Wednesday, October 14, 2015

Cisco Switching & Routing (L2&L3)

TCP is a transport layer protocol, which provides services such as: reliable connectivity, error recovery, flow control through windowing, multiplexing using port numbers and ordered data transfer. UDP on the other hand provides a connectionless service, meaning that no reliability is provided. In the scenario the TCP must be established between the Host requesting the Web page and the Web Server. For more information refer to: [Odom W. - Cisco CCENT - CCNA ICND1 100-101 Official Certification Guide, Part 1, Chapter 1, page 87] 

DNS (Domain Name System) is an internet service used to resolve or translate domain names like www.skillset.com into a dotted decimal IPv4 address or hexadecimal notation IPv6 address. ARP stands for Address Resolution Protocol. ARP resolves IP Addresses to MAC Addresses. HTTP stands for Hypertext Transfer Protocol. HTTP is used by World Wide Web to define how messages are formatted and transmitted. DHCP or Dynamic Host Configuration Protocol. DHCP is a protocol used to dynamically distribute Network Parameters such as IP addresses for interfaces and services.

A timing problem can cause intermittent connectivity on a WAN link. To solve the issue, check the CSU/DSU configuration and verify that clocking settings are fine. A timing problem cannot be caused by a layer 1 failure. A timing problem will not increase input errors it will put the interface status in an up/down state. For more information refer to: http://penta2.ufrgs.br/trouble/trwan.htm

The Window field or size in the TCP header is a number that specifies the amount of data a sender can transmit before needing an acknowledgment from the receiver. (http://www.networksorcery.com/enp/protocol/tcp.htm)

The "0.0.0.0" wildcard mask represents each octet of the address. The zero in each octet must match exactly, which means that the exact the host address of 192.168.1.2 must be checked. The equivalent of the command "permit host 192.168.1.2" is "permit 192.168.1.2 0.0.0.0". 

The command debug frame-relay lmi can give a real-time "debug" detail about the LMI exchange of packets. "show frame-relay lmi" displays statistics of the lmi and it can help on troubleshooting but does not display events occurring on the LMI exchange of packets. For more information on the debug command refer to: http://www.cisco.com/c/en/us/support/docs/dial-access/integrated-services-digital-networks-isdn-channel-associated-signaling-cas/10374-debug.html For more information on the "debug frame-relay lmi" refer to: http://www.cisco.com/c/en/us/td/docs/ios/12_2/wan/configuration/guide/fwan_c/wcffrely.html 

The command "access-list 100 deny tcp host 192.168.1.2 host 203.125.32.254 eq 25" is used to deny TCP service that uses port 25. This port number is used by SMTP or Simple Mail Transfer Protocol. FTP or File Transfer Protocol uses port numbers 20 (Data) and 21 (Command). DNS or Domain Name Service/System uses port 53. ICMP or Internet Control Message Protocol, however, is a messaging protocol at the network layer, not in the transport layer. ICMP use different types of messages. As an example, you can use "echo-reply" or "echo-request", etc., instead of using port numbers. 

Frame Relay, PPP and HDLC are WAN technologies while Ethernet and Token Ring are common LAN technologies. For more information refer to: http://computernetworkingnotes.com/wan-protocols-hdlc-ppp-frame-really-nat-pat/wan-terms.html
WAN operates at two layers, Physical layer and Data Link Layer.
      
To allow or deny ping packets, use the IP control protocol ICMP or Internet Message Control Protocol. The IP option means all IP protocols are allowed or filtered. Use UDP if you want to block or allow routing updates or other UDP services such as DNS. Use the TCP option if you want to allow or deny TCP protocols such as FTP, Telnet, SSH, etc. 

The "debug frame-relay lmi" command is used to display LMI messages exchanged between the router and Frame Relay switch over access link. The debug output can be used to determine if the router and the Frame Relay switch are sending and receiving LMI packets properly. The "no" form of this command disables the debug output. The "show frame-relay lmi" command displays LMI statistics but it does not show the contents of LMI messages.
http://www.techrepublic.com/article/troubleshoot-problems-with-frame-relay-circuits-on-your-cisco-router/#

https://prasadkeni.wordpress.com/2012/02/10/ospf-neighbor-list-is-empty/

A point-to-point link does not assign a DR or BDR, because is only two routers. The Non-Broadcast Multi-Access "NBMA" does not assign the DR/BDR as well because it uses the Hub and Spoke technology. An example of the NBMA is the Frame Relay. On a broadcast and non-broadcast the DR and BDR is normally elected. 
https://networklessons.com/ospf/ospf-drbdr-election-explained/

Clock Rate & Bandwidth cmds (serial int)
http://www.anythingoverip.co.za/tutorials/course-content/ccna/clock-rate-and-bandwidth-commands/

Which of the following command is used to set Frame Relay to use Cisco’s own encapsulation?
Configure Frame Relay encapsulation to use either Cisco or IETF encapsulations. If the encapsulation type is not specified, by default Cisco encapsulation is used.

The AVG (Active Virtual Gateway) responds to ARP (Address Resolution Protocol) requests for the default gateway IP address from all hosts. 
http://www.9tut.com/gateway-load-balancing-protocol-glbp-tutorial

GLBP or Gateway Load Balancing Protocol is also a Cisco-proprietary protocol that works like HSRP and VRRP but overcomes the limitation of existing FHRPs by adding a load balancing mechanism. VRRP or Virtual Router Redundancy Protocol is a form of FHRP or First Hop Redundancy Protocol. VRRP is an open standard FHRP that achieves availability and reliability of routing paths via automatic default gateway selections on an IP subnetwork by creating virtual routers. HSRP or Hot Standby Router Protocol is a Cisco-proprietary redundancy protocol that provides high network availability by providing first-hop redundancy for IP hosts on an IEEE 802 LAN configured with a default gateway IP address. 

"Router ID

A 32-bit number assigned to each router running the OSPF protocol. This number uniquely identifies the router within an Autonomous System."

 A method of selecting isn't stated. An example is given, but that's it. Per spec again:
 
"Router ID

This is a 32-bit number that uniquely identifies the router in the Autonomous System. One algorithm for Router ID assignment is to choose the largest or smallest IP address assigned to the router. If a router's OSPF Router ID is changed, the router's OSPF software should be restarted before the new Router ID takes effect. Before restarting in order to change its Router ID, the router should flush its self-originated LSAs from the routing domain (see Section 14.1), or they will persist for up to MaxAge minutes." Cisco happens to employ a method that some other vendors choose to follow, but not a requirement.If you have a loopback, that's the most stable interface on your router, so that will be used. If no loopback, just highest IP. If more than one loopback, highest of them.In many elections in OSPF, the higher RID wins thus the logic for choosing higher over lower.But you can manually specify a RID that isn't even possible to put as an "ip address" command.   

http://en.community.dell.com/support-forums/network-switches/f/866/t/19465205

Cisco Discovery Protocol (CDP) is a Layer 2 OSI model Cisco proprietary protocol used to find a Cisco neighbor device and learn about the type of hardware, software version, and active interfaces. CDP can be used by a L2 or L3 device. 

Cisco Discovery Protocol (CDP) is a Layer 2 Cisco proprietary protocol used to find a Cisco neighbor device and learn about the type of hardware, software version, and active interfaces. CDP can be used by a L2 or L3 device. In case that a Cisco IP phone is connected to an access port on a Layer 2 device and CDP is enabled, the switch will send CDP messages and discover the phone's information. It is possible to see the Cisco VoIP phone via the _show cdp neighbors” command on a Cisco switch.

Use the command show running-config to look at the current configuration. This command will display the active configuration file in memory including saved configuration changes. The working memory and running configuration are stored in RAM. _Show startup-config shows the backup configuration in NVRAM. The command _show memory displays the summary statistics about processor memory and I/O memory. There is no such command as _show current-config.

The command “show ip route” displays a summary of all configured routes in the router. The line “Gateway of last resort is not set” can be seen on the top of the output, which means that there is no gateway configured on the router R1. If no gateway is set and a packet with a destination not known by the routing table, reaches the router, the router will discard the packet. For more information refer to: [http://www.freeccnastudyguide.com/study-guides/ccna/ch4/routing/]

The command “show ip route” displays a summary of all configured routes in the router. A default gateway can be seen in the line “Gateway of last resort is 192.168.100.1 to network 0.0.0.0”, which means that any packet with unknown destination will be forwarded to its connected interface under the network 192.168.100.0/24, which can be seen below in the routing table. The line “C 192.168.100.0/24 is directly connected, Serial0/2”, states that packets destined to 192.168.100.0/24 will be forwarded via Serial0/2. For more information refer to: [http://www.freeccnastudyguide.com/study-guides/ccna/ch4/routing/]
https://www.skillset.com/tests?testId=50896
https://skillset.s3.amazonaws.com/img/question/43339/54d0037f-5668-49d8-96dc-4db10a0009b0       

Use the no form of command to disable a function or a feature in any Cisco Router or Switch. Use the "no" keyword to reenable a disabled feature or to enable a disabled feature disabled by default. Use the "disable" command to exit user mode. The keyword "default" can be used to return any command to its default value. Use the "end" keyword to finish the current configuration session and return the EXEC mode.  

sco Discovery Protocol (CDP) is a Layer 2 Cisco proprietary protocol used to find Cisco neighbor devices and learn about their type of hardware, software version, and active interfaces. CDP can be used by a L2 or L3 device. Theshow cdp neighbors delivers information about directly connected devices. Since R2 has only two physically attached devices and all devices have CDP enabled. Only R1 and SW2 will be displayed in the output of the command. CDP packets are not forwarded by Cisco Switches, it is only possible to see what is directly connected. 

Cisco Discovery Protocol (CDP) is a Layer 2 Cisco proprietary protocol used to find a Cisco neighbor device and learn about the type of hardware, software version, and active interfaces. For more information refer to: [Todd Lammle. - CCNA Routing and Switching Study Guide, Chapter 9] 

efore configuring an IPv6 version of a routing protocol, you have to enable first the forwarding of IPv6 Unicast Datagrams. To enable, issue the ipv6 unicast-routing global configuration command. The command ipv6 local enables IPv6 Policy Routing, ipv6 host configures static hostnames and ipv6 route configures static routing.   

he command _show protocols displays the status of layers 1 and 2 interfaces as well as the IP addresses used. The command _show ip protocols is different; it shows the routing protocols and timers associated with each routing protocol configured on a router. The command _show controllers displays information about the physical interface. The _show version command provides basic configuration for the system hardware as well as the software version. The command _show startup config displays the configuration that will be loaded the next time that the router is loaded. 
 <sh ip int bri - also possible>

Use the command show running-config to look at the current configuration. This command will display the active configuration file in memory including saved configuration changes. The working memory and running configuration are stored in RAM. _Show startup-config shows the backup configuration in NVRAM. For more information refer to: [http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/s5.html#]

Dynamic Host Configuration Protocol (DHCP) provides network configuration information to hosts, such as, IP Address, Subnet Mask, Default Gateway and DNS. DHCP eliminates the need to perform the configuration manually. DHCP allows easy administration and configuration for small to large networks. Manual configuration would work for small and large networks; however managing a large network through static configuration would become an issue. IPv4 auto-configuration is not intended for large networks. CDP is a L2 protocol used to find Cisco neighbors. For more information refer to: [Todd Lammle. - CCNA Routing and Switching Study Guide 2013, Chapter 3, page 98] 

The right sequence of messages for the DHCP client to initially find the IP information from the DHCP Server is as follows: DHCP Discover> DHCP Offer> DHCP Request> DHCP ACK. The message SYN does not exist in this DHCP negotiation. 

There are four basic steps in DHCP client IP address requests from the server. A DHCP client sends a DHCPDISCOVER broadcast message to locate a Cisco IOS DHCP server. Then, a DHCP server will offer configuration parameters to the client in a DHCPOFFER unicast. The client then will return a request for the offered IP address to the DHCP server in a DHCPREQUEST broadcast message. After which the DHCP server confirms with a DHCPACK unicast message to the client.

There are four basic steps in DHCP client IP address requests from the server. A DHCP client sends a DHCPDISCOVER broadcast message to locate a Cisco IOS DHCP server. Then, a DHCP server will offer configuration parameters to the client in a DHCPOFFER unicast. The client then will return a request for the offered IP address to the DHCP server in a DHCPREQUEST broadcast message. After which the DHCP server confirms with a DHCPACK unicast message to the client. However, there would be a situation when a DHCP server is unable to satisfy a DHCPREQUEST message, thus, responds with a DHCPNACK message. After receiving such message, the client restarts the configuration process by going into the Requesting state.


To enable the default gateway for the DHCP server, use the command "default-router" (default-router 172.16.1.1). To exclude a particular IP address from being distributed, use the command "ip dhcp excluded-address" (ip dhcp excluded-address 172.16.1.1 172.16.1.2).      


http://networkdiagram101.com/ - good tips!

The clockrate command is needed on a router (DCE) to provide clocking (speed) to the other end (DTE). If no clocking is configured a Layer 2 problem can occur. Another possible layer 2 problem is if the device is not recording the MAC addresses in the table. All other answers are typical layer 1 problems.


The command "nslookup" is used to do a look-up to the specific IP address associated with a domain name. Nslookup can be used for either Windows or Linux Operative sytems. The command "arp" is used to find the Layer 2 to Layer 3 address mappings in a host. The command "ping" is used to provide a basic connectivity test between the requesting host and a destination host. The diagnostic tool "nbstat" is used for NetBIOS over TCP/IP and is only for Windows computers. 

If physical layer is not properly functioning then higher layers will not work. A straight-trough cable is used to connect a network adapter (Router, PC, Firewall, etc) to a Switch or hub. If a straight-trough cable is used between two switches, communications will not work. Therefore to solve the issue the straight-through cable must be changed to a crossover cable. Autonegotiation can be used by devices that are capable of transmitting information at different rates, different duplex modes or different standards at the same speed. Autonegotiation can detect different speeds and duplex modes and use a defined one, but if cables are not properly installed, the negotiation will never happen. 

    

Tuesday, October 13, 2015

GNS3 to Real Network via USB.2.RJ45

GNS3 to Real Network via USB.2.RJ45

Belkin adapters working just fine
-- trunking between switches and also when connected into routers

Cost: 2x $3.49

802.1q and VLANS in Linux are just ok.

sudo apt install vlan
modprobe 8021q

ip link enx00051b00c31f 10
ifconfig enx00051b00c31f.10

-- if you need also routing -- sudo nano /etc/sysctl.conf
ipv4.forwarding = 1

-- to make the interfaces for VLANs permanent edit /etc/network or use NetworkManager -- Add New and bridge a VLAN to physical interface directly


                               #####################
 
-- NOTE: not possible to connect it to IOU directly if running in VM, docker is solution or PHY int bridged to VM's interface

-- Docker also can be used as lightweight PC -- google for Docker as Ubuntu based Virtual machine

Sunday, October 4, 2015

Security Attack avoidance :: Infographics

5 ways to protect yourself from a security attack – An infographic by the team at Pluralsight with security expert Troy Hunt.

Hacked! It doesnt have to happen to you! It has never been more important to keep your information secure. Just one security breach can compromise your whole digital identity.

Don't believe it could happen to you?

Switchport port-security

Switchport port-security


Security feature
- allows to limit maximum number of devices
- to control type / vendor of devices connected to switch









- Violations
- MAC categories
- Causes of violations
- Causes of violations

********************************************************************************

Switchport Violations

Before getting into the mechanics of how switchport security operates; it is important to review what happens should a violation occur. On Cisco equipment there are three different main violation types: shutdown, protect, and restrict. These are described in more detail below:
  • Shutdown – When a violation occurs in this mode, the switchport will be taken out of service and placed in the err-disabled state. The switchport will remain in this state until manually removed; this is the default switchport security violation mode.
  • Protect – When a violation occurs in this mode, the switchport will permit traffic from known MAC addresses to continue sending traffic while dropping traffic from unknown MAC addresses. When using this mode, no notification message is sent when this violation occurs.
  • Restrict – When a violation occurs in this mode, the switchport will permit traffic from known MAC addresses to continue sending traffic while dropping traffic from unknown MAC addresses. However, unlike the protect violation type, a message is also sent indicating that a violation has occurred.
**********************************************************************************

Switchport Security MAC Addresses

When using the switchport security feature, source MAC addresses are separated into three different categories, these include:
  • Static – Static secure MAC addresses are statically configured on each switchport and stored in the address table. The configuration for a static secure MAC address is stored in the running configuration by default and can be made permanent by saving them to the startup configuration.
  • Dynamic – Dynamic secure MAC addresses are learned from the device (or devices) connected to the switchport. These addresses are stored in the address table only and will be lost when the switchport state goes down or when the switch reboots.
  • Sticky – Sticky secure MAC addresses are a hybrid. They are learned dynamically from the devices connected to the switchport, are put into the address table AND are entered into the running configuration as a static secure MAC address (sometimes referred to as a static sticky MAC address). Like a static secure MAC address, these MAC addresses will be lost unless saved to the startup confi
  • guration.
The type of secure MAC addresses that an organization uses depends on the specific network environment (i.e.: Cisco phones / vendor, POS / type of device etc.)

**********************************************************************************

What causes a Switchport Violation?

  • The next question to ask is what causes a switchport violation; there are two situations that can cause a violation, these two situations include:

  • When the maximum number of secure MAC addresses has been added to a switchport’s address table and traffic from another MAC address is received on the switchport.
  • When an address that has been seen on a secure switchport has already been seen on another secure switchport in the same VLAN.
By default, one MAC is configured. What this means is that if more than one MAC address is seen on any given port a violation will occur.
By default, dynamic MAC entries in the address table will never time out (dynamic is the default method used for learning secure MAC addresses) as long as the switchport state remains up.

*********************************************************************************

Tshooting port security violation


When using dynamic MAC addresses
- engineers must physically disconnect the cable or shutdown the switchport to reset the dynamic entries in the address table. 

When using sticky MAC addresses
- the MAC address has to be manually removed from the running config or the switch must be rebooted to remove the contents from the address table.

If static secure MAC address
- must be manually removed from the running config to allow remove from the MAC address table. After that the device with a new MAC address can be connected to the switchport


----------------------------------------------------
Author's note:

DIY WiFi Microcontroller for hacking
Cisco was criticized in last months that their security focus is not ... powerful enough. On the other side many features used in production enviroment today were bring by Cisco.

Port security is very useful and NetOps Engineers should check more deeply in case that no device is found, alarms are raising OOBH etc.
With a raise of IoT even very small devices can do almost miracles
- See for example http://raspberrypi.com

Computer of creditcard size


Basic Cisco Switch config




***************************
   Basic Cisco Switch Config
***************************

enable secret password
!
hostname name
!
line con 0
exec_timeout 0 0
login
!
line vty 0 15
exec_timeout 0 0
login
!


###  Login Local ###

conf t
line vty 0 15
login local
end
!
conf t
username payo secret cisco1          <<<<<<<<< sha-256 (type 4) hash
username root password cisco2
ip domain-name example.com
crypto key generate rsa
1024
!
ip ssh version 2
end
!


                            *** overeni ***
                      sh ip ssh
                      sh ssh


######## Hiding Passwords ########

service password-encryption

enable secret 5 (7) secret   <<<< password!!!


*// nepouzivat enable secret password pass
!



####### Banner ######

conf t
banner C
......................................
 TEXT BANNERU
.....................................
C

banner login C

zneni textu pod motd bannerem
C

banner exec C

banner se objevi po zalogovani - pred enable
C





####### IP adresa #######

Na switchi nelze priradit IP adresu na interface - je treba

!
conf t
interface vlan 1
ip address 192.168.1.200 255.255.255.0
no shutdown
exit
!

! in case of dhcp
int vlan 1
ip address dhcp
no shutdown
!

! IP address na L2 switchi muze byt bind to 1 int only
! when configuring need to choose which vlan
! will be assigned for management
! L3 switch je ok s vice vlans

!
ip default gateway 192.168.1.1 255.255.255.0
!

do wr
end



********************* Verify IPv4 *****************************

sh dhcp lease
sh int vlan 1
sh ip default gateway

CHECK IF:
state up/up
if you see IP configured
*** dynamic from DHCP / nothing if failed ***

************************************************************

###########################

Configure Switch Interface

###########################

conf t
int Fa0/1
duplex full
speed 100
description ** WAN Connection **
exit
!
interface range Fa0/11 - 15
description *** NO Connection ***
shutdown
exit
!

- config of both speed and duplex disables autonegotiation

********** VERIFY ************

sh int stat
sh int sum
sh int AAx/y

******************************

##################

PORT SECURITY

##################

enable per port
each port maximum allowed MACs
if violated - by default shutting down all connections on port
sticky is savings MACs from all interfaces in config

!
conf t
int fa0/1
switchport mode access (switchport mode trunk)
switchport port-security
switchport port-security maximum xx





###############
 VLAN Config
###############

nepouzivat auto creation on interface

conf t
vlan number
int Fa0/0
switchport mode access | trunk
switchport access vlan number































Monday, September 14, 2015

Serial connection in Linux / ttyUSB


USB Serial / console connection in Linux

List all USB devices:
lsusb ----------------
Show USB Serial Devices & Drivers
cat /proc/tty/driver/usbserial
 ----------------
Show dev output of USB Serial
cat /proc/devices | grep -i "ttyUSB"
ls -al /dev/ttyUSB*
----------------
Change permissions for USB Serial to wrk properly (you might use 666)
chmod 777 /dev/ttyUSB* ----------------
Connect via minicom terminal (Ctrl+A Z to show menu, O to Serial Port Config, change settings as needed - usually only speed)




sudo apt install minicom
sudo minicom --device /dev/ttyUSB0

----------------
You might also use a PuTTY (Ubuntu has it in repo)
sudo apt search putty
sudo apt install putty putty-tools
----------------

Personally using a Quad Console Cable
Future Technology Devices International, Ltd FT4232H Quad HS USB-UART/FIFO IC

usb 1-12.1: FTDI USB Serial Device converter now attached to ttyUSB0
usb 1-12.1: FTDI USB Serial Device converter now attached to ttyUSB1
usb 1-12.1: FTDI USB Serial Device converter now attached to ttyUSB2
usb 1-12.1: FTDI USB Serial Device converter now attached to ttyUSB3



Thursday, July 9, 2015

Firewall Config

Firewall Configuration

adding rules before enabling the firewall 
ufw allow proto tcp from any to any port 22

       before running 'ufw enable'
ufw limit ssh/tcp
ufw allow log 22/tcp
ufw deny proto udp from 1.2.3.4 to any port 514


For example, when IPv6 is enabled, the following rule will allow
       access to port 22 for both IPv4 and IPv6 traffic:

         ufw allow 22
       IPv6 over IPv4 tunnels and 6to4 are supported by using the 'ipv6'  pro‐
       tocol  ('41'). This protocol can only be used with the full syntax. For
       example:

         ufw allow to 10.0.0.1 proto ipv6
         ufw allow to 10.0.0.1 from 10.4.0.0/16 proto ipv6

     ufw report *****

         raw
         builtins
         before-rules
         user-rules
         after-rules
         logging-rules
         listening
         added
       The  raw  report  shows  the complete firewall, while the others show a
       subset of what is in the raw report.

ufw logging *****

off    disables ufw managed logging
low    logs all blocked packets not matching the default  policy  (with
          rate limiting), as well as packets matching logged rules
medium log level low, plus all allowed packets not matching the default
              policy, all INVALID packets, and all new connections.  All  log‐
              ging is done with rate limiting.
high   log  level medium (without rate limiting), plus all packets with
              rate limiting

full   log level high without rate limiting