The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
You can deploy the ASAv on the Amazon Web Sources (AWS) cloud.
Note: The ASAv5 is NOT supported on AWS.
AWS is a public cloud environment that uses a private Xen Hypervisor. The ASAv runs as a guest in the AWS environment of the Xen Hypervisor. ASAv on AWS supports the following instance types:
Note: Both the ASAv10 and ASAv30 are supported on the c3.large instance. However, we do not recommend deploying the ASAv30 on any large instances due to resource under-provisioning.
Note: Only the ASAv30 is supported on xlarge instances.
Note: The ASAv does not support the Xen Hypervisor outside of the AWS environment.
You create an account on AWS, set up the ASAv using the AWS Wizard, and chose an Amazon Machine Image (AMI). The AMI is a template that contains the software configuration needed to launch your instance.
Note: The AMI images are not available for download outside of the AWS environment.
–Inside and outside interfaces
–(Optional) Additional subnet (DMZ)
–Management interface—Used to connect the ASAv to the ASDM; can’t be used for through traffic.
–Inside interface (required)—Used to connect the ASAv to inside hosts.
–Outside interface (required)—Used to connect the ASAv to the public network.
–DMZ interface (optional)—Used to connect the ASAv to the DMZ network when using the c3.xlarge interface.
Upgrade impact when using SSH public key authentication—Due to updates to SSH authentication, additional configuration is required to enable SSH public key authentication; as a result, existing SSH configurations using public key authentication no longer work after upgrading. Public key authentication is the default for the ASAv on Amazon Web Services (AWS), so AWS users will see this issue. To avoid loss of SSH connectivity, you can update your configuration before you upgrade. Or you can use ASDM after you upgrade (if you enabled ASDM access) to fix the configuration.
Sample original configuration for a username "admin":
To use the ssh authentication command, before you upgrade, enter the following commands:
We recommend setting a password for the username as opposed to keeping the nopassword keyword, if present. The nopassword keyword means that any password can be entered, not that no password can be entered. Prior to 9.6(2), the aaa command was not required for SSH public key authentication, so the nopassword keyword was not triggered. Now that the aaa command is required, it automatically also allows regular password authentication for a username if the password (or nopassword) keyword is present.
After you upgrade, the username command no longer requires the password or nopassword keyword; you can require that a user cannot enter a password. Therefore, to force public key authentication only, re-enter the username command:
Figure 1 shows the recommended topology for the ASAv in Routed Firewall Mode with four subnets configured in AWS for the ASAv (management, inside, outside, and DMZ).
Figure 1 Sample ASAv on AWS Deployment
The following procedure is a top-level list of steps to set up AWS on the ASAv. For detailed steps for setup, see Getting Started with AWS.
1. Log into aws.amazon.com and choose your region.
AWS is divided into multiple regions that are isolated from each other. The region is displayed in the upper right corner of your screen. Resources in one region do not appear in another region. Check periodically to make sure you are in the intended region.
2. Click My Account > AWS Management Console, and under Networking, click VPC > Start VPC Wizard, and create your VPC by choosing a single public subnet, and set up the following (you can use the default settings unless otherwise noted):
–Inside and outside subnet—Enter a name for the VPC and the subnets.
–Internet Gateway—Enables direct connectivity over the Internet (enter the name of the Internet gateway).
–outside table—Add entry to enable outbound traffic to the Internet (add 0.0.0.0/0 to Internet Gateway).
3. Click My Account > AWS Management Console > EC2, and then click Create an Instance.
–Select your AMI (for example Ubuntu Server 14.04 LTS).
Use the AMI identified in the your image delivery notification.
–Choose the instance type supported by the ASAv (for example, c3.large).
–Configure the instance (CPUs and memory are fixed).
–Under Advanced Details, add the Day 0 Configuration if desired. For the procedure for how to configure the Day 0 configuration with more information, such as Smart Licensing, see Prepare the Day 0 Configuration File.
–Storage (accept the defaults).
–Tag Instance—You can create a lot of tags to classify your devices. Give it a name you can use to find it easily.
–Security Group—Create a security group and name it. The security group is a virtual firewall for an instance to control inbound and outbound traffic.
By default the Security Group is open to all addresses. Change the rules to only allow SSH in from addresses you will be using to access your ASAv.
–Review your configuration and then click Launch.
Give the key pair a name you will recognize and download the key to a safe place; the key can never be downloaded again. If you lose the key pair, you must destroy your instances and redeploy them again.
5. Click Launch Instance to deploy your ASAv.
6. Click My Account > AWS Management Console > EC2 > Launch an Instance > My AMIs.
7. Make sure that the Source/Destination Check is disabled per interface for the ASAv.
AWS default settings only allow an instance to receive traffic for its IP address and only allow an instance to send traffic from its own IP address. To enable the ASAv to act as a routed hop, you must disable the Source/Destination Check on each of the ASAv's traffic interfaces (inside, outside, and DMZ).