ASA 5505 ports

[maximtory]

I am trying to configure my asa 5505 to only allow company PC's connected to my internal LAN and keep other from unplugging ports from their PC's and connecting say a laptop. I was thinking about trying to put some type of port security or filtering on the MAC address, but need help doing so.

This is a small branch office which is part of the reason for the added security. Is there anything we can do to keep users from connnecting their personal devices and using the same static ip's we have set to the pc's?Thanks for all your help!

 

[unclerico]

is the 5505 the only "switch" that you have or do you have something else plugged in downstream of it??

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[Supergrrover]

You're going to want 802.1x running to protect ports on a switch. They will need a password to open the switch port to allow traffic to flow. The setup and maintenance is way more than you want for a small office, I'm guessing. It is pretty involved and requires extra hardware such as a RADIUS server and a manageable switch that supports 802.1x.

Take a look at my 2nd post in this thread for an idea -

http://www.tek-tips.com/viewthread.cfm?qid=1277217

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[maximtory]

No unfortunatley since this is only a small branch office, this is the only device we are using, there is no switches, we just use the 8 ports on the ASA 5505. Is there any way to secure access on these ASA's?

 

[Supergrrover]

A cut through proxy will work for you but if people give out their passwords then it goes right around it. -

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/access_fwaaa.html#wp1063502

You could alternatively make all internal clients use a VPN to the ASA similar to this -

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805734ae.shtml

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[maximtory]

Does the second option you suggested dissallows people from connecting a personal laptop with a matching IP address to the network cable drop in their office to access the network?

We currently don't use any type of device VPN but are looking to setting that with our new ASA's to the PIX at our main office branch. It looks like the 2nd suggestion is how to set that up is that correct?

How does that prevent unauthorized PC connections? Thanks!

 

[Supergrrover]

For both, IP or not doesn't matter. They will need to authenticate to the ASA before they can pass traffic.

For option #2 - It's similar to that setup but you will have to tweak it a bit. Basically no PC will be able to get to the internet without the cisco VPN client set up on that PC with the correct settings AND a proper username and password.

I think option #2 is overkill and the first option is the better choice. You should have an internet/network use policy that outlines what can and can't be done and the consequences. Have everyone sign it and keep it on file. Most importantly is to enforce it.

Brent
Systems Engineer / Consultant
CCNP, CCSP