BGP BASIC CONFIGURATION

Configuration of BGPv4 is simple on Cisco. Here in this scenario R2 is on AS 1 and rest of the other routers i.e. R1,R5 and R3 are on AS 2.

Configuration Objective is to achieve inter AS communication. Simple BGP configuration neigbourship and broadcasting network. LANs shown as clouds C1 and C2.
Internet is connected through C2 cloud. Actually I used DSL modem located in C2 clound. And put routes into it for 192.168.56.0/24 towards R3. So that returning traffic can come in 192.168.56.0/24 network.
In C1  cloud I used VM OS to test all connectivity.

Traffic from VM OS passess through AS 1,AS 2 and to internet. Here is the trace from R2 router for e.g. gmail.com.

Version of IOS on all routers 12.4

R2#traceroute gmail.com source f0/0
Type escape sequence to abort.
Tracing the route to gmail.com (72.14.204.83)



1 172.16.1.2 [AS 2] 56 msec 24 msec 48 msec

2 10.1.1.2 [AS 2] 36 msec 44 msec 48 msec

3 10.1.1.6 [AS 2] 24 msec 48 msec 64 msec

4 * * * #DSL Hop found

5 59.95.96.1 [AS 2] 128 msec 156 msec 136 msec

6 218.248.255.90 [AS 2] 124 msec 140 msec 148 msec

7 121.244.78.166 [AS 2] 116 msec 136 msec 172 msec

8 59.163.25.242 [AS 2] 116 msec 148 msec 148 msec

9 121.240.0.18 [AS 2] 156 msec 140 msec 152 msec

10 216.239.43.214 [AS 2] 124 msec 148 msec 132 msec

11 72.14.232.93 [AS 2] [MPLS: Label 697405 Exp 4] 216 msec

72.14.232.100 [AS 2] [MPLS: Label 391761 Exp 4] 168 msec 160 msec

12 66.249.94.74 [AS 2] 228 msec

66.249.94.72 [AS 2] 200 msec

66.249.94.74 [AS 2] 252 msec

13 209.85.254.155 [AS 2] [MPLS: Label 509864 Exp 4] 500 msec

72.14.232.115 [AS 2] [MPLS: Label 416579 Exp 4] 432 msec

209.85.254.155 [AS 2] [MPLS: Label 520248 Exp 4] 464 msec

14 209.85.255.59 [AS 2] [MPLS: Label 481915 Exp 4] 464 msec 460 msec 480 msec

15 216.239.43.212 [AS 2] [MPLS: Label 729408 Exp 4] 468 msec 476 msec 448 msec

16 209.85.241.210 [AS 2] [MPLS: Label 780964 Exp 4] 448 msec

216.239.43.81 [AS 2] [MPLS: Label 715357 Exp 4] 420 msec 432 msec

17 209.85.248.222 [AS 2] 460 msec 584 msec 472 msec

18 66.249.94.54 [AS 2] 416 msec

209.85.242.209 [AS 2] [MPLS: Label 752323 Exp 4] 444 msec

209.85.248.222 [AS 2] 432 msec

19 72.14.204.83 [AS 2] 440 msec 436 msec 452 msec
 
and from VM OS:
 
C:\>tracert -d gmail.com




Tracing route to gmail.com [72.14.204.19]

over a maximum of 30 hops:



1 70 ms 17 ms 2 ms 192.168.56.2

2 35 ms 40 ms 10 ms 172.16.1.2

3 37 ms 27 ms 49 ms 10.1.1.2

4 51 ms 27 ms 19 ms 10.1.1.6

5 * * * Request timed out. #this hop  is the DSL modem connected

6 151 ms 147 ms 147 ms 59.95.96.1

7 145 ms 180 ms 169 ms 218.248.255.90

8 143 ms 124 ms 130 ms 115.113.128.17

9 134 ms 126 ms 122 ms 59.163.25.242

10 223 ms 135 ms 126 ms 121.240.0.18

11 124 ms 134 ms 127 ms 216.239.43.214

12 158 ms 188 ms 174 ms 72.14.232.93

13 187 ms 189 ms 215 ms 66.249.94.74

14 498 ms 455 ms 422 ms 209.85.254.155

15 492 ms 429 ms 444 ms 209.85.255.37

16 453 ms 431 ms 433 ms 216.239.43.212

17 426 ms 431 ms 459 ms 216.239.43.81

18 446 ms 432 ms 431 ms 209.85.248.222

19 429 ms 490 ms 429 ms 209.85.242.209

20 458 ms 486 ms 433 ms 72.14.204.19

Trace complete.




First We focus on R2. This router resides in AS 1 as a whole.

Its configuration is as follow:

interface FastEthernet0/0
ip address 192.168.56.2 255.255.255.0
duplex auto
speed auto

interface Serial1/0

ip address 172.16.1.1 255.255.255.252
serial restart-delay 0

router bgp 1
no synchronization
bgp log-neighbor-changes
redistribute connected route-map allowed
neighbor 172.16.1.2 remote-as 2
no auto-summary

! Only these routes will be broadcasted

ip access-list standard allowed
permit 192.168.56.0

route-map allowed permit 10
match ip address allowed


Configuration of R1

interface Loopback0
ip address 10.81.199.1 255.255.255.255

interface Serial1/0
ip address 172.16.1.2 255.255.255.252
serial restart-delay 0

interface Serial1/2
ip address 10.1.1.1 255.255.255.252
serial restart-delay 0

! IGP for intra AS domain routing

router ospf 1
log-adjacency-changes
network 10.1.1.0 0.0.0.255 area 0
network 10.81.199.0 0.0.0.255 area 0

router bgp 2
! Will not rely on IGP for routes
no synchronization
bgp log-neighbor-changes

!Neigbor relationship
neighbor 10.81.199.2 remote-as 2

! update source will be lo0
neighbor 10.81.199.2 update-source Loopback0

!for routes to be seen from iBGP hop coming from eBGP hop
neighbor 10.81.199.2 next-hop-self

neighbor 10.81.199.3 remote-as 2
neighbor 10.81.199.3 update-source Loopback0
neighbor 10.81.199.3 next-hop-self
neighbor 172.16.1.1 remote-as 1
no auto-summary

R5 configuration:

interface Loopback0

ip address 10.81.199.3 255.255.255.255

interface Serial1/1

ip address 10.1.1.5 255.255.255.252
serial restart-delay 0
!
interface Serial1/2
ip address 10.1.1.2 255.255.255.252
serial restart-delay 0

router ospf 1

log-adjacency-changes
network 10.1.1.0 0.0.0.255 area 0
network 10.81.199.0 0.0.0.255 area 0

router bgp 2

no synchronization
bgp log-neighbor-changes
neighbor 10.81.199.1 remote-as 2
neighbor 10.81.199.1 update-source Loopback0
neighbor 10.81.199.2 remote-as 2
neighbor 10.81.199.2 update-source Loopback0
no auto-summary
!

R3 Configuration:

interface Loopback0
ip address 10.81.199.2 255.255.255.255
!
interface FastEthernet0/0

ip address dhcp
duplex auto
speed auto

interface Serial1/1

ip address 10.1.1.6 255.255.255.252
serial restart-delay 0
!
router ospf 1

log-adjacency-changes
network 10.1.1.0 0.0.0.255 area 0
network 10.81.199.0 0.0.0.255 area 0
!
router bgp 2

no synchronization
bgp log-neighbor-changes

! Default route redistributionnetwork 0.0.0.0

network 192.168.1.0
neighbor 10.81.199.1 remote-as 2
neighbor 10.81.199.1 update-source Loopback0
neighbor 10.81.199.3 remote-as 2
neighbor 10.81.199.3 update-source Loopback0
no auto-summary
!
! Default route towards DSL modem
ip route 0.0.0.0 0.0.0.0 192.168.1.1

Types of NAT on Cisco PIX 525 using Version 8.0

In above network I have used 5 routers and used different types of NATs. Check the configuration of firewall. And rest of part of ip addressing is given in the diagram.


PAT tracking for any source


nat (inside) 1 0.0.0.0 0.0.0.0
global (outside) 1 interface
 
Dynamic Nating:
 
nat (inside) 2 192.168.20.0 255.255.255.0

global (outside) 2 192.168.1.20-192.168.1.30 netmask 255.255.255.0


Identity Nating:

nat (inside) 0 192.168.30.0 255.255.255.0


Static Nating:
 
static (inside,outside) 192.168.1.60 192.168.40.2 netmask 255.255.255.255
 
Outside Interface:
 
interface Ethernet1

nameif outside
security-level 0
ip address dhcp setroute


Inside Interface:
 
interface Ethernet0

nameif inside
security-level 100
ip address 192.168.100.2 255.255.255.0

routes:
 
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1

route inside 192.168.0.0 255.255.0.0 192.168.100.1 1

Access-lists:

access-list outside_to_inside extended permit tcp any host 192.168.1.60 eq telnet

access-list outside_to_inside extended permit icmp any any echo-reply

applied on:

access-group outside_to_inside in interface outside


Checking translation for each type of translation:

debug icmp trace
show conn
show xlate

Note: There more options for above commands to be used. So explore yourself.

OPENING NETMEETING ON INTERNET

Hi, in this tutorial I will explain how to open netmeeting connections between two remote sites across internet. For this I am using 256 kbps connection by applying Committed Access Rate (CAR). consider the scenario:


Here  I have used two routers as  shown in diagram. Ports I used to map statically to public are as follows:

To establish outbound NetMeeting connections through a natting, the natting must be configured to do the following:


* Pass through primary TCP connections on ports 522, 389, 1503, 1720 and 1731.
* Pass through secondary UDP connections on dynamically assigned ports (1024-65535).
 
For furhtur info. u can access this site: http://support.microsoft.com/kb/158623
 
 
 
static natting configuration on both routers are nearly same:
 
On R0:
 
ip nat inside source static tcp 192.168.1.3 389 10.1.1.1 389 extendable

ip nat inside source static tcp 192.168.1.3 522 10.1.1.1 522 extendable
ip nat inside source static tcp 192.168.1.3 1503 10.1.1.1 1503 extendable
ip nat inside source static tcp 192.168.1.3 1720 10.1.1.1 1720 extendable
ip nat inside source static tcp 192.168.1.3 1731 10.1.1.1 1731 extendable
 
 
On R1:
 
ip nat inside source static tcp 192.168.56.200 389 10.1.1.2 389 extendable
ip nat inside source static tcp 192.168.56.200 522 10.1.1.2 522 extendable
ip nat inside source static tcp 192.168.56.200 1503 10.1.1.2 1503 extendable
ip nat inside source static tcp 192.168.56.200 1720 10.1.1.2 1720 extendable
ip nat inside source static tcp 192.168.56.200 1731 10.1.1.2 1731 extendable
 
Note:
 
I didn't check audio after configuring these above commands on routers. Pls, feel free to give comments on if you have any update on this
 
Commands for applying CAR on both routers on serial interfaces:
 
 
interface Serial1/0

ip address 10.1.1.2 255.255.255.252
ip nat outside
ip virtual-reassembly
rate-limit input access-group 1 256000 64000 64000 conform-action transmit exceed-action drop
rate-limit output access-group 1 256000 64000 64000 conform-action transmit exceed-action drop
serial restart-delay 0
end

Cisco Password Encryption Published

Hey Programmer's, need to know something. Dont take this in a destructive

way, it is just provided for recovery purposes. 

Cisco PIX passwords are limited to a length of 16 Bytes, so in theory
 there are 255^16 possible passwords, but in real life there are about
 80^16 useful password combinations, take a look at your keyboard to
 verify, even if strong passwords are used.

 Cisco's password encryption is based on base64 encoded MD5 hashes.
 Routers IOS uses 1000 MD5 Update rounds to make password brute forcing
 attacks harder, but the PIX firewall uses only one MD5 update and then 
 the digest is base64 encoded.

 For base64 encoding Cisco uses the _crypt_to64() Function of the 
 FreeBSD libcrypt library.

 Here's the code to compute PIX password hashes:

         MD5Context ctx1;
         unsigned char final[MD5_SIZE+1];
         unsigned char cleartext [16+1];
         unsigned char cisco_encoded [16+1];

         memset(cisco_encoded,0,sizeof(cisco_encoded));
         memset(cleartext,0,sizeof(cleartext));
         strcpy((char*) cleartext,"test");

         MD5Init2(&ctx1);
         MD5Update2(&ctx1,(unsigned char*) cleartext,16);
         MD5Final2(final,&ctx1);

         char* p = (char*) cisco_encoded;
         _crypt_to64(p,*(unsigned long*) (final+0),4); p += 4;
         _crypt_to64(p,*(unsigned long*) (final+4),4); p += 4;
         _crypt_to64(p,*(unsigned long*) (final+8),4); p += 4;
         _crypt_to64(p,*(unsigned long*) (final+12),4); p += 4;

Regards,

Ashish Saretia.

+919893876066

Use of GLBP, HSRP and Active/Standby FAILOVER

Consider this type of scenario shown below:

Components used:

Cisco PIX 525 with 8.0 version.
c3600 router with  16ESW module for emulating as layer 3 switch.


Lower half is configured with GLBP and upper half is configured with HSRP.

Why I used both protocols? So that anybody wants to know about the mechanics how they work can able to check  configuration of both protocols. ethernet 2 of both firewalls is used as management interface.

Briefings of both protocols:

• Both are cisco proprietory.
• They can do interface monitoring so that is any interface fails  or active router or L3 switch goes down switchover will take place.
•  GLBP is somewhat different than HSRP in one feature that it provides loadbalancing among gateways. Can be on host based mac address, Round Robin Loadbalancing(default) or weighted.

Ofcourse, I have used failover on both firewalls FW0(Active) and FW1(Standby) for redundancy purpose.

Before configuring firewall always remember these points:

• Firewall model should be same
• No. of interfaces must be same
• OS version should be same
• Memories should be same
• For more you can refer to http://www.cisco.com/

You can go through BCMSN guide for further studies. I will not explain too much.

Configuration part:


FW0(PRIMARY) configuration:

!


hostname FW0

enable password 8Ry2YjIyt7RRXU24 encrypted

names

!

interface Ethernet0

nameif Outside

security-level 0

ip address 192.168.10.250 255.255.255.0

!

interface Ethernet1

nameif Inside

security-level 100

ip address 192.168.200.1 255.255.255.0

!

interface Ethernet2

nameif mgmt

security-level 99

ip address 192.168.4.253 255.255.255.0 standby 192.168.4.254

management-only

!

interface Ethernet3

!

interface Ethernet4

!

interface Redundant1

description LAN/STATE Failover Interface

member-interface Ethernet3

member-interface Ethernet4

!

passwd 2KFQnbNIdI.2KYOU encrypted

ftp mode passive

access-list Outside_access_in extended permit icmp any any

pager lines 24

mtu Outside 1500

mtu Inside 1500

mtu mgmt 1500

failover

failover lan unit primary

failover lan interface fail_int Redundant1

failover lan enable

failover polltime unit msec 200 holdtime msec 800

failover polltime interface msec 500 holdtime 5

failover key *****

failover link fail_int Redundant1

failover interface ip fail_int 1.1.1.1 255.255.255.252 standby 1.1.1.2

no monitor-interface mgmt

icmp unreachable rate-limit 1 burst-size 1

asdm image flash:/asdm-602.bin

no asdm history enable

arp timeout 14400

nat-control

global (Outside) 1 interface

nat (Inside) 1 0.0.0.0 0.0.0.0

access-group Outside_access_in in interface Outside

route Outside 0.0.0.0 0.0.0.0 192.168.10.254 1

route Inside 192.168.56.0 255.255.255.0 192.168.200.100 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.4.0 255.255.255.0 mgmt

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

no crypto isakmp nat-traversal

telnet timeout 5

ssh timeout 5

console timeout 0

dhcp-client broadcast-flag

threat-detection basic-threat

threat-detection statistics access-list

!

!

prompt hostname context

Cryptochecksum:2dba6cd4479e3e98aa10893eec4c2862

: end
 
FW1(SECONDARY) configuration:
 
 
 PIX Version 8.0(2)


!

hostname FW0

enable password 8Ry2YjIyt7RRXU24 encrypted

names

!

interface Ethernet0

nameif Outside

security-level 0

ip address 192.168.10.250 255.255.255.0

!

interface Ethernet1

nameif Inside

security-level 100

ip address 192.168.200.1 255.255.255.0

!

interface Ethernet2

nameif mgmt

security-level 99

ip address 192.168.4.253 255.255.255.0 standby 192.168.4.254

management-only

!

interface Ethernet3

!

interface Ethernet4

!

interface Redundant1

description LAN/STATE Failover Interface

member-interface Ethernet3

member-interface Ethernet4

!

passwd 2KFQnbNIdI.2KYOU encrypted

ftp mode passive

access-list Outside_access_in extended permit icmp any any

pager lines 24

mtu Outside 1500

mtu Inside 1500

mtu mgmt 1500

failover

failover lan unit secondary

failover lan interface fail_int Redundant1

failover lan enable

failover polltime unit msec 200 holdtime msec 800

failover polltime interface msec 500 holdtime 5

failover key *****

failover link fail_int Redundant1

failover interface ip fail_int 1.1.1.1 255.255.255.252 standby 1.1.1.2

no monitor-interface mgmt

icmp unreachable rate-limit 1 burst-size 1

asdm image flash:/asdm-602.bin

no asdm history enable

arp timeout 14400

nat-control

global (Outside) 1 interface

nat (Inside) 1 0.0.0.0 0.0.0.0

access-group Outside_access_in in interface Outside

route Outside 0.0.0.0 0.0.0.0 192.168.10.254 1

route Inside 192.168.56.0 255.255.255.0 192.168.200.100 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.4.0 255.255.255.0 mgmt

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

no crypto isakmp nat-traversal

telnet timeout 5

ssh timeout 5

console timeout 0

dhcp-client broadcast-flag

threat-detection basic-threat

threat-detection statistics access-list

!

!

prompt hostname context

Cryptochecksum:da40a422579a902a3ccf7899907ba015

: end



R0(GLBP ACTIVE) configuration:
 

!


version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname Router

!

boot-start-marker

boot-end-marker

!

!

no aaa new-model

memory-size iomem 5

!

!

ip cef

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

spanning-tree vlan 1 priority 8192

spanning-tree vlan 99 priority 8192

!

!

!

!

!

!

!

interface Port-channel1

switchport trunk native vlan 99

switchport mode trunk

!

interface FastEthernet0/0

no ip address

shutdown

duplex auto

speed auto

!

interface FastEthernet0/1

no ip address

shutdown

duplex auto

speed auto

!

interface FastEthernet1/0

switchport access vlan 99

!

interface FastEthernet1/1

!

interface FastEthernet1/2

!

interface FastEthernet1/3

!

interface FastEthernet1/4

!

interface FastEthernet1/5

!

interface FastEthernet1/6

!

interface FastEthernet1/7

!

interface FastEthernet1/8

!

interface FastEthernet1/9

!

interface FastEthernet1/10

!

interface FastEthernet1/11

!

interface FastEthernet1/12

!

interface FastEthernet1/13

no switchport

ip address 192.168.56.2 255.255.255.0

glbp 1 ip 192.168.56.254

glbp 1 priority 150

glbp 1 preempt

!

interface FastEthernet1/14

switchport trunk native vlan 99

switchport mode trunk

channel-group 1 mode on

!

interface FastEthernet1/15

switchport trunk native vlan 99

switchport mode trunk

channel-group 1 mode on

!

interface Vlan1

no ip address

!

interface Vlan99

ip address 192.168.200.254 255.255.255.0

glbp 2 ip 192.168.200.100

glbp 2 priority 150

glbp 2 preempt

glbp 2 authentication md5 key-string cisco

!

!

ip http server

no ip http secure-server

ip route 0.0.0.0 0.0.0.0 Vlan99 192.168.200.1

!

!

!

mac-address-table static 0007.b400.0202 interface FastEthernet1/15 vlan 99

!

!

!

!

control-plane

!

!

!

!

!

!

!

!

!

line con 0

exec-timeout 0 0

logging synchronous

line aux 0

line vty 0 4

login

!

!

end

R1(GLBP STANDBY) Configuration:
 
 
!


version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname Router

!

boot-start-marker

boot-end-marker

!

!

no aaa new-model

memory-size iomem 5

!

!

ip cef

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

vtp file nvram:vlan.dat



!

!

!

!

!

!

!

interface Port-channel1

switchport trunk native vlan 99

switchport mode trunk

!

interface FastEthernet0/0

no ip address

shutdown

duplex auto

speed auto

!

interface FastEthernet0/1

no ip address

shutdown

duplex auto

speed auto

!

interface FastEthernet1/0

switchport access vlan 99

!

interface FastEthernet1/1

!

interface FastEthernet1/2

!

interface FastEthernet1/3

!

interface FastEthernet1/4

!

interface FastEthernet1/5

!

interface FastEthernet1/6

!

interface FastEthernet1/7

!

interface FastEthernet1/8

!

interface FastEthernet1/9

!

interface FastEthernet1/10

!

interface FastEthernet1/11

!

interface FastEthernet1/12

!

interface FastEthernet1/13

no switchport

ip address 192.168.56.3 255.255.255.0

glbp 1 ip 192.168.56.254

glbp 1 timers 1 2

glbp 1 preempt

!

interface FastEthernet1/14

switchport trunk native vlan 99

switchport mode trunk

channel-group 1 mode on

!

interface FastEthernet1/15

switchport trunk native vlan 99

switchport mode trunk

channel-group 1 mode on

!

interface Vlan1

no ip address

!

interface Vlan99

ip address 192.168.200.253 255.255.255.0

glbp 2 ip 192.168.200.100

glbp 2 preempt

glbp 2 authentication md5 key-string cisco

!

!

ip http server

no ip http secure-server

ip route 0.0.0.0 0.0.0.0 Vlan99 192.168.200.1

!

!

!

mac-address-table static 0007.b400.0201 interface FastEthernet1/15 vlan 99

!

!

!

!

control-plane

!

!

!

!

!

!

!

!

!

line con 0

exec-timeout 0 0

logging synchronous

line aux 0

line vty 0 4

login

!

!

end
 
 
R3(HSRP ACTIVE) Configuration:
 
 
!


version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname Router

!

boot-start-marker

boot-end-marker

!

!

no aaa new-model

memory-size iomem 5

!

!

ip cef

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

spanning-tree vlan 1 priority 8192

spanning-tree vlan 99 priority 8192

vtp file nvram:vlan.dat



!

!

!

!

!

!

!

interface Port-channel1

switchport trunk native vlan 99

switchport mode trunk

!

interface FastEthernet0/0

no ip address

shutdown

duplex auto

speed auto

!

interface FastEthernet0/1

no ip address

shutdown

duplex auto

speed auto

!

interface FastEthernet1/0

switchport access vlan 99

!

interface FastEthernet1/1

!

interface FastEthernet1/2

!

interface FastEthernet1/3

!

interface FastEthernet1/4

!

interface FastEthernet1/5

!

interface FastEthernet1/6

!

interface FastEthernet1/7

!

interface FastEthernet1/8

!

interface FastEthernet1/9

!

interface FastEthernet1/10

!

interface FastEthernet1/11

!

interface FastEthernet1/12

!

interface FastEthernet1/13

no switchport

ip address 192.168.1.252 255.255.255.0

standby 3 ip 192.168.1.254

standby 3 timers 1 3

standby 3 priority 150

standby 3 preempt

!

interface FastEthernet1/14

switchport trunk native vlan 99

switchport mode trunk

channel-group 1 mode on

!

interface FastEthernet1/15

switchport trunk native vlan 99

switchport mode trunk

channel-group 1 mode on

!

interface Vlan1

no ip address

!

interface Vlan99

ip address 192.168.10.1 255.255.255.0

standby 4 ip 192.168.10.254

standby 4 timers 1 3

standby 4 priority 150

standby 4 preempt

standby 4 authentication md5 key-string cisco

!

!

ip http server

no ip http secure-server

ip route 0.0.0.0 0.0.0.0 192.168.1.1

!

!

!

mac-address-table static 0000.0c07.ac04 interface FastEthernet1/15 vlan 99

!

!

!

!

control-plane

!

!

!

!

!

!

!

!

!

line con 0

exec-timeout 0 0

logging synchronous

line aux 0

line vty 0 4

login

!

!

end

R2(HSRP STANBY) Configuration:
 
!


version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname Router

!

boot-start-marker

boot-end-marker

!

!

no aaa new-model

memory-size iomem 5

!

!

ip cef

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

!

vtp file nvram:vlan.dat



!

!

!

!

!

!

!

interface Port-channel1

switchport trunk native vlan 99

switchport mode trunk

!

interface FastEthernet0/0

no ip address

shutdown

duplex auto

speed auto

!

interface FastEthernet0/1

no ip address

shutdown

duplex auto

speed auto

!

interface FastEthernet1/0

switchport access vlan 99

!

interface FastEthernet1/1

!

interface FastEthernet1/2

!

interface FastEthernet1/3

!

interface FastEthernet1/4

!

interface FastEthernet1/5

!

interface FastEthernet1/6

!

interface FastEthernet1/7

!

interface FastEthernet1/8

!

interface FastEthernet1/9

!

interface FastEthernet1/10

!

interface FastEthernet1/11

!

interface FastEthernet1/12

!

interface FastEthernet1/13

no switchport

ip address 192.168.1.253 255.255.255.0

standby 3 ip 192.168.1.254

standby 3 timers 1 3

standby 3 preempt

!

interface FastEthernet1/14

switchport trunk native vlan 99

switchport mode trunk

channel-group 1 mode on

!

interface FastEthernet1/15

switchport trunk native vlan 99

switchport mode trunk

channel-group 1 mode on

!

interface Vlan1

no ip address

!

interface Vlan99

ip address 192.168.10.2 255.255.255.0

standby 4 ip 192.168.10.254

standby 4 timers 1 3

standby 4 preempt

standby 4 authentication md5 key-string cisco

!

!

ip http server

no ip http secure-server

ip route 0.0.0.0 0.0.0.0 192.168.1.1

!

!

!

!

!

!

!

control-plane

!

!

!

!

!

!

!

!

!

line con 0

exec-timeout 0 0

logging synchronous

line aux 0

line vty 0 4

login

!

!

end

Cut Through Proxy

This is not full fledged Proxy. This I call it Stateful Proxy. Here right side of firewall is inside network. Left side is unsecure connection. Test was done with VMWARE host as inside host. and outside network was accessed via DSL connection with host host OS windows XP. And was successful. When accessing any website traffic was intercepted by security appliance. Asking for username and password. If not correct drop the connections. Here in this configuration cut thru proxy is used to intercept egress tcp connections only.

Configuration of Firewall:

hostname pixfirewall
domain-name default.domain.invalid
enable password oyM4X.DeOBQWUivD encrypted
names
!
interface Ethernet0
nameif outside
security-level 0
ip address 192.168.1.254 255.255.255.0
!
interface Ethernet1
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet2
nameif inside
security-level 100
ip address 192.168.56.254 255.255.255.0
!
interface Ethernet3
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet4
shutdown
no nameif
no security-level
no ip address
!
passwd Q6PcEw0JPNC8SDNU encrypted
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
access-list icmp_in extended permit icmp any any
access-list private_ip_from_outside extended deny ip 10.0.0.0 255.0.0.0 any
access-list private_ip_from_outside extended deny ip 172.16.0.0 255.248.0.0 any
access-list private_ip_from_outside extended permit icmp any any
access-list private_ip_from_outside extended deny tcp any any eq 445
access-list private_ip_from_outside extended deny tcp any any eq 137
access-list deny_inside_to_outside extended deny tcp 192.168.0.0 255.255.0.0 any eq 445
access-list deny_inside_to_outside extended permit ip any any
pager lines 24
logging enable
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
! for letting data traffic flow from inside to outside
global (outside) 1 192.168.1.100
global (outside) 1 192.168.1.101
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
access-group private_ip_from_outside in interface outside
access-group deny_inside_to_outside in interface inside
! default route to outside hop ip i.e. 192.168.1.1
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 3:00:00 absolute
dynamic-access-policy-record DfltAccessPolicy
! authentication based on service accessed in this case all tcp based services(i.e. http , ftp, telnet etc)
aaa authentication include tcp/0 inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 LOCAL
aaa authentication secure-http-client
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
no crypto isakmp nat-traversal
telnet 192.168.56.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection scanning-threat shun
threat-detection statistics access-list
!
!

Limiting Number of TCP and UDP Connections on Firewall

Dear All,
I somehow know about configuring natting on cisco firewall. But how about cool feature of controlling TCP and UDP connections on your security appliance. Remember when you try to configure nat on internal network or static natting for internal/DMZ server on outside interface for persistent connection from server to outside, you have an option for limiting TCP and UDP connections.

This is like this:
nat (inside) 1 0 0 tcp 25 25 udp 25
Irrespective of global command used, u can only control tcp and udp connections when using nat command.
Explaination:
Above nat command tells that any number of hosts from any hosts can xlated but each host will only can make 25 tcp established connections, 25 tcp embryonic connections can be made(those connections whose sys flag is on), and 25 udp connections. Remember, this configuration applies to each and every hosts trying to initiate connection from inside(Egress Traffic).


What About Static natting:
I take an example:

static (dmz,outside) tcp 1.1.1.1 21 192.168.1.3 21 netmask 255.255.255.255 tcp 0 25 udp 0

Here you see that mapping is done of inside host 192.168.1.3 which is ftp server with mask 255.255.255.255 i.e. only one host mapped on 1.1.1.1 which is outside ip. tcp 0 25 instructs that unlimited connections from outside can be made(0 means unlimited). Ebryonic connections cannot be more than 25. after 25 embryonic connections.

What happens after limit reaches:

Security appliance uses tcp cookie and behaves as proxy between host to host connection. when see's any emryonic connection more than 25 connections from any host, will intercept and behalf of that connecting host security appliance will recalculate the syn segment and send it to target host. If it gets syn ack segment it redirects to connecting host, can be called as source host. If security appliance gets ack segment back then it will allow connection or else drop that traffic.

By virtue of tcp cookie technology, tcp connections are not stored in DRAM. On the fly security appliance does processing. So by this, DoS can be mitigated.