Network Labs: Cisco

Showing posts with label Cisco. Show all posts

Automation of switch configuration

Configuring access switches in an enterprise may involve deploying a bunch of identical settings to a load of devices, this kind of work is time consuming and not to say BORING AS HELL!

In case you are working with Cisco or Juniper as the vendor of the devices there is a way of deploying the configuration automatically by using a DHCP+TFTP server.

The process is very simple, at their default configuration a switch will try to receive an IP via DHCP at this moment we can use DHCP in order to point it to the tftp server with a predefined configuration file, after getting this file the device will load it automatically

I'll start with Cisco being the simplest, in case you have a Cisco router and a Cisco switch you can use the router as both the DHCP and the TFTP server, to do so:

P2P interface facing the switch, all we need here is an IP

Interface GigabitEthernet x/y
Ip address x.x.x.1 255.255.255.0

DCHP scope

ip dhcp pool <SCOPE NAME>
   network x.x.x.0 255.255.255.0
   bootfile network-confg
   option 150 ip x.x.x.1

Enable TFTP server function of the router (don’t forget to put the file in the local flash of the Router)

tftp-server flash: network-confg

In case there is no Router, the Router doesn't support the TFTP-Server function or you just have a dedicated servers you want to use

All you need is to use all you need is to is to configure the pool with option 150 pointing to the TFTP server and put a config file on the TFTP root folder.

Note that Cisco will first load a file with one of the following names: network-confg\ router-confg\ ciscortr.cfg \ cisconet.cfg
I suggest including "no service config" in the base configuration file, otherwise as the configuration is loaded the device will try to load a new file with its' new host-name every time it renews the DHCP lease.

Now let's move to another vendor – Juniper, in this case it's a bit more complicated as we need a couple more DHCP options.

In Juniper's case the process is very similar, with the difference that the switch includes a software upgrade as part of the process so we need more free space on the tftp server, for this example I used Red Hat Linux for both the DHCP and the TFTP, here is the configuration the DHCP side, first of all DHCPD has to be ISC 4 and above.

Edit /etc/dhcp/dhcpd.conf

Under "# Define Custom Options"

Configure new option group, in my case named Juniper

option space JUNIPER; #option;

configure all the suboptions to be "text" type

option JUNIPER.config-file-name code 1 = text;

option JUNIPER.image-file-type code 2 = text;

option JUNIPER.transfer-mode code 3 = text;

option JUNIPER.image-file-name code 00= text;

option JUNIPER.alt-image-file-name code 4= text;

add options 43 and 150 to the group

option JUNIPER -encapsulation code 43 = encapsulate JUNIPER;

option option-150 code 150 = ip-address;

*Note the type of option 150 is IP.

After we configured the group we can use it in the scope itself, in the same file add the scope configuration

subnet x.x.x.0 netmask 255.255.255.0

option routers <Default Gateway IP>;

option host-name "default";

host-name option will change the hostname of the switch, note that the switch will only load the configuration file with the name of its hostname.

option subnet-mask 255.255.255.0;

option domain-search "networklabs.info";

option domain-name-servers <DNS SERVER IP>;

option ntp-servers <NTP SERVER IP>;

option option-150 <TFTP SERVER IP>;

option tftp-server-name "<TFTP SERVER IP/HOSTNAME>";

option JUNIPER.image-file-name "/<NEW JUNOS VERSION FOR THE SWITCH TO LOAD>";

option JUNIPER.config-file-name "/<CONFIG FILE, MUST BE HOST-NAME.config>";

Image type is the Vendor requirement.

option JUNIPER.image-file-type "symlink";

The transfer more can be http/ftp/tftp/sftp but must be defined.

option JUNIPER.transfer-mode "tftp";

option JUNIPER.alt-image-file-name "/<NEW JUNOS VERSION FOR THE SWITCH TO LOAD ON THE ALTERNATE SLICE, RECOMMENDED TO BE IDENTICAL>"

Define the range of IP's for the DHCP server.

range x.x.x.100 x.x.x.150;

}

In FTP transfer mode request will be made via anonymous user.

Big thanks to Omer Shtivi for the resources and help with implementation.

Hope this post was helpful, If it was please consider a donation

BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N

Cisco Line Menu

Hi all,

Here is a nice feature you can use on a Cisco device to make the usage easier in case of a console server or just for limiting access for an experienced user - We can create a menu with pre-configured commands \ actions.

Here is an example for I used for a terminal access server

Configure aliases for the host which we'll connect to

ip host <Device-Name> <Connection-Port> <Device-IP>
ip host R2 23 1.1.1.2
ip host R3 23 1.1.1.3

Create a banner for the menu

menu Menu-1 title ^
**********************************************************
You have reached NetworkLabs-R1
Please use the menu bellow

**********************************************************
^

And now we create the menu

menu Menu-1 prompt ^C Your selection : ^C
menu Menu-1 text 1 Connect to R2 - 23
menu Menu-1 text s show active sessions
menu Menu-1 text e exit the menu
menu Menu-1 text q close the connection
menu Menu-1 command 1 resume R2 /connect telnet R2
menu Menu-1 command s show sessions
menu Menu-1 command e menu-exit
menu Menu-1 command q exit

First we configured the prompt for the command selection, then the text for "1,s,e,q' then the commands that will be issued according to the selection.

Suggest to add the following for the menu to clear the screen and allow only and loop back to the prompt after each selection

menu Menu-1 clear-screen
menu Menu-1 line-mode

At this point the menu can be activated by running "menu Menu-1" from the command line.

you may want to add the menu to be activated automatically on VTY login by adding

line vty 0 4
autocommand menu Menu-1

Hope this post was helpful, If it was please consider a donation:

BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N

LTC Address: LUqrKbzGihTU2GEnL3EwsuuLHCsxCJMdtR

Cisco MacSec over Juniper\Cisco MPLS

I would like to share a case I had involving MacSec over a layer 3 link.

The equipment was: 2 Cisco Switches (3750X), Cisco 2821 Router, Juniper J4350 Router.

Objective: establish MacSec between the Switches.

First of all MacSec will not work on layer 3, to make it work we need to emulate layer 1 between the switches, I did this VIA MPLS (Ethernet over MPLS).

OSPF configuration :

Router-1 (Juniper)

# Set interfaces ge-0/0/1 unit 0 family inet address 10.10.10.1/30
# Set interfaces lo0 unit 0 family inet address 1.1.1.1/32
# Set protocols ospf area 0.0.0.0 interface ge-0/0/1
# Set protocols ospf area 0.0.0.0 interface lo0

Router-2 (Cisco)

interface FastEthernet0/0
ip address 10.10.10.2 255.255.255.252
!
interface Loopback1
ip address 2.2.2.2 255.255.255.255
!
router ospf 10
log-adjacency-changes
network 2.2.2.2 0.0.0.0 area 0
network 10.10.10.0 0.0.0.3 area 0

At this point we should see the OSPF neighboring is up and the loopbacks are known to both routers

MPLS configuration :

Router-1

# set interfaces ge-0/0/1 unit 0 family mpls
# set interfaces ge-0/0/2 encapsulation ethernet-ccc;
# set interfaces ge-0/0/2 unit 0 family ccc;
# set protocols mpls interface all
# set protocols ldp interface ge-0/0/1
# set protocols ldp interface lo0
# set protocols l2circuit neighbor 2.2.2.2 interface ge-0/0/2.0 virtual-circuit-id 10

Router-2

mpls ldp router-id Loopback1 force
interface FastEthernet0/0
mpls ip
interface FastEthernet0/1
xconnect 1.1.1.1 10 encapsulation mpls

Now we should see the MPLS is also up, both the LDP and the virtual circuit
In case the VC is not up try to change the circuit number..

Finally the MacSec itself..

From Both Switches

interface GigabitEthernet2/0/1
switchport trunk encapsulation dot1q
switchport mode trunk
cts manual
no propagate sgt
sap pmk [MacSec Key] mode-list gcm-encrypt null no-encap

Let's test..!

Switch-1#show macsec summary
Interface Transmit SC Receive SC
GigabitEthernet2/0/1 1 1

For more info:

Switch-2#show macsec interface gigabitEthernet 1/0/1
MACsec is enabled
Replay protect : enabled
Replay window : 0
Include SCI : yes
Cipher : GCM-AES-128
Confidentiality Offset : 0
Capabilities
Max. Rx SA : 16
Max. Tx SA : 16
Validate Frames : strict
PN threshold notification support : Yes
Ciphers supported : GCM-AES-128
Transmit Secure Channels
SCI : 503DE58713810000
Elapsed time : 03:58:49
Current AN: 1 Previous AN: -
SC Statistics
Auth-only (0 / 0)
Encrypt (30755 / 0)
Receive Secure Channels
SCI : C89C1D66EF010000
Elapsed time : 03:58:49
Current AN: 1 Previous AN: -
SC Statistics
Notvalid pkts 0 Invalid pkts 0
Valid pkts 3044 Late pkts 0
Uncheck pkts 0 Delay pkts 0
Port Statistics
Ingress untag pkts 0 Ingress notag pkts 1852
Ingress badtag pkts 0 Ingress unknownSCI pkts 0
Ingress noSCI pkts 0 Unused pkts 0
Notusing pkts 0 Decrypt bytes 6953955
Ingress miss pkts 1852

Hope this post was helpful, If it was please consider a donation:
BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N
LTC Address: LUqrKbzGihTU2GEnL3EwsuuLHCsxCJMdtR

Cisco Catalyst 3560 - IPv6

A quick tip on IPv6 support in a Cisco 3560 Switch, unlike other devices (such as the 3750) the default configuration of the 3560 switch has all IPv6 functionality disabled,
In order to enable the IPv6 on this Catalyst all we need to do is apply the correct template on the device
this can be achieved by running the following command from Global config mode

sdm preferdual-ipv4-and-ipv6 {default |routing | vlan}

After we apply the template the device needs to be rebooted, take into consideration the boot will take about 8-10 minutes...

to read more about this - Visit Cisco's article on the matter: http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/12.2_53_se/configuration/guide/swipv6.html#wp1059828

Hope this post was helpful, If it was please consider a donation:
BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N
LTC Address: LUqrKbzGihTU2GEnL3EwsuuLHCsxCJMdtR

Cisco Site to Site + Remote Access VPN

There are some small office brunches needing both remote access to the office itself,
The remote access clients, like configured HERE and a permanent connection to another SITE (to the HQ for example).
Here is a quick guide for configuring multiple VPN types on a Cisco Router.

In this case I have configured a tunnel to a Fortinet FW (1.1.1.1),
For the authentication I used 3DES and SHA1 for the hashing.
Cisco Lan 10.100.100.0/24, Forti Lan 192.168.0.0/24

Here is my configuration:

Set a password for the tunnel ( may use a certificate instead )

crypto keyring Site-Key
pre-shared-key address 1.1.1.1 key 0 Cisco2Forti

Configure VPN Phase 1 Policy

crypto isakmp policy 1
encr 3des
hash sha
authentication pre-share
group 2
lifetime 28800

crypto isakmp profile Site-PH1
keyring Site-Key
match identity address 1.1.1.1 255.255.255.255

Configure VPN Phase 2

crypto ipsec transform-set Site_Set esp-3des esp-sha-hmac

Set Split-tunnel - what will be routed through

IP access-list Extended Site_ACL
permit ip 10.100.100.0 0.0.0.255 192.168.0.0 0.0.0.255

combine all the Settings to a VPN Tunnel :

crypto map clientmap 10 ipsec-isakmp
set peer 1.1.1.1
set transform-set Site_Set
set isakmp-profile Site-PH1
match address Site_ACL

Almost same thing for the Client access

crypto isakmp policy 2
encr 3des
authentication pre-share
group 2

crypto isakmp client configuration group Client-Access
key Client2Site
pool ippool
acl Client_ACL

crypto isakmp profile Client
match identity group alicenet
client authentication list auth
isakmp authorization list auth
client configuration address respond

crypto ipsec transform-set Client_Set esp-3des esp-sha-hmac

crypto dynamic-map dynmap 10
set transform-set Client_Set
set isakmp-profile Client

IP access-list Extended Client_ACL
permit ip 10.100.100.0 0.0.0.255 172.16.0.0 0.0.0.3

crypto map clientmap 100 ipsec-isakmp dynamic dynmap

Client to site VPN will also require configuring an ip pool - Basically DHCP for VPN

ip local pool ippool 172.16.0.0 172.16.0.3

For both of them to work we need to enable the Crypto (VPN) on the external interface,
in my case FastEthernet4

interface FastEthernet4
ip address 2.2.2.2 255.255.255.255
crypto map clientmap

And one last thing, in case there is NAT enabled – make sure to disable the NAT in the VPN
for example:

ip access-list extended NAT
deny ip 10.100.100.0 0.0.0.255 172.16.0.0 0.0.0.3
deny ip 10.100.100.0 0.0.0.255 192.168.0.0 0.0.0.255
permit ip 10.100.100.0 0.0.0.255 any

Hope this post was helpful, If it was please consider a donation:
BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N
LTC Address: LUqrKbzGihTU2GEnL3EwsuuLHCsxCJMdtR

Cisco ASA Device Manager

Hi all,

working with a Cisco firewall (PIX / ASA) we can get lost in the CLI to make our job a bit easyer we can use the GUI management tool provided by Cisco - the ASDM.

enabling this is very simple, two steps
First enable the feature and configure the port on witch the Cisco will listen to requests
http server enable 4430
In my case i wanted to use port 4430

allow access for the end Host / Network
http 10.10.10.0 255.255.255.0 inside
so basically i allow all host's coming from 10.10.10.0/24 to access the ASDM (as long as they arrive via interface 'inside' ).

Hope this post was helpful, If it was please consider a donation:
BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N

LTC Address: LUqrKbzGihTU2GEnL3EwsuuLHCsxCJMdtR

LAB - Recursive Routing

I would like to share an interesting case I encountered, I had a network that looks something like this :

From the bottom up, a switch with the LAN hosts connected to a Firewall. The firewall is connected to 2 router's each with its own WAN access ( with 2 different ISP's).

For the routing there is eBGP from each routers to his ISP and iBGP between the firewall to the routers (there is no peer between the routers themselves).

I will post the configuration from a simulation I did to illustrate this using Cisco routers:

FW:

interface FastEthernet0/0
description To Router-1 ip address 192.168.12.1 255.255.255.0!interface FastEthernet0/0description To Router-2 ip address 192.168.12.1 255.255.255.0!router bgp 1 no synchronization bgp log-neighbor-changes neighbor 192.168.12.2 remote-as 1 neighbor 192.168.13.3 remote-as 1 no auto-summary

Router-1

interface FastEthernet0/0 description To FW ip address 192.168.12.2 255.255.255.0!interface FastEthernet0/1 description To ISP-1 ip address 172.24.24.2 255.255.255.0!router bgp 1 no synchronization bgp log-neighbor-changes neighbor 172.24.24.4 remote-as 2 neighbor 192.168.12.1 remote-as 1 no auto-summary

basically same thing on Router-2.

From the FW :

Gateway of last resort is 192.167.24.4 to network 0.0.0.0

C 192.168.13.0/24 is directly connected, FastEthernet0/1C 192.168.12.0/24 is directly connected, FastEthernet0/0B 192.167.24.0/24 [200/0] via 192.167.24.4, 00:00:48B* 0.0.0.0/0 [200/0] via 192.167.24.4, 00:00:48

The issue occurred After a hardware failure one of the router's went down, as a result the firewall lost the wan access.

While debugging the issue found there is no default route on the firewall routing table, but there is one in its BGP table, the route being learned by the BGP was pointing to the IP of ISP2 (the one still up), later discovered there is no route for this destination as well.

The reason for this was very basic, we had a BGP peer that taught us both the default route and the path to the network in which it resides.

There was a few methods of solving this issue, adding "next-hop-self" to the neighbor settings of firewalls pear in the router.
Advertising the P2P network originating from the local router "redistribute connected" or just "network 172.24.24.0 mask 255.255.255.0" in the "router bgp 1"

And also there is a workaround solution – in the FW create a static route for network 172.24.24.0, "ip route 172.24.24.0 255.255.255.0 FastEthernet0/0 192.168.12.2"

Hope this post was helpful, If it was please consider a donation:
BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N

LTC Address: LUqrKbzGihTU2GEnL3EwsuuLHCsxCJMdtR

Cisco As a DNS server

A nice way to save some money on additional servers, there is a nice way to use a Cisco as a DNS server
it can be a good way to allow URL filtering for HTTPS or just remove some of the load of the local Server,
this achieved by running the following commands on the device :

(config)#ip domain-lookup
(config)#ip name-server 8.8.8.8
(config)#ip dns server

Domain-lookup will allow the Cisco to resolve domains,
Name server is to define the DNS to query for unknown host
IP DNS server allows answering queries

At this state any DNS request will be forwarded to 8.8.8.8 and the Cisco will act as the "middle man" between the client and the DNS.

Now let's add local records

(config)#ip host DOMAIN.COM 173.194.34.101
(config)#ip host DOMAIN.COM MX 1 ASPMX.L.GOOGLE.COM

This creates an A Record for DOMAIN.COM as 173.194.34.101
And MX record with priority of '1' to ASPMX.L.GOOGLE.COM

Any request for a sub-domain to DOMAIN.COM will be forwarded to 8.8.8.8

like i wrote before using that method we can implement URL-Filtering, to do so just block all DNS requests intended to any destination other than the Cisco and create a record for the URL you intend to block.

lets say you want to block interface FastEthernet 0/0 from accessing Facebook, it will look like this

access list to block all dns queries

ip access-list extended Block_DNS
10 permit udp 192.168.0.0 0.0.0.255 host 192.168.0.254 eq domain
20 deny udp 192.168.0.0 0.0.0.255 any eq domain
30 permit ip any any

put the ACL on the interface

interface FastEthernet 0/0
ip address 192.168.0.254 255.255.255.0
ip access-group Block_DNS in

and send Facebook to 0.0.0.0

ip host facebook.com 0.0.0.0
ip host www.facebook.com 0.0.0.0

all done.

Hope this post was helpful, If it was please consider a donation:
BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N
LTC Address: LUqrKbzGihTU2GEnL3EwsuuLHCsxCJMdtR

Cisco \ Fortigate Policy based routing

we sometimes encounter a situations when simple routing is not enough,

for instance we have several gateways and we need to load-balance between them based on the source/destination IP port or protocol.

Needless to say that can be achieved best by using a dedicated load-balancer device, but let's say we don’t have one ( and not eager to parches ).

In my opinion the simplest way of achieving this is PBR ( policy based routing), the concept is pretty basic – when a packet matches the condition I provide pass it to the gateway I provide ( off course pass can be replaced with other options).

In the Cisco world it's a route-map, for example:

route-map PBR permit 10
match ip address ACL1
set ip next-hop 1.1.1.1
route-map PBR permit 20

If we get a packet that matches access-list "ACL1" pass it to the ip 1.1.1.1, all other traffic passed according to the routing table (there is no match statement so anything is being matched, and no set basically so nothing is being performed).

In case of a Fortinet firewall, its Policy Route:

CLI version:

config router policy
    edit 1
        set input-device "port4"
        set src 172.18.0.0 255.255.0.0
        set dst 192.168.3.0 255.255.255.0
        set protocol 6
        set start-port 443
        set end-port 443
        set gateway 1.1.1.1
        set output-device "port3"
    next
end

or gui version:

In both cases packet with the source "172.18.0.0 255.255.0.0" and destination "192.168.3.0 255.255.255.0" TCP (protocol 6) port 443 pass it to interface "Port3" with 1.1.1.1 as the next-hop.

Hope this post was helpful, If it was please consider a donation:
BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N
LTC Address: LUqrKbzGihTU2GEnL3EwsuuLHCsxCJMdtR

Cisco: Route-maps

One of the main purposes of a route-map in a Cisco router is customize traffic management beyond the boundaries of the routing table, For example create load balancing, or in a different field, applying TAG's on a routes learned by a routing protocol
the structure of the route-map is very simple, it’s a set of rules, each rule has two fields, match and set.

For example a route-map used for policy based routing :

Router (config)# route-map TEST permit 10
Router (config-route-map)# match ip address 100
Router (config-route-map)# set ip next-hop 1.1.1.1
Router (config)# route-map TEST permit 20
Router (config-route-map)# match ip address 200
Router (config-route-map)# set ip next-hop 1.1.1.2

In this example I created a route-map named TEST, in case we have a match on access-list "100" change the next-hop to 1.1.1.1
In case we don’t, moving to rule 20, and there in case we have a match on access-list "200" change the next-hop to 1.1.1.2

In this example we can apply the route-map on the LAN interface, and set part of the network to pass through one line and another part through a different one,
This can be done by anything in the ACL, source or destination IP, Protocol, or port.
To make it more clear the ACL and applying the route-map:

Router (config)#access-list 100 permit ip host 192.168.0.50 any
Router (config)#access-list 100 permit gre any any
Router (config)#access-list 100 permit udp any any eq isakmp
Router (config)# interface FastEthernet 0/0
Router (config-if)#ip policy route-map

In other words, access-list 100 will match all packets with the one of the following criteria source of 192.168.0.50, GRE protocol, or ISAKMP (UDP port 500)
And I applied the route-map on the LAN interface, FastEthernet 0/0

Another example of using a route-map is applying custom settings to routes learned (or advertised ) by a routing protocol

for example:

Router (config)# route-map BGP-IN permit 10
Router (config-route-map)# match ip address 100
Router (config-route-map)# set tag 10
Router (config)# route-map BGP-IN permit 20
Router (config-route-map)# set tag 20
Router (config)#router bgp 1
Router (config-router)# neighbor 2.2.2.2 remote-as 2
Router (config-router)# neighbor 2.2.2.2 route-map BGP-IN in

In this example I used a route-map and applied it on a BGP peer 2.2.2.2 (on the incoming routes) ,
the first rule applies tag '10' to any route matched in ACL 100 and tag '20' to any other ( notice that if no match statement is configured the route-map will match everything)

this should cover basic route-map configuration

Hope this post was helpful, If it was please consider a donation:
BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N

LTC Address: LUqrKbzGihTU2GEnL3EwsuuLHCsxCJMdtR

Cisco L2TP Dial-in

To continue my previous post, another major way of connecting to the internet is L2TP/PPTP VPN,

The option of the PPTP I already covered in one of the previous post's (PPTP VPN to a Cisco router)

Now for the L2TP – to demonstrate this I used GNS3 with the same topology as the previous post,

*To download the ready GNS3 topology click here

On Server side :

Enable VPDN and configure a group

Server(config)#vpdn enable
Server(config)#vpdn-group L2TP
Server(config-vpdn)# no l2tp tunnel authentication
Server(config-vpdn)# lcp renegotiation always
Server(config-vpdn)# accept-dialin
Server(config-vpdn-acc-in)# protocol l2tp
Server(config-vpdn-acc-in)# virtual-template 1

The pool of IP's for the client

Server(config)#ip local pool MyPool 1.1.1.1 1.1.1.10

Create a user for the authentication

Server(config)# username test password 0 qwe123

Configure the template

Server(config)#interface Virtual-Template1
Server(config-if)# ip unnumbered FastEthernet0/0
Server(config-if)# peer default ip address pool MyPool
Server(config-if)# ppp authentication pap callin
Server(config-if)# ppp mtu adaptive

Configure phase 1

Server(config)#crypto isakmp policy 5
Server(config-isakmp)# encr 3des
Server(config-isakmp)# authentication pre-share
Server(config-isakmp)# group 2

Configure phase 2

Server(config)#crypto ipsec transform-set MySet esp-3des esp-sha-hmac

Advanced tunnel settings

Server(config)#crypto dynamic-map MyMap 10
Server(config-crypto-map)# set transform-set MySet

Append the settings to a crypto map

Server(config)#crypto map L2TP-MAP 10 ipsec-isakmp dynamic MyMap

Apply the crypto map on the desired interface

Server(config)#interface FastEthernet0/0
Server(config-if)# ip address 172.20.0.1 255.255.0.0
Server(config-if)# crypto map L2TP-MAP

Now to the client :

Create the class for L2TP

Client(config)#pseudowire-class L2TPv2
Client(config)#encapsulation l2tpv2

Create the dialer

Client (config)#interface Virtual-PPP1
Client (config-if)# ip address negotiated
Client (config-if)#ip virtual-reassembly
Client (config-if)#ppp pap sent-username test password qwe123
Client (config-if)#pseudowire 172.20.0.1 2 pw-class L2TPv2

and in case of WAN access

Client(config)# ip route 0.0.0.0 0.0.0.0 Virtual-PPP1

P.S

By default an windows XP client will not be able to connect unless we make changes to the registry and add a service on it, To allow a client to connect anyway add the L2TP key on both sides

On the server

Server(config)# crypto isakmp key 123 address 0.0.0.0 0.0.0.0 no-xauth

On the client add it under security tab in "IPSec settings"

Hope this post was helpful, If it was please consider a donation:
BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N

LTC Address: LUqrKbzGihTU2GEnL3EwsuuLHCsxCJMdtR

Cisco PPPOE Dial-in

Like I may have stated before, I work at an ISP.

Big part of my work in the support department is configuring and troubleshooting internet connectivity, and in order to accomplish this an important step is understanding who it works,

So I would like to dedicate the next few post to that purpose, starting with the PPPOE, to do so I used GNS3 with the following topology (or download it right here )

Server side :

Configure the pool of IP's to redistribute to clients

Server(config)#ip local pool MyPool 10.0.0.1 10.0.0.10

Create a username for the authentication

Server(config)#username test password 0 pass

Configure the template with the PPPOE configurations

Server(config-if)#interface Virtual-Template1
Server(config-if)# ip address 10.0.0.138 255.255.255.0
Server(config-if)# ip virtual-reassembly
Server(config-if)# peer default ip address pool MyPool
Server(config-if)# ppp authentication pap callin

Assign the template to the pppoe group, in this case global group

Server(config)#bba-group pppoe global
Server(config-bba-group)# virtual-template 1
Server(config-bba-group)# sessions per-mac limit 3

Enable the pppoe group on the link to the clients

Server(config)#interface FastEthernet0/0
Server(config-if)# pppoe enable group global

Client side :

Allow PPPOE on the link to the Server:

Client(config)#interface FastEthernet0/0
Client(config-if)# pppoe enable
Client(config-if)# pppoe-client dial-pool-number 1

Create the dialer:

Client(config)#interface Dialer1
Client(config-if)# ip address negotiated
Client(config-if)# encapsulation ppp
Client(config-if)# dialer pool 1
Client(config-if)# ppp pap sent-username test password 0 pass

Route all traffic via the PPPOE link

Client(config)#ip route 0.0.0.0 0.0.0.0 Dialer1

And last thing, verify connectivity

From server's side :

Server#show users
Interface User Mode Idle Peer Address
Vi1.1 test PPPoE - 10.0.0.2

Or the client :

Client#ping 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 124/148/184 ms

*Except the getting a high ping round trip, I think we can call it a success …

Hope this post was helpful, If it was please consider a donation:
BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N
LTC Address: LUqrKbzGihTU2GEnL3EwsuuLHCsxCJMdtR

BGP between Cisco routers on different subnets.

To illustrate this I will use GNS3, i used two Cisco Routers directly different subnets between them.

The topology is very simple:

Starting with the basic configuration, on R1:

NetworkLabs-1(config)#interface FastEthernet0/0
NetworkLabs-1(config-if)# ip address 10.0.1.1 255.255.255.0
NetworkLabs-1(config)# ip route 10.0.2.0 255.255.255.0 FastEthernet0/0

Same thing on R2

NetworkLabs-2(config)#interface FastEthernet0/0
NetworkLabs-2(config-if)# (config-if)#ip address 10.0.2.1 255.255.255.0
NetworkLabs-2(config-)#ip route 10.0.1.0 255.255.255.0 FastEthernet0/0

At this stage we have ping back and forth between both Routers, now to the BGP

NetworkLabs-1(config)#router bgp 1
NetworkLabs-1(config-router)# neighbor 10.0.2.1 remote-as 2
NetworkLabs-2(config)#router bgp 2
NetworkLabs-2(config-router)#neighbor 10.0.1.1 remote-as 1

At this stage BGP will not come up, it will be stuck on idle state, to make it work all we need is to add " disable-connected-check" on both of the routers

NetworkLabs-1(config-router)#neighbor 10.0.2.1 disable-connected-check
NetworkLabs-2(config-router)#neighbor 10.0.1.1 disable-connected-check

That's it.

Hope this post was helpful, If it was please consider a donation:
BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N

LTC Address: LUqrKbzGihTU2GEnL3EwsuuLHCsxCJMdtR

Cisco Login Security

Securing a network means nothing when failing to secure the edge router, so here is a few tips on how to secure Cisco's CLI remote management,

first restrict access by IP address, to do so create an access-list containing the IP's you might be connecting from and add restrict the access to that ACL,

let's assume you'll need access only from 192.168.0.0/24
Cisco# access-list 10 permit 192.168.0.0 0.0.0.255
Cisco# line vty 0 4
Cisco# access-class 10 in

that should make sure no one outside your network is able to access the router configurations, but what about inside your network ? it is still possible to gain access to the router by running a number of attacks on the router, to try and counter it we can use log in restrictions.

Block all access after 2 failed login attempts within 1 Minute for the period of 300Secounds (5 Minutes)

Cisco# login block-for 300 attempts 2 within 60

Delay 5 Seconds between each login attempt

Cisco# login delay 5

And offcource log each attempt, both successful and failed.

Cisco# login on-failure log
Cisco# login on-success log

Another feature is to allow specific IP's the possibility to access even if the device is in "quite mode" (block is active)

Cisco# access-list 20 permit 192.168.0.100
Cisco# login quiet-mode access-class 20

Hope this post was helpful, If it was please consider a donation:
BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N
LTC Address: LUqrKbzGihTU2GEnL3EwsuuLHCsxCJMdtR

Cisco integrated device IOS upgrade

when working with an Integrated device, such as the 860W/880W the wireless module is complitly separated from the "main" device

so in case we want (or need) to perform an IOS upgrade it needs to be done seperatly for the wireless module,

unlike the regular upgrade this one is a bit more complicated,

first of all acquire an image, it comes as a "tar" archive and upload it to the cisco,

make sure to upload it to the module and not to the main device.

I done this by ftp, looks like that :

Cisco-AP# copy ftp:upload/ap801-k9w7-tar.124-25d.JA1.tar flash:

Address or name of remote host [10.0.0.2]?

Source filename [/upload/ap801-k9w7-tar.124-25d.JA1.tar]?

Destination filename [ap801-k9w7-tar.124-25d.JA1.tar]?

Accessing ftp://10.0.0.2/upload/ap801-k9w7-tar.124-25d.JA1.tar...

Loading /upload/ap801-k9w7-tar.124-25d.JA1.tar !!!!!!!!!!!!!!!!!!!!!!!!!!

[OK - 6635520/4096 bytes]

Now that we have the file, we enter bootloader mode and extract it,

Done from the main device

Cisco# service-module wlan-ap 0 reset bootloader

Now log in to the module

Cisco# service-module wlan-ap 0 session

You will not be able to use regular Cisco commands, run the following :

ap: tar -xtract flash:ap801-k9w7-tar.124-25d.JA1.tar flash:

after a few minutes of work it will finish the extract and verify the files,

now all we have to do is load the new IOS and verify it works,

ap: dir flash:

Directory of flash:/

4 drwx 256 <date> ap801-k9w7-mx.124-21a.JA1

152 -rwx 5 <date> private-config

156 -rwx 1048 <date> private-multiple-fs

158 drwx 384 Jan 1 1970 00:09:36 +00:00 ap801-k9w7-mx.124-25d.JA1

ap: dir flash:ap801-k9w7-mx.124-25d.JA1

Directory of flash:ap801-k9w7-mx.124-25d.JA1/

159 drwx 64 <date> html

303 -rwx 5692562 <date> ap801-k9w7-mx.124-25d.JA1

304 -rwx 174876 <date> 8001.img

305 -rwx 15352 <date> A5.bin

306 -rwx 1616 <date> A2.bin

307 -rwx 286 <date> info

ap: boot flash:ap801-k9w7-mx.124-25d.JA1/ap801-k9w7-mx.124-25d.JA1

Loading "flash:ap801-k9w7-mx.124-25d.JA1/ap801-k9w7-mx.124-25d.JA1"...##################

And in case it loades ok and works as it soould remove the old IOS to make sure the module boot to the new one directly,

Cisco-AP#show flash:

Directory of flash:/

4 drwx 256 Jan 1 1970 00:07:40 +00:00 ap801-k9w7-mx.124-21a.JA1

Cisco-AP# delete /force /recursive flash: ap801-k9w7-mx.124-21a.JA1

Hope this post was helpful, If it was please consider a donation:
BTC Address: 1CnyMpjd1RntRDxSus2hu2aDMyzL4Kj29N

LTC Address: LUqrKbzGihTU2GEnL3EwsuuLHCsxCJMdtR