Networking-Blog

Tags: 3g, 3g hostname identity, 3g ipsec, 3g vpn, 887g, cisco 3g, cisco 887g

by admin

Cisco Ipsec Identity Hostname

The ISAKMP identity is the interface from which the remote router will
send ISAKMP messages to the local peer. If a router supports ISAKMP on
multiple interfaces, then hostnames should be used for ISAKMP identity.

To configure a router to send its hostname in its ISAKMP peer negotiations,
use the global command

<crypto isakmp identity {hostname | address}>.

The default is to use the router’s ISAKMP interface IP address.

If the hostname option is used to identify its ISAKMP negotiations,
the remote peer hosts need to have hostname-to-IP-address mapping,

achieved with <ip host {hostname} {IP address1} {IP Address 2…IP Address 8}>.

A router can also use DNS for hostname resolution, but local hostname
definitions are faster and don’t break if there is a DNS server problem.

Below is a pre-shared key configuration example between two routers. The local router
sends it hostname, and the remote machine sends its IP address.

First is the configuration on the local peer router (both the IP address and hostname
keys have been defined):

The configuration on the local router looks like this :

!
hostname outlan-rt01
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key secretkey address 192.168.10.3
crypto isakmp identity hostname
!
interface FastEthernet0/0
ip address 172.30.80.17 255.255.255.252
!

The configuration on the remote peer router looks like this:

!
hostname inlan-rt01
!
ip host outlan-rt01 172.30.80.17
!
!
crypto isakmp policy 10
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key secretkey address outlan-rt01
!
interface FastEthernet1/0
ip address 192.168.10.3 255.255.255.252

October 7, 2010 9:06 pm

Tags: cisco ipsec, identity hostname, ipsec hostname, ipsec identity

by admin

Cisco Linux ipsec VPN Hostname Identity Configuration

Defines the identity the router uses when participating in the IKE protocol.

hostname comms30
!
ip domain name commsgroup.ww
!
crypto isakmp policy 1
encr 3des
hash md5
authentication pre-share
group 2
crypto isakmp key commsr3m0t3 address 2.2.2.2
crypto isakmp identity hostname
crypto isakmp keepalive 15 10
!
crypto ipsec transform-set secure esp-3des esp-md5-hmac
!

crypto map mapping 1 ipsec-isakmp
set peer 2.2.2.2
set transform-set secure
match address VPN
!
ip nat inside source route-map NAT interface dialer0 overload
!
ip access-list extended NAT_ACL
deny ip 10.10.38.0 0.0.0.255 10.10.0.0 0.0.255.255
permit ip 10.10.38.0 0.0.0.255 any
!
ip access-list extended VPN
permit ip 10.10.38.0 0.0.0.255 10.10.0.0 0.0.255.255
!
route-map NAT permit 10
match ip address name NAT_ACL

Defines the identity the router uses when participating in the IKE protocol.
In order to use crypto isakmp identity hostname command : Configure the following :

hostname comms30
ip domain name commsgroup.ww
crypto isakmp identity hostname

On Linux peer address vpn config:

conn comms30
left=2.2.2.2
leftsubnet=10.10.0.0/16
right=0.0.0.0
rightid=@comms30.commsgroup.ww
rightsubnet=10.10.38.0/24
authby=secret
keyexchange=ike
aggrmode=no
ikelifetime=24h
keylife=8h
keyingtries=3
rekey=no
auto=start
esp=3des-md5-96
pfs=no

Linux Shared Key config:

ipsec.secrets config :

%any 2.2.2.2 : PSK “commsr3m0t3″
or
2.2.2.2 %any : PSK “commsr3m0t3″

If the remote user is behind a NAT-T Router / Firewall and further connected
via a point-to-point link and remote user has a default-gateway of a private
LAN address :

Scenerio :

So you have an internet facing Layer3 Router connected to another Layer3 Router,
behind this we have our remote user vpn router “cisco 857“.

NAT Traversal performs two tasks: it detects if both ends support NAT-T and
NAT-Discovery that detects NAT devices along the transmission path.
NAT-T encapsulate IPSec packets in UDP packets with port 4500
NAT-traversal encapsulates the ESP packets in UDP packets.

Internet Key Exchange (IKE) – User Datagram Protocol (UDP) port 500

Encapsulating Security Payload (ESP) – IP protocol number 50

IPsec NAT-T – UDP port 4500

eg :

Host Lan :
192.168.4.0/24

Default-Gateway :
192.168.2.127/30

Router/Firewall :
81.174.141.198

Remote Host Router is configured with :

Hostname
Domain-Name
Crypto Isakmp Hostname Identity

We know the remote NAT-T Firewall Router also there private lan default-gateway.
Here is the Linux ipsec configuration :

conn comms30
left=2.2.2.2
leftsubnet=10.10.0.0/16
right=0.0.0.0
rightid=@comms30.commsgroup.ww
rightnexthop=192.168.2.127
rightsubnet=192.168.4.0/24
rightsourceip=81.174.141.198
authby=secret
keyexchange=ike
aggrmode=no
ikelifetime=24h
keylife=8h
keyingtries=3
rekey=no
auto=start
esp=3des-md5-96
pfs=no
dpddelay=30
dpdtimeout=120
dpdaction=clear

October 7, 2010 5:05 pm

Tags: Cisco dynamic ip, dynamic ipsec, hostname dynamic, identity hostname, ipsec dynamic, linux ipsec identity, vpn dynamic

by admin

Cisco Aironet 1130 AP

infrastructure-ssid optional :

Designate the SSID as an infrastructure SSID. The repeater uses this SSID to associate to the
root access point. Infrastructure devices must associate to the repeater access point using this
SSID unless you also enter the optional keyword.

station-role repeater :

Set the access point’s role in the wireless LAN to repeater

Remove these 2 lines if wanting Access-Point as a standalone (not as a repeater) :

infrastructure-ssid optional
station-role repeater

Authenication WPA
!
dot11 ssid Llyglaspub
authentication key-management wpa
wpa-psk ascii 7 06001C225B4B0B485C4341
!
interface Dot11Radio0
encryption mode ciphers aes-ccm tkip
!
ssid Llyglaspub
!

Authentication open
!
dot11 ssid Llyglaspub
authentication open
guest-mode
!
interface Dot11Radio0
no ip address
!
ssid Llyglaspub

Configuration :
!
ip dhcp excluded-address 10.0.0.1 10.0.0.2
!
ip dhcp pool DATA
import all
network 10.0.0.0 255.255.255.0
default-router 10.0.0.1
dns-server 10.0.0.1
lease 0 2
update arp
!
dot11 ssid Llyglaspub
vlan 1
authentication open
guest-mode
!
power inline negotiation prestandard source
!
interface Dot11Radio0
no ip address
no ip route-cache
!
ssid Llyglaspub
!
station-role root access-point
world-mode dot11d country GB outdoor
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
!
interface BVI1
ip address 10.0.0.2 255.255.255.0
ip access-group LAN in
no ip route-cache
!
ip default-gateway 10.0.0.1
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
bridge 1 route ip

Default SSID Configuration
Feature	Default Setting
SSID	tsunami
Guest Mode SSID	tsunami (The access point broadcasts this SSID in its beacon and allows client devices with no SSID to associate.)

Creating an SSID

Beginning in privileged EXEC mode, follow these steps to create an SSID:


	Command	Purpose
Step 1	configure terminal	Enter global configuration mode.
Step 2	interface dot11radio { 0 \| 1 }	Enter interface configuration mode for the radio interface. The 2.4-GHz radio is radio 0, and the 5-GHz radio is radio 1.
Step 3	ssid ssid-string	Create an SSID and enter SSID configuration mode for the new SSID. The SSID can consist of up to 32 alphanumeric characters. SSIDs are case sensitive.
Step 4	authentication client username password	(Optional) Set an authentication username and password that the access point uses to authenticate to the network when in repeater mode. Set the username and password on the SSID that the repeater access point uses to associate to a root access point, or with another repeater.
Step 5	accounting list-name	(Optional) Enable RADIUS accounting for this SSID. For list-name, specify the accounting method list. Click this link for more information on method lists: /en/US/docs/ios/12_2/security/configuration/guide/scfacct.html#xtocid2
Step 6	vlan vlan-id	(Optional) Assign the SSID to a VLAN on your network. Client devices that associate using the SSID are grouped into this VLAN. You can assign only one SSID to a VLAN.
Step 7	guest-mode	(Optional) Designate the SSID as your access point’s guest-mode SSID. The access point includes the SSID in its beacon and allows associations from client devices that do not specify an SSID.
Step 8	infrastructure-ssid [optional]	(Optional) Designate the SSID as the SSID that other access points and workgroup bridges use to associate to this access point. If you do not designate an SSID as the infrastructure SSID, infrastructure devices can associate to the access point using any SSID. If you designate an SSID as the infrastructure SSID, infrastructure devices must associate to the access point using that SSID unless you also enter the optional keyword.
Step 9	station-role repeater	Set the access point’s role in the wireless LAN to repeater
Step 10	copy running-config startup-config	(Optional) Save your entries in the configuration file.

October 7, 2010 10:30 am

Tags: 1130 ap, aironet, aironet 1130, cisco 1130, cisco aironet

by admin

Cisco – How to move ssh traffic to a different port

Cisco Tip of the day – How to move ssh traffic to a different port

If you know anything about linux, you know ssh is a necessity. It is the same for routers if you do not want everything you do passed in cleartext across the net. Problem is that alot of people use a cisco router as their firewall with NAT enabled. So when you try to ssh to your linux box from work (or elsewhere) via port 22, it will hit the router instead. So you have two options:

Configure PAT so you move your ssh traffic to a different public port, say 2222, and it will redirect it to port 22 on the inside of your network.
Configure a rotary group and move the router’s ssh port to a different port, say 2222.

This post will cover the latter.

It is a pretty simple config, but it takes awhile to find it on Cisco’s web site due to the amount of information they have on there. It is two lines total:

ip ssh port 2222 rotary 1

This line moves the ssh service to port 2222, and makes it part of rotary group 1. A rotary group allows you to define attributes, services and features of lines that reference the group. In this case, any line that is part of rotary group one will have ssh on port 2222.

line vty 0 4 rotary 1
This set of commands places vty lines 0 through 4 in rotary group 1. So these vtys will take on all the features you have configured for that group. In this case, ssh has been moved to port 2222 on vty lines 0 through 4.

And that is it.

ip ssh maxstartups 2
ip ssh authentication-retries 2
ip ssh port 5225 rotary 1
ip ssh logging events
ip ssh version 2

October 2, 2010 1:25 pm

Tags: cisco ssh, ip ssh, ip ssh port, ssh port, ssh rotary 1

by admin

Cisco: Source Quench

When does a Cisco router generate a source quench?

A Cisco router generates a source quench only if it does not have the buffer space needed to queue the packet.
If the router can’t queue the routed packet onto the output interface’s queue, it generates a source quench and
registers an output drop against the output interface. If the router isn’t congested, it won’t generate a source quench.

show ip traffic – Output for source quenches sent.
show interface – See if there are any drops. If there are none, then you should not see any source quench.

September 29, 2010 4:48 pm

Tags: cisco source quench, show interface, show ip traffic, source quench

by admin

Cisco: VLAN’s

What Is a VLAN?

A virtual LAN (VLAN) is a logical LAN, or a logical subnet. It defines
a broadcast domain. A physical subnet is a group of devices that shares
the same physical wire. A logical subnet is a group of switch ports
assigned to the same VLAN, regardless of their physical location in a
switched network.

Two types of VLANs are:

End-to-end VLAN—VLAN members are assigned by function
and can reside on different switches. They are used when hosts are
assigned to VLANs based on functions or workgroups, rather than
physical location. VLANs should not extend past the Building
Distribution submodule. Figure 2-1 shows end-to-end VLANs.

Local VLAN—Hosts are assigned to VLANs based on their location,
such as a floor in a building. A router accomplishes sharing
of resources between VLANs. This type is typically found in the
Building Access submodule. Figure 2-2 shows an example of local
VLANs.

Best Practices

VLAN networks need many of the same considerations that normal
Ethernet lines demand. For instance, VLANs should have one IP subnet.
By supplying consecutive subnets to VLANs, the routing advertisements
can be summarized (which has many benefits to convergence).
A stereotypical description of capacity requirements is possible. Access
ports are assigned to a single VLAN and should be Fast Ethernet or
faster. Ports to the distribution layer should be Gigabit Ethernet or
better. Core ports are Gigabit Etherchannel or 10-Gig Ethernet.
Remember that uplink ports need to be able to handle all hosts communicating
concurrently, and remember that although VLANs logically
separate traffic, traffic in different VLANs can still experience
contention with other VLANs when both VLANs travel over the same
trunk line.
Take into account the entire traffic pattern of applications found in your
network. For instance, Voice VLANs pass traffic to a remote Call
Manager. Multicast traffic has to communicate back to the routing
process and possibly call upon a Rendezvous Point.

Creating a VLAN in Global

Config Mode
VLANs must be created before they may be used. VLANs may be
created in global configuration mode or in VLAN database mode.
Creating VLANs in global configuration is easy—just identify the
VLAN number and name it!

(config)#vlan 12
(config-vlan)#name MYVLAN

Assigning Ports to VLANs

When statically assigning ports to VLANs, first make it an access port,
and then assign the port to a VLAN. At the interface configuration prompt:

(config-if)#switchport mode access
(config-if)#switchport access vlan 12

The commands are similar when using dynamic VLAN assignment. At
interface configuration mode:

(config-if)#switchport mode access
(config-if)#switchport access vlan dynamic

If you use dynamic, you must also enter the IP address of the VMPS
server at global configuration mode:

(config-if)#vmps server ip address

Verifying VLAN Configuration

To see a list of all the VLANs and the ports assigned to them, use the
command show vlan. To narrow down the information displayed, you
can use these keywords after the command: brief, id, vlan-number, or
name vlan-name:

ASW# show vlan brief
VLAN Name Status Ports
—— ———————————————— ————- ———————
————————
1 default active Fa0/1, Fa0/2, Fa0/3,
Fa0/10,Fa0/11,Fa0/12
20 VLAN0020 active Fa0/5,Fa0/6,Fa0/7
21 VLAN0021 active Fa0/8,Fa0/9
1002 fddi-default active
1003 trcrf-default active
1004 fddinet-default active
1005 trbrf-default active

September 29, 2010 4:46 pm