Skip navigation

Monitoring Central

3 Posts authored by: ams.norman

Update – February 7, 2018:

Cisco® updated their vulnerability advisory on Monday, February 5, 2018 after identifying “additional attack vectors and features that are affected.” What does this mean? If you patched last week, you may need to patch again. Be sure to read the advisory notice carefully to find out if your environment is at risk.

-------------------------------------

 

(Originally posted Wednesday, January 31, 2018):

 

What is it?

Earlier this week, Cisco revealed that there is a security vulnerability in the Cisco® ASAs, exposing these firewalls to remote attackers. Of course, now we all know about it, as does anyone who may want to exploit this opening. The good news: Cisco has released a critical update to address the issue. The bad news? There is no other workaround, so affected devices must be updated to be secured, and now you’re in a race against anyone who may be trying to take advantage. It’s worth noting that some FirePower devices are affected also, so read the Cisco post in detail to help ensure that you know where your vulnerabilities may lie.

 

What can you do?

Fortunately, if you have SolarWinds® Network Performance Monitor (NPM), our own KMSigma has created a report so you can quickly see if you have vulnerable devices. (For a refresher on implementing user-created reports, see How to export and import reports in the Orion® web console.)

 

Once you’ve identified affected devices, you can use Network Configuration Manager (NCM) to easily schedule, patch, and monitor your ASA devices using the firmware upgrade process. Are you running multi-context ASAs? No problem. The firmware upgrade path supports both single- and multi-context upgrades.

In this industry, it doesn’t take long to realize that discovering vulnerabilities of this nature—and subsequently addressing them—is a standard part of the job description. Having the right tools available can make a notable difference in how long your network is exposed and how much effort is required to remediate issues.

 

Tell us:

Were your devices affected? Have you already updated, and if so, did you use NPM and NCM to do so? Use the comments to tell us how it went. Were you affected but don’t have NPM or NCM? Download free 30-day trials of Network Performance Monitor and Network Configuration Manager today and see how they can help.

 

Learn more about Network Insight for Cisco ASA:

Did you know that SolarWinds added a new Network Insight feature for Cisco ASA in the NPM 12.2 and NCM 7.7 releases? Learn about all the functionality included in Network Insight for Cisco ASA.

Were you affected by an internet connectivity outage earlier this week? This outage affected users across the U.S., and originated from Level 3, an ISP recently acquired by CenturyLink®. Because Level 3 also provides infrastructure to other internet providers, some Comcast®, Spectrum®, Verizon®, and AT&T® users experienced outages as well.

          Tweet from Level 3 - https://twitter.com/Level3NOC/status/927633534424141824
                (Source: Twitter)

 

A configuration error? That’s what I thought when I first read this. There are many crazy ways connectivity issues can occur, from rats chewing through cables to your standard PEBKAC error causing a user to holler, “the internet is down!” But configuration errors? This is an easy one to address.

 

Perhaps even more concerning than a massive telecommunications company losing connectivity due to a config error is the amount of time to recover. After the issue was corrected, Level 3 issued a statement to several publications (including TechCrunch, Slate, Mashable, and The Verge), saying:

 

"On Monday, November 6th, our network experienced a service disruption affecting some customers with IP-based services. The disruption was caused by a configuration error. We know how important these services are to our customers. Our technicians were able to restore service within approximately 90 minutes."

 

90 minutes to recover from an issue that is affecting potentially millions* of people in the middle of the workday is about 89 minutes too long. (*Total number of customers affected hasn’t been released, but it included customers of Comcast, Spectrum, Verizon, and AT&T across the U.S., among others.)

 

         

               (Source: DownDetector.com via CNN)

 

Are YOU ready to ensure that something like this doesn’t happen to you? With SolarWinds® Network Configuration Manager (NCM), you can rest easy knowing that you are prepared. Even if a config error does occur, you can quickly rollback to a known-good config that you have saved, thanks to NCM’s automatic backups. If you need to make updates across devices, you can easily push bulk changes. And no need to worry about someone else messing with your configs—you can control who can make changes, and what kind, directly from the NCM console.

 

While we can’t help you with rats chewing your cables, we CAN help with your config management. Download a free trial of Network Configuration Manager today.

 

What are some of the craziest causes of connectivity issues that you’ve encountered?

DO YOUR FIREWALLS HAVE ACCESS CONTROL LISTS OR OUT-OF-CONTROL LISTS?

 

Do you badge in and out of your office each day? That electronic lock should be doing two things: making sure you can get in (and get to work), and keeping people who shouldn’t be there out.  If the permissions aren’t right, you could be blocked from entering. Or, worse, people who aren’t authorized could walk right in. This is what happens if the Access Control Lists (ACLs) on your firewall aren’t properly configured. Valid traffic could be blocked, or unauthorized traffic could slip through. This can impact productivity and even be a security risk.

 

ACLs can be hundreds or even thousands of lines long. They may have been set up years ago and been modified too many times to count. Are you confident that they are controlling the traffic the way you want? Do you need deeper network insights to see what is really going on?

 

Reviewing your Access Control Lists can be a tedious task, but the latest release of SolarWinds® Network Configuration Manager (NCM) makes it easy. This release introduces a new feature, Network Insight™ for Cisco® ASA, so you can easily review and audit ACLs for your Cisco ASA firewall.

 

  1. Review what ACLs are configured
    You can’t control it if you don’t know you have it. First, take a look to see what Access Control Lists are set up. The network insights you get with NCM will allow you to view all ACLs configured on the ASA. See if you have an ACL that was configured but never applied. Do you have ACLs that were set up so long ago that none of the original creators are still around?

  2. Audit where and how they are assigned
    An ACL may be configured correctly but assigned to the wrong zone, reducing its effectiveness. Are your ACLs assigned to the correct zones? What interfaces are assigned to those zones? Review where your Cisco ASA ACLs are assigned to maximize their strength.

  3. See what rules are being used
    Do you have rules in place that are never used, or rules that are getting hit all the time? Use NCM’s ACL Rule Browser to browse to object group definitions, search and filter within your ACLs, and view the hit count for individual rules to debug your access rules. Rules that are never hit may have been superseded by other policy changes. Rules that are getting hit all the time may indicate a need to refine the rule. With increased network insight you can optimize the ACL rules on your Cisco ASA.

  4. Detect shadow or redundant rules
    Access Control List rules are applied in the order they are listed. When a rule is overridden by a previous rule that does a different action, it is a shadow rule. A rule that is hidden because a previous rule does the same action is a redundant rule. For example, your office wants to let in anyone who is an employee, but not on the weekends. If the badge reader checks “let in all employees” first and then checks the day of the week, the weekend rule is a shadow rule. It will not matter because the door unlocked after confirming it was an employee who was trying to enter. You can reduce security risks and help ensure your ACLs are working as intended by identifying shadow or redundant rules.

  5. Compare ACLs for changes
    It can be difficult to troubleshoot ACL config issues. Network Configuration Manager helps make this process easier with side-by-side ACL config comparisons on your Cisco ASAs. You can compare an ACL to a previous version on the same node, or compare to other nodes, interfaces, or to a different ACL. Identify errors and verify consistency with Network Insights for Cisco ASA.

 

By working through this simple checklist, you can restore confidence that your firewalls are effectively managing the traffic flow in and out of your network. You can try Network Insight for Cisco ASA in the latest release of Network Configuration Manager. With a free, 30-day trial of NCM, you can see for yourself how easily you can bring your ACLs back under control. Look like a firewall expert without having to be a firewall expert!

SolarWinds uses cookies on its websites to make your online experience easier and better. By using our website, you consent to our use of cookies. For more information on cookies, see our cookie policy.