Networking-Blog

My WordPress Blog

Categories

Cisco Linux IPSEC VPN

Create hq additional vpn profile on the vm :

conn comms1
left=90.90.90.90
leftsubnet=192.168.0.0/16
rightid=@commshq.networks.ww
right=217.33.177.219
rightsubnet=172.16.30.0/24
authby=secret
ikelifetime=1h
keylife=24h
keyingtries=3
rekey=yes
auto=start
esp=3des-md5-96
pfs=yes

Create comms2 additional vpn profile on the vm :

conn comms2
left=90.90.90.90
leftsubnet=172.16.30.0/24
right=216.12.12.12
rightsubnet=192.168.49.0/24
type=tunnel
authby=secret
auth=esp
esp=3des-md5-96
ikelifetime=1h
keylife=24h
keyingtries=3
pfs=yes
rekey=yes
auto=start
dpdaction=restart
dpddelay=15
dpdtimeout=30

Added additional vpn on hq router :

ip access-list extended VPN
remark LAN_TO_LAN
permit ip 172.16.30.0 0.0.0.255 192.168.0.0 0.0.255.255

Added additional vpn on comms2 router :

ip access-list extended VPN
remark LAN_TO_LAN
permit ip 192.168.49.0 0.0.0.255 172.16.30.0 0.0.0.255

Added additional rule to VM on the FORWARD chain to allow traffic
from 192.168.0.0 to 172.16.30.0 :

sudo iptables -I FORWARD 7 -s 192.168.0.0/255.255.0.0 -d 172.16.30.0/255.255.255.0 -j ACCEPT
!
Added additional rule to VM on the FORWARD chain to allow traffic
from 172.16.30.0 to 192.168.0.0 :

sudo iptables -I FORWARD 7 -s 172.16.30.0/255.255.255.0 -d 192.168.0.0/255.255.0.0 -j ACCEPT

Cisco Routers, Linux
No comments yet.

Tags: , , ,

by admin

Cisco Traversing a NAT device

 

Using NAT Traversal

Network Address Translation (NAT) and Port Address Translation (PAT) are implemented in many networks where IPSec is also used, but the number of incompatibilities that prevent IPSec packets from successfully traversing a NAT device.

PIX Firewall Version 6.3 provides a feature called “Nat Traversal,” as described by Version 2 and Version 3 of the draft IETF standard, UDP Encapsulation of IPsec Packets,” which is available at the following URL:

http://www.ietf.org/html.charters/ipsec-charter.html

NAT Traversal allows ESP packets to pass through one or more NAT devices. This feature is disabled by default.

Note NAT Traversal is supported for both dynamic and static crypto maps.

To enable NAT traversal, enter the following command:

isakmp nat-traversal [natkeepalive]
isakmp nat-traversal 20

Valid values for natkeepalive are 10 to 3600 seconds; the default is 20 seconds.

 

Enabling IPsec over NAT-T

NAT-T lets IPsec peers establish a connection through a NAT device. It does this by encapsulating IPsec traffic in UDP datagrams, using port 4500, thereby providing NAT devices with port information. NAT-T auto-detects any NAT devices, and only encapsulates IPsec traffic when necessary. This feature is disabled by default.

• The security appliance can simultaneously support standard IPsec, IPsec over TCP, NAT-T, and IPsec over UDP, depending on the client with which it is exchanging data.

• When both NAT-T and IPsec over UDP are enabled, NAT-T takes precedence.
• When enabled, IPsec over TCP takes precedence over all other connection methods.
• When you enable NAT-T, the security appliance automatically opens port 4500 on all IPsec enabled interfaces.

The security appliance supports multiple IPsec peers behind a single NAT/PAT device operating in one of the following networks, but not both:

• LAN-to-LAN
• Remote access

In a mixed environment, the remote access tunnels fail the negotiation because all peers appear to be coming from the same public IP address, that of the NAT device. Also, remote access tunnels fail in a mixed environment because they often use the same name as the LAN-to-LAN tunnel group (that is, the IP address of the NAT device).
This match can cause negotiation failures among multiple peers in a mixed LAN-to-LAN and remote access network of peers behind the NAT device.

Cisco ASA, Cisco Routers
No comments yet.

Tags: , , ,

by admin

Cisco 857 Radius Eap Wireless Authentication

Extensible Authentication Protocol (EAP) Authentication Types 

802.1x Overview
 It is a port access protocol for protecting networks via authentication. As a result, this type of
authentication method is extremely useful in the Wi-Fi environment due to the nature of the
medium. If a Wi-Fi user is authenticated via 802.1x for network access, a virtual port is opened on
the access point allowing for communication. If not successfully authorized, a virtual port is not made
available and communications are blocked.

There are three basic pieces to 802.1x authentication:

  1. Supplicant – a software client running on the Wi-Fi workstation
  2. Authenticator – the Wi-Fi access point
  3. Authentication Server – a authentication database, usually a radius server such
    as Cisco* ACS*, Funk Steel-Belted RADIUS*, or Microsoft* IAS*

Extensible Authentication Protocol (EAP) is used to pass the authentication information
between the supplicant (the Wi-Fi workstation) and the authentication server
(Microsoft IAS or other). The actual authentication is defined and handled by the EAP type.
The access point acting as authenticator is only a proxy to allow the supplicant and the
authentication server to communicate.

aaa new-model
!
!
aaa group server radius wifieap
server 10.195.2.52 auth-port 1812 acct-port 1813
!
aaa authentication login default group tacacs+ local enable
aaa authentication login wifiaaa group wifieap local
aaa authorization exec default group tacacs+ local none
aaa authorization commands 0 default group tacacs+ local none
aaa authorization commands 1 default group tacacs+ local none
aaa authorization commands 15 default group tacacs+ local none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 0 default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
!
!
dot11 syslog
!
dot11 ssid GHG-Client-EAP
vlan 1
authentication open eap wifiaaa
authentication network-eap wifieap
authentication key-management wpa
guest-mode
!
bridge irb
!

interface Dot11Radio0
no ip address
!
encryption vlan 1 mode ciphers aes-ccm tkip

!
ssid GHG-Client-EAP
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
world-mode dot11d country GB outdoor
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no cdp enable
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
no ip address
bridge-group 1
bridge-group 1 spanning-disabled
!
interface BVI1
description LAN
ip address 192.168.1.0 255.255.255.0
!
ip radius source-interface BVI1
radius-server host 10.195.2.52 auth-port 1812 acct-port 1813 key 3Meq8LneR7t6
radius-server timeout 3
!
bridge 1 protocol ieee
bridge 1 route ip

Cisco Routers
No comments yet.

Tags: , , ,

by admin

Cisco QOS

The assured forwarding (AF) model is used to provide priority values to different data applications.

The Expedited Forwarding (EF) model is used to provide resources to latency (delay) sensitive real-time, interactive traffic.
The EF model uses one marking — DSCP 46. DSCP 46 is backward compatible with an IP Precedence value of 5 as seen in the following binary pattern:

101110 = DSCP 46

The EF marking of 46 does NOT follow the drop preference rules of the assured forwarding model. Please do NOT think that the 11 means high drop preference. The EF model is used for voice over IP media traffic (RTP) by default in most vendors phones. Cisco IP Phones mark signaling packets (SCCP or SIP) to CS3 (24), while media (RTP) is marked to EF (DSCP 46) by default. All EF traffic is normally mapped to the priority queue (PQ) on Cisco switches and routers. The priority queue guarantees three critical services:

• Packet Loss
• Delay
• Jitter (delay variation)

The three most significant bits of 101 are only considered if IP Precedence was being used.

The Assured Forwarding (AF) PHB group provides delivery of IP packets in four
independently forwarded AF classes.
Within each AF class, an IP packet can be assigned one of three different
levels of drop precedence.

There are four classes defined in the Assured Forwarding model.

They are as follows:

Class 1 = 001
Class 2 = 010
Class 3 = 011
Class 4 = 100

Each class has three drop preferences (low, medium, and high).
The drop preferences are indicated by the next two bits of the
DSCP value in the ToS byte.

00 = No drop preference (class selector or user defined)
01 = Low Drop Preference
10 = Medium Drop Preference
11 = High Drop Preference

In case of congestion, the drop precedence of a packet determines the relative
importance of the packet within the AF class.
A congested DS node tries to protect packets with a lower drop precedence
value from being lost by preferably discarding packets with a higher drop
precedence value.

Expedited Forwarding (EF) PHB: “The EF PHB can be used to build a low loss, low latency, low jitter, assured bandwidth, end-to-end service through DS (Diffserv) domains. Such a service appears to the endpoints like a point-to- point connection or a “virtual leased line.” This service has also been described as Premium service.” Codepoint 101110 is recommended for the EF PHB, which corresponds to a DSCP value of 46.

(config-cmap)# match ip dscp ?
<0-63>   Differentiated services codepoint value
af11     Match packets with AF11 dscp (001010)
af12     Match packets with AF12 dscp (001100)
af13     Match packets with AF13 dscp (001110)
af21     Match packets with AF21 dscp (010010)
af22     Match packets with AF22 dscp (010100)
af23     Match packets with AF23 dscp (010110)
af31     Match packets with AF31 dscp (011010)
af32     Match packets with AF32 dscp (011100)
af33     Match packets with AF33 dscp (011110)
af41     Match packets with AF41 dscp (100010)
af42     Match packets with AF42 dscp (100100)
af43     Match packets with AF43 dscp (100110)
cs1      Match packets with CS1(precedence 1) dscp (001000)
cs2      Match packets with CS2(precedence 2) dscp (010000)
cs3      Match packets with CS3(precedence 3) dscp (011000)
cs4      Match packets with CS4(precedence 4) dscp (100000)
cs5      Match packets with CS5(precedence 5) dscp (101000)
cs6      Match packets with CS6(precedence 6) dscp (110000)
cs7      Match packets with CS7(precedence 7) dscp (111000)
default  Match packets with default dscp (000000)
ef       Match packets with EF dscp (101110)

Each DSCP is represented by its AF value, its value in decimal,
and its value in binary. Assured Forwarding Codepoints

Class 1

Low-Drop Precedence
AF11 = 10 (001010)

Medium-Drop Precedence
AF12 = 12 (001100)

High-Drop Precedence
AF13 = 14 (001110)

Class 2

Low-Drop Precedence
AF21 = 18 (010010)

Medium-Drop Precedence
AF22 = 20 (010100)

High-Drop Precedence
AF23 = 22 (010110)

Class 3

Low-Drop Precedence
AF31 = 26 (011010)

Medium-Drop Precedence
AF32 = 28 (011100)

High-Drop Precedence
AF33 = 30 (011110)

Class 4

Low-Drop Precedence
AF41 = 34 (100010)

Medium-Drop Precedence
AF42 = 36 (100100)

High-Drop Precedence
AF43 = 38 (100110)

Any Diffserv-aware system can use the AF codepoint as a guide for providing
differentiated forwarding behaviors to different classes of traffic.

When these packets reach a Diffserv router, the router evaluates the packets’
codepoints along with DSCPs of other traffic in the queue. The router then
forwards or drops packets, depending on the available bandwidth and the
priorities that are assigned by the packets’ DSCPs.

Note that packets that are marked with the EF PHB are guaranteed bandwidth over
packets that are marked with the various AF PHBs.

Cisco Routers
No comments yet.

Tags:

by admin

Cisco 877w Wireless 2 Vlans

dot11 ssid COMMS-GUEST
vlan 2
authentication open
authentication key-management wpa
guest-mode
mbssid guest-mode
wpa-psk ascii 7 00564302545F0F1528341F1B1D4855
!
dot11 ssid COMMS-WIFI
vlan 1
authentication open
mbssid guest-mode
!
bridge irb
!
encryption vlan 1 key 1 size 128bit 7 B4FC3CB4C9F77341AC86BD5936B9 transmit-key
encryption vlan 1 mode wep mandatory
!
encryption vlan 2 mode ciphers tkip
!
ssid COMMS-GUEST
!
ssid COMMS-WIFI
!
mbssid
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
station-role root
world-mode dot11d country GB outdoor
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.2
encapsulation dot1Q 2
no cdp enable
bridge-group 2
bridge-group 2 subscriber-loop-control
bridge-group 2 spanning-disabled
bridge-group 2 block-unknown-source
no bridge-group 2 source-learning
no bridge-group 2 unicast-flooding
!
interface Vlan1
no ip address
bridge-group 1
bridge-group 1 spanning-disabled
!
interface Vlan2
no ip address
bridge-group 2
bridge-group 2 spanning-disabled
!
interface BVI1
description LAN
ip address 1.1.1.1 255.255.255.0
ip inspect myfw in
ip nat inside
ip virtual-reassembly
!
interface BVI2
description GUESTLAN
ip address 2.2.2.2 255.255.255.0
ip inspect myfw in
ip nat inside
ip virtual-reassembly
!
bridge 1 protocol ieee
bridge 1 route ip
bridge 2 protocol ieee
bridge 2 route ip

Cisco Routers
No comments yet.

Tags: , ,

by admin

Cisco Upgrade Rommon Image

Upgrading the ROMMON Image from ROMMON Mode

Complete these steps to upgrade the ROMMON image from ROMMON mode.

Step 1 Download the ROMMON image C820_RM_ALT.srec.122-4r.XM2 from CCO, and place it on your TFTP server.

Step 2 Place the router in ROMMON mode by sending a telnet break command during the router reboot sequence. The following prompt will be displayed, indicating entry into ROMMON mode:

rommon>

Step 3 In ROMMON mode, set the following parameters by typing the names followed by an equals sign as shown, and then typing a value for the parameter.

IP_ADDRESS=

IP_SUBNET_MASK=

DEFAULT_GATEWAY=

TFTP_SERVER=

TFTP_FILE=

Table 1 describes the type of value to provide for each parameter.

Parameter Value
IP_ADDRESS= IP address of the router
IP_SUBNET_MASK= Subnet mask of the router
DEFAULT_GATEWAY= IP address of the router’s default gateway
TFTP_SERVER= IP address of the TFTP server on which the ROMMON image is located
TFTP_FILE= The path and filename of the ROMMON image

Step 4 Verify the parameter settings by entering the set command. Correct any mistakes by reentering the parameter and value.

rommon>set

TFTP_CHECKSUM=0

IP_SUBNET_MASK=255.255.255.0

DEFAULT_GATEWAY=1.6.0.1

TFTP_SERVER=223.255.254.254

IP_ADDRESS=1.6.97.20

TFTP_FILE=C820_RM_ALT.srec.122-4r.XM2

Step 5 Upgrade the ROMMON image by entering the tftpdnld -u command. Sample output is shown below.

rommon>tftpdnld -u

IP_ADDRESS: 1.6.97.20

IP_SUBNET_MASK: 255.255.255.0

DEFAULT_GATEWAY: 1.6.0.1

TFTP_SERVER: 223.255.254.254

TFTP_FILE: C820_RM_ALT.srec.122-4r.XM2

WARNING: alternate copy of rommon exists, filename: C820_RM_ALT.srec all existing data in
the alternate copy of rommon will be lost.

Do you wish to continue? y/n:  [n]:

Step 6 Enter y to start the download. A series of exclamation points (!!!!!!) indicates that the image is downloading successfully. The router will reboot when the download is complete.

Note You may need to reset the router while in ROMMON mode by entering the reset command before entering the tftpdnld command. The router will prompt you to do this if needed. If prompted to reset the router, you must reset the router and then follow Step 2 through Step 6 to update the ROMMON image.

Updating the ROMMON Image in IOS EXEC Mode

Complete these steps to upgrade the ROMMON image from IOS EXEC mode.

Step 1 Download the ROMMON image C820_RM_ALT.srec.122-4r.XM2 from CCO and place it on your TFTP server.

Step 2 In IOS EXEC mode, save the current configuration by entering the command copy running-config startup-config.

Step 3 Enter copy tftp: rommon:, and answer the prompts as shown in the following example:

820-2#copy tftp: rommon:

Address or name of remote host []? 223.255.254.253

Source filename []? C820_RM_ALT.srec.122-4r.XM2

Destination filename [C820_RM_ALT.srec.122-4r.XM2]?

Loading C820_RM_ALT.srec.122-4r.XM2 from 223.255.254.253 (via Ethernet0): !

WARNING…

Do not attempt ROMMON upgrades unless you know what you are doing.

Writing to ROMMON must note be interrupted.

Do not reset the router during this operation.

Do what you can to ensure power to the router is not interrupted.

The router will reload after ROMMON upgrade is successfully completed.

Do you want to continue?[confirm]

Press Enter to continue. The router will begin downloading the ROMMON image. Successful download is indicated by a series of exclamation marks (!!!!!!). The router will automatically reboot.

Cisco Routers
No comments yet.

Tags: , ,

by admin

Cisco Password Recovery

There are times when you need to recover Cisco Router password.
This tutorial shows how to do it in few simple and detailed steps .

Depending on the router model, the configuration might be slightly different,
but the concept remains same (check Summarized Steps)

Although it is possible to bypass router password feature, but it is not possible to recover encrypted
passwords. Plain text passwords can be viewed from saved configuration but the encrypted passwords
must be changed to a new password

Summarized Steps

  1. Connect to router console port using terminal or PC using terminal emulation with appropriate settings.
  2. (Optional) Find configuration register
  3. Enter ROMMON mode
  4. Change the configuration register
  5. Recover or change passwords
  6. Change back the configuration register

Connect to Router

Attach a PC with terminal emulation to the console port of the router using the following settings

  • 9600 baud rate
  • No parity
  • 8 data bits
  • 1 stop bit
  • No flow control

Make sure to use rollover cable for connection

(Optional) Find configuration register

Use the following command to check configuration register.

Router>show version
...
DRAM configuration is 64 bits wide with parity enabled.
55K bytes of NVRAM.
16384K bytes of ATA System CompactFlash (Read/Write)

Configuration register is 0x2102

Router>

Configuration register is at the end of the output.

Entering ROMMON mode

Power cycle the router. Turn it off using power switch and turn the router back on.
Within 60 seconds press Break in terminal to enter ROMMON mode
Note : The break sequence is different in every terminal emulation software (usually it is Ctrl+Break),
check the documentation for details.

Here are the few common standard break key combination

Hyperterminal : Ctrl + Break
Putty : Ctrl + Break
Telnet : Ctrl + ], then type “send brk”

Configuration Register

By default the configuration register is set to 0×2102. In order to bypass the router password,
the configuration register has to be changed to 0×2142.
Under ROMMON mode enter the following command

rommon 1>confreg 0x2142
rommon 2>reset

reset command will reboot the router

Recovering passwords

When the router reboots, it will not prompt for password because of the configuration register.
The router will be loaded from flash, so the configuration (NVRAM) will be blank.
Important : Do not type “copy running-config startup-config”. This will overwrite the startup config with
blank configuration file.

Copy the configuration to the running-config

Router#copy startup-config running-config

Thats it. Now all you have to do is reassign the password if it is encrypted, or recover from running-config
if it is unencrypted.

Revert Configuration Register

After everything is done, set the configuration register back to 0×2102 (or whatever value was at the beginning
of password recovery process)

Router(config)#config-register 0x2102

Save the configuration file to commit all the changes.

Extra Reading : Disable Password Recovery

Cisco Routers
No comments yet.

Tags: ,

by admin

Cisco IOS Recovery

Set PC ip_ddress:

pc: ip address : 192.168.0.2
subnet mask: 255.255.255.0
default gateway: 192.168.0.1

And then Power on the router:

hit Ctrl + Break key together. And the router will appear:

rommon 1>
Then type the following commands:

format              Format a filesystem-format <filesystem>

format flash:

IP_ADDRESS=192.168.0.1
IP_SUBNET_MASK=255.255.255.0
DEFAULT_GATEWAY=192.168.0.1
TFTP_SERVER=192.168.0.2
TFTP_FILE=c850-advsecurityk9-mz.124-6.T5.bin
TFTP_CHECKSUM=1

rommon1 >tftpdnld
When you see “!!!!!!!!!!!!!!!!!!!” running, you’re successful and wait some minutes until progress finish.

fsck                Check filesystem consistency-fsck <filesystem>

fsck flash:

If you have the output of a show stacks or show tech-support command from your Cisco device, you can use
the Output Interpreter to display potential issues and fixes.

dir flash:

set = display the monitor variables

rommon 16 > set
PS1=rommon ! >
TFTP_TIMEOUT=800000
FE_SPEED_MODE=4
TFTP_RETRY_COUNT=20
BSI=0
RANDOM_NUM=1540763391
CRASHINFO=flash:crashinfo_20020301-000015
ROM_PERSISTENT_UTC=1014940815
RET_2_RTS=
RET_2_RCALTS=
%

Cisco Routers
No comments yet.

Tags: , , ,

by admin

Cisco QOS VOIP

class-map match-any VOIPTraffic
match access-group name VOIPTraffic
!
class-map match-any ExpeditedForwarding
match  dscp ef
!
policy-map WAN_Outbound
class ExpeditedForwarding
priority 400
class class-default
fair-queue
random-detect
!
policy-map LAN_Inbound
class VOIPTraffic
set dscp ef
!
ip access-list extended VOIPTraffic
permit ip host 10.10.11.2 any



Cisco Routers
No comments yet.

Tags: ,

by admin