1. What is a Firewall?
Firewall is a device that is placed between a trusted and an untrusted network. It deny or permit traffic that enters or leaves network based on pre-configured policies. Firewalls protect inside networks from unauthorized access by users on an outside network. A firewall can also protect inside networks from each other. For example - By keeping a Management network separate from a user network.
2. What is the difference between Gateway and Firewall?
A Gateway joins two networks together and a network firewall protects a network against unauthorized incoming or outgoing access. Network firewalls may be hardware devices or software programs.
3. Firewalls works at which Layers?
Firewalls work at layer 3, 4 & 7.
4. What is the difference between Stateful & Stateless Firewall?
Stateful firewall - A Stateful firewall is aware of the connections that pass through it. It adds and maintains information about users connections in state table, referred to as a connection table. It than uses this connection table to implement the security policies for users connections. Example of stateful firewall are PIX, ASA, Checkpoint.
Stateless firewalls - (Packet Filtering) Stateless firewalls on the other hand, does not look at the state of connections but just at the packets themselves.
Example of a packet filtering firewall is the Extended Access Control Lists on Cisco IOS Routers.
5. What information does Stateful Firewall Maintains?
Stateful firewall maintains following information in its State table:-
1.Source IP address.
2.Destination IP address.
3.IP protocol like TCP, UDP.
4.IP protocol information such as TCP/UDP Port Numbers, TCP Sequence Numbers, and TCP Flags.
6. What are the security-levels in Cisco ASA?
ASA uses Security levels to determine the Trustworthiness of a network attached to the respective interface. The security level can be configured between 0 to 100 where higher numbers are more trusted than lower. By default, the ASA allows traffic from a higher security level to a lower security level only.
7. How can we allow packets from lower security level to higher security level (Override Security Levels)?
We use ACLs to allow packets from lower security level to higher security level.
8. Same Security level traffic is allowed or denied in ASA?
By default same security level traffic is not allowed. To allow it we use command:-
ASA(config)# same-security-traffic permit inter-interface.
9. What is the security level of Inside and Outside Interface by default?
Security Level of Inside interface by default is 100. Security Level of Outside Interface by default is 0.
10. What protocols are inspected by ASA?
By default, TCP and UDP are inspected by ASA.
11. Does ASA inspects ICMP?
No, ASA does not inspect ICMP by default.
12. Explain DMZ (Demilitarized Zone) Server?
If we need some network resources such as a Web server or FTP server to be available to outside users we place these resources on a separate network behind the firewall called a demilitarized zone (DMZ). The firewall allows limited access to the DMZ, but because the DMZ only includes the public servers, an attack there only affects the servers and does not affect the inside network.
13. How does a firewall process a packet?
When a packet is received on the ingress interface, the ASA checks if it matches an existing entry in the connection table. If it does, protocol inspection is carried out on that packet.
----------------------------------------------------------------------------------------------------------------------
If it does not match an existing connection and the packet is either a TCP-SYN packet or UDP packet, the packet is subjected to ACL checks.The reason it needs to be a TCP-SYN packet is because a SYN packet is the first packet in the TCP 3-way handshake. Any other TCP packet that isn’t part of an existing connection is likely an attack.
----------------------------------------------------------------------------------------------------------------------
If the packet is allowed by ACLs and is also verified by translation rules, the packet goes through protocol inspection.
----------------------------------------------------------------------------------------------------------------------
Then, the IP header is translated if NAT is used and if the NAT rule specifies an egress interface, the ASA will virtually forward the packet to this egress interface and then perform a route lookup.
----------------------------------------------------------------------------------------------------------------------
If a route is found that specifies the egress interface, then the Layer-2 header of the packet is re-written and the packet is forwarded out the egress interface.
14. What are the values for timeout of TCP session, UDP session, ICMP session?
TCP session - 60 minutes
UDP session - 2 minutes
ICMP session - 2 seconds
15. Explain TCP Flags?
While troubleshooting TCP connections through the ASA, the connection flags shown for each TCP connection provide information about the state of TCP connections to the ASA.
16. What is the command to see timeout timers?
# sh run timeout
17. What is the Difference between ports in ASA 8.4 and ASA 8.2?
In ASA 8.4 all ports are Gig ports and in ASA 8.2 all are Ethernet ports.
18. What is the command to check connection table?
# sh conn
19. How ASA works in reference to Traceroute?
ASA does not decrement the TTL value in traceroute because it does not want to give its information to others for security purpose. It forwards it without decrementing the TTL Value.
20. What if we apply ACL as global in ASA?
It will be applied on all interfaces towards inbound. Global option is only in ASA 8.4 not in ASA 8.2
CCIE Routing and Switching Interview Questions and Answers
21. What is the difference in ACL on ASA than on Router?
In router, if we delete one access-control entry whole ACL will be deleted. In ASA, if we will delete one access-control entry whole ACL will not be deleted.
22. Name some concepts that cannot be configured on ASA?
Line VTY cannot be configured on ASA.
Wildcard mask concept is not present in ASA.
Loopback cannot be configured on ASA.
23. What is the command to capture packets in ASA?
To capture packet from inside interface:- # capture abc interfacer inside
To see it:- # sh capture abc
24. What is the command to enable HTTP on ASA?
# http server enable
25. How to give static route on ASA?
# route outside <Destination IP> <Subnet Mask> < Next Hop>
26. How to give default route on ASA?
# route outside 0 0 < Next Hop>
27. What are the different types of ACL in Firewall?
1.Standard ACL
2.Extended ACL
3.Ethertype ACL (Transparent Firewall)
4.Webtype ACL (SSL VPN)
28. What is Tranparent Firewall?
In Transparent Mode, ASA acts as a Layer 2 device like a bridge or switch and forwards Ethernet frames based on destination MAC-address.
29. What is the need of Transparent Firewall?
If we want to deploy a new firewall into an existing network it can be a complicated process due to various issues like IP address reconfiguration, network topology changes, current firewall etc. We can easily insert a transparent firewall in an existing segment and control traffic between two sides without having to readdress or reconfigure the devices.
30. What are the similarities between switch and ASA (in Transparent mode) ?
Both learns which mac addresses are associated with which interface and store them in local mac address table.
31. What are the differences between switch and ASA (in Transparent mode) ?
ASA does not floods unknown unicast frames that are not found in mac address table.
ASA does not participate in STP.
Switch process traffic at layer 1 & layer 2 while ASA can process traffic from layer 1 to layer 7.
32. What are the features that are not supported in Transparent mode?
1.Dynamic Routing.
2.Multicasting.
3.QOS.
4.VPNs like IPSec and WebVPN cannot be terminated.
5.ASA cannot act as DHCP relay agent.
33. Explain Ether-Type ACL?
In Transparent mode, unlike TCP/IP traffic for which security levels are used to permit or deny traffic all non-IP traffic is denied by default. We create Ether-Type ACL to allow NON-IP traffic. We can control traffic like BPDU, IPX etc with Ether-Type ACL.
34. What is the command to convert ASA into Transparent mode?
# firewall transparent
35. What is the command to see mode (routed or transparent)?
# sh firewall
36. Explain Failover?
Failover is a cisco proprietary feature. It is used to provide redundancy. It requires two identical ASAs to be connected to each other through a dedicated failover link. Health of active interfaces and units are monitored to determine if failover has occurred or not.
37. What are type of Failover?
1.Active/Standby Failover.
2.Active/Active Failover.
38. What information is exchanged between ASAs over a Failover link?
1.State - Active or standby.
2.Hello Messages.
3.Network Link Status.
4.Mac Addresses.
5.Configuration Replication and Synchronization.
39. What is the difference between Stateful failover and Stateless failover?
Stateless Failover - When failover occurs all active connections are dropped. Clients need to re-establish connections when the new active unit takes over.
Stateful Failover - The active unit continually passes per-connection state information to the standby unit. After a failover occurs, the same connection information is available at the new active unit. Clients are not required to reconnect to keep the same communication session.
40. What Information Active unit passes to the standby unit in Stateful Failover?
NAT translation table, TCP connection states, The ARP table, The Layer 2 bridge table (when running in transparent firewall mode), ICMP connection state etc.
41. What are the Failover Requirements between two devices?
Hardware Requirements - The two units in a failover configuration must be the same model, should have same number and types of interfaces.
Software Requirements - The two units in a failover configuration must be in the same operating modes (routed or transparent single or multiple context). They must have the same software version.
42. Explain Active/Standby Failover?
In Active/Standby Failover, one unit is the active unit which passes traffic. The standby unit does not actively pass traffic. When Failover occurs, the active unit fails over to the standby unit, which then becomes active. We can use Active/Standby Failover for ASAs in both single or multiple context mode.
43. Explain Active/Active Failover?
It is only available for ASAs in multiple context mode. In an Active/Active Failover configuration, both ASAs can pass network traffic. In Active/Active Failover, we divide the security contexts on the ASA into Failover Groups. A Failover Group is simply a logical group of one or more security contexts. Each group is assigned to be active on a specific ASA in the failover pair. When Failover occurs, it occurs at the Failover group level.
44. What is the command to enable Failover?
# Failover
45. What is the command to see Failover?
# sh failover
46. Explain Unit Health Monitoring in Failover? How Failover occurs?
The ASA unit determines the health of the other unit by monitoring the failover link. When a unit does not receive three consecutive hello messages on the failover link, it sends hello messages on each interface, including the failover interface, to find whether or not the other unit is responsive.
Based upon the response from the other unit it takes following actions:-
1.If the ASA receives a response on the failover interface, then it does not failover.
2.If the ASA does not receive a response on the failover link, but it does receive a response on another interface, then the unit does not failover. The failover link is marked as failed.
3.If the ASA does not receive a response on any interface, then the standby unit switches to active mode and classifies the other unit as failed.
47. How active unit is determined in Active/Standby Failover?
1.If a unit boots and detects another unit already running as active, it becomes the standby unit.
2.If a unit boots and does not detect active unit, it becomes the active unit.
3.If both units boot simultaneously, then the primary unit becomes the active unit, and the secondary
unit becomes the standby unit.
48. Name some commands replicated to standby unit?
All configuration commands except for mode, firewall, and failover lan unit are replicated to standby unit.
# copy running-config startup-config
# write memory
49. Name some commands that are not replicated to standby unit?
All forms of the copy command except for # copy running-config startup-config
all forms of the write command except for # write memory
50. Explain Active/Standby Failover & Active/Active Failover in terms of preemption?
In Active/Standby Failover there is no preemption.
In Active/Active Failover preemption is optional.
Firewall is a device that is placed between a trusted and an untrusted network. It deny or permit traffic that enters or leaves network based on pre-configured policies. Firewalls protect inside networks from unauthorized access by users on an outside network. A firewall can also protect inside networks from each other. For example - By keeping a Management network separate from a user network.
2. What is the difference between Gateway and Firewall?
A Gateway joins two networks together and a network firewall protects a network against unauthorized incoming or outgoing access. Network firewalls may be hardware devices or software programs.
3. Firewalls works at which Layers?
Firewalls work at layer 3, 4 & 7.
4. What is the difference between Stateful & Stateless Firewall?
Stateful firewall - A Stateful firewall is aware of the connections that pass through it. It adds and maintains information about users connections in state table, referred to as a connection table. It than uses this connection table to implement the security policies for users connections. Example of stateful firewall are PIX, ASA, Checkpoint.
Stateless firewalls - (Packet Filtering) Stateless firewalls on the other hand, does not look at the state of connections but just at the packets themselves.
Example of a packet filtering firewall is the Extended Access Control Lists on Cisco IOS Routers.
5. What information does Stateful Firewall Maintains?
Stateful firewall maintains following information in its State table:-
1.Source IP address.
2.Destination IP address.
3.IP protocol like TCP, UDP.
4.IP protocol information such as TCP/UDP Port Numbers, TCP Sequence Numbers, and TCP Flags.
6. What are the security-levels in Cisco ASA?
ASA uses Security levels to determine the Trustworthiness of a network attached to the respective interface. The security level can be configured between 0 to 100 where higher numbers are more trusted than lower. By default, the ASA allows traffic from a higher security level to a lower security level only.
7. How can we allow packets from lower security level to higher security level (Override Security Levels)?
We use ACLs to allow packets from lower security level to higher security level.
8. Same Security level traffic is allowed or denied in ASA?
By default same security level traffic is not allowed. To allow it we use command:-
ASA(config)# same-security-traffic permit inter-interface.
9. What is the security level of Inside and Outside Interface by default?
Security Level of Inside interface by default is 100. Security Level of Outside Interface by default is 0.
10. What protocols are inspected by ASA?
By default, TCP and UDP are inspected by ASA.
11. Does ASA inspects ICMP?
No, ASA does not inspect ICMP by default.
12. Explain DMZ (Demilitarized Zone) Server?
If we need some network resources such as a Web server or FTP server to be available to outside users we place these resources on a separate network behind the firewall called a demilitarized zone (DMZ). The firewall allows limited access to the DMZ, but because the DMZ only includes the public servers, an attack there only affects the servers and does not affect the inside network.
13. How does a firewall process a packet?
When a packet is received on the ingress interface, the ASA checks if it matches an existing entry in the connection table. If it does, protocol inspection is carried out on that packet.
----------------------------------------------------------------------------------------------------------------------
If it does not match an existing connection and the packet is either a TCP-SYN packet or UDP packet, the packet is subjected to ACL checks.The reason it needs to be a TCP-SYN packet is because a SYN packet is the first packet in the TCP 3-way handshake. Any other TCP packet that isn’t part of an existing connection is likely an attack.
----------------------------------------------------------------------------------------------------------------------
If the packet is allowed by ACLs and is also verified by translation rules, the packet goes through protocol inspection.
----------------------------------------------------------------------------------------------------------------------
Then, the IP header is translated if NAT is used and if the NAT rule specifies an egress interface, the ASA will virtually forward the packet to this egress interface and then perform a route lookup.
----------------------------------------------------------------------------------------------------------------------
If a route is found that specifies the egress interface, then the Layer-2 header of the packet is re-written and the packet is forwarded out the egress interface.
14. What are the values for timeout of TCP session, UDP session, ICMP session?
TCP session - 60 minutes
UDP session - 2 minutes
ICMP session - 2 seconds
15. Explain TCP Flags?
While troubleshooting TCP connections through the ASA, the connection flags shown for each TCP connection provide information about the state of TCP connections to the ASA.
16. What is the command to see timeout timers?
# sh run timeout
17. What is the Difference between ports in ASA 8.4 and ASA 8.2?
In ASA 8.4 all ports are Gig ports and in ASA 8.2 all are Ethernet ports.
18. What is the command to check connection table?
# sh conn
19. How ASA works in reference to Traceroute?
ASA does not decrement the TTL value in traceroute because it does not want to give its information to others for security purpose. It forwards it without decrementing the TTL Value.
20. What if we apply ACL as global in ASA?
It will be applied on all interfaces towards inbound. Global option is only in ASA 8.4 not in ASA 8.2
CCIE Routing and Switching Interview Questions and Answers
21. What is the difference in ACL on ASA than on Router?
In router, if we delete one access-control entry whole ACL will be deleted. In ASA, if we will delete one access-control entry whole ACL will not be deleted.
22. Name some concepts that cannot be configured on ASA?
Line VTY cannot be configured on ASA.
Wildcard mask concept is not present in ASA.
Loopback cannot be configured on ASA.
23. What is the command to capture packets in ASA?
To capture packet from inside interface:- # capture abc interfacer inside
To see it:- # sh capture abc
24. What is the command to enable HTTP on ASA?
# http server enable
25. How to give static route on ASA?
# route outside <Destination IP> <Subnet Mask> < Next Hop>
26. How to give default route on ASA?
# route outside 0 0 < Next Hop>
27. What are the different types of ACL in Firewall?
1.Standard ACL
2.Extended ACL
3.Ethertype ACL (Transparent Firewall)
4.Webtype ACL (SSL VPN)
28. What is Tranparent Firewall?
In Transparent Mode, ASA acts as a Layer 2 device like a bridge or switch and forwards Ethernet frames based on destination MAC-address.
29. What is the need of Transparent Firewall?
If we want to deploy a new firewall into an existing network it can be a complicated process due to various issues like IP address reconfiguration, network topology changes, current firewall etc. We can easily insert a transparent firewall in an existing segment and control traffic between two sides without having to readdress or reconfigure the devices.
30. What are the similarities between switch and ASA (in Transparent mode) ?
Both learns which mac addresses are associated with which interface and store them in local mac address table.
31. What are the differences between switch and ASA (in Transparent mode) ?
ASA does not floods unknown unicast frames that are not found in mac address table.
ASA does not participate in STP.
Switch process traffic at layer 1 & layer 2 while ASA can process traffic from layer 1 to layer 7.
32. What are the features that are not supported in Transparent mode?
1.Dynamic Routing.
2.Multicasting.
3.QOS.
4.VPNs like IPSec and WebVPN cannot be terminated.
5.ASA cannot act as DHCP relay agent.
33. Explain Ether-Type ACL?
In Transparent mode, unlike TCP/IP traffic for which security levels are used to permit or deny traffic all non-IP traffic is denied by default. We create Ether-Type ACL to allow NON-IP traffic. We can control traffic like BPDU, IPX etc with Ether-Type ACL.
34. What is the command to convert ASA into Transparent mode?
# firewall transparent
35. What is the command to see mode (routed or transparent)?
# sh firewall
36. Explain Failover?
Failover is a cisco proprietary feature. It is used to provide redundancy. It requires two identical ASAs to be connected to each other through a dedicated failover link. Health of active interfaces and units are monitored to determine if failover has occurred or not.
37. What are type of Failover?
1.Active/Standby Failover.
2.Active/Active Failover.
38. What information is exchanged between ASAs over a Failover link?
1.State - Active or standby.
2.Hello Messages.
3.Network Link Status.
4.Mac Addresses.
5.Configuration Replication and Synchronization.
39. What is the difference between Stateful failover and Stateless failover?
Stateless Failover - When failover occurs all active connections are dropped. Clients need to re-establish connections when the new active unit takes over.
Stateful Failover - The active unit continually passes per-connection state information to the standby unit. After a failover occurs, the same connection information is available at the new active unit. Clients are not required to reconnect to keep the same communication session.
40. What Information Active unit passes to the standby unit in Stateful Failover?
NAT translation table, TCP connection states, The ARP table, The Layer 2 bridge table (when running in transparent firewall mode), ICMP connection state etc.
41. What are the Failover Requirements between two devices?
Hardware Requirements - The two units in a failover configuration must be the same model, should have same number and types of interfaces.
Software Requirements - The two units in a failover configuration must be in the same operating modes (routed or transparent single or multiple context). They must have the same software version.
42. Explain Active/Standby Failover?
In Active/Standby Failover, one unit is the active unit which passes traffic. The standby unit does not actively pass traffic. When Failover occurs, the active unit fails over to the standby unit, which then becomes active. We can use Active/Standby Failover for ASAs in both single or multiple context mode.
43. Explain Active/Active Failover?
It is only available for ASAs in multiple context mode. In an Active/Active Failover configuration, both ASAs can pass network traffic. In Active/Active Failover, we divide the security contexts on the ASA into Failover Groups. A Failover Group is simply a logical group of one or more security contexts. Each group is assigned to be active on a specific ASA in the failover pair. When Failover occurs, it occurs at the Failover group level.
44. What is the command to enable Failover?
# Failover
45. What is the command to see Failover?
# sh failover
46. Explain Unit Health Monitoring in Failover? How Failover occurs?
The ASA unit determines the health of the other unit by monitoring the failover link. When a unit does not receive three consecutive hello messages on the failover link, it sends hello messages on each interface, including the failover interface, to find whether or not the other unit is responsive.
Based upon the response from the other unit it takes following actions:-
1.If the ASA receives a response on the failover interface, then it does not failover.
2.If the ASA does not receive a response on the failover link, but it does receive a response on another interface, then the unit does not failover. The failover link is marked as failed.
3.If the ASA does not receive a response on any interface, then the standby unit switches to active mode and classifies the other unit as failed.
47. How active unit is determined in Active/Standby Failover?
1.If a unit boots and detects another unit already running as active, it becomes the standby unit.
2.If a unit boots and does not detect active unit, it becomes the active unit.
3.If both units boot simultaneously, then the primary unit becomes the active unit, and the secondary
unit becomes the standby unit.
48. Name some commands replicated to standby unit?
All configuration commands except for mode, firewall, and failover lan unit are replicated to standby unit.
# copy running-config startup-config
# write memory
49. Name some commands that are not replicated to standby unit?
All forms of the copy command except for # copy running-config startup-config
all forms of the write command except for # write memory
50. Explain Active/Standby Failover & Active/Active Failover in terms of preemption?
In Active/Standby Failover there is no preemption.
In Active/Active Failover preemption is optional.
Really great article
ReplyDeleteVery Informative article about Network Engineering and arista certification
ReplyDelete