So. Let’s say our Cisco ASA is the Black Gate of Mordor.
ciscoasa> en Password: ciscoasa# conf t ciscoasa(config)# hostname BlackGateOfMordor BlackGateOfMordor(config)#
Around the time of the War of the Ring, Sauron has taken over Mordor and the local real estate is fair teeming with orcs and Nazgûl. One does not simply walk into Mordor, as Boromir would say. (One does not simply rock into Mordor either, but that is a whole ‘nother meme.) So, pretty much the highest security neighborhood in the local school district. Security level 100.
BlackGateOfMordor(config)# int GigabitEthernet0/0 BlackGateOfMordor(config-if)# nameif Mordor INFO: Security level for "Mordor" set to 0 by default. BlackGateOfMordor(config-if)# security-level 100 BlackGateOfMordor(config-if)# ip add 220.127.116.11 255.255.255.0 BlackGateOfMordor(config-if)# no shut
Outside the Black Gate, we have Gondor. Full of pesky men, dwarves, elves and hobbity things. Not to be allowed in to Mordor by default. Security level 0. And not a moment too soon. The Army of the West just strolled up to the Black Gate, the wankers.
BlackGateOfMordor(config)# int GigabitEthernet0/1 BlackGateOfMordor(config-if)# nameif Gondor INFO: Security level for "Gondor" set to 0 by default. BlackGateOfMordor(config-if)# ip add 18.104.22.168 255.255.255.0 BlackGateOfMordor(config-if)# no shut
Cirith Ungol is a pass in the western mountains of Mordor. Difficult to traverse, so let’s give it security level 100 as well. I mean, we’ve got two watchers and a big spider guarding that interface. Not even a hobbit could get through. (Note to self: configure AIP-SSM card.)
BlackGateOfMordor(config-if)# int GigabitEthernet0/2 BlackGateOfMordor(config-if)# nameif Cirith_Ungol INFO: Security level for "Cirith_Ungol" set to 0 by default. BlackGateOfMordor(config-if)# ip add 10.10.10.100 255.255.255.0 BlackGateOfMordor(config-if)# security-level 100 BlackGateOfMordor(config-if)# no shut
So this is what we have:
As it stands, the Nazgûl can travel to Gondor and beyond because they originate from the interface with the highest security level. By default, any traffic originating from Mordor to any lower-security interface is permitted. (I hear Gondor is lovely this time of year. Fancy a mini-break?) And when our Nazgûl return from Gondor, they are allowed back in to Mordor even though the Gondor interface is at security level 0 (and therefore has an implicit deny on all traffic coming into the Black Gate.) This is because the Nazgûl are returning traffic.The outgoing leg of their trip was placed in the state table of the ASA (cough, Black Gate) and now the returning Ringwraithalicious packets are a continuation of the traffic.
The Army of the West are outside the Gondor interface. With security level 0 on that interface, they aren’t going in unless the gate cracks open (e.g. ACL permitting inbound traffic), or they disguise themselves as Nazgûl returning home (e.g. packet spoofing, man-in-the-middle attack). Unfortunately, the Nazgûl have a secret knock (randomized sequence numbers), so a disguise is not gonna work.
Frodo and Sam and Gollum are trying to get into Mordor via Cirith Ungol, which has a security level of 100. The Cirith_Ungol interface and the Mordor interface have the same security level, but traffic between interfaces with the same security level is not permitted by default. After Sam and Frodo defeat the security at Cirith Ungol, there is nothing to stop them from going into Mordor. This is the equivalent of running a same-security-traffic permit inter-interface command.
BlackGateOfMordor(config)# same-security-traffic permit inter-interface
Now traffic can flow freely between Mordor and Cirith_Ungol. No ACLs needed. Of course the Eye of Sauron is a pretty sensitive IPS, tuned to the hobbit signature. All the Army of the West can hope to do is distract the IPS by increasing the amount of traffic and thus increasing the noise-to-signal ratio. There might also be a bit of a SYN flood effect there. Sam and Frodo, disguised as orcs, may be able to fly under the radar long enough to get their payload to their target, Mount Doom.
That was fun 🙂 And probably full of plot holes.
Although this was meant to be a bit of procrastination, and not intended to be educational, I accidentally learned something. While attempting to set the clock to 9 March 3019, (the date when Frodo and Sam and Gollum get to the Morgul road), I learned that the Cisco ASA clock can be set to a year of 2035 and no later.