CSMへのセキュアなファイアウォールASAのプロビジョニング

はじめに

このドキュメントでは、Cisco Security Manager(CSM)にセキュアファイアウォール適応型セキュリティアプライアンス(ASA)をプロビジョニングするプロセスについて説明します。

前提条件

要件

次の項目に関する知識があることが推奨されます。

• セキュアなファイアウォールASA
• CSM

使用するコンポーネント

このドキュメントの情報は、次のソフトウェアとハードウェアのバージョンに基づいています。

• セキュアファイアウォールASAバージョン9.18.3
• CSM バージョン 4.28

このドキュメントの情報は、特定のラボ環境にあるデバイスに基づいて作成されました。このドキュメントで使用するすべてのデバイスは、クリアな（デフォルト）設定で作業を開始しています。本稼働中のネットワークでは、各コマンドによって起こる可能性がある影響を十分確認してください。

背景説明

CSMは、一貫したポリシーの適用とセキュリティイベントの迅速なトラブルシューティングを可能にし、セキュリティ導入全体の要約レポートを提供します。一元化されたインターフェイスを使用して、組織は効率的に拡張し、可視性が向上したさまざまなシスコのセキュリティデバイスを管理できます。

設定

次の例では、仮想ASAがCSMにプロビジョニングされ、中央集中型管理が行われます。

コンフィギュレーション

HTTPS管理のためのASAの設定

ステップ 1：すべての権限を持つユーザを作成します。

コマンドライン(CLI)構文：

configure terminal
username < user string > password < password > privilege < level number >

これは、次のコマンド例のユーザcsm-userとパスワードcisco123を意味します。

ciscoasa# configure terminal
ciscoasa(config)# username csm-user password cisco123 privilege 15

ステップ 2：HTTPサーバを有効にします。

コマンドライン(CLI)構文：

configure terminal
http server enable

ステップ 3：CSMサーバのIPアドレスに対してHTTPSアクセスを許可します。

コマンドライン(CLI)構文：

configure terminal
http < hostname > < netmask > < interface name >

これは次のコマンド例の変換であり、任意のネットワークが外部インターフェイス(GigabitEthernet0/0)上のHTTPS経由でASAにアクセスできます。

ciscoasa# configure terminal
ciscoasa(config)# http 0.0.0.0 0.0.0.0 outside

ステップ 4：CSMサーバからHTTPSに到達できることを確認します。

任意のWebブラウザを開き、次の構文を入力します。

https://< ASA IP address >/

これは、前の手順でHTTPSアクセスに許可された外部インターフェイスのIPアドレスの次の例を示しています。

https://10.8.4.11/

ASAのHTTPS応答

CSMへのセキュアなファイアウォールASAのプロビジョニング

ステップ 1：CSMクライアントを開いてログインします。

CSMクライアントログイン

ステップ 2：Configuration Managerを開きます。

CSMクライアントダッシュボード

ステップ 3：Devices > New Deviceの順に移動します。

CSMコンフィギュレーションマネージャ

ステップ 4：目的の結果に応じて要件を満たす追加オプションを選択します。設定済みのASAがすでにネットワークに設定されているため、この例の最適なオプションはAdd Device From Networkであり、Nextをクリックします。

Device Addメソッド

ステップ 5：セキュアファイアウォールASAの設定とディスカバリ設定に従って、必要なデータを入力します。次にNextをクリックします。

ASAの設定

手順 6：ASAで設定したCSMユーザとenableパスワードの両方から、必要なクレデンシャルを入力します。

ASAクレデンシャル

手順 7：必要なグループを選択するか、不要な場合はこのステップを省略して、Finishをクリックします。

CSMグループの選択

ステップ 8：チケット要求が制御目的で生成された場合は、OKをクリックします。

CSMチケットの作成

ステップ 9：検出がエラーなしで終了することを検証し、Closeをクリックします。

ASAディスカバリ

ステップ 10：CSMクライアントでASAが登録済みとして表示され、正しい情報が表示されていることを確認します。

登録されたASA情報

確認

HTTPSデバッグは、トラブルシューティングの目的でASAで使用できます。次のコマンドを使用します。

debug http

CSM登録のデバッグが成功した例を次に示します。

ciscoasa# debug http debug http enabled at level 1. ciscoasa# HTTP: processing handoff to legacy admin server [/admin/exec//show%20version] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20version HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒^^u HTTP: processing GET URL '/admin/exec//show%20version' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/config] HTTP: admin session verified = [0] HTTP MSG: GET /admin/config HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒e HTTP: processing GET URL '/admin/config' from host 10.8.4.12 HTTP: Authentication username = '' HTTP: processing handoff to legacy admin server [/admin/exec//show%20version] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20version HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒^^u HTTP: processing GET URL '/admin/exec//show%20version' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//sh%20module%20%7c%20in%20(CX%20Security%20Services%20Processor-%7ccxsc%20ASA%20CX5)] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//sh%20module%20%7c%20in%20(CX%20Security%20Services%20Processor-%7ccxsc%20ASA%20CX5) HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒^2▒^aware_123▒ HTTP: processing GET URL '/admin/exec//sh%20module%20%7c%20in%20(CX%20Security%20Services%20Processor-%7ccxsc%20ASA%20CX5)' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//sh%20module%20%7c%20in%20(FirePOWER)] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//sh%20module%20%7c%20in%20(FirePOWER) HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒▒▒▒ HTTP: processing GET URL '/admin/exec//sh%20module%20%7c%20in%20(FirePOWER)' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//sh%20cluster%20info] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//sh%20cluster%20info HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒^ HTTP: processing GET URL '/admin/exec//sh%20cluster%20info' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//sh%20inventory] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//sh%20inventory HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒^^u HTTP: processing GET URL '/admin/exec//sh%20inventory' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//sh%20vm] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//sh%20vm HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒ 2▒^^^u HTTP: processing GET URL '/admin/exec//sh%20vm' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/config] HTTP: admin session verified = [0] HTTP MSG: GET /admin/config HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒e HTTP: processing GET URL '/admin/config' from host 10.8.4.12 HTTP: Authentication username = '' HTTP: processing handoff to legacy admin server [/admin/exec//show%20version] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20version HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒^^u HTTP: processing GET URL '/admin/exec//show%20version' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//show%20inventory] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20inventory HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒u HTTP: processing GET URL '/admin/exec//show%20inventory' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//show%20password%20encryption] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20password%20encryption HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒^^ HTTP: processing GET URL '/admin/exec//show%20password%20encryption' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//show%20running-config%20all%20tunnel-group] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20running-config%20all%20tunnel-group HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒2▒^▒^e HTTP: processing GET URL '/admin/exec//show%20running-config%20all%20tunnel-group' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//show%20running-config%20all%20group-policy] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20running-config%20all%20group-policy HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒2▒^▒^e HTTP: processing GET URL '/admin/exec//show%20running-config%20all%20group-policy' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//show%20crypto%20ca%20trustpool%20detail] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20crypto%20ca%20trustpool%20detail HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒2▒^2▒^▒^e HTTP: processing GET URL '/admin/exec//show%20crypto%20ca%20trustpool%20detail' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//show%20snmp-server%20engineID] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20snmp-server%20engineID HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒^P_▒ HTTP: processing GET URL '/admin/exec//show%20snmp-server%20engineID' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//show%20version] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20version HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒▒^u HTTP: processing GET URL '/admin/exec//show%20version' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//show%20failover] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20failover HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒^u HTTP: processing GET URL '/admin/exec//show%20failover' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//dir%20%2frecursive%20all-filesystems] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//dir%20%2frecursive%20all-filesystems HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒2▒^2▒^2▒^▒^e HTTP: processing GET URL '/admin/exec//dir%20%2frecursive%20all-filesystems' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//show%20asdm%20image] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20asdm%20image HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒^ 2▒^^^ HTTP: processing GET URL '/admin/exec//show%20asdm%20image' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//show%20running-config%20webvpn] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20running-config%20webvpn HTTP/1.1 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM Cache-Control: no-cache Pragma: no-cache Host: 10.8.4.11 Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2 Connection: keep-alive ▒▒▒P_▒ HTTP: processing GET URL '/admin/exec//show%20running-config%20webvpn' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//show%20vpn-sessiondb%20full%20webvpn] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20vpn-sessiondb%20full%20webvpn HTTP/1.1 Host: 10.8.4.1110.8.4.11 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM ▒▒▒^2▒^1 HTTP: processing GET URL '/admin/exec//show%20vpn-sessiondb%20full%20webvpn' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//show%20vpn-sessiondb%20full%20ra-ikev1-ipsec] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20vpn-sessiondb%20full%20ra-ikev1-ipsec HTTP/1.1 Host: 10.8.4.1110.8.4.11 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM ▒▒▒ HTTP: processing GET URL '/admin/exec//show%20vpn-sessiondb%20full%20ra-ikev1-ipsec' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//show%20vpn-sessiondb%20full%20ra-ikev2-ipsec] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20vpn-sessiondb%20full%20ra-ikev2-ipsec HTTP/1.1 Host: 10.8.4.1110.8.4.11 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM ▒▒▒ HTTP: processing GET URL '/admin/exec//show%20vpn-sessiondb%20full%20ra-ikev2-ipsec' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec HTTP: processing handoff to legacy admin server [/admin/exec//show%20vpn-sessiondb%20full%20anyconnect] HTTP: admin session verified = [0] HTTP MSG: GET /admin/exec//show%20vpn-sessiondb%20full%20anyconnect HTTP/1.1 Host: 10.8.4.1110.8.4.11 Authorization: Basic OmNpc2NvMTIz User-Agent: CSM ▒▒▒1 HTTP: processing GET URL '/admin/exec//show%20vpn-sessiondb%20full%20anyconnect' from host 10.8.4.12 HTTP: Authentication username = '' Exited from HTTP Cli Exec