4

I have a practice network set up with the relevant topography shown in the below image:

network topology

I have TACACS+ running on HQ-AAA-Server (192.168.10.10) and AAA working using it on HQ (IOS) and HQ-FW1 (ASA). I also have a working VPN tunnel between HQ-FW1 and Branch-FW1. I would like to do AAA for the branch network from HQ-AAA-Server also but am struggling to work out how to set it up. I am starting wih Branch-FW1 but it's confusing me as the TACACS traffic will originate from inside the firewall.

As far as I can tell I will need an additional line in the VPN ACL to mark TACACS traffic as interesting on the Branch-FW1 but I am not sure what the source interface or IP will be? I guess I might also need some NAT settings too but again I'm not sure of source/destination IPs/Interfaces? I'll post the config for Branch-FW1 but if anything else is needed I can edit it in.

I've also been trying to test things with packet tracer but am again unsure as to what addresses/interfaces to use to properly simulate tacacs traffic coming from the Branch-FW1 firewall.

packet-tracer input <interface> tcp <origin IP> 1234 192.168.10.10 49

Full Config:


: 
: Serial Number: 9A2EL3EHE12
: Hardware:   ASAv, 2048 MB RAM, CPU Pentium II 2000 MHz
: Written by localadmin at 16:53:57.819 UTC Wed Dec 1 2021
!
ASA Version 9.5(2)204 
!
hostname Branch-FW
domain-name asecuritycompany.com
enable password 8Ry2YjIyt7RRXU24 encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
names
!
interface GigabitEthernet0/0
 description TO THE BRANCH ROUTER OUTSIDE 10.1.1.0/30 NETWORK
 nameif outside
 security-level 0
 ip address 10.1.1.2 255.255.255.252 
!
interface GigabitEthernet0/1
 description TO THE BRANCH INSIDE 10.1.10.0/24 NETWORK
 nameif inside
 security-level 100
 ip address 10.1.10.1 255.255.255.0 
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/6
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
dns server-group DefaultDNS
 domain-name asecuritycompany.com
object network net-local
 subnet 10.1.10.0 255.255.255.0
object network net-outside
 subnet 10.1.1.0 255.255.255.252
object network net-remote
 subnet 192.168.10.0 255.255.255.0
access-list HQFTPACL extended permit ip object net-local object net-remote 
pager lines 23
mtu outside 1500
mtu inside 1500
no failover
no monitor-interface service-module 
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static net-local net-local destination static net-remote net-remote
!
object network net-local
 nat (inside,outside) dynamic interface
object network net-outside
 nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 10.1.1.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
aaa-server HQ-TACACS-GROUP protocol tacacs+
aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10
 key testing123
user-identity default-domain LOCAL
aaa authentication serial console HQ-TACACS-GROUP LOCAL
aaa authentication telnet console HQ-TACACS-GROUP LOCAL
aaa authentication ssh console HQ-TACACS-GROUP LOCAL
aaa authentication enable console HQ-TACACS-GROUP LOCAL
aaa authorization command HQ-TACACS-GROUP LOCAL
aaa accounting ssh console HQ-TACACS-GROUP
aaa accounting enable console HQ-TACACS-GROUP
aaa accounting command HQ-TACACS-GROUP
aaa accounting serial console HQ-TACACS-GROUP
aaa accounting telnet console HQ-TACACS-GROUP
no snmp-server location
no snmp-server contact
crypto ipsec ikev1 transform-set HQFTPTRANS esp-aes-256 esp-sha-hmac 
crypto ipsec security-association pmtu-aging infinite
crypto map HQFTPMAP 1 match address HQFTPACL
crypto map HQFTPMAP 1 set pfs group1
crypto map HQFTPMAP 1 set peer 192.168.20.2 
crypto map HQFTPMAP 1 set ikev1 transform-set HQFTPTRANS
crypto map HQFTPMAP interface outside
crypto ca trustpoint _SmartCallHome_ServerCA
 no validation-usage
 crl configure
crypto ca trustpool policy
 auto-import
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh stricthostkeycheck
ssh 192.168.10.21 255.255.255.255 inside
ssh timeout 10
ssh version 2
ssh key-exchange group dh-group14-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
username localadmin password zDkbp36jt66L0Z6u encrypted privilege 15
tunnel-group 192.168.20.2 type ipsec-l2l
tunnel-group 192.168.20.2 ipsec-attributes
 ikev1 pre-shared-key SECRET-KEY
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns migrated_dns_map_1 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect ip-options 
  inspect netbios 
  inspect rsh 
  inspect rtsp 
  inspect skinny  
  inspect esmtp 
  inspect sqlnet 
  inspect sunrpc 
  inspect tftp 
  inspect sip  
  inspect xdmcp 
  inspect icmp 
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email [email protected]
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
 profile License
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination transport-method http
Cryptochecksum:fa74a8e9d80a2e0fff5425ca5332b3a9
: end

Using Packet Tracer I get the following output:

Branch-FW(config)# packet-tracer input inside tcp 10.1.10.1 1234 192.168.10.10$

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,outside) source static net-local net-local destination static net-remote net-remote
Additional Information:
NAT divert to egress interface outside
Untranslate 192.168.10.10/49 to 192.168.10.10/49

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

First am I correctly simulating Tacacs traffic with this command, and secondly if I am what ACL do I need to allow traffic?

Doing a bit more testing, I can ping 192.168.10.10 from Br-PC1 so the Tacacs host is accessible from the branch network, but I can't ping it from the Branch-FW1 so it appears as if all (?) traffic is being blocked when the source of the traffic is the firewall?

Edit: Turns out what I was missing was:

management-access inside

to enable router management from the inside interface, however for this to kick in properly it needs to be written to memory copy run start then the ASA needs to be rebooted for the full AAA to work.

2 Answers 2

4

In the line aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10, the portion that says (inside) is your interface binding that tells the ASA which interface to use as the source to reach the AAA server. As you need this to go over a tunnel to reach the host because it’s remote, sourcing from the inside is required. You already have a NAT exemption statement, which looks correct.

So, the traffic will come from 10.1.10.1 since that’s the IP address on the interface with the nameif of inside.

10
  • 1
    Thanks, I've done a run of packet tracer with those assumptions and added the output to the question.
    – DavidM
    Dec 1, 2021 at 18:42
  • @DavidM You can’t use packet-tracer for this because it’s traffic generating from the firewall itself, not traffic flowing through the firewall. You would be better off using the test aaa-server authentication command to try a test authentication request, or try an actual authentication request rather than via the test aaa-server authentication command.
    – Jesse P.
    Dec 1, 2021 at 19:21
  • 1
    Using test aaa-server authentication HQ-TACACS-GROUP username <user> password <pass> and providing 192.168.10.10 as the ip when prompted fails and from wireshark I cannot see any traffic generated on either the inside or outside interface of the firewall. Is there something that would block the traffic within the firewall itself?
    – DavidM
    Dec 1, 2021 at 19:31
  • 1
    Sorry, the error was "ERROR: Authentication Server not responding: No error"
    – DavidM
    Dec 1, 2021 at 19:44
  • 1
    @DavidM Nice. Good catch. You don’t have to accept my answer since it didn’t solve your problem. You can submit your own answer and then accept that. That way you get some more points on here, too.
    – Jesse P.
    Dec 3, 2021 at 11:57
4

Your configuration

aaa-server HQ-TACACS-GROUP (inside) host 192.168.10.10
 key testing123

defines the inside interface as the source.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.