Add Cisco devices

Relevant for: AFA Administrators

This topic describes how to add Cisco devices to AFA and perform related configurations.

Add a CSM-managed Cisco device

This procedure describes how to add a Cisco device managed by a Cisco CSM. You must add each Cisco device or security context that is managed by a Cisco CSM separately, even if they are managed by the same CSM.

Note: To perform this procedure, you must have a Cisco API license for the CSM device.

Do the following:

  1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.

  2. In the vendor and device selection page, select Cisco > Point > Firewall via CSM (CSM 4.3 or above).

  3. Complete the fields as needed, and then click Finish.

    Firewall Host Name

    Type the host name of the Cisco device to be analyzed, as it appears in the CSM UI.

    CSM Server

    Type the host name or IP address of the Cisco CSM server.

    CSM User Name

    Type the username to use for SSH access to the Cisco CSM.

    CSM Password

    Type the password to use for SSH access to the Cisco CSM.

    Select the remote agent that should perform data collection for the device.

    To specify that the device is managed locally, select Central Manager.

    This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

    Select the baseline compliance profile to use, in order to enable generation of Baseline Compliance Reports for this device.

    The drop-down list includes all baseline compliance profiles in the system. For more information on baseline compliance profiles and instructions for adding new baseline compliance profiles, see Customize baseline configuration profiles

    Select None to disable Baseline Compliance Report generation for this device.

    Specify how AFA should acquire the device's routing information:

    • Automatic. AFA will automatically generate the device's routing information upon analysis or monitoring
    • Static Routing Table (URT). AFA will take the device's routing information from a static file you provide. For more information, see Specify routing data manually.

    Specify how rules should be displayed in device reports:

    • ASDM: Display rules in the Cisco Adaptive Security Device Manager (ASDM) graphical interface.
    • CLI: Display rules in command line format.

    The default value is ADSM.

    Note: Intelligent Policy Tuner and the "Unused objects within rules" list are available only with ADSM.

    Log collection method

    Specify the log collection method that AFA should use when collecting traffic logs for the Cisco device, by selecting one of the following:

    • Hit-counters: Only use hit-counter data. The Change History report page will be based on "last modified" timestamps, and Intelligent Policy Tuner is disabled.
    • Standard: Use hit-counter data for rule usage, and Syslog data for the Change History report page. Intelligent Policy Tuner is disabled.
    • Extensive: Combine data from both hit-counters and Syslog. Intelligent Policy Tuner is enabled.

    The default value is Extensive.

    Note: The Extensive method is only available when the ADSM is selected in the Rules view area.

    Syslog-ng server

    If you selected Standard or Extensive in the Log collection method field, you must specify the syslog server. For details, see Specify a Syslog server.

    Additional firewall identifiers

    Type any additional IP addresses or host names that identify the device. When adding multiple entries, separate values by a ':'. For example: "1.1.1.1:2.2.2.2:ServerName".

    This is relevant when the device is represented by multiple or non-standard device identifiers in the logs, for example, in cases of firewall clusters or non-standard logging settings. If AFA receives logs with an identifier it does not recognize, the logs will not be processed.

    Note: This field is only relevant for the parent device. In order to specify additional identifiers for sub-systems (Juniper VSYS/LSYS, Fortinet VDOM, Cisco security context, etc.), see Add additional device identifiers for sub-systems.

    Log collection frequency (minutes)

    Type the interval of time in minutes, at which AFA should collect logs for the device.

    Real-time change monitoring

    Select this option to enable real-time alerting upon configuration changes. For details, see Configure real-time monitoring.

    Set user permissions

    Select this option to set user permissions for this device.

    The new device is added to the device tree.

  4. If you selected Set user permissions, the Edit users dialog box appears.

    In the list of users displayed, select one or more users to provide access to reports for this account.

    1. To select multiple users, press the CTRL button while selecting.

    1. Click OK to close the dialog.

A success message appears to confirm that the device is added.

Cisco Application Centric Infrastructure (ACI) devices in AFA

The following sections describe how ASMS connects to Cisco ACI devices:

Network connectivity

The following diagrams show an ASMS Central Manager or Remote Agent connecting to a Cisco ACI APIC and fabric.

Device permissions

ASMS requires the following permissions to access Cisco ACI devices:

ASMS requires minimal, read-only access permissions to access Cisco ACI devices and collect data.

The user defined on the ACI APIC controller must have the following read-only privileges:

  • tenant-connectivity

  • tenant-epg

  • tenant-ext-connectivity

  • tenant-security

  • tenant-qos

  • nw-svc-policy

When ActiveChange is enabled, the Cisco ACI user defined in ASMS must have write permissions for the Admin role.

MSO/NDO visibility in the device tree

  • The MSO/NDO is not shown in the device tree.

  • The APIC is shown in the device tree in this format:

    • For MSO: MSO_[MSO host name]/[APIC IP] or MSO_[MSO IP]/[APIC IP]. For example, MSO_mso.example.local/10.20.244.3 or MSO_10.20.244.1/10.20.244.3.

    • For NDO: NDO_[NDO host name]/[APIC IP] or NDO_[MSO IP]/[APIC IP]. For example, NDO_mso.example.local/10.20.244.3 or NDO_10.20.244.1/10.20.244.3.

  • Tenant names are defined in the device tree as: [APIC host name]_[TenantName] or [APIC IP]_[TenantName]. For example, aci.example.local_ CLI-P or 10.20.244.3_CLI-P

EPG / ESG identification and supported contract scopes

During analysis, AFA reads all configuration data from ACI and saves EPG values according to the following logic:

  • If an EPG is associated to specific VMs (endpoints), their IP addresses are saved as the EPG value.
  • Otherwise, AFA learns Bridge Domains (BD) or EPG subnets to define the EPG value.
  • For APICs that are managed by an MSO, IPs (endpoints) of Stretched EPGs, although they may reside in different sites, are displayed on each site as if they were on the local site. For example, if Stretched EPG 1 covers two sites with different endpoints in each site, the sites will display all IPs (endpoints) on each. 

During analysis, AFA reads all configuration data from ACI and stores ESG values according to the following logic:

  • If an ESG is associated with specific VMs (endpoints), the IP addresses of those VMs are stored as the value for the ESG.

  • If no specific VMs are associated, AFA reads endpoint selectors from the ESG configuration to determine the ESG value.

  • Currently, AFA only supports IP Selectors for ESG objects.

  • ESGs are represented by the icon

The AFA Policy tab displays the following contract scopes for ACI EPGs/ESGs:

  • ApplicationProfile. Supported only when the consumer and provider are from the same Application Profile.

  • Global
  • Tenant. Supported only when the consumer and provider are from the same tenant.
  • VRF. If the consumer or provider belong to different VRFs, AFA shows expanded rules, one for each VRF.

There are six contract types available on the AFA Policy tab:

Regular

Contract between EPGs/ESGson same APIC.

Inter-site

Contract between EPGs on different APICs managed by the same MSO/NDO.

CPG

Contract Preferred Group
Inter-VRF*

For inter-VRF connectivity:

  1. Between VRFs in the same tenant using inter-VRF contracts, inter-VRF contract types are shown for both. (Scope should be Tenant or Global).

  2. Between two tenants, inter-VRF contract types are shown for all and the contract must be defined on the common tenant. (Scope should be Global).
Imported*

For inter-VRF connectivity:

  • Between VRFs in different tenants with exported and imported contracts. On the tenant exported from, inter-VRF contract type is shown. On the tenant imported to, Import contract type is shown. (Scope must be Global).
Not formed

Contracts that are missing consumer and/or provider info.

*In MSO/NDO-managed environments, these contract types are combined with the inter-site type, when relevant.

The diagram below illustrates Inter-site contracts. EPGs residing on other APICs are displayed as if they are local (known as Shadow EPGs). For example, for the Inter-Site contract between EPG 1 on APIC 1 and EPG 2 on APIC 2, Shadow EPG 2 resides on APIC 1 and Shadow EPG 1 resides on APIC 2, each with all its content.

The diagram below illustrates VRF-related contracts .

Add a Cisco (ACI) to AFA

This procedure describes how to connect Cisco ACI devices to AFA. AFA always connects to Cisco ACI devices via REST.

Note:

  • ASMS requires minimal, read-only access permissions to access Cisco ACI devices and collect data.

    The user defined on the ACI APIC controller must have the following read-only privileges:

    • tenant-connectivity

    • tenant-epg

    • tenant-ext-connectivity

    • tenant-security

    • tenant-qos

    • nw-svc-policy

Do the following:

  1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.

  2. In the vendor and device selection page, select Cisco > Application Centric Infrastructure (ACI).

  3. Populate the fields as follows:

    1. Enter details to access your device from AFA:

    Host

    Enter the device's host name or IP address.

    Tip: Typically, your APIC cluster has three nodes. Specify the host name or IP address of only one of the APIC nodes.

    If the node you added goes down, you'll need to switch your AFA device configuration to another node. Edit the device configuration in AFA and enter the host name or IP address of that second node.

    User Name

    In the Username field, enter your APIC service username.

    If you use login domains for APIC authentication, the username format is: 

    apic:fallback\\<username>

    Password

    Enter the password to access the device.
    1. If the APIC is managed by an MSO/NDO, select the Multi-site setup checkbox.

    Multi-site Host

    Enter the multi-site host name or IP address.
    Multi-site domain Enter the multi-site domain name. If left blank, default domain is local.

    User Name

    Enter the username to access the MSO/NDO.

    Password

    Enter the password to access the MSO/NDO.

    Select a remote agent to perform data collection for the device, if relevant.

    To configure the device to be managed locally, select Central Manager.

    For more details, see Configure a distributed architecture.

    Select this option to enable FireFlow to generate recommendations and push them to the device.

    Note: Recommendations can be generated for all APICs and tenants managed by MSO/NDOs. However, when an APIC is managed by an MSO/NDO, ASMS can deploy changes with ActiveChange only for tenants not managed by MSO/NDO.

    For more details, see Implement changes with ActiveChange.

    Select either of the following options:

    • Real-time change monitoring. Enable real-time alerting upon configuration changes. For details, see Configure real-time monitoring.
    • Set user permissions. Set user permissions for this device.

  4. If you enabled ActiveChange, the ActiveChange License Agreement dialog is displayed.

    Select I Agree, and click OK.

  5. Click Finish. The new device is added to the device tree.

    • ACI devices appear in the device tree in a two-tier hierarchy, including both APICs and tenants.
    • EPGs/ESGs are shown with the following syntax: <application_profile>/<EPG_name> or <application_profile>/<ESG_name>. For more details, see EPG / ESG identification and supported contract scopes.
    • Any VRFs on the map are shown with the following syntax: <Tenant_name>/<VRF_name>
    • vzAny objects are shown with the following syntax: <VRF_name>/vzAny. AFA updates the contents of these objects upon change monitoring and analysis.
    • When an APIC is managed to an MSO, see MSO/NDO visibility in the device tree.

  6. If you selected Set user permissions, the Edit users dialog box appears.

    In the list of users displayed, select one or more users to provide access to reports for this account.

    1. To select multiple users, press the CTRL button while selecting.

    1. Click OK to close the dialog.

A success message appears to confirm that the device is added. The ACI and each ACI tenant is displayed in the device tree.

By default, AFA query results include ACI tenants with either of the following criteria:

  • ACI tenants with a BD that intersects with the query source or destination
  • ACI tenants where one or more of the tenant’s VRFs is included in the query path

ASMS administrators can configure AFA to identify ACI tenants only when the tenant's VRF is included in the query path. Do the following:

  1. On your AFA machine, browse to and open the devicedriver-cisco-aci.properties file for editing. This file is located in the /data/algosec-ms/config directory on your AFA machine.
  2. Update the devicedriver.cisco.aci.protectedCloudHostsEnabled parameter value to false.

Cisco ASA firewalls in AFA

The following sections describe how ASMS connects to Cisco ASA firewalls:

Note: All references in the ASMS Documentation to Cisco ASA devices also refer to legacy PIX and FWSM devices. To add a new PIX or FWSM device to AFA, select ASA options.

See also: VALIDATE_USER_ROUTING_URT parameter which applies only to Cisco PIX.

Network connection

The following diagram shows an ASMS Central Manager or Remote Agent connecting to a Cisco ASA device:

Device permissions

ASMS requires the following permissions to connect to your Cisco ASA devices:

ASMS requires the ability to run the following commands on your ASA device:

  • show version
  • show mode
  • changetosystem
  • show context
  • show access-list
  • show ipv6 access-list
  • show running-config
  • show route
  • terminal
  • show cts sgt-map

Tip: You may want to create a separate user for ASMS, enabling the user to have a security level 5.

When ActiveChange is enabled, ASMS requires a user with read-write permissions and is able to enter privileged mode, using enable credentials (security level 15).

ASMS supports the ability to collect logs either by receiving Syslog messages from the device, or by collecting Syslog messages from a remote Syslog server.

In either case, make sure that your Cisco ASA device is configured to send CISCO 106100 SYSLOG events to ASMS.

For example:

%FWSM-6-106100: access-list acl_ID {permitted | denied | est-allowed}  protocol interface_name/source_address(source_port) -> interface_name/dest_address(dest_port) hit-cnt number ({first hit | number-second interval})

These messages are logged when packets match an ACL statement, if you have the log option for the access-list command configured.
The message level depends on the level defined for the access-list command. By default, this level 6.

Note: Intelligent Policy Tuner analysis is supported for Cisco ASA versions 7.1 and higher.

To use this feature, the device must send correct log messages, in type 106100, and the device's ACLs must contain the keyword log.

Add a Cisco ASA firewall

This procedure describes how to add a Cisco ASA firewall to AFA.

Do the following:

  1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.
  2. In the vendor and device selection page, select Cisco > ASA.

  3. Complete the fields as needed.

    Enter details to access your device from AFA:

    Host

    Enter the device's host name or IP address.

    User Name

    Enter the username to use for SSH access to the device.

    Note: AFA partially supports user awareness for Cisco ASA devices. The network user appears as a field for each rule in the Policy tab, but is not used in traffic simulation queries.

    Password

    Enter the password to use for SSH access to the device.

    Note: For Cisco ASA devices enabled for CyberArk, the Password and Enable User Password must be the same.

    Enable User Password

    Enter the enable user password to use:

    • noenable. Skip running the enable command.
    • Algosec_no_passwd. The enable password is empty.
    • Leave the field empty. AFA will issue a login command instead of the enable command, using the same password provided for the SSH connection.

    Note: For Cisco ASA devices enabled for CyberArk, the Password and Enable User Password must be the same.

    Retrieve credentials from CyberArk vault

    Select to authenticate the device with a CyberArk Vault instead of saving the device credentials on the AlgoSec server.

    When selected, also enter the following CyberArk details for the device being authenticated:

    • Platform (Policy ID)
    • Safe
    • Folder
    • Object

    Note: These options only appear when CyberArk is configured in AFA. For details, see Integrate ASMS and CyberArk.

    Select the remote agent that should perform data collection for the device.

    To specify that the device is managed locally, select Central Manager.

    Note: This field is only relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

    To enable generation of Baseline Compliance Reports for this device, select the baseline compliance profile to use.

    The drop-down list includes all baseline compliance profiles in the system.

    To disable Baseline Compliance Report generation for this device, select None.

    For more details, see Customize baseline configuration profiles.

    Select one of the following methods to collect data:

    • SSH (recommended)
    • Telnet

    Then define:

    Custom Port

    To specify a custom port, select this option and type the port.

    This option is only relevant when SSH is selected.

    Number of allowed encryption keys

    Enter the permitted number of different RSA keys received from this device's IP address.

    Different RSA keys may be sent from the same IP address in cases of cluster fail-over, device operating system upgrades, etc.

    For example, if a cluster fail-over occurs, the secondary node will send a new RSA key from the same IP address to AFA. If this number is set to 1, the connection to the node will fail, resulting in a failed analysis.

    Specify how AFA should acquire the device's routing information:

    • Automatic. AFA will automatically generate the device's routing information upon analysis or monitoring.
    • Static Routing Table (URT). AFA will take the device's routing information from a static file you provide. For more details, see Specify routing data manually.

    Specify how rules should be displayed in device reports:

    • ASDM: Display rules in the Cisco Adaptive Security Device Manager (ASDM) graphical interface.
    • CLI (Default): Display rules in command line format.

    Note: Intelligent Policy Tuner and the Unused objects within rules list are available only with ADSM. For more details, see Intelligent Policy Tuner.

    Define the following as needed:

    Log collection method

    Specify the log collection method that AFA should use when collecting traffic logs for the Cisco device, by selecting one of the following:

    • Hit-counters: Only use hit-counter data. The Change History report page will be based on last modified timestamps.

      Intelligent Policy Tuner is disabled.

    • Standard: Use hit-counter data for rule usage, and Syslog data for the Change History report page.

      Intelligent Policy Tuner is disabled.

    • Extensive (Default): Combine data from both hit-counters and Syslog.

      Intelligent Policy Tuner is enabled.

      Note: This method is available only when ADSM is selected in the Rules view area. For details, see Rules View.

    Syslog-ng server

    If you selected Standard or Extensive in the Log collection method field, you must specify the syslog server.

    For details, see Specify a Syslog server.

    Additional firewall identifiers

    Enter any additional IP addresses or host names that identify the device. When adding multiple entries, separate values by a colon (:).

    For example: 1.1.1.1:2.2.2.2:ServerName.

    This is relevant when the device is represented by multiple or non-standard device identifiers in the logs, for example, in cases of firewall clusters or non-standard logging settings. If AFA receives logs with an identifier it does not recognize, the logs will not be processed.

    Note: This field is only relevant for the parent device, and not for sub-systems. For more details, see Add additional device identifiers for sub-systems

    Log collection frequency (minutes)

    Enter the interval of time in minutes, at which AFA should collect logs for the device.

    Select this option to enable FireFlow to generate CLI recommendations and push them to the device.

    Checking this box will enable ActiveChange for all the supported Cisco firewalls, Cisco IOS routers, and Juniper SRX firewalls (not only for this device).

    For more details, see Implement changes with ActiveChange.

    Select the following as needed:

    Real-time change monitoring

    Select this option to enable real-time alerting upon configuration changes. For details, see Configure real-time monitoring.

    Set user permissions

    Select this option to set user permissions for this device.

  4. If you enabled ActiveChange, the ActiveChange License Agreement dialog is displayed.

    Select I Agree, and click OK.

  5. Click Finish. The new device is added to the device tree.

  6. If you selected Set user permissions, the Edit users dialog box appears.

    In the list of users displayed, select one or more users to provide access to reports for this account.

    1. To select multiple users, press the CTRL button while selecting.

    1. Click OK to close the dialog.

A success message appears to confirm that the device is added. Any configured contexts on the ASA device are also imported.

Cisco Firepower devices in AFA

The following sections describe how ASMS connects to Cisco Firepower devices:

Note: AFA automatically identifies Cisco Firepower devices in service-chaining mode if the device has only a single interface.

If your device has multiple interfaces and service-chaining mode is not identified automatically, configure this for your device manually. For more details, see Configure one-armed mode manually.

Note:

For logging engines: AlgoSec supports Unified Syslog (SNORT) engine events for Cisco Firepower.

Network connectivity

The following diagram shows an ASMS Central Manager or Remote Agent connecting to a Cisco Firepower device:

Device permissions

ASMS requires the following device permissions to connect to Cisco Firepower devices:

The Cisco Firepower system includes both the Firepower Management Center (FMC) and the Firepower Threat Defense (FTD) firewalls.

Direct onboarding of an FTD (without FMC) is currently not supported. AFA manages the FMC directly, supporting the FTD via the FMC API.

In addition, for data collection AFA executes the following commands on FTD via SSH:

  • show version

  • show route

Therefore, AFA must have both of the following access rights:

  • API (HTTPS) access to the FMC
  • SSH access to the FTD. AFA does not support direct access to the FDM API.

To connect to your device, ASMS requires either a:

  1. User with an Administrator role; or

  2. User with a custom FMC user role. See To create a Custom FMC user role for AFA analysis and monitoring

The user must be:

  • Dedicated for ASMS. Connecting to the device using the same user as ASMS may cause that user to be logged out of the Firepower UI at each monitoring cycle, as well as when any changes are made to the Firepower device via ASMS.

  • Created as part of the Global domain.

    For example:

In FMC Settings > Users > User Roles tab, give the custom FMC user role the following permissions to run AFA analysis and monitor:

  • Policies

    • Access Control

      • Access Control Policy

    • Intrusion Policy

    • Malware & File Policy

    • DNS Policy

    • Identity Policy

    • SSL Policy

    • Prefilter Policy

  • Devices

    • Device Management

    • NAT

      • NAT list

  • VPN

  • Object Manager

    • Rule Editor

  • Deploy Configuration to Devices

  • System

    • Domains

    • Monitoring

      • Audit

    • Syslog

Note: Make sure the External Database Access box is deselected.

When ActiveChange is enabled, ASMS requires read-write permissions.

The user must continue to maintain Administrator or the custom FMC user role permissions

For the custom FMC user role, in FMC Settings > Users > User Roles tab, add the following permissions to enable ActiveChange (in addition to AFA analysis and monitoring settings above, see To create a Custom FMC user role for AFA analysis and monitoring):

  • Policies

    • Access Control

      • Access Control Policy

        • Modify Access Control Policy

  • Object Manager

    • Rule Editor

      • Modify Rule Editor

    • Modify Object Manager

  • Deploy Configuration to Devices

Note: Make sure the External Database Access box is deselected.

Add a Cisco Firepower

This procedure describes how to add a Cisco Firepower device to AFA.

Do the following:

  1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.

  2. In the vendor and device selection page, select Cisco > Firepower.

  3. Complete the following fields as needed.

    Enter details to access the device from AFA:

    Host

    Enter the hostname or IP address of the FMC.

    User Name

    Enter the username to use for SSH access to the FMC device.

    Note: AFA does not support user or network application awareness for Cisco Firepower. The network application appears as a field for each rule in the Policy tab, but is not used in traffic simulation queries.

    Password

    Enter the password to use for SSH access to the FMC device.

    Select the remote agent that should perform data collection for the device.

    To specify that the device is managed locally, select Central Manager.

    This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

    Select this option to allow FireFlow to automatically implement changes on the device.

    For more details, see Implement changes with ActiveChange.

    You can take advantage of the power of policy optimization features (like unused rules, IPT , etc.) for your Cisco Firepower device by implementing traffic logs collection and monitoring.

    This step assumes that your FMC has already been configured to send logs to a syslog server. See Cisco FMC Documentation for the FMC version you are using. For details to configure a syslog server in ASMS, see Specify a Syslog server.

    Define the following as needed:

    Syslog-ng server

    Specify the syslog server.

    For details, see Specify a Syslog server.

    Additional firewall identifiers

    Enter any additional IP addresses or host names that identify the device. When adding multiple entries, separate values by a colon (:).

    For example: 1.1.1.1:2.2.2.2:ServerName.

    This is relevant when the device is represented by multiple or non-standard device identifiers in the logs, for example, in cases of firewall clusters or non-standard logging settings. If AFA receives logs with an identifier it does not recognize, the logs will not be processed.

    Note: This field is only relevant for the parent device, and not for sub-systems. For more details, see Add additional device identifiers for sub-systems

    Log collection frequency (minutes)

    Enter the interval of time in minutes, at which AFA should collect logs for the device.

    Log collection method
    (on page 2)

    Specify the log collection method that AFA should use when collecting traffic logs for the Cisco device, by selecting one of the following:

    • Standard: Use hit-counter data for rule usage, and Syslog data for the Change History report page.

      Intelligent Policy Tuner is disabled.

    • Extensive (Default): Combine data from both hit-counters and Syslog.

      Intelligent Policy Tuner is enabled.

      Note: This method is available only when ADSM is selected in the Rules view area. For details, see Rules View.

    • None Logs are disabled.

  1. Click Next to continue on to the FirePower - Step 2/2 page. This page lists the FTDs that are managed by the Firepower FMC. For example:

  2. To exclude an FTD, clear its check box in the table.

  3. Click to configure details for the selected FTDs.

    In the Direct Access Configuration, define the Host, User Name, and Password, and Baseline Profile for each FTD.

    Tip: To disable Baseline Compliance Report generation for this device, select None.

    For more details, see Customize baseline configuration profiles.

    For example:

    Click Test Connectivity to test the connections to the FTDs defined, and then click OK.

    Note: You must specify the credentials for each FTD in order for AFA to collect routing data it needs to accurately analyze the device.

  4. Select the following as needed:

    Real-time change monitoring

    Select this option to enable real-time alerting upon configuration changes. For details, see Configure real-time monitoring.

    Set user permissions

    Select this option to set user permissions for this device.

  5. If you enabled ActiveChange, the ActiveChange License Agreement dialog is displayed.

    Select I Agree, and click OK.

  6. Click Finish.

    The new device is added to the device tree.

  7. If you selected Set user permissions, the Edit users dialog box appears.

    In the list of users displayed, select one or more users to provide access to reports for this account.

    1. To select multiple users, press the CTRL button while selecting.

    1. Click OK to close the dialog.

A success message appears to confirm that the device is added.

Cisco IOS routers in AFA

The following sections describe how Cisco IOS routers are added to AFA:

Network connectivity

The following diagram shows an ASMS Central Manager or Remote Agent connecting to a Cisco IOS router.

Device permissions

ASMS requires the following for the user used to access your Cisco IOS routers:

ASMS requires the ability to run the following commands on your Cisco IOS routers:

  • show version
  • show interface
  • show ipv4 vrf all interface
  • show ip interface
  • show ipv6 interface
  • show ip access-list
  • show ipv6 access-list
  • show bgp summary
  • show running-config
  • show ip route
  • show bgp vpnv4 unicast labels
  • show ipv4 vrf all interface brief
  • show ip route vrf

Note: Some commands may be relevant only on IOS-XE and IOS-XR devices.

Tip: You may want to create a read-only user with specific permissions to run show running-config view full.

For details, see Defining a limited-privilege Cisco IOS Router user for AFA data collection in AlgoPedia.

When ActiveChange is enabled, ASMS requires a user that is able to enter privileged mode, using enable credentials (security level 15).

Add a Cisco IOS router

This procedure describes how to add a Cisco IOS router to AFA.

Do the following:

  1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.
  2. In the vendor and device selection page, select Cisco > IOS Router.

  3. Complete the fields as needed.

    Enter details for accessing your device.

    Host

    Enter the device's host name or IP address.

    User Name

    Enter the username to use for device access via SSH.

    Password

    Enter the password to use for device access via SSH.

    Note: For Cisco IOS devices enabled for CyberArk, the Password and Enable User Password must be the same.

    Enable User Name

    Enter the enable username to use.

    If you do not want AFA to enter the enable mode, enter noenable.

    Note: This field is required.

    Enable User Password

    Do one of the following:

    • Enter the enable user password to use.
    • To specify an empty enable password, enter AlgoSec_no_passwd.

    Note: For Cisco IOS devices enabled for CyberArk, the Password and Enable User Password must be the same.

    Note: This field is required.

    Retrieve credentials from CyberArk vault

    Select this check box to authenticate the device with a CyberArk Vault instead of saving the device credentials on the AFA server.

    When selected, also enter the following CyberArk details for the device being authenticated via CyberArk:

    • Platform (Policy ID)
    • Safe
    • Folder
    • Object

    Note: These options only appear when CyberArk is configured in AFA. For details, see Integrate ASMS and CyberArk.

    Select the remote agent that should perform data collection for the device.

    To specify that the device is managed locally, select Central Manager.

    This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

    To enable generation of Baseline Compliance Reports for this device, select the baseline compliance profile to use.

    The drop-down list includes all baseline compliance profiles in the system. For more details, see Customize baseline configuration profiles.

    To disable Baseline Compliance Report generation for this device, select None.

    Note: If this router is divided into VRF modules, Baseline Compliance Reports will only be generated for the root/default VRF.

    Select the following options as needed:

    Include risk analysis and policy optimization

    Select this option to include risk analysis and policy optimization analysis in the device's reports.

    When this is not selected, AFA produces condensed router reports which run as if there is no license for risks, optimization or regulatory compliance. Reports still include policy changes and baseline compliance.

    This option is disabled by default.

    Note: Selecting this option will increase the analysis time for this router significantly and might result in performance degradation.

    Automatically add/remove VRF instances upon detection (Applies for all Cisco Routers)

    Select this option to enable automatic updating of VRF instances for all Cisco routers defined in AFA.

    The updates will be reflected in the device tree and graphic network map, and the updates will affect the device license usage.

    Select a data transmission method:

    • SSH (more secure)
    • Telnet

    Define the following as needed:

    Custom Port

    To specify a custom port, select this option and type the port.

    This option is only relevant when SSH is selected.

    Number of allowed encryption keys

    Enter the permitted number of different RSA keys received from this device's IP address.

    Different RSA keys may be sent from the same IP address in cases of cluster fail-over, device operating system upgrades, etc. For example, if a cluster fail-over occurs, the secondary node will send a new RSA key from the same IP address to AFA. If this number is set to 1, the connection to the node will fail, resulting in a failed analysis.

    Specify how AFA should acquire the device's routing information:

    • Automatic. AFA will automatically generate the device's routing information upon analysis or monitoring.
    • Static Routing Table (URT). AFA will take the device's routing information from a static file you provide. For details, see Specify routing data manually.

    Select this option to enable FireFlow to generate CLI recommendations and push them to the device.

    Checking this box will enable ActiveChange for all the supported Cisco firewalls, Cisco IOS routers, and Juniper SRX firewalls (not only for this device).

    For more details, see Implement changes with ActiveChange.

    Select the following as needed:

    Real-time change monitoring

    Select this option to enable real-time change monitoring. For details, see Configure real-time monitoring.

    Set user permissions

    Select this option to set user permissions for this device.

  4. If you enabled ActiveChange, the ActiveChange License Agreement dialog is displayed.

    Select I Agree, and click OK.

  5. Click Finish. The new device is added to the device tree.

  6. If you selected Set user permissions, the Edit users dialog box appears.

    In the list of users displayed, select one or more users to provide access to reports for this account.

    1. To select multiple users, press the CTRL button while selecting.

    1. Click OK to close the dialog.

A success message appears to confirm that the device is added. The new device appears in the device tree, including any VRF devices as unique nodes.

Cisco ISE devices in AFA

The following sections describe how ASMS connects to CISCO ISE devices:

Network connectivity

The following diagram shows an ASMS Central Manager or Remote Agent connecting to a Cisco ISE device.

Device permissions

ASMS connects to Cisco ISE devices via the Admin Node, using the ERS API.

To do so, ASMS requires an Administrator user with Read/Write permissions and the ERS-Operator group assignment.

Additionally, ASMS requires:

  • A REST connection over port 9060
  • Cisco ISE TrustSec SXP feature enabled for the device

Add a Cisco ISE device to AFA

This procedure describes how to add a Cisco ISE device to AFA.

Do the following:

  1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.
  2. In the vendor and device selection page, select Cisco > CISCO ISE.

  3. Complete the fields as needed.

    Enter details for accessing your device.

    Host

    Enter the device's host name or IP address.

    User Name

    Enter the username to use for device access.

    Password

    Enter the password to use for device access.

    Select the remote agent that should perform data collection for the device.

    To specify that the device is managed locally, select Central Manager.

    This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

    Select the following as needed:

    Real-time change monitoring

    Select this option to enable real-time change monitoring. For details, see Configure real-time monitoring.

    Set user permissions

    Select this option to set user permissions for this device.

  4. Click Finish. The new device is added to the device tree.

  5. If you selected Set user permissions, the Edit users dialog box appears.

    In the list of users displayed, select one or more users to provide access to reports for this account.

    1. To select multiple users, press the CTRL button while selecting.

    1. Click OK to close the dialog.

A success message appears to confirm that the device is added.

Cisco Meraki devices in AFA

ASMS supports Cisco Meraki devices as follows:

  • Policy Visibility including the following policy types:

    • Group Policy: displayed in ASMS as Layer 3 firewall Group Policy [GroupPolicyName]

    • Layer 3 Outbound rules

    • Site-to-site outbound firewall

  • Report Generation
  • Topology including VPN tunnels
  • Change History
  • Risks Calculation
  • Map Visibility
  • Regulatory Compliance
  • Traffic Simulation Query
  • Monitor Cycle

The following sections describe how ASMS connects to Cisco Meraki devices:

Network connectivity

From AFA we communicate with Meraki via Rest API over HTTPS protocol.

Device permissions

ASMS requires an API key to communicate with the Meraki via the Cisco Meraki SaaS application. See Add Cisco devices.

Obtaining Cisco Meraki API Key

An API key is required to add a Meraki device to ASMS.

Create your Meraki API key, as follows:

  1. Navigate to the Meraki dashboard at this address: https://account.meraki.com/secure/login/dashboard_login
  2. Login using your Meraki account credentials.

  3. From your Cisco Meraki Account, in the upper right corner of screen, click My Profile from the user name drop down menu.

  4. Scroll to the API access/ API keys section. Click the Generate new APIKey button.

    Tip: If the maximum two API keys already exist, revoke one so you can create a new one.

  5. When the new API key dialog is displayed, do the following:

    1. Click the copy icon to the right of the API key

    2. Store the API key on your computer

    3. Click the I have stored my new API key check box

    4. Click Done

      Warning: Be careful with the API Key. Treat it like you would any other password.

  6. In the Meraki Dashboard, click Organization > Setting to open the Organization Settings.

  7. Under Dashboard API Access, select the Enable access to the Cisco Meraki Dashboard API checkbox.

  8. Click Save Changes.

Add Cisco Meraki

Now that you have the API key, add the Cisco Meraki to AFA.

Do the following:

  1. In Passthrough L2 bridge mode, the Cisco Meraki Network acts as a layer 2 bridge between the internet and LAN ports. When deployed as an L2 bridge, the device is in "Passthrough mode" and "Site-to-site VPN" is turned off.

    To enable Passthrough L2 bridge mode:

    • In the file /data/algosec-ms/config/ms-devicemanager-prod.properties, set this config property as follows before onboarding:

      devicedriver.cisco.meraki.definition.onboardNetworksInPassthroughBridgeMode = true​

    Tip: To enable Traffic Simulation Query for an L2 device

    1. Manually place the device on the map (For details, see Manage Layer 2 (L2) devices in the map).

    2. Re-run the analysis.​

    Note: Networks in VPN Concentrator mode are supported by default.

  2. In AFA, go to Administration
  3. Click the Devices Setup tab
  4. From New drop-down, select Devices

  5. Select Cisco Meraki.
    The Step 1 of 2 form appears:


  6. Enter:
    1. Display name: The display name must not contain spaces.
    2. Authentication key The API Key you have just generated.

  7. When using Geographic Distribution architecture: Under Geographic Distribution, select the remote agent that should perform data collection for the device. To specify that the device is managed locally, select Central Manager. For more details, see Configure a distributed architecture.

  8. Click Next. Step 2 of 2 appears:

    Tip: If you know which organizations you want to onboard, you can save the time needed to calculate which organizations will be greyed out as unavailable in the Available Organizations list. Do this by disabling the following config property before onboarding (located in file: /data/algosec-ms/config/ms-devicemanager-prod.properties):

    devicedriver.cisco.meraki.definition.checkOrganizationsAvailability=false​

    This will enable checkboxes for all organizations regardless of their availability.

    By default, organizations that are not available are greyed out and are not selectable.

  9. Select the relevant organizations of the account from the organization names listed.

    Why can't I select an organization?

    Organizations are greyed out (unavailable) when:

    • API access is disabled for this organization: To make API requests for this organization, you must first enable API access.

    • License expired: Meraki API services are available for licensed Meraki devices only. Contact Meraki support to renew your licenses.

    • Invalid API key: The API KEY used does not have required permissions to manage the organization.

    Why can't I see an organization after on-boarding?

    After onboarding, an organization will not appear if:

    • It has no configured networks.

    • Networks in Passthrough L2 bridge mode are being skipped. To turn on network detection, see (Optional) Enable Passthrough L2 bridge mode.

    • Network has neither VLANs nor devices with configured interfaces.

    • Network does not have supported devices (only Meraki MX is supported by default).

    For more details, see the log: /data/algosec-ms/logs/ms-devicemanager.log.

  10. Select the options as required:

    Real-time change monitoring

    Select this option to enable real-time change monitoring. For details, see Configure real-time monitoring.

    Set user permissions

    Select this option to set user permissions to use this device in FireFlow and AppViz.
  11. Click Finish

Reduce API Calls

When not using network clients for group policies, the number of API calls can be reduced by setting the devicedriver.cisco.meraki.datacollection.skipNetworkClients configuration parameter.

Name devicedriver.cisco.meraki.datacollection.skipNetworkClients
Value

One of the following:

  • true: Fetching Meraki network clients information is skipped.
  • false (default): Allowing full data collection.

Cisco Nexus routers in AFA

The following sections describe how ASMS connects to Cisco Nexus routers:

Network connection

The following diagram shows the connection between an ASMS Central Manager or Remote Agent and a Cisco Nexus router over SSH.

Device permissions

To analyze Cisco Nexus router devices, ASMS requires the ability to run the following commands on the Nexus device:

  • show version
  • show interface
  • show ip interface
  • show ip access-list
  • show running-config
  • show vdc membership (For Nexus 7000 and above)
  • show vrf interface | xml
  • show vrf all interface
  • show ip route
  • show ip route vrf all
  • show vrf all
  • show bgp vpnv4 unicast labels

For Nexus versions 7000 and above, ASMS must also have permissions to view all VDCs.

Add a Cisco Nexus router to AFA

This procedure describes how to add a Cisco Nexus router to AFA.

Do the following:

  1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.

  2. In the vendor and device selection page, select Cisco > Nexus Router.

  3. Complete the fields as needed.

    Enter the following details for accessing your device from AFA:

    Host

    Enter the host name or IP address of the device.

    User Name

    Enter the username to use for SSH access to the device.

    Password

    Enter the password to use for SSH access to the device.

    Retrieve credentials from CyberArk vault

    Select this check box to authenticate the device with a CyberArk Vault instead of saving the device credentials on the AFA server.

    When selected, also define the following:

    • Platform (Policy ID)
    • Safe
    • Folder
    • Object

    Note: These options only appear when CyberArk is configured in AFA. For details, see Integrate ASMS and CyberArk.

    Select the remote agent that should perform data collection for the device.

    To specify that the device is managed locally, select Central Manager.

    This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

    To enable generation of Baseline Compliance Reports for this device, select the baseline compliance profile to use.

    The drop-down list includes all baseline compliance profiles in the system. For more details, see Customize baseline configuration profiles.

    Note: To disable Baseline Compliance Report generation for this device, select None.

    Select the following as needed:

    Include risk analysis and policy optimization

    Select this option to include risk analysis and policy optimization analysis in the device's reports.

    When this is not selected, AFA produces condensed router reports which run as if there is no license for risks, optimization or regulatory compliance. Reports still include policy changes and baseline compliance.

    This option is disabled by default.

    Note: Selecting this option will increase the analysis time for this router significantly and might result in performance degradation.

    Automatically add/remove VRF instances upon detection (Applies for all Cisco Routers)

    Select this option to enable automatic updating of VRF instances for all Cisco routers defined in AFA.

    The updates will be reflected in the device tree and graphic network map, and the updates will affect the device license usage.

    Specify how AFA should acquire the device's routing information:

    • Automatic. AFA will automatically generate the device's routing information upon analysis or monitoring.
    • Static Routing Table (URT). AFA will take the device's routing information from a static file you provide. For more details, see Specify routing data manually.

    Select a data transmission method:

    • Telnet
    • SSH (more secure)

    Then define:

    Custom Port

    To specify a custom port, select this option and type the port.

    This option is only relevant when SSH is selected.

    Number of allowed encryption keys

    Enter the permitted number of different RSA keys received from this device's IP address.

    Different RSA keys may be sent from the same IP address in cases of cluster fail-over, device operating system upgrades, etc.

    For example, if a cluster fail-over occurs, the secondary node will send a new RSA key from the same IP address to AFA.

    If this number is set to 1, the connection to the node will fail, resulting in a failed analysis.

    Select the following as needed:

    Real-time change monitoring

    Select this option to enable real-time alerting upon configuration changes. For details, see Configure real-time monitoring.

    Set user permissions

    Select this option to set user permissions for this device.
  4. Click Finish. The new device is added to the device tree.

  5. If you selected Set user permissions, the Edit users dialog box appears.

    In the list of users displayed, select one or more users to provide access to reports for this account.

    1. To select multiple users, press the CTRL button while selecting.

    1. Click OK to close the dialog.

A success message appears to confirm that the device is added.

Configure one-armed mode manually

AFA automatically identifies Cisco Firepower devices in one-armed mode, when the device has a single interface. If your device has multiple interfaces and one-armed mode is not identified automatically, configure this for your device manually.

Do the following:

  1. On the AFA machine, access your device configuration meta file as follows:

    /home/afa/.fa/firewalls/<device_name>/fwa.meta

    where <device_name> is the name of the device listed. If you device is listed multiple times, enter the longer name.

  2. On a new line, enter:

    is_steering_device=yes

  3. Run an analysis on the device to update the device data in AFA.