Category Archives: Security

Redundant Links the Quick and Dirty Way: SLA Monitoring on Cisco ASA

This topic is old news, but always a good thing to know if you have a constrained budget and limited time to make your network a little more robust. Do you have executives screaming at you because the internet is down and your business is losing tons of revenue by the minute because your services are hosted in the cloud? Then implement redundant links to the internet!

Many small branch offices don’t have redundant links. If those small branches don’t warrant redundant links, you can pretty much bet they don’t have a dedicated router (or pair of routers) either. More commonly, a firewall is used as the termination point for the connection to the Wild, Wild Internet of Things. This is perfectly fine for a small branch of part an organization that doesn’t need to scale quickly (in contrast, see: DMVPN for quick scaling), but once a branch scales beyond “small”, redundant internet links from different ISPs are absolutely necessary. With more and more services moving to a cloud-based platform, business requirements demand uninterrupted access to the internet.

A common firewall platform is the Cisco ASA, and there is a quick and easy way to achieve ISP redundancy using a feature called SLA monitoring.

When you configure a primary internet link connected to your ASA, you configure a default static route. This route is intended for all traffic with a destination IP address that is not in your routing table to flow to. The next-hop of the route points to your primary ISP gateway.

Default_Route

However, static routes are manual entries. In order to fail over to a backup link, the default static route would need to be manually changed to take priority over the primary default route. Moreover, there is no inherent mechanism to determine if a static route is up or down since it is not a dynamic routing protocol. Static routes remain in the routing table even if the next-hop gateway is unavailable! The only time a static route is removed from the routing table is if the associated interface’s link-state goes into a down state. So what happens if the ISP gateway goes down, or if problems occur on your primary ISP’s network? This is where SLA Monitoring comes in.

The SLA Monitoring feature associates a static route with a monitoring target. ICMP echo requests get sent to the target over the specified interface. If the monitored IP is unreachable for a specified amount of time, the static route is removed from the routing table, and the backup route can take over. Once the target becomes reachable from the primary interface again, the primary default route is inserted back into the routing table.

IP_SLA

IMPORTANT NOTE: This is a viable solution for outbound traffic from your internal network. However, if you are hosting services that need to be reachable from the internet after a failure (email, web services, etc.), a more advanced solution needs to be put in place. If your primary connection fails, and your services are using public IP addresses from your primary provider, those services are no longer available when the backup takes over. A solution like BGP peering would need to be put in place in order to advertise your public IP space over both internet links — this is a topic for another post.

How to Configure IP SLA

So now that you know what the feature does, how do you implement it?

1. sla monitor sla_id

This configures the monitor process where you specify the parameters to be tracked.

2. type echo protocol ipIcmpEcho target_ip interface if_name

This configures the specific IP address that will be tracked for the monitoring process set up in step 1. The target_ip argument should be an IP address that can be reached from the interface specified in the if_name argument. For example, if you are setting up redundant internet links, you can do something like this for your primary link:

type echo protocol ipIcmpEcho 4.2.2.2 interface outside

4.2.2.2 is a public DNS server which is reachable from the primary interface outside, but the IP address can be any public IP which you see as critical.

3. sla monitor schedule sla_id life forever start-time now

This schedules the monitoring process. The command above is the typical use-case, but it is possible to schedule the monitoring process to begin at a later time and to only occur at specified times. Most of the time, you will want the process to run for an unspecified amount of time and start now. For more information on other options, please see the ASA Configuration Guide.

4. track track_id rtr sla_id reachability

This associates a tracked static route with the SLA monitoring process that was defined in steps 1-3. track_id is a number you assign with this command, while sla_id is the number you chose in step 1.

5. route if_name dest_ip mask gateway_ip track track_id

There are a lot of arguments here, but it is just your standard static routing configuration with the track argument added onto the end. This command defines the static route to be installed in the routing table while the tracked object is reachable. In other words, this static route should be your primary default route. For example, if I have an interface outside with an IP address 1.1.1.2, a gateway IP of 1.1.1.1, and a track_id of 1, the resulting command is:

route outside 0.0.0.0 0.0.0.0 1.1.1.1 track 1

If my monitored target IP becomes unreachable, this route will be removed from the routing table. That means we need to have a backup default route – using our backup interface – with a higher administrative distance. For example:

route backup 0.0.0.0 0.0.0.0 2.2.2.1 2

I chose 2 as the administrative distance here because it is higher than the default of 1 (which your primary link is using) and lower than 5, which is the AD for an EIGRP summary route. If you’re not using EIGRP or another routing protocol, then this number is arbitrary, but using 2 is still a good practice.

Now you’re all set! If the target IP of the monitoring process becomes unreachable, then the primary default route will be removed, and the backup default route will take over.

Hopefully that makes sense! If you have any comments or questions, please post a comment, email me, or tweet me!

Cisco Identity Services Engine – Part 1 – Overview

What is the Cisco Identity Services Engine?

Today’s enterprise network is rapidly changing, especially when it comes to employee mobility. Employees are no longer tethered to desktop workstations, but instead access enterprise resources via a variety of devices: tablets, smartphones, and personal laptops, just to name a few. Being able to access resources from anywhere greatly increases productivity, but it also increases the probability of data breaches and security threats because you may not control the security posture of devices accessing the network. Keeping track of all devices accessing the network is a huge task in itself, and as the need for more access arises, the more unsustainable it becomes to manage.

The Cisco Identity Services Engine (ISE) is an identity-based network access control and policy enforcement system. ISE allows a network administrator to centrally control access policies for wired and wireless endpoints based on information gathered via RADIUS messages passed between the device and the ISE node, also known as profiling. The profiling database is updated on a regular basis to keep up with the latest and greatest devices so there are no gaps in device visibility.

Essentially, ISE attaches an identity to a device based on user, function, or other attributes to provide policy enforcement and security compliance before the device is authorized to access the network. Based on the results from a variety of variables, an endpoint can be allowed onto the network with a specific set of access rules applied to the interface it is connected to, else it can be completely denied or given guest access based on your specific company guidelines.

Let’s analogize LOTR-style for clarification: ISE is Gandalf, and the end-user device is the pursuing Balrog. I think you know where this is going.

You_Shall_Not_Pass
YOU SHALL NOT PASS!

ISE an automated policy enforcement engine that takes care of the mundane day-to-day tasks like BYOD device onboarding, guest onboarding, switchport VLAN changes for end-users, access list management, and many others, so a network administrator can focus on other important tasks (and cool projects!).

ISE Basics

The ISE platform is typically a distributed deployment of nodes made up of three different personas: Policy Administration Node (PAN), Monitoring and Troubleshooting Node (MnT), and Policy Services Node (PSN). All three roles are required for ISE to function.

Policy Administration Node (PAN)

The PAN persona is the interface an administrator logs into in order to configure policies. It is the control center of the deployment. This node allows an administrator to make changes to the entire ISE topology, and those changes are pushed out from the admin node to the Policy Services Nodes (PSN).

Policy Services Node (PSN)

The PSN persona is where policy decisions are made. These are the nodes where network enforcement devices send all network messaging to; RADIUS messaging is an example of what is sent to the PSNs. The messages are processed and the PSN gives the go/no-go for access to the network.

Monitoring and Troubleshooting Node (MnT)

The MnT persona is where logging occurs and reports are generated. All logs are sent to this node and it sorts through them so it can assemble them in a legible format. It is also used to generate various reports so you can make management happy with pretty pictures and numbers (*wink wink*) as well as notify you of any alarms for ISE.

How ISE Works

Now that you know what each persona does, let’s take a look at how everything fits together as a complete system. The diagram shows a logical representation of ISE, because the personas may be distributed across many different appliances. Familiarize yourself with the figure below, and I will explain what each piece is doing:

http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_50_ise_deployment_tg.pdf
ISE Communication Model

The figure above is from the Cisco Trustsec How-To Guide: ISE Deployment Types and Guidelines. If you’re considering deploying ISE, I really recommend reading all ISE Design Guides before you plan your implementation.

  1. Communication starts with the endpoint. This could be a laptop, smartphone, tablet, security camera, videoconferencing system — anything that requires network access.
  2. The client must connect through a network access device — a switch, a wireless LAN controller, or a VPN concentrator — in order to gain access to the network. This is where enforcement of all policies takes place.
  3. The endpoint is asked for authentication via an 802.1X request, and that request is sent to the Policy Services Node.
  4. At this point, the PSN has already been given a specific configuration from the Admin node. The PSN will process the credentials (it may need to query an external database for this; LDAP or Active Directory, for example), and based on the configuration set the PSN will make an authorization decision.
  5. The PSN sends the decision back to the network access device so it can enforce the decision. The network access device is sent specific actions to take for the session. Many actions can be taken at this point depending on the policy, but a few common features are dynamic access lists, change of authorization (to switch VLANs, for example), and Security Group Tags (part of the Cisco TrustSec solution).
  6. Now the client can access specific resources based on what the PSN has sent back as a rule set. Alternatively, the client can be redirected to the guest login page or completely denied access to the network.
  7. All of these messages passed back and forth are all logged to the monitoring node, where they can be viewed from the admin node in an organized format.

This is definitely a complex beast with a lot of moving parts, but as long as you keep the fundamentals in mind and break it down into different parts, it’s not too tough to implement and troubleshoot. The most time-consuming part of a deployment is figuring out your policies for authorization. Once you have standard policies across the board, enforcing those policies is a breeze with ISE. I will go into policies in my next post, but let’s move onto the last topic for the overview: Deployment Topologies and Licensing.

Physical Deployment Examples

What I’m about to say here is probably the most important part of a deployment: DO NOT TRY TO SAVE MONEY BY GIVING UP HIGH AVAILABILITY! These nodes control access to your entire network. If these nodes go down, you might as well have a total network failure because nobody will get authenticated or authorized. Design ISE with as much high availability as you can afford. The only time a standalone deployment is acceptable is if you are doing a very small proof-of-concept which does not effect production end-users.

The other important part of a deployment is the hardware chosen to implement ISE on. Now, Cisco does offer an ESX/ESXi option, however, I don’t recommend that for a few reasons. First and foremost, the appliance option is tested and rated to scale to a certain number of endpoints. If you use the ESX/ESXi option, you are losing a little bit of that predictability. I said it before and I will say it again, these nodes control access to your entire network, so if you have unpredictable performance, then you will have unpredictable issues. The other thing I don’t like about an ESX/ESXi option is troubleshooting. If you do have an issue with ISE, you really want it resolved quickly. If you’re using the VM deployment and something goes wrong, you have to open tickets with Cisco, your server manufacturer, VMWare, and anything else that may be tied to your deployment. That’s not incredibly efficient, and you’re likely to run into a lot of vendor finger-pointing before you finally get the issue resolved. If you go with the Cisco appliance route, you open a ticket with Cisco, and that’s it! Smartnet covers the software and the hardware, so it makes the issue resolution process much simpler. I will say it one last time: These nodes control access to your entire network!

With that said, let’s get into the actual deployment options:

  • Standalone
    • One node running all three personas (PAN, MnT, PSN).
    • No redundancy.
    • Limited to a maximum of 2000 endpoints, regardless of hardware type.
  • Two-Node Deployment
    • Two nodes running all three personas (PAN, MnT, PSN).
    • Simple redundancy – one node is assigned the primary admin role and secondary monitoring role, and the other node is assigned the secondary admin role and primary monitoring role. They both run the policy services node, and network access devices are configured to use both PSNs.
    • Still limited to a maximum of 2000 endpoints.
  • Mid-sized Deployment – Separate Policy Services Nodes
    • Two nodes taking on the admin and monitoring persona, but no policy service persona.
    • Policy service nodes are standalone boxes. You can have up to 5 PSNs in a deployment where the PAN and MnT are collocated.
    • Limited to a maximum of 10000 endpoints regardless of hardware capacity.
  • Large Deployment
    • Every persona has its own dedicated node. You have a primary admin node, a secondary admin node, a primary monitoring node, a secondary monitoring node, and up to 40 policy services nodes. This deployment is so large that you will likely need load balancers to serve virtual IPs with a group of PSNs sitting behind it.
    • The endpoint capacity is based on the hardware of nodes. Prior to ISE version 1.2, the maximum capacity was 100000 endpoints. In version 1.2, that limitation was increased to 250000 endpoints.

If you’re looking for the performance metrics for each appliance, take a look at the design guides I linked to above. There are plenty of charts and other goodies to explain everything.

Got it? Good! Onto licensing this bad boy!

Licensing

ISE is offered in a few different flavors of licensing: functionality-based or deployment-based.

Functionality-based is the “full-steam ahead” type of licensing where all network access devices are supported and feature-sets are licensed. You can choose from the Base License or Base + Advanced License. The Base License is for deployments that only need to authenticate and authorize users and devices, provision guest users, access reporting features, and monitor and troubleshoot access to the network. The base license is perpetual (it has no term subscription limit). The Advanced License expands on the base license and enables organizations to make more advanced decisions (it has all of the cool features that you really want in a deployment). The features include device onboarding and provisioning, device profiling and feed service, posture services, mobile device management integration, and security group access capabilities. This license is term-based with a choice of 3- or 5-year term subscriptions. The base license is a prerequisite for the advanced license.

Deployment-based licensing is the slow, phased approach to deploying ISE. This type of licensing allows you to start with wireless endpoints only and expand to wired and VPN later when your organization is ready. Due to the complexity of ISE, I recommend using the phased approach and really getting to know the product before rolling it out to the entirety of the network. The Wireless License includes everything that the base + advanced license does, but it only applies to wireless network access devices. The wireless license is term-based with a choice of 3- or 5-year term subscriptions. This license typically satisfies most BYOD (Bring Your Own Device) policies management may be asking for. Once ISE has been proven effective on the wireless front, it’s typically pretty easy to justify rolling it out to wired and VPN devices as well using the Wireless Upgrade License. The wireless upgrade license is the same as wireless, but it expands the functionality of ISE to wired and VPN network access devices. It is also licensed on 3- or 5-year terms.

Along with the term length, each license has an endpoint limit (100, 250, 500, 1000, 1500, and so on). Keep in mind, this is not total endpoints, but simultaneously authorized endpoints. If an endpoint isn’t authorized, it doesn’t increment the license count. If an endpoint is authorized and then leaves the network, the license count decrements because it is de-authorized.

SO! Hopefully this information was helpful. It’s a lot to take in, and there are many nooks and crannies to navigate in order to have a successful ISE deployment. Keep an eye out for Part 2: Wireless ISE Deployment, where I’ll get into the technical details of the deployment type most organizations decide to start with.

As always, leave a comment below or send me an email at garret@thenetworksurgeon.com with any questions!