and optimize resource usage.

VMware states that the reason of this open version is to allow the community and vendors can now include tools when releasing their virtual appliances so there is no need to install tools separately after installation.

There are following packages available

  • open-vm-tools – includes core tools, user space binaries and libraries
  • open-vm-tools-dekstop – includes additional user-space programs and features such as resizing guest display, copy and paste between guest and host, drag and drop operation between guest and hosts
  • open-vm-tools-devel – includes libraries for developing vmtoolsd plugins and documentation

Supported operating systems are

  • Fedora 19 and later
  • Debian 7.x and later
  • OpenSUSE 11x and later
  • Ubuntu 12.04 LTS, 13.10 and later
  • RHEL 7.0 and later
  • CentOS 7
  • Oracle Linux 7

The base open-vm-tools package is already included in Debain default repository, so installation is super easy.

  1. Log into Guest VM and simple type
root@deb01:~# apt-get install open-vm-tools

The package size is around 171 MB, after downloading you can verify that it is indeed running by checking the running processes and software version.

root@deb01:~# ps ax|grep vmtools
 2096 ?        Sl     0:00 /usr/bin/vmtoolsd
 2654 pts/0    S+     0:00 grep vmtools
root@deb01:~# lsmod| grep vm
vmsync                 12721  0
vmhgfs                 52556  0
vmw_balloon            12606  0
vmwgfx                 99436  0
ttm                    53664  1 vmwgfx
drm                   183952  2 ttm,vmwgfx
vmci                   74044  1 vmhgfs
root@deb01:~# vmtoolsd -v
VMware Tools daemon, version 9.3.0.13625 (build-724730)

In Guest Summary page, you can also see that VM is running VMware tools.

Open VM Tools

Open VM Tools

Conclusion

It is good to see that VMware is opening their software a little bit so many people can now contribute to improve the code. Vendors can use tools during product development and enhance the interoperability when running on virtual infrastructure.

Resources

 

Cisco ASAv firewall REST API

Introduction to API

The evolution of application programming interface is gaining significant importance in the adoption of software defined networking. Many vendors realized that the next step after releasing their hardware products as virtual machines is to provide a new programmatic way of configuring for their devices.

The traditional way to configure switches, routers, firewalls and many other network gear is to use Command Line Interface either directly on console or remotely via SSH. As network devices became more complex and capable new ways of emerged like Graphical User Interface running on device itself or centrally allowing to manage multiple boxes from one place.

Applications and services have radically changed in last few years and they become more complex and are composed of many different components that are often interconnected by underlying network infrastructure. This means that the network configuration is often complex, time consuming and often prone to human error.

There is a better way to program the network infrastructure. One of the popular methods is through an API interface. The idea is that during an application deployment, when virtual machines are build and configured according the blueprint, the same configuration templates would be used to deploy objects and rules within the firewall according the application security requirements. This would allow quick application deployment and un-deployment without any human intervention.

What you gain by utilizing this deployment approach is that you have a model where you once define and build the base application rules – objects, services, acls and you can reuse it many times by changing variables such as number of virtual machines or stacks. This level of automation is needed for the next-generation data centers to services its clients.

ASA REST API

To support the idea outlined here, Cisco has recently released a REST API client that can be used as another method of configuration of their popular firewall product line. The ASA uses small plugin that is uploaded into device flash memory, much like ASDM and then activated from CLI. This allows a client to perform certain elementary operations such as Create, Read, Update, Delete on ASA resources such as network objects or ACL. After the right API call has been executed ASA will respond with a status code such as 201 Object Created.

The high level architecture of this model looks like this:

rest-api-arch

If you compare this style of configuration to traditional way through CLI you see that we can achieve the same things but in programmatic matter.

Note: REST stands for Representational State Transfer and it is a software architecture style. You refer the full article at http://en.wikipedia.org/wiki/Representational_state_transfer

 

API Requests

To support the basic object operations such as create or delete, ASA support the following requests that can be fired toward the firewall from REST API client.

  • GET – used when retrieving data from an object, for example list of all existing service objects
  • PUT – used when adding information to a specific object if it exists, if not it will create the object, for example a network object group
  • POST – similar to previous, used when adding information to an existing object
  • DELETE – used when deleting an object
  • PATCH – used when partially modifying an object for example updating destination TCP port in service object

API Response

Usually when you fire a request you will get a response back if the operation was successful. If you think about it is similar with HTTP protocol. You request a web resources by GET operation and get a response code 200 OK or 500 Internal Server Error. ASA supports these responses:

  • LOCATION – when POST method is used and a new resource is created, the location will hold its unique URI which represents the resource. This object can be used later when removing the object with DELETE request.

  • CONTENT-TYPE – similar to HTTP describes what content is being encoded, whether it is a JSON, XML or text representation. This helps to format the response.

Each response also contain HTTP status coded that outlines if the operation was successful or an error happened. We can categories these codes into the following groups:

  • 20x – indicates successful operations, such as:

    • 200 OK – Standard response when request was successfully completed – e.g. list all objects within an object group or saving a configuration
    • 201 Created – Standard response when request was successfully completed – e.g. object created, static route added
    • 202 Accepted – Request has been accepted, but it is still being processed
    • 204 No Content – Request has been accepted, but no content is being returned, e.g. when you query and empty object.
  • 4xx – indicates a client side error, for example
    • 400 Bad Request – Indicated that there were missing or invalid parameters in request, e.g. you tried to create a network object with an invalid range.
    • 404 Not Found – The object that you trying to list is does not exist or its unavailable. e.g. querying a previously deleted object
    • 405 Method not Allowed – happens when you try to delete and object which is in use or when modifying a read only only object.
  • 5xx – Indicates a server-side error

When an error is returned it would be handy to know what went wrong and learn from it. Lucky for us ASA will just do that in an intuitive manner and easy to read format. For example I have tried to delete object named UDP-123 that was used within a service object group ntp and I have received a status code of 500 and the response body would contain the following message. Status codes are great way how to quickly determine the response and can be used by a deployment applications to track any errors in the script.

{
  “messages”: [
    {
      “level”: “Error“,
      “code”: “OBJECT-USED“,
      “details”: “Usages:[Service Groups: ntp,]
    }
  ]
}

We can break down the error message into these generic sections

  • message – lists of the the warnings
  • level – lists the info code such as Error, Warning, Info
  • code – lists the type of an error
  • details – lists additional details if available, gives use more clues

Practical Example

You should now have some basic level of understanding why REST API is important in the world of SDN and also gained some familiarity with requests and responses that ASA REST implementation is using. To put some meat into discussion we are going to remonstrate a real world usage of this new interface.

We will have a server farm with multiple web VM accepting connections from outside network and retrieving resources from back end database server. The management VM will reside on a different network.

The policy will be simple, where we allow any source going to web servers on port TCP 80 and from web servers to database servers on port TCP 3306. We will also enable TCP 80 and 443 from web servers to Internet.

 asav-rest
 

Getting the code

REST API client is available both for a physical ASA as well as ASAv. I using the later one which can be downloaded from Cisco. Refer to this post on how to setup ASAv from scratch in vSphere.

You will need the following REST API Agent from Cisco download page: asa-restapi-101.lfbff-k8.SPA.

I have also update the my virtual ASAv from version asa931-smp-k8.bin to latest available version asa932-200-smp-k8.bin

 rest-client-asa

After uploading the client to flash memory, there are several steps that needs to be completed before we can fire our first request. To avoid frustration with corrupted files I suggest to run md5 sum after the files landed on flash.

verify /md5 boot:asa932-200-smp-k8.bin
verify /MD5 (boot:/asa932-200-smp-k8.bin) = 2679aefdf9017a5845f3fcc9321d4a1d
verify /md5 boot:asa-restapi-101-lfbff-k8.SPA
verify /MD5 (boot:/asa-restapi-101-lfbff-k8.SPA) = 76b3496b930018b1cda30fdd407cd041

Initial Configuration

If you are happy with the sums, continue with configuring the management interface, HTTPS server and REST Server plugin.

#Configure and enable management interface
interface Management0/0
 management-only
 ip address 10.201.230.1 255.255.255.0
 no shut
#Create a local user, privilege 15 is needed to invoke PUT/POST and DELETE #operations. Lower level privilege accounts can be used for monitoring-only #purpose. For example level 3 can request monitoring requests while level5 or #greater can invoke GET request.
 
username restclient password restpassword privilege 15
enable secret area51devs
 
#Configure and enable HTTPS server
 
http server enable

http 0.0.0.0 0.0.0.0 management

 
#Configure HTTP authentication to query local database
 
aaa authentication http console LOCAL
#Enable and configure REST API Agent
 
rest-api image boot:/as-restapi-101-lfbff-k8.SPA

rest-api agent

And that is all that is needed to have basic REST API agent up and running, really easy to deploy, thanks to Cisco developers.

Installing REST Client

Now the 2nd part of the equation is to get a REST API client. I am using Firefox therefore I have downloaded the browser plugin from here. After installation the browser will restart and a new icon will appear in the upper left corner. Simple click on it and you will be presented by the following clean interface.

rest-client

Now to test that everything works as expected, initiate your first GET operation against the following URL: https://<management-ip>/api/monitoring/device/components/version

The first time request will require authentication so enter credentials you created in local database. If you are successful, you should receive a response similar to this:

rest-server-headers

The Response Headers tab will shows you the status code that has been returned while the Response Body (Highlights) will show you the actual contents which displays the software version, mode and other system related information.

rest-server-json

You might wonder, how did I know what object to call to get the version of the virtual ASA. And the answers is that ASA contains a awesome documentation that is located on device itself. Simple point your browser to the following URL https://<management-ip>/doc/ . You will be presented by the API main documentation page.

rest-server-doc

The online documentation is an excellent resource for learning about API calls and ASA resources. As you can see it is divided in to several sections and it even contains an integrated API console where you can execute the calls. Huge number of examples will give you head start while developing your scripts.

The operations can be even exported into common scripting language such as JavaScript, Python or Perl and part of a large deployment script. For example the previous call in Javacript would look like this:

/*
 * Generated ASA REST API sample script - Javascript
 * Uses node.js
 */

var https = require('https');

process.env.NODE_TLS_REJECT_UNAUTHORIZED = "0";

var data = {};

var server = "10.201.230.5";

// Default credentials
var username = "restclient";
var password = "restpassword";

// process arguments
// process.argv[0] == node
// process.argv[1] == filename
process.argv.forEach(function(val, index) {
    if (index == 2) {
        username = val;
    }
    else if (index == 3) {
        password = val;
    }
});

var api_path = "/api/monitoring/device/components/version";    // param


var options = {
    host: server,
    path: api_path,
    method:"GET",
    headers: {
        'Content-Type': 'application/json',
        'Authorization': 'Basic ' + new Buffer(username + ':' + password).toString('base64')
    }
};

var req = https.request(options, function(res) {
    console.log("statusCode: ", res.statusCode);
    console.log("headers: ", res.headers);

    res.on('data', function(d) {
        process.stdout.write(d);
    });
});
req.end();

req.on('error', function(e) {
    console.error(e);
});
This file can be than saved as .js file and run using program called nodejs available here.

If you use a developer tool such as Inspector to see the actual GET request, you can see that part of header is an Authorization field with value of “Basic cmVzdGNsaWVudDpyZXN0cGFzc3dvcmQ=”. Which is nothing else than username:password encoded in Base64. You can verify it here. Every request contains this field for proper authorization.

Configuring Network Interfaces

Now that we have the basic REST API client up and running lets configure the remaining three network interfaces. Back in client change the method from GET to PUT and point it to the first physical interface located at the following URL http://<management-ip/api/interfaces/physical/GigabitEthernet0_API_SLASH_0

 

Since this is the first time that we are putting something in the request body, we need to change the default content type in REST Client from text/plain to application/json. Otherwise the ASA will not understand what we are asking from it to do.

rest-client-content-type

Back to the client the body need to contain the following code:

{
  “securityLevel”: 100,
  “kind”: “object#GigabitInterface“,
  “channelGroupMode”: “active“,
  “flowcontrolLow”: -1,
  “name”: “outside“,
  “duplex”: “auto“,
  “forwardTrafficSFR”: false,
  “hardwareID”: “GigabitEthernet0/0“,
  “mtu”: 1500,
  “lacpPriority”: -1,
  “flowcontrolHigh”: -1,
  “ipAddress”: {
    “ip”: {
      “kind”: “IPv4Address“,
      “value”: “10.0.2.90
    },
    “kind”: “StaticIP“,
    “netMask”: {
      “kind”: “IPv4NetMask“,
      “value”: “255.255.255.0
    }
  },
  “flowcontrolOn”: false,
  “shutdown”: false,
  “interfaceDesc”: “Outside Network“,
  “managementOnly”: false,
  “channelGroupID”: “”,
  “speed”: “auto“,
  “forwardTrafficCX”: false,
  “flowcontrolPeriod”: -1
}

After successfully firing the request you should receive the return code 204 which means request has been accepted but no content is being returned.

rest-server-interface

You can log into CLI and make sure that the interface has been indeed configured according our parameters. Or you can perform a GET operation against the location of a newly configured resource. Follow the same approach for the inside and dmz interface.

rest-api-cli

Note: All our interfaces will have the same security level of 100. We will later use global ACL to control what is allowed to pass through the firewall. For this to work we also need to enable same-security-traffic permit inter-interface in global configuration mode.

Configuring static routes

To get to the Internet we also need a default gateway. This time the method is POST and it is simple as firing the following API call against this URL:  https://<management-ip>/api/routing/static

{
  “tunneled”: false,
  “kind”: “object#IPv4Route“,
  “distanceMetric”: 1,
  “tracked”: false,
  “interface”: {
    “kind”: “objectRef#Interface“,
    “name”: “outside
  },
  “gateway”: {
    “kind”: “IPv4Address“,
    “value”: “10.0.2.1
  },
  “network”: {
    “kind”: “AnyIPAddress“,
    “value”: “any4
  }
}

Again, you will receive a unique response that contains the resource URL this time has the following format: https://10.201.230.5/api/routing/static/cec906bc. If I use this URL and change the method to GET. I receive the information about this default route.

Creating Objects

So far we have configured the basics and now are are going to play a little with various objects and object groups. Lets start by creating couple of service objects. We are going to create a couple of TCP objects which will be later included in object groups.

First, we need to point the REST client to URL: https://<management-ip>/api/objects/networkservices. We will use POST method and the body will contain the following:

{
  “kind”: “object#TcpUdpServiceObj”,
  “name”: “TCP-80“,
  “value”: “tcp/80
}

The response status code should be 201 Created. The response will also include the resource URI. In this case it will be http://<mngement-ip>/api/objects/networkservices/TCP-80

Follow the same approach and create network objects TCP-443, TCP-3306. When you finish your output of GET http://<management-ip>/api/objects/networkservices should reassemble the following:

{
   “kind”: “collection#NetworkServiceObjects“,
   “rangeInfo”:
   {
       “offset”: 0,
       “limit”: 3,
       “total”: 3
   },
   “items”:
   [
       {
           “kind”: “object#TcpUdpServiceObj“,
           “selfLink”: “https://10.201.230.5/api/objects/networkservices/TCP-3306“,
           “name”: “TCP-3306“,
           “value”: “tcp/3306“,
           “objectId”: “TCP-3306
       },
       {
           “kind”: “object#TcpUdpServiceObj“,
           “selfLink”: “https://10.201.230.5/api/objects/networkservices/TCP-443“,
           “name”: “TCP-443“,
           “value”: “tcp/https“,
           “objectId”: “TCP-443
       },
       {
           “kind”: “object#TcpUdpServiceObj“,
           “selfLink”: “https://10.201.230.5/api/objects/networkservices/TCP-80“,
           “name”: “TCP-80“,
           “value”: “tcp/http“,
           “objectId”: “TCP-80
       }
   ]
}

We are also going to create a couple of hosts that will be used in network objects groups. Network objects are located at https://<management-ip>/api/networkobjects/ . Again POST method will be used.

{
  "host": {
    "kind": "IPv4Address",
    "value": "172.16.1.11"
  },
  "kind": "object#NetworkObj",
  "name": "web01",
  "objectId": "web01"
}

You can create multiple objects with same API call, for this you need to create a bulk API request again the main URL https://<mnagement-ip>/api and include the sub-paths and methods into the request body field.

[  
{
    “resourceUri”: “/api/objects/networkobjects“,
    “data”: {
      “host”: {
        “kind”: “IPv4Address“,
        “value”: “172.16.1.12
      },
      “name”: “web02
    },
    “method”: “Post
  },
  {
    “resourceUri”: “/api/objects/networkobjects“,
    “data”: {
      “host”: {
        “kind”: “IPv4Address“,
        “value”: “172.16.1.13
      },
      “name”: “web03
    },
    “method”: “Post
  }
]

The response for this request will be similar to create just one object. The status code will be 200 OK, however I have found that the Response Body (Highlight) did not contain any detail about the newly created resources URLs. This information was indeed contained in Response Body (Raw) tab. Perhaps it is just the way the Firefox REST Client works at the moment.

{
"entryMessages":
[
      {
           "resourceUri":"/api/objects/networkobjects",
           "method":"POST",
           "selfLink":"http://10.201.230.5/api/objects/networkobjects/web02",
           "messages":
           [
              {
              "level":"Info",
              "code":"201",
              "details":"Created (201) - The request has been fulfilled and resulted in a new resource being created"
              }
           ]
     },
     {
           "resourceUri":"api/objects/networkobjects",
           "method":"POST",
           "selfLink":"http://10.201.230.5/api/objects/networkobjects/web03",
           "messages":
           [
               {
               "level":"Info",
               "code":"201",
               "details":"Created (201) - The request has been fulfilled and resulted in a new resource being created"
               }
           ]
      }
],
"commonMessages":[]
}

I have created two additional network objects db01 with value 172.16.1.11 and db02 with value 172.16.1.12. After all objects are create the GET method against https://<management-ip>/api/networkobjects will return something like this:

{
   “kind”: “collection#NetworkObj”,
   “rangeInfo”:
   {
       “offset”: 0,
       “limit”: 5,
       “total”: 5
   },
   “items”:
   [
       {
           “kind”: “object#NetworkObj“,
           “selfLink”: “https://10.201.230.5/api/objects/networkobjects/db01“,
           “name”: “db01“,
           “host”:
           {
               “kind”: “IPv4Address“,
               “value”: “172.16.0.11
           },
           “objectId”: “db01
       },
       {
           “kind”: “object#NetworkObj“,
           “selfLink”: “https://10.201.230.5/api/objects/networkobjects/db02“,
           “name”: “db02“,
           “host”:
           {
               “kind”: “IPv4Address“,
               “value”: “172.16.0.12
           },
           “objectId”: “db02
       },
       {
           “kind”: “object#NetworkObj“,
           “selfLink”: “https://10.230.201.5/api/objects/networkobjects/web01“,
           “name”: “web01“,
           “host”:
           {
               “kind”: “IPv4Address”,
               “value”: “172.16.1.11
           },
           “objectId”: “web01
       },
       {
           “kind”: “object#NetworkObj“,
           “selfLink”: “https://10.230.201.5/api/objects/networkobjects/web02“,
           “name”: “web02“,
           “host”:
           {
               “kind”: “IPv4Address“,
               “value”: “172.16.1.12
           },
           “objectId”: “web02
       },
       {
           “kind”: “object#NetworkObj“,
           “selfLink”: “https://10.230.201.5/api/objects/networkobjects/web03“,
           “name”: “web03“,
           “host”:
           {
               “kind”: “IPv4Address“,
               “value”: “172.16.1.13
           },
           “objectId”: “web03
       }
   ]
}

Note: When you try to create an object that is already existing you will receive an 400 Bad Request error and the response body will contain the following error description

{
   “messages”:
   [
       {
           “level”: “Error“,
           “code”: “DUPLICATE“,
           “context”: “objectId“,
           “details”: “db01
       }
   ]
}

Creating Object Groups

Now that we have created couple of service and network objects, lets put them in their respective groups according their usage. We start with services and then with hosts. The URL for service object groups is https://<management-ip/api/objects/networkservicegroups

{
     "kind": "object#NetworkServiceGroup",
     "name": "http",
     "members":
     [
         {
             "kind": "objectRef#TcpUdpServiceObj",
             "objectId": "TCP-80"
         }
      ],
      "description": ""
}

The response will be 201 Created and Response header will also contain the object-group unique URL such as https://<management-ip>/api/objects/networkservicegroups/http

Follow the same approach for other service object groups https and mysql.

Next, we are going to great two network object groups one will be web-servers and other will be named database-servers. The targeted API resource is https://<management-ip>/api/objects/networkobjectgroups

{
  "kind": "object#NetworkObjGroup",
  "name": "web-servers",
  "members": [
    {
      "kind": "objectRef#NetworkObj",
      "objectId": "web01"
    },
    {
      "kind": "objectRef#NetworkObj",
      "objectId": "web02"
    },
    {
      "kind": "objectRef#NetworkObj",
      "objectId": "webb03:
    }
], 
"description": "Corporate web servers" 
}

We response is again a 201 Created status code with the resource URL. The object group web-servers now contain three objects. Follow the same process when creating database-servers object group.

Now that we have all needed objects created, its time to put a some security policy in place with and ACL.

Creating Access Control List

First we are going to define that web servers can talk to backend database on mysql port. The global ACL resource URL is located at https://<managment-ip>/api/access/global/rules

{
        "sourceAddress": {
        "kind": "objectRef#NetworkObjGroup",
        "objectId": "web-servers"
      },
      "destinationAddress": {
        "kind": "objectRef#NetworkObjGroup",
        "objectId": "database-servers"
      },
      "sourceService": {
        "kind": "objectRef#NetworkServiceGroup",
        "objectId": "mysql"
      },
      "destinationService": {
        "kind": "objectRef#NetworkServiceGroup",
        "objectId": "mysql"
      },
      "permit": true,
      "active": true,
      "position":1,
      "remarks": ["1 REST_PROJECT: WEB to DB"],
      "ruleLogging": {
        "logInterval": 300,
        "logStatus": "Informational"
      }
}

From web servers to Internet on web port:

{
        “sourceAddress”: {
        “kind”: “objectRef#NetworkObjGroup“,
        “objectId”: “web-servers
      },
      “destinationAddress”: {
        “kind”: “AnyIPAddress“,
        “value”: “any
      },
      “sourceService”: {
        “kind”: “objectRef#NetworkServiceGroup“,
        “objectId”: “http
      },
      “destinationService”: {
        “kind”: “objectRef#NetworkServiceGroup“,
        “objectId”: “http
      },
      “permit”: true,
      “active”: true,
      “position”:2,
      “remarks”: [“2 REST_PROJECT: WEB to INTERNET HTTP“],
      “ruleLogging”: {
        “logInterval”: 300,
        “logStatus”: “Informational
      }
}

From web servers to Internet on https port:

{
        “sourceAddress”: {
        “kind”: “objectRef#NetworkObjGroup“,
        “objectId”: “web-servers
      },
      “destinationAddress”: {
        “kind”: “AnyIPAddress“,
        “value”: “any
      },
      “sourceService”: {
        “kind”: “objectRef#NetworkServiceGroup“,
        “objectId”: “https
      },
      “destinationService”: {
        “kind”: “objectRef#NetworkServiceGroup“,
        “objectId”: “https
      },
      “permit”: true,
      “active”: true,
      “position”:3,
      “remarks”: [“3 REST_PROJECT: WEB to INTERNET HTTPS”],
      “ruleLogging”: {
        “logInterval”: 300,
        “logStatus”: “Informational
      }
}

From Internet to web servers on web port:

{
        “sourceAddress”: {
        “kind”: “AnyIPAddress“,
        “value”: “any
      },
      “destinationAddress”: {
        “kind”: “objectRef#NetworkObjGroup“,
        “objectId”: “web-servers
      },
      “sourceService”: {
        “kind”: “objectRef#NetworkServiceGroup“,
        “objectId”: “http
      },
      “destinationService”: {
        “kind”: “objectRef#NetworkServiceGroup“,
        “objectId”: “http
      },
      “permit”: true,
      “active”: true,
      “position”:4,
      “remarks”: [“4 REST_PROJECT: INTERNET TO WEB HTTP“],
      “ruleLogging”: {
        “logInterval”: 300,
        “logStatus”: “Informational
      }
}

You could very like fire just one bulk request that will contain all access control list entries, I will elaborate on optimizations in an upcoming article.

I found out that when you create the first global access list entry, ASA will automatically name it global_access and will apply it same way as you would enter access-group global_access global.

Saving the configuration

Once you finish playing with the ASA, do not forget to save your configuration by jumping on a CLI and typing write memory or elegantly through the following POST method against the URL https://<managemenet-ip>/api/cli. This method is called generic CLI command executer and can be used for anything that was not implemented through direct call at this point.

{
  "commands": [
    "write memory"
  ]
}

rest-server-wrmem

Verification and debugging

You have several methods to verify the applied global policy. Either use browser and test that the application is working as expected pulling data from database, or perform a quick check with packet tracer right on the ASA.

asav01# packet-tracer input dmz tcp 172.16.1.11 50006 172.16.0.11 3306

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 172.16.0.11 using egress ifc  inside

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group global_access global
access-list global_access extended permit object-group mysql object-group web-servers object-group database-servers log
access-list global_access remark 2 CHG0063555: WEB to INTERNET HTTP
object-group service mysql
 service-object object TCP-3306
object-group network web-servers
 description: Corporate web servers
 network-object object web01
 network-object object web02
 network-object object web03
object-group network database-servers
 description: Corporate db servers
 network-object object db01
 network-object object db02
Additional Information:

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: QOS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: QOS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 10
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 2344, packet dispatched to next module

Result:
input-interface: dmz
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: allow

To verify that the REST API plugin is enabled and configured, issue the following commands at CLI:

asav01# show rest-api agent
REST API agent is currently enabled.

There are also several debug options that can help you troubleshoot why it is not working:

asav01# debug rest-api ?

  agent    Rest-API Agent
  cli      Rest-API cli handling
  client   Rest-API client request handling
  daemon   Rest-API debug/syslog handling
  process  Starting/Stopping of Rest-API Agent
  <cr>

asav01# debug rest-api client
asav01# [ra client event]: rest_agent_connect: Opening TCP socket to REST API Agent succeeded.
[ra client event]: rest_agent_connect: Connecting to TCP socket succeeded.
[ra client event]: rest_agent_buf_push_and_receive: socks_proxy_csocket_send succeeded.
[ra client event]: rest_agent_buf_push_and_receive: temporarily no message received.
[ra client event]: send_response_to_rest_client: Received response message of length 424 from REST Agent.
[ra client event]: rest_agent_buf_push_and_receive: Received the entire HTTP response of length 424 – closing the connection with REST API Agent.

You can find more details on which each option does in the documentation in the end of the post. There are also API-related syslog messages that can be examined when issues arise.

Conclusion

It might seem that to accomplish such simple configuration as creating a couple of objects and adding them to global access rule takes a lot of manual writing, but bare in mind that the actual scripts in real world would be populated with the right values dynamically by the deployment script. The nice thing is that every object has its unique resource path in ASA, therefore an un-deployment script can remember these values when doing application removal.

And with that last toughs my friends this long post came to its end. I hope that you learned something new today and let me what are your feelings about this new method of configuration and if you are thinking to deploy applications in near future that would program the ASA for themselves automagically.

Resources

About the ASA REST API

http://www.cisco.com/c/dam/en/us/td/docs/security/asa/api/asapedia_rest_api.pdf

Cisco ASA REST API Quick Start Guide

http://www.cisco.com/c/en/us/td/docs/security/asa/api/qsg-asa-api.html