How to emulate Cisco ASA

December 4th, 2009 by Jeremy Grossmann Leave a reply »

In this article, I will show you how to emulate Cisco ASA using Qemu. Once again, please note that ASA is not provided and will not be. So please don’t ask. Also be aware that ASA does not 100% work in Qemu but that’s enough to play with it.

This Howto is still a draft and has been tested only on Linux.


Installation

First compile and patch Qemu as you would do for running JunOS. This will give us pcap, lcap and UDP tunnels (i.e. GNS3/Dynamips connections) capabilities.

Then obtain ASA itself. If you are smart and patient you will find it. I used asa802-k8.bin for my installations. As far as I know, nobody has been able to run ASA > version 8.2 (ASA keeps rebooting).

The next step is to get an initrd and a Linux kernel (inside the initrd) from your ASA image to use them with Qemu and also fix the initrd for our needs. The initrd is zipped and archived in the ASA image, we have to extract it.

There are 2 ways, manually or using a tool I created.

Manual method

Create an hexadecimal dump of your image:

hexdump -C asa802-k8.bin > asa802-k8.hex

Search for the ZIP header:

grep “1f 8b 08 00 1d” asa802-k8.hex
001228b0  1f 8b 08 00 1d 3d 73 46  00 03 ec 3a 6d 54 14 57  |…..=sF…:mT.W|

We can see that the ZIP file starts at offset 1228b0.

Let’s find the image size:

ls -la asa802-k8.bin
-rwxr-xr-x  1 root  staff  14524416 26 Nov 20:14 asa802-k8.bin
14524416 bytes.

Now we need to find out where in the file we can start extracting the ZIP part.

echo "14524416 ; ibase=16 ; last - 1228B0" | bc | tail -n 1
13334352

Extract the zipped part of the ASA image:

tail -c 13334352 asa802-k8.bin > asa802-k8.gz

Decompress it with gzip:

gzip -d asa802-k8
gzip: asa802-k8.gz: decompression OK, trailing garbage ignored

Make a temp directory and go into it so we can extract the files contained in the uncompressed archive file (the initrd):

mkdir tmp ; cd tmp

Now extract the archive with cpio (you must have the administrator rights to successfully extract device files).

cpio -i --no-absolute-filenames --make-directories < ../asa802-k8

Copy the Linux kernel to your previous directory:

cp vmlinuz ../asa802-k8.kernel

Before compressing back the initrd, create the following script in asa/scripts/first_start.sh

This script formats the 256 MB flash on first start to be used by ASA. Loads the network drivers modules for Intel e100 (i82559er in Qemu) and Intel e1000 cards and activates the network interfaces to be used in ASA. I noticed that if we immediately start ASA after this first boot, it freezes (don’t really know why but it seems the system do something and slow down during the first minute …). The next time you start the system, the script will still load the activate the network interfaces and automatically start ASA.

#!/bin/sh
 
##
## Author: Jeremy Grossmann (2009)
## Contributor: J. Pedro Flor (28 january 2010)
##
 
FIRST_START=no
if test ! -e /mnt/disk0/lina_monitor
then
 cd /asa/scripts/
 echo "d" > /asa/scripts/fdisk.pf.in
 echo "o" >> /asa/scripts/fdisk.pf.in
 echo "n" >> /asa/scripts/fdisk.pf.in
 echo "p" >> /asa/scripts/fdisk.pf.in
 echo "1" >> /asa/scripts/fdisk.pf.in
 echo "1" >> /asa/scripts/fdisk.pf.in
 echo ""  >> /asa/scripts/fdisk.pf.in
 echo "t" >> /asa/scripts/fdisk.pf.in
 echo "4" >> /asa/scripts/fdisk.pf.in
 echo "w" >>/asa/scripts/fdisk.pf.in
 
 echo ""
 echo -n "Initializing partition..."
 /sbin/fdisk /dev/hda < /asa/scripts/fdisk.pf.in > /dev/null 2> /dev/null
 echo "done"
 
 echo ""
 echo -n "Formating and mounting partition..."
 mkdosfs -F 16 /dev/hda1 > /dev/null 2> /dev/null
 mount -t vfat -o umask=0000,noatime,check=s,shortname=mixed /dev/hda1 /mnt/disk0 > /dev/null 2> /dev/null
 echo "done"
 echo ""
 
 cp /asa/bin/lina /mnt/disk0/lina
 cp /asa/bin/lina_monitor /mnt/disk0/lina_monitor
 FIRST_START=yes
fi
 
# load drivers
modprobe e100
modprobe e1000
ifconfig eth0 up
ifconfig eth1 up
ifconfig eth2 up
ifconfig eth3 up
ifconfig eth4 up
ifconfig eth5 up
 
if test $FIRST_START = yes
then
 echo ""
 echo "          Cisco ASA with <NO> Multiple Security Contexts"
 echo "          =============================================="
 echo ""
 echo "This is your first boot, please wait about 2 minutes for 'disk0' creation"
 echo "and then execute the following commands inside the Linux prompt:"
 echo ""
 echo " # cd /mnt/disk0"
 echo " # /mnt/disk0/lina_monitor"
 echo ""
 echo ""
 echo ""
 echo "Please note to use the following command under ASA to save your configs:"
 echo ""
 echo " ciscoasa(config)# boot config disk0:/.private/startup-config"
 echo " ciscoasa(config)# copy running-config disk0:/.private/startup-config"
 echo ""
 echo ""
 echo ""
 echo "To get webvpn working, execute the following commands:"
 echo ""
 echo " ciscoasa# mkdir disk0:/var"
 echo " ciscoasa# mkdir disk0:/var/log"
 echo " ciscoasa# mkdir disk0:/csco_config"
 echo " ciscoasa# mkdir disk0:/csco_config/97"
 echo " ciscoasa# mkdir disk0:/csco_config/97/webcontent"
 echo ""
 echo "          ( Powered by Pedro Flor )"
 echo "          ( [email protected]  )"
 echo ""
 exit
fi
 
echo ""
echo ""
echo "Starting Cisco ASA with <NO> Multiple Security Contexts..."
echo ""
 
cd /mnt/disk0
/mnt/disk0/lina_monitor

In order for the script to be loaded at startup, edit etc/init.d/rcS and change /asa/bin/lina_monitor by /asa/scripts/first_start.sh

Change first_start.sh permissions:

chmod 755 first_start.sh

Now you can compress all the file and have the initrd ready to use in Qemu:

find . | cpio -o -H newc | gzip -9 > ../asa802-k8.initrd.gz

Automated extraction method

TODO

Using ASA with Qemu

Create a FLASH (this is a virtual hard disk).

qemu-img create FLASH 256M

Then you can start Qemu.

qemu -hda FLASH -kernel asa802-k8.kernel -hdachs 980,16,32 \
-initrd asa802-k8.initrd.gz -m 512 -no-kqemu -nographic -append \
"console=ttyS0,9600n8 hda=980,16,32 bigphysarea=16384 auto nousb ide1=noprobe"

TODO: networking of ASA. Very similar with JunOS emulation.

Using ASA with GNS3

To be completed:

In Preferences -> Qemu -> Qemuwrapper section:

Set the path to Qemuwrapper (can be found in the GNS3 package)

Set the working directory (e.g. /tmp).

Set the path to your patched Qemu in “Path to Qemu”

In ASA section:

Set the paths to your initrd and kernel.

Drag and Drop an ASA symbol on the scene, start the firewall and telnet to it.

121 comments

  1. xplore says:

    Hi frndz,
    please help me….. for this installation…

    I followed the blog and installed GNS3 on my windows xp machine.

    Following is the configuration on GNS3.

    http://img651.imageshack.us/f/qemu.jpg/

    http://uploadpic.org/showpic-79426/qemuhost.html

    http://www.imagehousing.com/imageupload.php?id=507223

    ———
    Qemu started successfully:
    got the final message as: ok, booting the kernel

    ——
    Prob: @asa console

    i copied:
    modprobe e1000

    ifconfig eth0 up

    ifconfig eth1 up
    ifconfig eth2 up
    ifconfig eth3 up
    ifconfig eth4 up
    ifconfig eth5 up
    cp /asa/bin/lina /mnt/disk0/lina
    cp /asa/bin/lina_monitor /mnt/disk0/lina_monitor

    cd /mnt/disk0/mnt/disk0/lina_monitor
    ========
    still no use:
    geting the following:

    #

    only hash promt:so please help me

    # ls ——–showing the following….
    asa dev init linuxrc proc sbin usr
    bin etc lib mnt root sys

    ###################################
    stopped at # propmt

    Thanks in Advance

  2. scott says:

    hi
    I have the same problem as fernando has.
    I’m working on Ubuntu 10.04 and my GNS3 version is 0.7.2

    I have installed qemu step by step , my problem is , when my ASA has no link with any other equipments, it can start and I also telnet it successful,however,when I have linked the ASA interfaces to a router or a switch, it can’t start.
    I try to start the ASA first and then link to routers , but I can’t ping from the asa to the router.

  3. zali says:

    tobie,
    your custom kernel and initrd’s are great, but here is a problem I am facing while running it in multiple security context mode using “lina -m”, i.e I can see only limited commands in interface config mode, like I can’t even assign ip add to interfaces

    Regards/Zali

  4. ken says:

    Solved.I downgraded qemu to 0.11.0 from the default that comes with Ubuntu 10.04, version 0.12.3 i think.

  5. tobie says:

    zali,

    multi-mode in asa gns3 works great.
    its all about the concept of “context”
    please check the asa docs for configuration details.

  6. arun umrao says:

    hi
    asa downloaded with link given by someone is good but i tried my own first_start.sh script with replacing —-

    ifconfig eth0 up
    ifconfig eth1 up
    ifconfig eth2 up
    ifconfig eth3 up
    ifconfig eth4 up
    ifconfig eth5 up

    with—–

    ifconfig eth0 down hw ether 00:00:AC:10:01:03
    ifconfig eth1 down hw ether 00:00:AC:10:01:04
    ifconfig eth2 down hw ether 00:00:AC:10:01:05
    ifconfig eth3 down hw ether 00:00:AC:10:01:06
    ifconfig eth4 down hw ether 00:00:AC:10:01:07
    ifconfig eth5 down hw ether 00:00:AC:10:01:08
    ifconfig eth0 up
    ifconfig eth1 up
    ifconfig eth2 up
    ifconfig eth3 up
    ifconfig eth4 up
    ifconfig eth5 up

    it work with any glitches.

  7. innoe says:

    Tobie,

    How do I save the configuration in Multiple context mode. I used this command “copy running-config disk0:/.private/startup-config”, but when I restart the ASA, it comes up in single mode?

  8. arun umrao says:

    hi innoe

    use this steps of commands

    1nd command
    ciscoasa# copy running-config disk0:/.private/running-config

    2nd command

    ciscoasa# copy disk0:/.private/running-config disk0:/.private/startup-config
    3nd command
    ciscoasa# configure terminal
    ciscoasa(config)# boot config disk0:/.private/startup-config
    ciscoasa(config)# exit

    it may help you.
    thanks

  9. Sushant says:

    Hi i am facing this problem plz help

    asa(config)# interface ethernet 0/0
    asa(config-if)# namei
    asa(config-if)# nameif inside
    ERROR: open(np/port/id/0/-1) failed.
    ERROR: open() failed.
    ERROR: Failed to initialize interface inside
    ERROR: Add interface failed.
    asa(config-if)# no shut
    asa(config-if)# no shutdown
    Failed to change interface status: cannot get channel
    asa(config-if)#

    ASAP

  10. tobie says:

    innoe,

    i made a simple “hack” on my initrd file.
    I actually made “two initrd file”, one for the single-mode and the other for multi-mode.

    When im studying and doing some testing on multi-mode asa, i will load the multi-mode initrd and start my labs. all well and its great!

    the flash file will automatically updates that corresponds to your initrd modes.

  11. tobie says:

    guys!!!

    i got my 2nd ccie number!

    R&S and Security!!

    thanks to gns3 team!

  12. Van says:

    I did this for the asa805-k8.bin, asa823-k8.bin, and the asa832-k8.bin, but the grep could not find the 1f 8b 08 at the beginning of the files for the asa805-k8.bin, so when I got to the gzip -d I got an error not in gzip format. after getting the asa823-k8.bin and the asa832-k8.bin unzipped I could not find the initrd or the vmlinuz. I also made your script, but I don’t know what to edit in the etc/int.d/rcS and the /asa/bin/lina_monitor.

  13. Van says:

    I compressed back the initrd, but the asa802 won’t load to command prompt. The asa823 gave me the error missing /dev/tty50 and the asa832 kept restarting, but I need to check if the script was in the asa/scripts/ and that the line in the rcS was changed from /asa/bin/lina_monitor to /asa/scripts/first_start.sh. I may have to find the correct kernel for the asa823 and the asa832. Otherwise the asa802 works with the initrd and vmlinuz obtain when using the unpack.exe from unpack-0.1_win tools I downloaded from the gns3 website.

  14. Van says:

    I am so close the getting the asa832-k8 emulate and the asa823-k8, but I need to know were the kernel starts and ends in the asa823-k8.bin so I can yank the kernel from the kernel by determining the skip and count values. Otherwise the I have successfully extracted the initrd and the kernel from the asa832-k8.bin, but keep getting the following error:

    done
    Freeing initrd memory: 14077k freed
    platform rtc_cmos: registered platform RTC device (no PNP device found)
    highmem bounce pool size: 64 pages
    HugeTLB registered 4 MB page size, pre-allocated 0 pages
    bigphysarea: Allocated 16384 pages at 0xdf800000.
    msgmni has been set to 673
    io scheduler noop registered
    io scheduler anticipatory registered (default)
    io scheduler deadline registered
    io scheduler cfq registered
    pci 0000:00:00.0: Limiting direct PCI/PCI transfers
    pci 0000:00:01.0: PIIX3: Enabling Passive Release
    pci 0000:00:01.0: Activating ISA DMA hang workarounds
    Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
    serial8250: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A
    loop: module loaded
    pcnet32.c:v1.35 21.Apr.2008 [email protected]
    tun: Universal TUN/TAP device driver, 1.6
    tun: (C) 1999-2004 Max Krasnyansky
    Uniform Multi-Platform E-IDE driver
    ide_generic: please use “probe_mask=0x3f” module parameter for probing all legacy ISA IDE ports
    ide-gd driver 1.18
    TCP cubic registered
    NET: Registered protocol family 17
    RPC: Registered udp transport module.
    RPC: Registered tcp transport module.
    802.1Q VLAN Support v1.8 Ben Greear
    All bugs added by David S. Miller
    TIPC: Activated (version 1.6.4 compiled Jul 30 2010 16:45:45)
    NET: Registered protocol family 30
    TIPC: Started in single node mode
    Using IPI Shortcut mode
    VFS: Cannot open root device “hda1″ or unknown-block(0,0)
    Please append a correct “root=” boot option; here are the available partitions:
    Kernel panic – not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

    Does anyone know what I need to configure in GNS3 or change in the first_start.sh or rcS scripts if necessary to make the run completely and load to command line?

  15. Greg says:

    I am trying the procedure with ASA binary: asa804-k8.bin converted into hex, but when I grep for “1f 8b 08 00 1d” nothing comes up. Any ideas?

    Thanks

  16. Jorge Avelar says:

    this step below does not work for me.

    echo “25159680 ; ibase=16 ; last – 1228b0″ | bc | tail -n l
    tail: illegal offset — l
    (standard_in) 1: parse error

  17. Jon says:

    To get the ASA to run in transparent mode within my GNS3 instance, I added to the asa/scripts/first_start.sh script provided above:
    After:
    ifconfig eth0 up
    ifconfig eth1 up
    Add:
    ifconfig eth0 promisc
    ifconfig eth1 promisc

    Without this, packets weren’t making it up to the ASA process, and were discarded at the nic when running in transparent mode.

    That might be obvious to others, but wanted to mention it since I had to search a while for it.

Leave a Reply