This post will provide a brief overview of a seldom referred to part of the ASA, the Accelerated Security Path (ASP). As we know the ASA’s Adaptive Security Algorithm is responsible for inspecting all traffic that traverses the ASA, and based on its configured security policies will either permit or deny the traffic.
Read Full Entry »

Another new addition to the ASA v8.x code was the introduction of the Local Certificate Authority Server. Although this is not specifically mentioned in the current CCIE Security Lab blueprint I thought it a useful topic to touch on, in case of future inclusion, or for potential real world applications.

The ASA’s Local CA Server provides the appliance with a basic level of Certificate provisioning functionality. The primary use for the Local CA is to provide registered users the ability to enroll for certificates, which can then be used with features such as WebVPN.

Read Full Entry »

We conclude this multi-part techtorial with Part 3, QoS for Dynamic Multipoint VPN.

DMVPN provides the ability for large scale VPN’s, in a Hub and Spoke topology, while using a simplified Dynamic deployment model for the spokes. This is due to the reduced configuration required on the Hub device.

Read Full Entry »

Here in part 2 we are going to continue with QoS for IOS VPN’s. In Part 1 for the ASA we showed that QoS policies were defined and applied using MPF (Modular Policy Framework). With IOS we also use another modular component called MQC, or Modular QoS Command-Line Interface. MQC although similar in nature to MPF, is far more powerful and granular.
Read Full Entry »

Hi everyone and welcome to this my first post on the IPexpert Blog.  I’m going to kick off here with a multipart post on Quality of Service for VPN’s.

Part 1 will concentrate on the VPN QoS for the ASA firewall, with Part 2 covering VPN QoS for IOS routers. So lets start by diving straight into the ASA.  Firstly, lets take a quick look at what Quality of Service features are available for the ASA:

Priority or Low Latency Queueing – This is the primary method used when dealing with traffic flows that do not react well to network latency, such as voice and video etc. Traffic in the Priority queue will be processed and transmitted ahead of all other traffic.

Read Full Entry »