Configuring ISA

The Config tab for the ISA offers three general levels of configuration: global, clientless vpn, and interface. The global level and interface levels offer the same settings as a switch. Note that the Config tab provides an alternative to the CLI only for some simple, common features; to access the full set of ISA commands that have been modeled you must use the CLI tab.

ISA Firewall can be configured under the Global Settings > ASA Firewall.

Throughout your configurations in the Config tab, the lower window will display the equivalent CLI commands for all your actions.

 

Global Settings, Algorithm Settings, Interface

For these sections of the Config tab, please refer to the Switches page as they function similarly with the ISA config tab


Clientless VPN

For this section of the Config tab, please refer to the ASA page as they function similarly with the ISA config tab


ISA Firewall Configuration

For the ISA Firewall Configuration, users can configure an interface with the following firewall settings:


To configure Firewall on an ISA-3000, create the device, go to the Config dialog and click on the button ASA Firewall.

ASA Firewall Configuration Dialog

 

Block a Source IPv4 Address
  1. Select an interface
  2. Select Block a source IPv4 address
  3. Enter an IPv4 address in the input box Host Ipv4
  4. Click on the button Add
  5. Observe the entry is added in the Unsaved Firewall Configuration table
  6. Click on Save Config and observe that the config is saved as an ACL statement access-list [if-name]_access_in extended deny ip host [X.X.X.X] any
  7. Highlight the newly added statement. Move the statement up above the ACL access-list [if-name]_access_in extended permit ip any any
Examples:

ASA Firewall: Block a Source Host IPv4 Address

ASA Firewall: Block a Source Host IPv4 Address

 

Block a Destination IPv4 Address
  1. Select an interface
  2. Select Block a destination IPv4 address
  3. Enter an IPv4 address in the input box Host Ipv4
  4. Click on the button Add
  5. Observe the entry is added in the Unsaved Firewall Configuration table
  6. Click on Save Config and observe that the config is saved as an ACL statement access-list [if-name]_access_in extended deny ip host [X.X.X.X] any
  7. Highlight the newly added statement. Move the statement up above the ACL access-list [if-name]_access_in extended permit ip any any
Examples:

ASA Firewall: Block a Source Host IPv4 Address

ASA Firewall: Block a Source Host IPv4 Address

 

Block a URL
  1. Select an interface
  2. Select Block a URL
  3. Enter a URL in the input box URL
  4. Click on the button Add
  5. Observe the entry is added in the Unsaved Firewall Configuration table
  6. Click on Save Config and observe that the config is saved as an ACL statement access-list [if-name]_access_in extended deny ip any object [URL]
  7. Highlight the newly added statement. Move the statement up above the ACL access-list [if-name]_access_in extended permit ip any any
  8. On the CLI window, execute show running-config and observe that these commands are added:
    object network obj-[URL]
    fqdn [URL]
Examples:

ASA Firewall: Block a URL

ASA Firewall: Block a URL

 

Block a URL from a Host
  1. Select an interface
  2. Select Block a URL from a host
  3. Enter an IPv4 address in the input box Host Ipv4
  4. Enter a URL in the input box URL
  5. Click on the button Add Both
  6. Observe the entry is added in the Unsaved Firewall Configuration table
  7. Click on Save Config and observe that the config is saved as an ACL statement access-list [if-name]_access_in extended deny ip any object [URL]
  8. Highlight the newly added statement. Move the statement up above the ACL access-list [if-name]_access_in extended permit ip any any
  9. On the CLI window, execute show running-config and observe that these commands are added:
    object network obj-[URL]
    fqdn [URL]
    host [X.X.X.X.]
ASA Firewall: Block a URL from a Host

ASA Firewall: Block a URL from a Host

ASA Firewall: Block a URL from a Host

 

Block a Traffic Type
  1. Select an interface
  2. Select Block a traffic type
  3. Select a type of traffic to block.
  4. Click on the button Add
  5. Observe the entry is added in the Unsaved Firewall Configuration table or in the Saved Non-ACL Firewall Configuration table
  6. Click on Save Config and observe that the config is saved as an ACL statement: access-list [if-name]_access_in extended deny [tcp/udp] any any eq [PORT-NUMBER]
  7. Highlight the newly added statement. Move the statement up above the ACL access-list [if-name]_access_in extended permit ip any any
Examples:

ASA Firewall: Block Traffic

ASA Firewall: Block Traffic

 

Block a Traffic Type from a Host
  1. Select an interface
  2. Select Block a traffic type from a host
  3. Enter an IPv4 address in the input box Host Ipv4
  4. Select a type of traffic to block
  5. Click on the button Add
  6. Observe the entry is added in the Unsaved Firewall Configuration table or in the Saved Non-ACL Firewall Configuration table
  7. Click on Save Config and observe that the config is saved as an ACL statement: access-list [if-name]_access_in extended deny [tcp/udp] host [X.X.X.X] any any eq [PORT-NUMBER]
  8. Highlight the newly added statement. Move the statement up above the ACL access-list [if-name]_access_in extended permit ip any any
Examples:

ASA Firewall: Block Traffic from a Host

ASA Firewall: Block Traffic from a Host

ASA Firewall: Block Traffic from a Host

 

 

Examples

Sample File Description

isa3000_firewall.pkt.pkt

This file demonstrates how the firewall on ISA-3000 filters traffic based on different configurations, such as blocking traffic from an IP address, from a URL or from a traffic type.

 

Current Modeling Limitations

Firewall on ISA-3000 does not support Deep Packet Inspection (DPI) of industrial protocols and supports custom application detectors to create alerts or block traffic based on industrial application flows.

The firewall also does not support Application Awareness and Control. It can't block unauthorized commands or dangerous configuration parameters and inspect for unwanted applications or deviations.

In addition, the firewall does not support managed remote access for employees and third parties with optional multi-factor authentication, enabling secure VPN connections to manage remote sites and control vendor access.

Finally, it does not include the feature of hardware bypass to maintain traffic flow during power failures, dual power inputs, and quality-of-service policies to ensure operational continuity.