Skip to content

Create a new Cisco ASA machine

Preview feature

This feature is available in Preview and isn't yet generally available (GA). Functionality and behavior can change before GA.

Creating a machine for a Cisco Adaptive Security Appliance (ASA) firewall lets Certificate Manager - SaaS discover and provision the identity certificates that serve its remote-access VPN and management interfaces. Certificate Manager - SaaS connects to the firewall's HTTPS management interface. It doesn't use the ASA REST API agent, so you don't need to install it. After you create the machine, you can provision certificates to it.

Before you begin

  • The hostname or IP address of the Cisco ASA management interface. IPv6 addresses are supported.
  • The HTTPS management port, if it isn't 443.
  • At least one active VSatellite connection that can reach the Cisco ASA management interface on that port.
  • A local Cisco ASA account with privilege level 15. Provisioning runs configuration commands, so it requires privilege level 15. Which commands a lower-privilege account can run for discovery depends on the firewall's own command-privilege settings.
  • For a firewall in multiple-context mode, one machine for each security context you want to manage. Each machine addresses exactly one security context.

Note

Certificate Manager - SaaS doesn't verify the certificate that the Cisco ASA management interface presents, because that certificate is self-signed by default. The connection is still encrypted.

Prepare the Cisco ASA

Run these commands on the Cisco ASA command-line interface (CLI) to give Certificate Manager - SaaS access to the HTTPS management interface. Replace the values in angle brackets with your own.

  1. Create a local account with privilege level 15:

    username <username> password <password> privilege 15

  2. Turn on the HTTPS server. If you use a port other than 443, add it to the command.

    http server enable

  3. Allow the VSatellite network to reach the management interface:

    http <vsatellite-network> <mask> <interface-nameif>

  4. Authenticate HTTPS management connections against the local user database:

    aaa authentication http console LOCAL

  5. Save the configuration:

    write memory

Create the machine

  1. In Server Hostname, enter the hostname or IP address of the Cisco ASA management interface.

  2. (Optional) In Port, enter the HTTPS management port. If you leave it empty, Certificate Manager - SaaS uses 443.

  3. For Credential Type, choose one of the following:

    • Enter Credentials to enter the Cisco ASA account's username and password.
    • Select Credentials to use shared credentials from CyberArk.

    Note

    Credential types require additional licensing. Only users with the CyberArk shared credential capability see this option.

    Important

    Your role can limit which credentials you see. System Administrators and PKI Administrators can select any credential. Users with the Resource Owner role can use only the credentials that belong to their teams.

  4. Enter the credentials for the method you chose:

    • If you chose Enter Credentials, enter the Username and Password of the Cisco ASA account.
    • If you chose Select Credentials, for Credential, choose the shared credential that holds the account's username and password.

    Warning

    Remember to store your username and password securely when creating a new machine. For security reasons, you will not be able to modify the fields under the "Access" tab without these credentials. This ensures that only authorized individuals can modify these fields.

  5. (Optional) In Security Context, for a firewall in multiple-context mode, enter the name of the security context that owns the Server Hostname. Leave it empty for a single-context firewall. The name can contain only letters, digits, periods (.), underscores (_), and hyphens (-), up to 64 characters.

    Note

    Certificate Manager - SaaS doesn't send this value to the firewall. It records it on the machine's installations. If you change it later, the next discovery reports every installation on the machine as new.

  6. Click Test Access, then click Continue. Continue is enabled only after the test succeeds.

    Note

    The test passes if the Cisco ASA accepts the credentials, even when the account's privilege level is below 15. Provisioning fails with an account below privilege level 15.

Tip

The Cisco ASA allows six concurrent HTTPS management sessions for each security context, shared with the Adaptive Security Device Manager (ASDM) and other management clients. If connections are refused intermittently, close other management sessions, and avoid running discovery and provisioning against the same firewall at the same time.

What's next?

Refer back to Create a new machine to finish setting up your new machine by configuring Discovery and Provisioning scheduling. When you configure discovery, you can set these options:

  • Exclude Expired Certificates skips certificates that have already expired.
  • Exclude Trust Pool Certificates skips the CA certificates in the Cisco ASA trust pool. When this option is off, discovery also reports trust pool certificates so you can track when they expire. Certificate Manager - SaaS doesn't renew trust pool certificates. If discovery on a firewall with a large trust pool doesn't finish, turn this option on.

For existing machines: