Deploying microsoft direct access in a test lab using Microsoft Hyper V and Cisco ASA 550

Question

1. The Current situation:

I have just started an internship in a company and one of the requirements for a succesful internship is the carrying out of a project. I decided on deploying Microsoft Direct Access as it enables Transparent and secure connection between Remote users and the internal network.

2. The Problem:

My test environment will be deployed behind a Firewall and the Company has a Cisco ASA550 in place but are reluctant to allow me use the device to simulate a test environment (probably scared I might make their network vulnerable to external attack).

3. The Question

How does one simulate a Cisco ASA firewall without coughing (not literally) out so much. Thanks.

Answer 1

You can simulate an ASA device in software emulators, several products exists.

Although product recommendation is off topic here, searching the web for Cisco emulator should quickly lead to GNS3 which is very popular.

GNS3 require that you provide software image, and there's some licensing concern here, but since the company actually own an ASA, it may be ok (but I can't guaranty it). Also I'm not sure it can emulate your specific model.

Another tool you could use is Cisco VIRL, it's not free but quite cheap, easy to install and has ASA emulation in.

Answer 2

You might look at Cisco Anyconnect automatic login vs DirectConnect. In terms of ASA:

Cisco Adaptive Security Virtual Appliance (ASAv) Data Sheet

The Adaptive Security Virtual Appliance runs as a virtual machine inside a hypervisor in a virtual host (Figure 1). Most of the features that are supported on a physical ASA by Cisco software are supported on the virtual appliance as well, except for clustering and multiple contexts. The virtual appliance supports site-to-site VPN, remote-access VPN, and clientless VPN functionalities as supported by physical ASA devices.

Cisco Adaptive Security Virtual Appliance (ASAv) Quick Start Guide, 9.5

You must install a smart license on the ASAv. Until you install a license, throughput is limited to 100 Kbps so you can perform preliminary connectivity tests. A smart license is required for regular operation.

Answer 3

Thanks Ron and JFL. I decided to use a Windows Server instead since it is a test environment. First I installed the role "Network Policy and Access Service" and enabled NAT. I then redirect required traffic (HTTPS) to the edge Server in my test environment. I do appreciate your help though. If anyone needs more clarification do let me know.