Cisco ASA: All-in-one Next-Generation Firewall, …

1 Cisco Press800 East 96th StreetIndianapolis, IN 46240 Cisco ASA All-in-one Next-Generation firewall , IPS, and VPN Services, Third EditionJazib Frahim, CCIE No. 5459 Omar SantosAndrew Ossipov, CCIE No. 18483 Cisco ASA: All-in-one Next-Generation firewall , IPS, and VPN Services, Third EditionJazib Frahim, Omar Santos, Andrew OssipovCopyright 2014 Pearson Education, by: Cisco Press800 East 96th Street Indianapolis, IN 46240 USAAll rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information stor-age and retrieval system, without written permission from the publisher, except for the inclusion of brief quotations in a in the United States of AmericaLibrary of Congress Control Number: 2014936118 ISBN-13: 978-1-58714-307-6 ISBN-10: 1-58714-307-0 Warning and DisclaimerThis book is designed to provide information about Cisco ASA.

2 Every effort has been made to make this book as complete and as accurate as possible, but no warranty or fitness is information is provided on an as is basis. The authors, Cisco Press, and Cisco Systems, Inc., shall have neither liability nor responsibility to any person or entity with respect to any loss or dam-ages arising from the information contained in this book or from the use of the discs or programs that may accompany opinions expressed in this book belong to the authors and are not necessarily those of Cisco Systems, AcknowledgmentsAll terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized. Cisco Press or Cisco Systems, Inc.

3 , cannot attest to the accuracy of this information. Use of a term in this book should not be regarded as affecting the validity of any trademark or service SalesFor information about buying this title in bulk quantities, or for special sales opportunities (which may include electronic versions; custom cover designs; and content particular to your business, training goals, marketing focus, or branding interests), please contact our corporate sales depart-ment at or (800) government sales inquiries, please contact For questions about sales outside the , please contact ii Cisco ASA: All-in-one Next-Generation firewall , IPS, and VPN Services, Third ii4/11/14 11:33 AMSecond Printing September 2014 Feedback InformationAt Cisco Press, our goal is to create in-depth technical books of the highest quality and value.

4 Each book is crafted with care and precision, undergoing rigorous development that involves the unique expertise of members from the professional technical feedback is a natural continuation of this process. If you have any comments regarding how we could improve the quality of this book, or otherwise alter it to better suit your needs, you can contact us through email at Please make sure to include the book title and ISBN in your greatly appreciate your : Paul Boger Business Operation Manager, Cisco Press: Jan CornelssenAssociate Publisher: Dave Dusthimer Executive Editor: Brett BartowTechnical Editors: Magnus Mortensen, Managing Editor: Sandra SchroederPhillip StrelauDevelopment Editor: Marianne Bartow Project Editor: Seth KerneyCopy Editor: Bill McManus Book Designer: Louisa AdairEditorial Assistant: Vanessa Evans Composition: Trina WurstIndexer.

5 Brad Herriman Proofreader: Sarah Kearnsiiiiv Cisco ASA: All-in-one Next-Generation firewall , IPS, and VPN Services, Third EditionAbout the AuthorsJazib Frahim, CCIE No. 5459, is a Principal Engineer in the Global Security Services Practice at Cisco . He has been with Cisco for over 15 years, with a focus on cyber-secu-rity and emerging security technologies. Jazib is also responsible for guiding customers in the design and implementation of security solutions and technologies in their networks with a focus on network security. He leads a team of solutions architects to guide them through the lifecycle of services and solutions development. Jazib has also been engaged in the development of a number of customer-focused services, such as managed threat defense, network-based identity, bring-your-own-device (BYOD), and many others.

6 Jazib holds a bachelor s degree in computer engineering from Illinois Institute of Technology and a master s degree in business administration (MBA) from North Carolina State addition to CISSP, Jazib also holds two CCIEs, one in routing and switching and the other in security. He has presented at many industry events, such as Cisco Live, Interop, and ISSA, on multiple occasions. He has also authored and coauthored numerous techni-cal documents, whitepapers, and books, including the following Cisco Press titles: Cisco ASA: All-in-one firewall , IPS, and VPN Adaptive Security Appliance Cisco ASA: All-in-one firewall , IPS, Anti-X, and VPN Adaptive Security Appliance, Second Edition Cisco Network Admission Control, Volume II: NAC Deployment and Troubleshooting SSL Remote Access VPNsOmar Santos is a Senior Incident Manager of Cisco s Product Security Incident Response Team (PSIRT), where he mentors and leads engineers and incident managers during the investigation and resolution of security vulnerabilities in all Cisco products.

7 Omar has designed, implemented, and supported numerous secure networks for Fortune 500 companies and the government. Prior to his current role, he was a technical leader within the World Wide Security Practice and Cisco s Technical Assistance Center (TAC), where he taught, led, and mentored many engineers within both is an active member of the security community, where he leads several industry-wide initiatives and standards bodies. His active role helps businesses, academic institu-tions, state and local law enforcement agencies, and other participants that are dedicated to increasing the security of the critical has delivered numerous technical presentations at conferences and to Cisco custom-ers and partners, as well as many C-level executive presentations to many organizations.

8 He has authored numerous whitepapers, articles, and security configuration guidelines and best practices, and has also authored or coauthored the following Cisco Press books: Cisco ASA: All-in-one firewall , IPS, and VPN Adaptive Security Appliance Cisco ASA: All-in-one firewall , IPS, Anti-X, and VPN Adaptive Security Appliance, Second Editionv Cisco Network Admission Control, Volume II: NAC Deployment and Troubleshooting End-to-End Network Security: Defense-in-DepthAndrew Ossipov, CCIE No. 18483 and CISSP No. 344324, is currently a Technical Marketing Engineer at Cisco with primary concentration on firewall , intrusion preven-tion, and other Cisco Data Center Security solutions.

9 With over 15 years of networking experience, Andrew previously worked with LAN switching, routing protocol, and net-work data storage technologies and performed academic research in the area of VoIP. At Cisco , Andrew is involved in a broad range of activities that include solving customers technical problems of the highest complexity, architecting features and products, and defining the future direction of the product portfolio. He is an inventor and co-inventor of multiple pending cross-technology patents. Andrew received his bachelor of science in computer engineering and master of science in electrical engineering degrees from Wichita State the Technical ReviewersMagnus Mortensen, CCIE No.

10 28219, has more than 10 years of network experience and has been employed at Cisco since June of 2006. During his years at Cisco , Magnus has been working with firewall and network security technologies and is currently part of the Security & NMS Technical Leadership team. Based in Research Triangle Park, North Carolina, Magnus specializes in the full breadth of firewall technologies and is one of the founding members of the Cisco TAC Security Podcast Series. Besides troubleshooting customer networks, he enjoys creating new tools and programs that help advance not only TAC, but Cisco as an organization. Originally from southern New York state, Magnus moved down to North Carolina after graduating from Rensselaer Polytechnic Institute with a bachelor s degree in computer systems Strelau has been with Cisco Systems since 2008 and is a technical lead on the firewall Technical Assistance Center (TAC) team.