Add Cisco devices

Relevant for: AFA Administrators

This topic describes how to add Cisco devices to AFA and perform related configurations.

Add a CSM-managed Cisco device

This procedure describes how to add a Cisco device managed by a Cisco CSM. You must add each Cisco device or security context that is managed by a Cisco CSM separately, even if they are managed by the same CSM.

Note: To perform this procedure, you must have a Cisco API license for the CSM device.

Do the following:

Access the Devices Setup page. For details, see Access the DEVICES SETUP page.
In the vendor and device selection page, select Cisco > Point > Firewall via CSM (CSM 4.3 or above).

Complete the fields as needed, and then click Finish.

Access Information

Firewall Host Name	Type the host name of the Cisco device to be analyzed, as it appears in the CSM UI.
CSM Server	Type the host name or IP address of the Cisco CSM server.
CSM User Name	Type the username to use for SSH access to the Cisco CSM.
CSM Password	Type the password to use for SSH access to the Cisco CSM.

Log Collection and Monitoring

Log collection method	Specify the log collection method that AFA should use when collecting traffic logs for the Cisco device, by selecting one of the following: Hit-counters: Only use hit-counter data. The Change History report page will be based on "last modified" timestamps, and Intelligent Policy Tuner is disabled. Standard: Use hit-counter data for rule usage, and Syslog data for the Change History report page. Intelligent Policy Tuner is disabled. Extensive: Combine data from both hit-counters and Syslog. Intelligent Policy Tuner is enabled. The default value is Extensive. Note: The Extensive method is only available when the ADSM is selected in the Rules view area.
Syslog-ng server	If you selected Standard or Extensive in the Log collection method field, you must specify the syslog server. For details, see Specify a Syslog server.
Additional firewall identifiers	Type any additional IP addresses or host names that identify the device. When adding multiple entries, separate values by a ':'. For example: "1.1.1.1:2.2.2.2:ServerName". This is relevant when the device is represented by multiple or non-standard device identifiers in the logs, for example, in cases of firewall clusters or non-standard logging settings. If AFA receives logs with an identifier it does not recognize, the logs will not be processed. Note: This field is only relevant for the parent device. In order to specify additional identifiers for sub-systems (Juniper VSYS/LSYS, Fortinet VDOM, Cisco security context, etc.), see Add additional device identifiers for sub-systems.
Log collection frequency (minutes)	Type the interval of time in minutes, at which AFA should collect logs for the device.

The new device is added to the device tree.

If you selected Set user permissions, the Edit users dialog box appears.

In the list of users displayed, select one or more users to provide access to reports for this account.
1. To select multiple users, press the CTRL button while selecting.
1. Click OK to close the dialog.

A success message appears to confirm that the device is added.

Cisco Application Centric Infrastructure (ACI) devices in AFA

The following sections describe how ASMS connects to Cisco ACI devices:

Network connectivity
Device permissions
MSO/NDO visibility in the device tree
EPG / ESG identification and supported contract scopes
Add a Cisco (ACI) to AFA

Network connectivity

The following diagrams show an ASMS Central Manager or Remote Agent connecting to a Cisco ACI APIC and fabric.

Device permissions

ASMS requires the following permissions to access Cisco ACI devices:

MSO/NDO visibility in the device tree

EPG / ESG identification and supported contract scopes

Supported contract scopes for EPGs/ESGs

The AFA Policy tab displays the following contract scopes for ACI EPGs/ESGs:

ApplicationProfile. Supported only when the consumer and provider are from the same Application Profile.
Global
Tenant. Supported only when the consumer and provider are from the same tenant.
VRF. If the consumer or provider belong to different VRFs, AFA shows expanded rules, one for each VRF.

There are six contract types available on the AFA Policy tab:

Regular	Contract between EPGs/ESGson same APIC.
Inter-site	Contract between EPGs on different APICs managed by the same MSO/NDO.
CPG	Contract Preferred Group
Inter-VRF*	For inter-VRF connectivity: Between VRFs in the same tenant using inter-VRF contracts, inter-VRF contract types are shown for both. (Scope should be Tenant or Global). Between two tenants, inter-VRF contract types are shown for all and the contract must be defined on the common tenant. (Scope should be Global).
Imported*	For inter-VRF connectivity: Between VRFs in different tenants with exported and imported contracts. On the tenant exported from, inter-VRF contract type is shown. On the tenant imported to, Import contract type is shown. (Scope must be Global).
Not formed	Contracts that are missing consumer and/or provider info.

*In MSO/NDO-managed environments, these contract types are combined with the inter-site type, when relevant.

The diagram below illustrates Inter-site contracts. EPGs residing on other APICs are displayed as if they are local (known as Shadow EPGs). For example, for the Inter-Site contract between EPG 1 on APIC 1 and EPG 2 on APIC 2, Shadow EPG 2 resides on APIC 1 and Shadow EPG 1 resides on APIC 2, each with all its content.

The diagram below illustrates VRF-related contracts .

Add a Cisco (ACI) to AFA

This procedure describes how to connect Cisco ACI devices to AFA. AFA always connects to Cisco ACI devices via REST.

Note:

ASMS requires minimal, read-only access permissions to access Cisco ACI devices and collect data.

The user defined on the ACI APIC controller must have the following read-only privileges:
- tenant-connectivity
- tenant-epg
- tenant-ext-connectivity
- tenant-security

Do the following:

Access the Devices Setup page. For details, see Access the DEVICES SETUP page.
In the vendor and device selection page, select Cisco > Application Centric Infrastructure (ACI).

Populate the fields as follows:

Access Information

Enter details to access your device from AFA:

Host

Enter the device's host name or IP address.

Tip: Typically, your APIC cluster has three nodes. Specify the host name or IP address of only one of the APIC nodes.

If the node you added goes down, you'll need to switch your AFA device configuration to another node. Edit the device configuration in AFA and enter the host name or IP address of that second node.

User Name

In the Username field, enter your APIC service username.

If you use login domains for APIC authentication, the username format is:

apic:fallback\\<username>

Password

Enter the password to access the device.

If the APIC is managed by an MSO/NDO, select the Multi-site setup checkbox.

Multi-site Host	Enter the multi-site host name or IP address.
Multi-site domain	Enter the multi-site domain name. If left blank, default domain is local.
User Name	Enter the username to access the MSO/NDO.
Password	Enter the password to access the MSO/NDO.

If you enabled ActiveChange, the ActiveChange License Agreement dialog is displayed.

Select I Agree, and click OK.
Click Finish. The new device is added to the device tree.
- ACI devices appear in the device tree in a two-tier hierarchy, including both APICs and tenants.
- EPGs/ESGs are shown with the following syntax: <application_profile>/<EPG_name> or <application_profile>/<ESG_name>. For more details, see EPG / ESG identification and supported contract scopes.
- Any VRFs on the map are shown with the following syntax: <Tenant_name>/<VRF_name>
- vzAny objects are shown with the following syntax: <VRF_name>/vzAny. AFA updates the contents of these objects upon change monitoring and analysis.
- When an APIC is managed to an MSO, see MSO/NDO visibility in the device tree.
If you selected Set user permissions, the Edit users dialog box appears.

In the list of users displayed, select one or more users to provide access to reports for this account.
1. To select multiple users, press the CTRL button while selecting.
1. Click OK to close the dialog.

A success message appears to confirm that the device is added. The ACI and each ACI tenant is displayed in the device tree.

Cisco ASA firewalls in AFA

The following sections describe how ASMS connects to Cisco ASA firewalls:

Network connection
Device permissions
Add a Cisco ASA firewall

Note: All references in the ASMS Documentation to Cisco ASA devices also refer to legacy PIX and FWSM devices. To add a new PIX or FWSM device to AFA, select ASA options.

See also: VALIDATE_USER_ROUTING_URT parameter which applies only to Cisco PIX.

Network connection

The following diagram shows an ASMS Central Manager or Remote Agent connecting to a Cisco ASA device:

Device permissions

ASMS requires the following permissions to connect to your Cisco ASA devices:

Add a Cisco ASA firewall

This procedure describes how to add a Cisco ASA firewall to AFA.

Do the following:

Access the Devices Setup page. For details, see Access the DEVICES SETUP page.
In the vendor and device selection page, select Cisco > ASA.

Complete the fields as needed.

Access Information

Enter details to access your device from AFA:

Host	Enter the device's host name or IP address.
User Name	Enter the username to use for SSH access to the device. Note: AFA partially supports user awareness for Cisco ASA devices. The network user appears as a field for each rule in the Policy tab, but is not used in traffic simulation queries.
Password	Enter the password to use for SSH access to the device. Note: For Cisco ASA devices enabled for CyberArk, the Password and Enable User Password must be the same.
Enable User Password	Enter the enable user password to use: noenable. Skip running the enable command. Algosec_no_passwd. The enable password is empty. Leave the field empty. AFA will issue a login command instead of the enable command, using the same password provided for the SSH connection. Note: For Cisco ASA devices enabled for CyberArk, the Password and Enable User Password must be the same.
Retrieve credentials from CyberArk vault	Select to authenticate the device with a CyberArk Vault instead of saving the device credentials on the AlgoSec server. When selected, also enter the following CyberArk details for the device being authenticated: Platform (Policy ID) Safe Folder Object Note: These options only appear when CyberArk is configured in AFA. For details, see Integrate ASMS and CyberArk.

Remote Management Capabilities

Select one of the following methods to collect data:

SSH (recommended)
Telnet

Then define:

Custom Port

To specify a custom port, select this option and type the port.

This option is only relevant when SSH is selected.

Number of allowed encryption keys

Enter the permitted number of different RSA keys received from this device's IP address.

Different RSA keys may be sent from the same IP address in cases of cluster fail-over, device operating system upgrades, etc.

For example, if a cluster fail-over occurs, the secondary node will send a new RSA key from the same IP address to AFA. If this number is set to 1, the connection to the node will fail, resulting in a failed analysis.

Log Collection and Monitoring

Define the following as needed:

Log collection method	Specify the log collection method that AFA should use when collecting traffic logs for the Cisco device, by selecting one of the following: Hit-counters: Only use hit-counter data. The Change History report page will be based on last modified timestamps. Intelligent Policy Tuner is disabled. Standard: Use hit-counter data for rule usage, and Syslog data for the Change History report page. Intelligent Policy Tuner is disabled. Extensive (Default): Combine data from both hit-counters and Syslog. Intelligent Policy Tuner is enabled. Note: This method is available only when ADSM is selected in the Rules view area. For details, see Rules View.
Syslog-ng server	If you selected Standard or Extensive in the Log collection method field, you must specify the syslog server. For details, see Specify a Syslog server.
Additional firewall identifiers	Enter any additional IP addresses or host names that identify the device. When adding multiple entries, separate values by a colon (:). For example: 1.1.1.1:2.2.2.2:ServerName. This is relevant when the device is represented by multiple or non-standard device identifiers in the logs, for example, in cases of firewall clusters or non-standard logging settings. If AFA receives logs with an identifier it does not recognize, the logs will not be processed. Note: This field is only relevant for the parent device, and not for sub-systems. For more details, see Add additional device identifiers for sub-systems
Log collection frequency (minutes)	Enter the interval of time in minutes, at which AFA should collect logs for the device.

If you enabled ActiveChange, the ActiveChange License Agreement dialog is displayed.

Select I Agree, and click OK.
Click Finish. The new device is added to the device tree.
If you selected Set user permissions, the Edit users dialog box appears.

In the list of users displayed, select one or more users to provide access to reports for this account.
1. To select multiple users, press the CTRL button while selecting.
1. Click OK to close the dialog.

A success message appears to confirm that the device is added. Any configured contexts on the ASA device are also imported.

Cisco Firepower devices in AFA

The following sections describe how ASMS connects to Cisco Firepower devices:

Network connectivity
Device permissions
Add a Cisco Firepower

Note: AFA automatically identifies Cisco Firepower devices in service-chaining mode if the device has only a single interface.

If your device has multiple interfaces and service-chaining mode is not identified automatically, configure this for your device manually. For more details, see Configure one-armed mode manually.

Note:

For logging engines: AlgoSec supports Unified Syslog (SNORT) engine events for Cisco Firepower.

Network connectivity

The following diagram shows an ASMS Central Manager or Remote Agent connecting to a Cisco Firepower device:

Device permissions

ASMS requires the following device permissions to connect to Cisco Firepower devices:

Device analysis

The Cisco Firepower system includes both the Firepower Management Center (FMC) and the Firepower Threat Defense (FTD) firewalls.

Direct onboarding of an FTD (without FMC) is currently not supported. AFA manages the FMC directly, supporting the FTD via the FMC API.

In addition, for data collection AFA executes the following commands on FTD via SSH:

show version
show route

Therefore, AFA must have both of the following access rights:

API (HTTPS) access to the FMC
SSH access to the FTD. AFA does not support direct access to the FDM API.

To connect to your device, ASMS requires either a:

User with an Administrator role; or
User with a custom FMC user role. See To create a Custom FMC user role for AFA analysis and monitoring

The user must be:

Dedicated for ASMS. Connecting to the device using the same user as ASMS may cause that user to be logged out of the Firepower UI at each monitoring cycle, as well as when any changes are made to the Firepower device via ASMS.
Created as part of the Global domain.
For example:

To create a Custom FMC user role for AFA analysis and monitoring

In FMC Settings > Users > User Roles tab, give the custom FMC user role the following permissions to run AFA analysis and monitor:

Policies
- Access Control
  - Access Control Policy
- Intrusion Policy
- Malware & File Policy
- DNS Policy
- Identity Policy
- SSL Policy
- Prefilter Policy
Devices
- Device Management
- NAT
  - NAT list
VPN
Object Manager
- Rule Editor
Deploy Configuration to Devices
System
- Domains
- Monitoring
  - Audit
- Syslog

Note: Make sure the External Database Access box is deselected.

ActiveChange

When ActiveChange is enabled, ASMS requires read-write permissions.

The user must continue to maintain Administrator or the custom FMC user role permissions

Additional ActiveChange settings for the custom FMC user role

For the custom FMC user role, in FMC Settings > Users > User Roles tab, add the following permissions to enable ActiveChange (in addition to AFA analysis and monitoring settings above, see To create a Custom FMC user role for AFA analysis and monitoring):

Policies
- Access Control
  - Access Control Policy
    - Modify Access Control Policy
Object Manager
- Rule Editor
  - Modify Rule Editor
- Modify Object Manager

Deploy Configuration to Devices

Note: Make sure the External Database Access box is deselected.

Add a Cisco Firepower

This procedure describes how to add a Cisco Firepower device to AFA.

Do the following:

Access the Devices Setup page. For details, see Access the DEVICES SETUP page.
In the vendor and device selection page, select Cisco > Firepower.

The Access Permission page opens.

Complete the following fields as needed.

Access Information

Enter details to access the device from AFA:

Host	Enter the hostname or IP address of the FMC.
User Name	Enter the username to use for SSH access to the FMC device. Note: AFA does not support user or network application awareness for Cisco Firepower. The network application appears as a field for each rule in the Policy tab, but is not used in traffic simulation queries.
Password	Enter the password to use for SSH access to the FMC device.

Log collection and monitoring

You can take advantage of the power of policy optimization features (like unused rules, IPT, etc.) for your Cisco Firepower device by implementing traffic logs collection and monitoring.

This step assumes that your FMC has already been configured to send logs to a syslog server. See Cisco FMC Documentation for the FMC version you are using. For details to configure a syslog server in ASMS, see Specify a Syslog server.

Define the following as needed:

Syslog-ng server	Specify the syslog server. For details, see Specify a Syslog server.
Additional firewall identifiers	Enter any additional IP addresses or host names that identify the device. When adding multiple entries, separate values by a colon (:). For example: 1.1.1.1:2.2.2.2:ServerName. This is relevant when the device is represented by multiple or non-standard device identifiers in the logs, for example, in cases of firewall clusters or non-standard logging settings. If AFA receives logs with an identifier it does not recognize, the logs will not be processed. Note: This field is only relevant for the parent device, and not for sub-systems. For more details, see Add additional device identifiers for sub-systems
Log collection frequency (minutes)	Enter the interval of time in minutes, at which AFA should collect logs for the device.
Log collection method (on page 2)	Specify the log collection method that AFA should use when collecting traffic logs for the Cisco device, by selecting one of the following: Standard: Use hit-counter data for rule usage, and Syslog data for the Change History report page. Intelligent Policy Tuner is disabled. Extensive (Default): Combine data from both hit-counters and Syslog. Intelligent Policy Tuner is enabled. Note: This method is available only when ADSM is selected in the Rules view area. For details, see Rules View. None Logs are disabled.

Click Next to continue to the Managed Devices page.

This page lists the FTDs that are managed by the FMC.
(Optional) To exclude an FTD, clear its check box in the table.

Configure a single FTD

Do the following:

Double-click on the row of the FTD to edit.
Enter Host IP, User Name, and Password in the appropriate fields.

(Optional) Select options from the following dropdowns.

Log Collection Method

Select one of the following to determine log functionality for a selected device:

None (default): Disable logging.
Standard: Enable logging.
Extensive: Enable logging and the Intelligent Policy Tuner.

This enables AFA to detect policy optimization data, such as unused rules, and display them in the Policy Optimization section of the AFA report. For details, see POLICY OPTIMIZATION page.

Note: Completing log collection and monitoring details on the Access Permission page enables the Log Collection Method dropdown.

Baseline Profile

Select the baseline compliance profile to use, in order to enable generation of Baseline Compliance Reports for this device.

The drop-down list includes all the relevant baseline compliance profiles in the system. For more information on baseline compliance profiles and instructions for adding new baseline compliance profiles, see Customize baseline configuration profiles

Select None (default) to disable Baseline Compliance Report generation for this device.

Note: If this router is divided into VRF modules, Baseline Compliance Reports will only be generated for the root/default VRF.

Tip: Selecting a baseline profile other than None automatically allows you to edit the Host IP, User Name, and Password fields.

Click Test Connectivity to test connectivity to the defined FTD.

Note: This triggers a direct SSH connection to the FTD.

Note: You must specify the credentials for each FTD in order for AFA to collect routing data it needs to accurately analyze the device.

Configure all of the selected FTDs in bulk

Do the following:

Click .

The Bulk Update window appears.

Select the checkboxes of the credentials and settings you want to update and enter appropriate values.

Log Collection Method	Select one of the following to determine log functionality for a selected device: None (default): Disable logging. Standard: Enable logging. Extensive: Enable logging and the Intelligent Policy Tuner. This enables AFA to detect policy optimization data, such as unused rules, and display them in the Policy Optimization section of the AFA report. For details, see POLICY OPTIMIZATION page. Note: Completing log collection and monitoring details on the Access Permission page enables the Log Collection Method dropdown.
Baseline Profile	Select the baseline compliance profile to use, in order to enable generation of Baseline Compliance Reports for this device. The drop-down list includes all relevant baseline compliance profiles in the system. For more information on baseline compliance profiles and instructions for adding new baseline compliance profiles, see Customize baseline configuration profiles Select None (default) to disable Baseline Compliance Report generation for this device. Note: If this router is divided into VRF modules, Baseline Compliance Reports will only be generated for the root/default VRF. Tip: Selecting a baseline profile other than None automatically allows you to edit the Host IP, User Name, and Password fields.
User Name	User name associated with the FTD
Password	Pasword associated with the FTD

Click Update All.
Click Test Connectivity to test connectivity to the FTDs defined.

Note: This triggers a direct SSH connection to the FTD.

Note: You must specify the credentials for each FTD in order for AFA to collect routing data it needs to accurately analyze the device.

A message informs you whether AFA connected to the FTD successfully.

Select the following as needed:

Real-time change monitoring	Select this option to enable real-time alerting upon configuration changes. For details, see Configure real-time monitoring.
Set user permissions	Select this option to set user permissions for this device.

If you enabled ActiveChange, the ActiveChange License Agreement dialog is displayed.

Select I Agree, and click OK.
Click Finish.

The new device is added to the device tree.
If you selected Set user permissions, the Edit users dialog box appears.

In the list of users displayed, select one or more users to provide access to reports for this account.
1. To select multiple users, press the CTRL button while selecting.
1. Click OK to close the dialog.

A success message appears to confirm that the device is added.

Cisco IOS routers in AFA

The following sections describe how Cisco IOS routers are added to AFA:

Network connectivity
Device permissions
Add a Cisco IOS router

Network connectivity

The following diagram shows an ASMS Central Manager or Remote Agent connecting to a Cisco IOS router.

Device permissions

ASMS requires the following for the user used to access your Cisco IOS routers:

Add a Cisco IOS router

This procedure describes how to add a Cisco IOS router to AFA.

Do the following:

Access the Devices Setup page. For details, see Access the DEVICES SETUP page.
In the vendor and device selection page, select Cisco > IOS Router.

Complete the fields as needed.

Access Information

Enter details for accessing your device.

Host	Enter the device's host name or IP address.
User Name	Enter the username to use for device access via SSH.
Password	Enter the password to use for device access via SSH. Note: For Cisco IOS devices enabled for CyberArk, the Password and Enable User Password must be the same.
Enable User Name	Enter the enable username to use. If you do not want AFA to enter the enable mode, enter noenable. Note: This field is required.
Enable User Password	Do one of the following: Enter the enable user password to use. To specify an empty enable password, enter AlgoSec_no_passwd. Note: For Cisco IOS devices enabled for CyberArk, the Password and Enable User Password must be the same. Note: This field is required.
Retrieve credentials from CyberArk vault	Select this check box to authenticate the device with a CyberArk Vault instead of saving the device credentials on the AFA server. When selected, also enter the following CyberArk details for the device being authenticated via CyberArk: Platform (Policy ID) Safe Folder Object Note: These options only appear when CyberArk is configured in AFA. For details, see Integrate ASMS and CyberArk.

Advanced

Select the following options as needed:

Include risk analysis and policy optimization

Select this option to include risk analysis and policy optimization analysis in the device's reports.

When this is not selected, AFA produces condensed router reports which run as if there is no license for risks, optimization or regulatory compliance. Reports still include policy changes and baseline compliance.

This option is disabled by default.

Note: Selecting this option will increase the analysis time for this router significantly and might result in performance degradation.

Automatically add/remove VRF instances upon detection (Applies for all Cisco Routers)

Select this option to enable automatic updating of VRF instances for all Cisco routers defined in AFA.

The updates will be reflected in the device tree and graphic network map, and the updates will affect the device license usage.

Remote Management Capabilities

Select a data transmission method:

SSH (more secure)
Telnet

Define the following as needed:

Custom Port

To specify a custom port, select this option and type the port.

This option is only relevant when SSH is selected.

Number of allowed encryption keys

Enter the permitted number of different RSA keys received from this device's IP address.

Different RSA keys may be sent from the same IP address in cases of cluster fail-over, device operating system upgrades, etc. For example, if a cluster fail-over occurs, the secondary node will send a new RSA key from the same IP address to AFA. If this number is set to 1, the connection to the node will fail, resulting in a failed analysis.

If you enabled ActiveChange, the ActiveChange License Agreement dialog is displayed.

Select I Agree, and click OK.
Click Finish. The new device is added to the device tree.
If you selected Set user permissions, the Edit users dialog box appears.

In the list of users displayed, select one or more users to provide access to reports for this account.
1. To select multiple users, press the CTRL button while selecting.
1. Click OK to close the dialog.

A success message appears to confirm that the device is added. The new device appears in the device tree, including any VRF devices as unique nodes.

Cisco ISE devices in AFA

The following sections describe how ASMS connects to CISCO ISE devices:

Network connectivity
Device permissions
Add a Cisco ISE device to AFA

Network connectivity

The following diagram shows an ASMS Central Manager or Remote Agent connecting to a Cisco ISE device.

Device permissions

ASMS connects to Cisco ISE devices via the Admin Node, using the ERS API.

To do so, ASMS requires an Administrator user with Read/Write permissions and the ERS-Operator group assignment.

Additionally, ASMS requires:

A REST connection over port 9060
Cisco ISE TrustSec SXP feature enabled for the device

Add a Cisco ISE device to AFA

This procedure describes how to add a Cisco ISE device to AFA.

Do the following:

Access the Devices Setup page. For details, see Access the DEVICES SETUP page.
In the vendor and device selection page, select Cisco > CISCO ISE.

Complete the fields as needed.

Access Information

Enter details for accessing your device.

Host	Enter the device's host name or IP address.
User Name	Enter the username to use for device access.
Password	Enter the password to use for device access.

Click Finish. The new device is added to the device tree.
If you selected Set user permissions, the Edit users dialog box appears.

In the list of users displayed, select one or more users to provide access to reports for this account.
1. To select multiple users, press the CTRL button while selecting.
1. Click OK to close the dialog.

A success message appears to confirm that the device is added.

Cisco Meraki devices in AFA

ASMS supports Cisco Meraki devices as follows:

Policy Visibility including the following policy types:
- Group Policy: displayed in ASMS as Layer 3 firewall Group Policy [GroupPolicyName]
- Layer 3 Outbound rules
- Site-to-site outbound firewall

Report Generation
Topology including VPN tunnels
Change History
Risks Calculation
Map Visibility
Regulatory Compliance
Traffic Simulation Query
Monitor Cycle

The following sections describe how ASMS connects to Cisco Meraki devices:

Network connectivity
Device permissions
Obtaining Cisco Meraki API Key
Reduce API Calls

Network connectivity

From AFA we communicate with Meraki via Rest API over HTTPS protocol.

Device permissions

ASMS requires an API key to communicate with the Meraki via the Cisco Meraki SaaS application. See Obtaining Cisco Meraki API Key.

Obtaining Cisco Meraki API Key

An API key is required to add a Meraki device to ASMS.

Create your Meraki API key, as follows:

Navigate to the Meraki dashboard at this address: https://account.meraki.com/secure/login/dashboard_login
Login using your Meraki account credentials.
From your Cisco Meraki Account, in the upper right corner of screen, click My Profile from the user name drop down menu.
Scroll to the API access/ API keys section. Click the Generate new APIKey button.

Tip: If the maximum two API keys already exist, revoke one so you can create a new one.
When the new API key dialog is displayed, do the following:
1. Click the copy icon to the right of the API key
2. Store the API key on your computer
3. Click the I have stored my new API key check box
4. Click Done
  
  Warning: Be careful with the API Key. Treat it like you would any other password.
In the Meraki Dashboard, click Organization > Setting to open the Organization Settings.
Under Dashboard API Access, select the Enable access to the Cisco Meraki Dashboard API checkbox.
Click Save Changes.

Add Cisco Meraki

Now that you have the API key, add the Cisco Meraki to AFA.

Do the following:

(Optional) Enable Passthrough L2 bridge mode
In Passthrough L2 bridge mode, the Cisco Meraki Network acts as a layer 2 bridge between the internet and LAN ports. When deployed as an L2 bridge, the device is in "Passthrough mode" and "Site-to-site VPN" is turned off.

To enable Passthrough L2 bridge mode:
- In the file /data/algosec-ms/config/ms-devicemanager-prod.properties, set this config property as follows before onboarding:
  
  devicedriver.cisco.meraki.definition.onboardNetworksInPassthroughBridgeMode = true
Tip: To enable Traffic Simulation Query for an L2 device
1. Manually place the device on the map (For details, see Manage Layer 2 (L2) devices in the map).
2. Re-run the analysis.
Note: Networks in VPN Concentrator mode are supported by default.
In AFA, go to Administration
Click the Devices Setup tab
From New drop-down, select Devices
Select Cisco Meraki.

The Access Permission page opens.
Enter:
1. Display name: The display name must not contain spaces.
2. Authentication key The API Key you have just generated.
When using Geographic Distribution architecture: Under Geographic Distribution, select the remote agent that should perform data collection for the device. To specify that the device is managed locally, select Central Manager. For more details, see Configure a distributed architecture.
Click Next. Step 2 of 2 appears:

Tip: If you know which organizations you want to onboard, you can save the time needed to calculate which organizations will be greyed out as unavailable in the Available Organizations list. Do this by disabling the following config property before onboarding (located in file: /data/algosec-ms/config/ms-devicemanager-prod.properties):

devicedriver.cisco.meraki.definition.checkOrganizationsAvailability=false

This will enable checkboxes for all organizations regardless of their availability.

By default, organizations that are not available are greyed out and are not selectable.
Select the relevant organizations of the account from the organization names listed.
Why can't I select an organization?

Organizations are greyed out (unavailable) when:
- API access is disabled for this organization: To make API requests for this organization, you must first enable API access.
- License expired: Meraki API services are available for licensed Meraki devices only. Contact Meraki support to renew your licenses.
- Invalid API key: The API KEY used does not have required permissions to manage the organization.
Why can't I see an organization after on-boarding?

After onboarding, an organization will not appear if:
- It has no configured networks.
- Networks in Passthrough L2 bridge mode are being skipped. To turn on network detection, see (Optional) Enable Passthrough L2 bridge mode.
- Network has neither VLANs nor devices with configured interfaces.
- Network does not have supported devices (only Meraki MX is supported by default).
For more details, see the log: /data/algosec-ms/logs/ms-devicemanager.log.

Select the options as required:

Real-time change monitoring	Select this option to enable real-time change monitoring. For details, see Configure real-time monitoring.
Set user permissions	Select this option to set user permissions to use this device in FireFlow and AppViz.

Click Finish

Reduce API Calls

When not using network clients for group policies, the number of API calls can be reduced by setting the devicedriver.cisco.meraki.datacollection.skipNetworkClients configuration parameter.

Name

devicedriver.cisco.meraki.datacollection.skipNetworkClients

Value

One of the following:

true: Fetching Meraki network clients information is skipped.
false (default): Allowing full data collection.

Cisco Nexus routers in AFA

The following sections describe how ASMS connects to Cisco Nexus routers:

Network connection
Device permissions
Add a Cisco Nexus router to AFA

Network connection

The following diagram shows the connection between an ASMS Central Manager or Remote Agent and a Cisco Nexus router over SSH.

Device permissions

To analyze Cisco Nexus router devices, ASMS requires the ability to run the following commands on the Nexus device:

show version
show interface
show ip interface
show ip access-list
show running-config
show vdc membership (For Nexus 7000 and above)
show vrf interface | xml
show vrf all interface
show ip route
show ip route vrf all
show vrf all
show bgp vpnv4 unicast labels
show bgp l2vpn evpn

For Nexus versions 7000 and above, ASMS must also have permissions to view all VDCs.

Add a Cisco Nexus router to AFA

This procedure describes how to add a Cisco Nexus router to AFA.

Do the following:

Access the Devices Setup page. For details, see Access the DEVICES SETUP page.
In the vendor and device selection page, select Cisco > Nexus Router.

Complete the fields as needed.

Access Information

Enter the following details for accessing your device from AFA:

Host	Enter the host name or IP address of the device.
User Name	Enter the username to use for SSH access to the device.
Password	Enter the password to use for SSH access to the device.
Retrieve credentials from CyberArk vault	Select this check box to authenticate the device with a CyberArk Vault instead of saving the device credentials on the AFA server. When selected, also define the following: Platform (Policy ID) Safe Folder Object Note: These options only appear when CyberArk is configured in AFA. For details, see Integrate ASMS and CyberArk.

Additional Information

Select the following as needed:

Include risk analysis and policy optimization

Select this option to include risk analysis and policy optimization analysis in the device's reports.

This option is disabled by default.

Note: Selecting this option will increase the analysis time for this router significantly and might result in performance degradation.

Automatically add/remove VRF instances upon detection (Applies for all Cisco Routers)

Select this option to enable automatic updating of VRF instances for all Cisco routers defined in AFA.

The updates will be reflected in the device tree and graphic network map, and the updates will affect the device license usage.

Remote Management Capabilities

Select a data transmission method:

Telnet
SSH (more secure)

Then define:

Custom Port

To specify a custom port, select this option and type the port.

This option is only relevant when SSH is selected.

Number of allowed encryption keys

Enter the permitted number of different RSA keys received from this device's IP address.

Different RSA keys may be sent from the same IP address in cases of cluster fail-over, device operating system upgrades, etc.

For example, if a cluster fail-over occurs, the secondary node will send a new RSA key from the same IP address to AFA.

If this number is set to 1, the connection to the node will fail, resulting in a failed analysis.

Click Finish. The new device is added to the device tree.
If you selected Set user permissions, the Edit users dialog box appears.

In the list of users displayed, select one or more users to provide access to reports for this account.
1. To select multiple users, press the CTRL button while selecting.
1. Click OK to close the dialog.

A success message appears to confirm that the device is added.

Configure one-armed mode manually

AFA automatically identifies Cisco Firepower devices in one-armed mode, when the device has a single interface. If your device has multiple interfaces and one-armed mode is not identified automatically, configure this for your device manually.

Do the following:

On the AFA machine, access your device configuration meta file as follows:

/home/afa/.fa/firewalls/<device_name>/fwa.meta

where <device_name> is the name of the device listed. If you device is listed multiple times, enter the longer name.
On a new line, enter:

is_steering_device=yes
Run an analysis on the device to update the device data in AFA.

Add Cisco devices

Add a CSM-managed Cisco device

Cisco Application Centric Infrastructure (ACI) devices in AFA

Cisco ASA firewalls in AFA

Cisco Firepower devices in AFA

Cisco IOS routers in AFA

Cisco ISE devices in AFA

Network connectivity

Device permissions

Cisco Meraki devices in AFA

Cisco Nexus routers in AFA

Configure one-armed mode manually

Sorry about that

Great!