{"id":1028,"date":"2014-05-23T22:33:35","date_gmt":"2014-05-23T20:33:35","guid":{"rendered":"http:\/\/diablo.craem.net\/wordpress\/?p=1028"},"modified":"2014-05-23T22:33:35","modified_gmt":"2014-05-23T20:33:35","slug":"virtualizando-cisco-asa-55xx","status":"publish","type":"post","link":"https:\/\/diablo.craem.net\/?p=1028","title":{"rendered":"Virtualizando cisco asa 55xx"},"content":{"rendered":"

Esta vez toca ampliar el laboratorio de pr\u00e1cticas de networking… ya tengo varios routers virtuales mikrotik, pero nunca hab\u00ed\u00ada podido hacer un cisco asa.
\nHay que decir, que no es legal, no est\u00e1 soportado por cisco y que cada uno que haga lo que quiera….
\nYo lo he usado para practicar el cambio que ha hecho cisco; de la versi\u00f3n 8.2.x a la 8.3 en adelante, ha modificado todo el tema de nat y
\nLa guia original aqui<\/a>
\nPrimero de todo, nos bajamos la versi\u00f3n 8.4.2 de cisco asa, junto con el ASDM
\nhttps:\/\/software.cisco.com\/download\/release.html?mdfid=280582808&softwareid=280775065&release=9.2.1.ED
\n<\/code>
\nLuego nos bajamos el script que extrae los ficheros de imagen y nos hace la ISO:
\nhttpss:\/\/gist.github.com\/anonymous\/c3225054e6681a39be16<\/code>
\nPara preparar la ISO, tengo una fedora x86 y los siguientes paquetes:
\nvim-minimal vim-common mkisofs<\/code>
\nY los instalamos tal que as\u00ed\u00ad:
\nyum -y install vim-minimal vim-common mkisofs<\/code>
\nYo, modifiqu\u00e9 el script para que el firewall arranque solo y tenga que darle al intro cada vez que se reinicia…. aqu\u00ed\u00ad cada uno que haga lo que quiera:
\n
\n#!\/bin\/bash
\n# FILENAME: repack.v4.1.sh
\n# AUTHOR: dmz
\n# SOURCE: https:\/\/7200emu.hacki.at\/viewtopic.php?t=9074
\n# DISCLAIMER: All information provided here are solely for self-education and investigation purposes. Provided AS-IS without any warranties.
\nVERSION=4.1
\nIMAGE=$1
\nCWD=`pwd`
\n[ -z \"$IMAGE\" ] && IMAGE=$CWD\/asa842-k8.bin
\necho \"Repack script version: $VERSION\"
\nif [ ! -f \"$IMAGE\" ]; then
\necho \"USAGE: repack.sh \/path\/to\/asa\/image\"
\nexit 1;
\nfi
\nXXD=`which xxd`
\nISOLINUX_BIN=\/usr\/share\/syslinux\/isolinux.bin
\nMKISOFS=`which mkisofs`
\nif [ ! -x \"$XXD\" ]; then
\necho \"ERROR: xxd command not found\"
\necho \"Install 'vim' or 'vim-enhanced' package to get it\"
\nexit 1;
\nfi
\nCREATEISO=no
\nif [ -x \"$MKISOFS\" -a -e \"$ISOLINUX_BIN\" ]; then
\necho \"Detected syslinux\/cdrtools - ISO will be created\"
\nCREATEISO=yes
\nelse
\necho \"no syslinux\/cdrtools - ISO creation skipped\"
\nfi
\nBASE_NAME=`basename \"$IMAGE\"`
\ncase \"$BASE_NAME\" in
\n'asa842-k8.bin') # ASA 8.4(2)
\ndd skip=102400 if=\"$IMAGE\" of=\"$CWD\/asa842-vmlinuz\" bs=1 count=1359344
\ndd skip=1461744 if=\"$IMAGE\" of=\"$CWD\/asa842-initrd-original.gz\" bs=1
\nTMP_DIR=`mktemp -d`
\npushd $TMP_DIR
\ngunzip -c \"$CWD\/asa842-initrd-original.gz\" | cpio -i --no-absolute-filenames --make-directories
\nfind . | cpio -o -H newc | gzip -9 > \"$CWD\/asa842-initrd-original.gz\"
\nsed -i -e \"s\/(VERBOSE=).*\/1yes\/\" etc\/init.d\/rcS
\nsed -i -e \"s\/echo -n\/echo\/\" etc\/init.d\/S10udev
\nsed -i -e \"s#^fi$#fingrep -q shell \/proc\/cmdlinen[ $? == 0 ] && echo '\/bin\/sh' >> \/tmp\/run_cmd#\" asa\/scripts\/rcS
\nsed -i -e \"\/mount\/d\" asa\/scripts\/format_flash.sh
\nsed -i -e \"s#mount=0#if [ ! -e \/dev\/hda1 ]; then \/asa\/scripts\/format_flash.sh \/dev\/hda1 0 0 \/dev\/hda; finmount=0#\" asa\/scripts\/rcS.common
\nxxd -r -g 2 -c 16 - asa\/bin\/lina < \"$CWD\/asa842-initrd.gz\"
\npopd
\nrm -rf $TMP_DIR
\nif [ \"$CREATEISO\" == \"yes\" ]; then
\nTMP_DIR=`mktemp -d`
\npushd $TMP_DIR
\nmkdir isolinux
\ncp $ISOLINUX_BIN isolinux\/
\ncp $CWD\/asa842-vmlinuz .
\ncp $CWD\/asa842-initrd.gz .
\ncp $CWD\/asa842-initrd-original.gz .
\ncat >isolinux\/isolinux.cfg <isolinux\/boot.txt < is not supported!\"
\nexit 1;
\n;;
\nesac
\n<\/code>
\nal script, le damos permisos de ejecuci\u00f3n :
\n
\n[root@localhost home]# chmod +x repack.v4.sh
\n<\/code>
\ny ahora lo ejecutamos…..
\n
\n[root@localhost home]# .\/repack.v4.sh .\/asa842-k8.iso
\nRepack script version: 4
\nDetected syslinux\/cdrtools - ISO will be created
\nVersion is not supported!
\n[root@localhost home]# .\/repack.v4.sh .\/asa842-k8.iso
\nRepack script version: 4
\nUSAGE: repack.sh \/path\/to\/asa\/image
\n[root@localhost home]# .\/repack.v4.sh .\/asa842-k8.bin
\nRepack script version: 4
\nDetected syslinux\/cdrtools - ISO will be created
\n1359344+0 registros le\u00ed\u00addos
\n1359344+0 registros escritos
\n1359344 bytes (1,4 MB) copiados, 9,43295 s, 144 kB\/s
\n23697936+0 registros le\u00ed\u00addos
\n23697936+0 registros escritos
\n23697936 bytes (24 MB) copiados, 165,249 s, 143 kB\/s
\n\/tmp\/tmp.mHaYlsi8ln \/home
\ngzip: \/home\/asa842-initrd-original.gz: decompression OK, trailing garbage ignored
\n114476 blocks
\n114476 blocks
\n114476 blocks
\n\/home
\n\/tmp\/tmp.bkRPw31Byc \/home
\nI: -input-charset not specified, using utf-8 (detected in locale settings)
\nSize of boot image is 4 sectors -> No emulation
\n 21.05% done, estimate finish Fri May 23 22:18:54 2014
\n 42.01% done, estimate finish Fri May 23 22:18:54 2014
\n 63.01% done, estimate finish Fri May 23 22:18:54 2014
\n 83.97% done, estimate finish Fri May 23 22:18:54 2014
\nTotal translation table size: 2048
\nTotal rockridge attributes bytes: 0
\nTotal directory bytes: 2048
\nPath table size(bytes): 26
\nMax brk space used 0
\n23823 extents written (46 MB)
\n\/home
\n<\/code>
\nY ahora, al ver el directorio…
\n
\n[root@localhost home]# ls -l
\ntotal 119496
\n-rw-r--r--. 1 root root 23518187 may 23 22:18 asa842-initrd.gz
\n-rw-r--r--. 1 root root 23517694 may 23 22:18 asa842-initrd-original.gz
\n-rw-r--r--. 1 root root 25159680 may 23 22:12 asa842-k8.bin
\n-rw-r--r--. 1 root root 1359344 may 23 22:15 asa842-vmlinuz
\n-rw-r--r--. 1 root root 48789504 may 23 22:18 asa.iso
\n-rwxr-xr-x. 1 root root 4301 may 23 22:11 repack.v4.sh
\n[root@localhost home]#
\n<\/code>
\nTenemos el fichero asa.iso, que lo copiaremos a nuestro vmware.
\nCreamos una m\u00e1quina virtual con los siguientes requisitos:
\n1) Disco ide de 256 Mb (no necesitamos m\u00e1s)
\n2) Tarjetas de red \u00abe1000\u00bb<\/strong>
\n3) 1 sola cpu
\nY nos queda tal que:
\n
\n\"vmware1\"<\/a>
\nY ahora, para hacerlo m\u00e1s realista, asignar\u00e9 el puerto serie a la m\u00e1quina f\u00ed\u00adsica:
\n\"vmware2\"<\/a>
\nAhora, arrancamos la m\u00e1quina y conectamos el puerto serie …. \ud83d\ude42
\n
\nasaTest# sh ver
\nCisco Adaptive Security Appliance Software Version 8.4(2)
\nDevice Manager Version 7.2(1)
\nCompiled on Wed 15-Jun-11 18:17 by builders
\nSystem image file is \"Unknown, monitor mode tftp booted image\"
\nConfig file at boot was \"startup-config\"
\nasaCraem up 1 day 9 hours
\nHardware: ASA 5520, 1024 MB RAM, CPU Pentium II 3000 MHz
\nInternal ATA Compact Flash, 256MB
\nBIOS Flash unknown @ 0x0, 0KB
\n 0: Ext: GigabitEthernet0 : address is 000c.29a2.705e, irq 0
\n 1: Ext: GigabitEthernet1 : address is 000c.29a2.7068, irq 0
\n 2: Ext: GigabitEthernet2 : address is 000c.29a2.7072, irq 0
\n 3: Ext: GigabitEthernet3 : address is 000c.29a2.707c, irq 0
\n 4: Ext: GigabitEthernet4 : address is 000c.29a2.7086, irq 0
\nLicensed features for this platform:
\nMaximum Physical Interfaces : Unlimited perpetual
\nMaximum VLANs : 100 perpetual
\nInside Hosts : Unlimited perpetual
\nFailover : Disabled perpetual
\nVPN-DES : Disabled perpetual
\nVPN-3DES-AES : Disabled perpetual
\nSecurity Contexts : 0 perpetual
\nGTP\/GPRS : Disabled perpetual
\nAnyConnect Premium Peers : 5000 perpetual
\nAnyConnect Essentials : Disabled perpetual
\nOther VPN Peers : 5000 perpetual
\nTotal VPN Peers : 0 perpetual
\nShared License : Disabled perpetual
\nAnyConnect for Mobile : Disabled perpetual
\nAnyConnect for Cisco VPN Phone : Disabled perpetual
\nAdvanced Endpoint Assessment : Disabled perpetual
\nUC Phone Proxy Sessions : 2 perpetual
\nTotal UC Proxy Sessions : 2 perpetual
\nBotnet Traffic Filter : Disabled perpetual
\nIntercompany Media Engine : Disabled perpetual
\nThis platform has an ASA 5520 VPN Plus license.
\nSerial Number: 123456789AB
\nRunning Permanent Activation Key: 0x00000000 0x00000000 0x00000000 0x00000000 0x00000000
\nConfiguration register is 0x0
\nConfiguration has not been modified since last system restart.
\n<\/code>
\nenjoy your virtual asa<\/p>\n","protected":false},"excerpt":{"rendered":"

Esta vez toca ampliar el laboratorio de pr\u00e1cticas de networking… ya tengo varios routers virtuales mikrotik, pero nunca hab\u00ed\u00ada podido hacer un cisco asa. Hay que decir, que no es legal, no est\u00e1 soportado por cisco y que cada uno que haga lo que quiera…. Yo lo he usado para practicar el cambio que ha […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,5],"tags":[],"class_list":["post-1028","post","type-post","status-publish","format-standard","hentry","category-cisco","category-linux"],"_links":{"self":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts\/1028","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1028"}],"version-history":[{"count":0,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=\/wp\/v2\/posts\/1028\/revisions"}],"wp:attachment":[{"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1028"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1028"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/diablo.craem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1028"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}