Cisco Adaptive Security Appliance (ASA)

Cisco Adaptive Security Appliance (ASA) Software is the core operating system for the Cisco ASA Family, delivering firewall capabilities for ASA devices in an array of form factors.

Use Cases the Adapter Solves

• Network Device Inventory: Bring Cisco ASA firewall devices into Axonius alongside other network and endpoint assets, giving security teams a unified view of firewall devices, their interfaces, DHCP leases, and DNS configuration.
• VPN Session Visibility: Surface active VPN sessions and connected users from ASA devices in Axonius, enabling correlation with identity and endpoint data to detect anomalous access patterns.

Types of Assets Fetched

This adapter fetches the following types of assets:

Devices, Users, Network/Firewall Rules

Data Retrieved through the Adapter

Devices - fields such as: Hostname, IP Address, MAC Address, Network Interfaces, DHCP Lease data

Users - fields such as: Username, user account details from the ASA local user database

Network/Firewall Rules - fields such as: Access rules, NAT rules

HTTP Interface (Firepower 2100/2120)

With the HTTP Interface (Firepower 2100/2120) connection method, the adapter fetches the following data. A field that the ASA does not return a value for stays empty. The Legacy REST API method is unchanged.

• Devices - The ASA itself as a device, with Host Name, Device Manufacturer Serial, Device Model, Software Version, Hardware, Uptime, Network Interfaces, Interfaces (name, alias, virtual, status, line protocol, subnet mask, bandwidth, and MTU), Management Access Hosts, DNS Configuration, and IP Audit Policies. DHCP leases and VPN sessions are fetched as separate devices.
• Network/Firewall Rules - One rule for each access list line and one for each NAT rule.
  • Access list lines have Name (the access list name followed by _line_ and the line number), Policy Name, Priority, Action (Allowed or Denied), Is Enabled, and Access Rule (ACL Type, Rule Body, Protocol, Source, Source Port, Destination, Destination Port, and Hit Count). Access Ranges Allowed is set only for an active permit line of an extended access list that an access group applies to traffic.
  • NAT rules have NAT Rule (Section, Rule Number, Source Interface, Destination Interface, NAT Type, Description, Unidirectional, Source, Destination, and Service Origin and Translated, Translate Hits, and Untranslate Hits). Network Address Translations is set only for an active rule that changes an address or a port. Identity NAT rules and inactive rules get no translation.
• Users - User Name and Privilege Level.

Before You Begin

Required Ports

• TCP port 443 — Used by both the Legacy REST API and the HTTP Interface connection methods.

Authentication Methods

The Cisco ASA adapter uses Basic HTTP authentication (username and password) for both connection methods.

APIs

Axonius uses one of the following APIs depending on the selected Connection Method

Required Permissions

Privilege 5 or greater is required in order to invoke GET APIs.

Supported From Version

Supported from Axonius version 6.1

Setting Up Cisco Adaptive Security Appliance (ASA) to Work with Axonius

For Legacy REST API:

1. Ensure the Cisco ASA REST API plugin is installed and enabled on the device.
2. Create a user account with Privilege 5 or greater.
3. Note the hostname or IP address, username, and password for use in the Axonius connection parameters.

For HTTP Interface (Firepower 2100/2120):

1. Enable the HTTP server on the ASA device: http server enable
2. Configure HTTP authentication: aaa authentication http console LOCAL
3. Create a local user account with appropriate privileges.
4. Note the hostname or IP address, username, and password for use in the Axonius connection parameters.

Connecting the Adapter in Axonius

1. Navigate to the Adapter Catalog, search for Cisco Adaptive Security Appliance (ASA), and select the adapter.
2. Click Add Connection.
3. Provide the following parameters.

Required Parameters

1. Connection Method (default: Legacy REST API) - Select the connection method to use when connecting to the Cisco ASA device:

   • Legacy REST API — Connects using the ASA REST API (/api/... endpoints). Use this for standard ASA devices.
   • HTTP Interface (Firepower 2100/2120) — Connects using the ASA HTTP Interface for Automation (/admin/... endpoints). Use this for Cisco Firepower 2100/2120 appliances running in ASA software mode, which do not support the legacy REST API. Requires the following ASA-side configuration:
     • http server enable
     • aaa authentication http console LOCAL

2. Host Name or IP Address - The hostname or IP address of the Cisco Adaptive Security Appliance (ASA) server.

3. User Name and Password - The credentials for a user account that has the Required Permissions to fetch assets.

Optional Parameters

1. Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

   Note:

   The configuration of SSL parameters for Management connections might impact some of the VPNs configured on Firewall devices, as some elements of the SSL firewall configuration are shared between VPN and Management interfaces.

2. HTTPS Proxy - Connect the adapter to a proxy instead of directly connecting it to the domain.

3. HTTPS Proxy User Name - The user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.

4. HTTPS Proxy Password - The password to use when connecting to the server using the HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Troubleshooting

Some old ASA devices and software may not be supported, as the Axonius adapter client's TLS/SSL is not compatible with them. A possible error message that might return in this case is as follows:

Connection test failed for all Entity types: Test Connection failed for entity EntityType.Devices Error details: Failed to run on main endpoint tree Failed to run endpoints because Unable to do request: HTTPSConnectionPool ….. Caused by SSLError(SSLError(1, '[SSL: UNSAFELEGACYRENEGOTIATIONDISABLED] unsafe legacy renegotiation disabled (ssl.c:997)