cisco asav example

[lax-pati]

Hello,

Thanks for coming up with such an amazing project..no words to express my gratitude as how easy you guys have made the life of many network explorers :)

I am not familiar with FW config and wondering if there is any sample lab or an example to use cisco asav with netlab topology. i checked the examples but could not find any info on that. I have created a asa vagrant box and planning to use it to setup with few routers and hosts along with asav. Any info would help greatly.... Thank you

[jbemmel]

You can do:

netlab up tests/integration/initial/01-interfaces.yml -d asav

Build instructions for the appliance: https://netlab.tools/labs/asav/

[lax-pati]

Thanks, yes, my asav vagrant box is up.. but i am looking for any sample topology file example to stich asav with other routers. netlab has given beautiful examples without breaking head on getting the configs i.e ospf, bgp etc. wondering if something similar exists for using asav :)

[lax-pati]

any help please @jbemmel @steffann @ipspace ?

[lax-pati]

Appreciate that. Few hosts sitting behind routers(ceos,iosv kind) attached to assv, allowing hosts to communicate (internal networks). One host acting like external network, if it tries to ping, I guess assv would block it. Please correct me if that's not how asav supposed to work. h1--r1-asav-r2-h2 ping should work. h3-r3-asav-r1-h1 ping should not work. Is this ok? If this doesn't make sense, any topology that you think appropriate could help, just that there are few routers and hosts traffic through asav.. Thanks for your willingness to help

…

On Tue, 3 Dec, 2024, 1:26 am Astrotokii, ***@***.***> wrote: I have an asav vagrant box on my system, I can probably whip up a small sample topology for you with basic configs, is there a specific set up you were looking for? — Reply to this email directly, view it on GitHub <#1600 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BNLZ2HITEHOZTHMXTXGG6AT2DS3O3AVCNFSM6AAAAABSZ37X52VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTCNBUGA3DMMI> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[ipspace]

Here's a sample topology https://github.com/ipspace/netlab-examples/tree/master/multi-platform/asav, details described in https://blog.ipspace.net/2024/12/netlab-asav-topology/.

Routing works, but I don't know enough about ASAv to configure the firewall/security bits that would allow H1 to ping X.

[lax-pati]

Thats so sweet @ipspace , thanks a lot for your help :)

[lax-pati]

Hi @ipspace tried using the example, but getting into ssh issues. used the options suggested in your blog i.e tried adding in topology file and also modifying the ssh config to accept old algos but no luck. this is what i added in .ssh/config :
Host *
KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1
Ciphers +aes128-cbc,3des-cbc
PubkeyAcceptedAlgorithms +ssh-rsa
HostkeyAlgorithms +ssh-rsa

vagrant ssh also did not work. its complaining that "/root/.ssh/config: terminating, 1 bad configuration options". i have netlab version 1.9.2

virsh console of asav throwing
"ERROR: /etc/ssh/lina_sshd.conf: No such file or directory". Any pointers on resolving this please ?

[ipspace]

@lax-pati: I always had problems with '+x' in .ssh/config. According to the documentation it should work, but (sometimes?) does not. That's why I went for netlab_ssh_args.

This might work:

• Set netlab_ssh_args in topology file
• Start the lab and do netlab inspect defaults.devices.asav.group_vars to verify the netlab_ssh_args variable was set as expected.
• Execute netlab connect -v fw to see the SSH command that will be executed
• Extract the SSH command from the weird printout (sorry about that), replace LogLevel=ERROR with LogLevel=INFO and execute it.
• You should get an error message telling you what algorithms ASAv wants to use. Use that to adjust the netlab_ssh_args variable.
• Report what worked ;)

[ipspace]

Nice to see you got it up and running. Anyway, netlab needs to create an extra Linux bridge to implement multi-access networks for containerlab (which natively supports only P2P links), and to figure out if the bridge already exists, it executes the brctl show name command.

That command should return an error code if the bridge does not exist (and so netlab will go and create it), but sometimes (on Ubuntu 18.04) it generates an error but returns OK status. That's clearly a bug in brctl that has been fixed in the meantime, but it's been impossible for me to reproduce it as I stopped using Ubuntu 18.04 a long while ago (and supposedly it doesn't happen consistently).

[lax-pati]

Ok, thank you @ipspace for your quick responses :) I am sure you have enough on your plate, but u took time to respond to my asks, much appreciated... i will check what you posted previously when i tear this lab and go back to the original topo. But in other issue that you shared, things worked with ovs, but not for me even with ovs.. so seems its high time for upgrading ubuntu :)

[lax-pati]

Hi @ipspace topology is up and working. You had mentioned about the config to get pings from h1 to x are not there. This is the piece to get it working. Pings from h1 to x would work but fw would block pings from x to h1..

configured "security-level 100" on internal network port i.e gi0/0 and an acl to allow pings from internal to external. By default, asa allows traffic from higher security level to lower security level i.e from 100 -> 0, as external port security-level is 0, which is not changed. Not sure if this is the ideal config, but it works !!

access-group ALLOW_INTERNAL in interface internal
access-list ALLOW_INTERNAL extended permit ip 172.16.0.0 255.255.0.0 any

[ipspace]

Thank you!

[ipspace]

Updated the blog post (https://blog.ipspace.net/2024/12/netlab-asav-topology/). Thanks again!