ciscodevnet / cisco-asav

Auto scaling of ASAv on AWS and Azure

Adaptive Security Appliance Virtual

ASAv Autoscaling

This Repository provides resources to bring up ASAv Auto Scale solution.

Some of the key features of the ASAv Auto Scale include:

• Complete serverless implementation!
• Completely automated ASAv instance configuration.
• Support for Enabling / Disabling Auto Scaling feature.

ASAv Cluster

Clustering lets you group multiple ASAv units together as a single logical device. A cluster provides all the convenience of a single device (management, integration into a network) while achieving the increased throughput and redundancy of multiple devices.

• ASAv cluster is supported on AWS from 9.19 release.
• ASAv cluster is supported on Azure from 9.20.2 release.

AWS GuardDuty Integration with Cisco ASAv

This solution make use of the threat analysis data/results from Amazon GuardDuty (malicious IPs generating threats, attacks etc.) and feeds the information(malicious IP) to the Cisco Adaptive Security Appliance (ASAv) to protect the underlying network and applications against future threats originating from these sources(IP).

Cloud Deployment Templates for Cisco ASAv

This provides set of templates for deployment of ASAv in public clouds.

Azure Templates

Azure Resource Manager(ARM) templates to deploy Cisco's ASAv and ASAv HA in Azure public cloud using custom image.

Azure Resource Manager Templates
Azure Resource Manager templates are JSON files that contain resource descriptions and parameter definitions.

• Template file: This is the main resources file that deploys all the components within the resource group.
• Parameter file: This file includes the parameters required to successfully deploy the ASAv.

Openstack Templates

This repository conatains heat template files to deploy the Cisco Adaptive Security Virtual Appliance (ASAv)on OpenStack environment.

Resources

ASAv Autoscale

• For Azure on ASAv 9.15 and above: Code | README | [Deployment/Configuration Guide](autoscale/azure/asav_azure_autoscale_v919.pdf

• For AWS on ASAv 9.15 and above: Code | README | Deployment/Configuration Guide

• For GCP on ASAv 9.17 and above: Code | README | Deployment/Configuration Guide

• For OCI on ASAv 9.17 and above: Code | README | Deployment/Configuration Guide

ASAv Cluster

• For AWS ASAv Cluster on ASAv 9.19 and above: Code | README | Deployment/Configuration Guide
• For Azure ASAv Cluster on ASAv 9.20.2 and above: Code | README | Deployment/Configuration Guide

Cloud Service Integration

• AWS Guardduty: Code | README | Deployment/Configuration Guide

Deployment Template

• Azure ASAv Deployment Template:

  • For ASAv 9.20: README | ASAv | ASAV HA
  • For ASAv 9.19: README | ASAv | ASAV HA
  • For ASAv 9.18: README | ASAv | ASAV HA
  • For ASAv 9.17: README | ASAv | ASAV HA
  • For ASAv 9.16: README | ASAv | ASAV HA
  • For ASAv 9.15: README | ASAv | ASAV HA
  • For ASAv 9.14: README | ASAv | ASAV HA

• Openstack ASAv Heat Deployment Template: README | ASAv

cisco-asav's Issues

User-data for OpenStack ignored

Hi -

I am revisiting ASAv for OpenStack and having a hard time with the heat templates as written. The user-data definition here (https://github.com/CiscoDevNet/cisco-asav/blob/master/deployment-templates/openstack/ASAv/deploy_asav.yaml#L101-L119) implies the use of cloud-init vs the old day0-config via personality (file injection), but the changes specified in the user-data are not executed. Upon creation of the ASAv, it continues to have a stock configuration and will not attempt to load the configured being pushed via user-data. Can you confirm if the ASAv KVM image even has cloud-init installed? Docs mention Queens or Stein as supported but both are long EOL. Thanks.

Template Image issue

Use new Image version for Cisco ASAv autoscale template

Below options valid as on - 14Nov 2022
9171.0.0
91717.0.0
918.0.121
918.0.13
918.0.24
9181.0.0
919.0.101

Use below command to find latest available images
Get-AzVMImage -Location northeurope -PublisherName cisco -Offer cisco-asav -Sku asav-azure-byol| Select Version

Documentation PDF and Readme.md inconsistent.

The Readme.md here: https://github.com/CiscoDevNet/cisco-asav/blob/master/autoscale/azure/ASAv9.15/README.md
says:

• Support to deploy ASAv with PAYG licensing mode

The deployment guide PDF says:
• License the configuration. PAYG billing is not supported.

Only one can be true :)