Saturday, August 8, 2009

Periodical Configuration Save of Cisco Devices

Periodical configuration save of Cisco devices can be done from inside the device by using a combination of "kron" and "archive" commands. As we had no routine of taking backup of our router but yesterday after a long search now i have successfully configured all stuff like backup, monitoring my router through Nipper (see my full blog on it, click Nipper), Now i will take my backup and will save at remote place :).

Define the location of your configuration save apart from the default Flash location. Based on your IOS support, this can be a HTTP, HTTPS, FTP, or TFTP path. I am taking the backup using tftp.

The following commands is used to enable archive and define the path, while third command is used that when ever someone copy configuration to NVRAM so it will take backup also.

PSW-DXX (config) # archive
PSW-DXX (config-archive)# path tftp://10.110.1.22/
PSW-DXX(config-archive) # write-memory


If you want to suppress the display of password information in configuration log files, use the hidekeys command in configuration change logger configuration mode. or To allow the display of password information in configuration log files, use the no form of this command

PSW-DXX (config)# archive
PSW-DXX (config-archive)# log config
PSW-DXX (config-archive-log-cfg)# hidekeys or no hidekeys
PSW-DXX (config-archive-log-cfg)# exit


To enable the logging of configuration changes, use the logging enable command in configuration change logger configuration mode. To disable the logging of configuration changes, use the no form of this command.

PSW-DXX (config-archive-log-cfg)# logging enable
or
PSW-DXX (config-archive-log-cfg)# no logging enable


To specify the maximum number of entries retained in the configuration log, use the logging size command in configuration change logger configuration mode. By default value is 100. To reset the default value, use the no form of this command.

PSW-DXX (config-archive-log-cfg)# logging size 200


2. KRON

Define the policy list for the scheduler. The following is calling the "write config" command which will trigger the copy over network from the above:

PSW-DXX (config) # kron policy-list backup-config
PSW-DXX (config-kron-policy) # cli write memory


Define the schedule of the policy. The following example is for ten minutes past evening, everyday:

PSW-DXX (config) # kron occurrence daily-config-backup at 05:10 recurring
PSW-DXX (config-kron-occurrence) # policy-list backup-config


Note: Every time the "write memory" command is issued, the device will trigger a network copy to the path specified above.

I hope this will be informative for you. :)

Cheers :)

Friday, August 7, 2009

Audit your Cisco router's security with Nipper

While recently googling on a net, I learned about Nipper. Although there are many security tools that i studied which is used to perform security audits of network devices, but i found Nipper unique, so i configure this on our office (SNGPL) production router.

What is Nipper (Network Infrastructure Parser), Nipper is an open source network devices security auditing tool. One benefit of being open source is that it’s free :)Previously known as CiscoParse, Nipper isn’t especially polished, but it is very functional. It was easy to install and easy to use.

Even more impressive :) is that it works with many different types of network devices (and not just Cisco). Here’s a list of compatible network devices that Nipper can audit:

Cisco switches (IOS)
Cisco routers (IOS)
Cisco firewalls (PIX, ASA, FWSM)
Cisco Catalyst switches (NMP, CatOS, IOS)
Cisco Content Service Switches (CSS)
Juniper NetScreen Firewalls (ScreenOS)

How to use NIPPER ?

Nipper supports a lot of devices and provides many options, so I here i can’t possibly demonstrate all those options. what i do is to show you the basic demonstration. For our example, we’ll use Nipper to audit a Cisco router that has only the default configuration.

To begin, I took a Cisco 1841 router. First, download Nipper from SourceForge.net it’s available for both Windows and Linux. Extract it to a folder on your local PC; let’s call it C:\nipper as i have done like this.

Next, obtain a text version of the router’s configuration file. Telnet or SSH to the router, use the show running-configuration command, copy and paste the output into Notepad, and save it to your local PC in the aforementioned C:\nipper directory.

Alternatively, you can use a TFTP server and copy the configuration to your local PC. For example, I tried this using Tftpd32.exe, and it was both quick and easy. Use the following command to copy the file if some one don't know how to do :)

PSW-DXX # copy startup-config tftp:
Address or name of Remote Host: 10.110.1.22
Destination filename[startup-config] yes
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! OK :)


Once you have the running configuration that you want to audit on your PC, go to the Windows command prompt, and CD into the Nipper directory. Run the following, as shown in Figure A:




C:\nipper> nipper --ios-router --input=startup-config.txt --output=audit.html


The system will immediately return you to the command prompt without providing any information. But don’t worry — it worked.

Next, open a Web browser and enter this URL: c:\nipper\audit.html. This will take you to the security report. Figure B offers a screenshot of the audit.




What does Nipper tell you?

Scrolling through this report, you’ll see that Nipper provides security audit information such as:

1. A software version that has vulnerabilities and the reference numbers for those vulnerabilities
2. Recommendations to disable services that might cause others to be able to access the router
3. Commands that you need to enable to secure the router
For our example, Nipper told us that we need to do the following:

a): Upgrade the router’s IOS needs to prevent vulnerability to a Telnet remote DoS attack and a TCP listener DoS attack.
b): Configure the service tcp-keepalives-in command to help prevent a DoS attack.
c): Configure timeouts on consoles to prevent anyone from gaining access to the router from a Telnet or console session.
d): Configure the HTTP service as secure with HTTPS, and enable authentication.
Enable logging.

In addition to several other recommendations, Nipper provided a summary of the device’s configuration — what services are turned on or off, status of the lines, status of the interfaces, DNS, time zone, and more. Check out the actual report from our example.

Considering that it’s so small, simple, and free, Nipper is an amazingly powerful network device security auditing tool. For help with Nipper, run the C:\nipper\nipper -help command at the command prompt after you’ve downloaded, extracted, run the program.

I hope it will be informative for you as i found it very useful :)

Enjoy!

10 commands you should master when working with the Cisco IOS

The Cisco IOS provides thousands of commands, and configuring it can be challenging. Here are 10 commands that we should need to know while using the Cisco IOS.

1: " ? " (Help):

The "?", It may seem entirely too obvious that you should know how to type ? to ask for help when using the Cisco IOS. However, the Cisco IOS is completely different from other operating systems when it comes to using the question mark (help key). As the IOS is a command-line operating system with thousands of possible commands and parameters, using the ? can save our day.

We can use the command in many ways. First, use it when you don’t know what command to type. For example, type ? at the command line for a list of all possible commands. we can also use ? when we don’t know what a command’s next parameter should be. For example, you might type show ip ? If the router requires no other parameters for the command, the router will offer cr (carrige return) means it is the only available option. Finally, use ? to see all commands that start with a particular letter. For example, show c? will return a list of commands that start with the letter c.

2: show running-configuration

The show running-config command shows the router, switch, or firewall’s current configuration. The running-configuration is the config that is in the router’s memory. You change this config when you make changes to the router. Keep in mind that config is not saved until you do a copy running-configuration startup-configuration. The shortcut for this command is sh run.

3: Save Configuration

This command will save the configuration that is currently being modified (in RAM), also known as the running-configuration, to the nonvolatile RAM (NVRAM). If the power is lost, the NVRAM will preserve this configuration. In other words, if you edit the router’s configuration, don’t use this command and reboot the router–those changes will be lost (if you want to do so). This command can be abbreviated copy run start. The copy command can also be used to copy the running or startup configuration from the router to a TFTP server in case something happens to the router.

Router # copy running-configuration startup-configuration


4: show interface

The show interface command displays the status of the router’s interfaces. Among other things, this output provides the following:

Interface status (up/down)
Protocol status on the interface
Utilization
Bandwidth
Errors
Delay
MTU

This command is essential for troubleshooting a router or switch. It can also be used by specifying a certain interface, like sh int fa0/0.

Router # show interface


or for specific interface

Router # show interface fastethernet 0/0


5: show ip interface

Even more popular than show interface are show ip interface and show ip interface brief. The show ip interface command provides tons of useful information about the configuration and status of the IP protocol and its services, on all interfaces. The show ip interface brief command provides a quick status of the interfaces on the router, including their IP address, Layer 2 status, and Layer 3 status.

6: config terminal, enable, interface, and router

Cisco routers have different modes where only certain things can be shown or certain things can be changed. Being able to move between these modes is critical to successfully configuring the router.

For example, when logging in, you start off at the user mode (where the prompt looks like >). From there, you type enable to move to privileged mode (where the prompt looks like #). In privileged mode, you can show anything but not make changes. Next, type config terminal (or config t) to go to global configuration mode (where the prompt looks like router(config)# ). From here, you can change global parameters. To change a parameter on an interface (like the IP address), go to interface configuration mode with the interface command (where the prompt looks like router(config-if)#). Also from the global configuration mode, you can go into router configuration using the router {protocol} command. To exit from a mode, type exit.

Router >

Router >enable.............Router #

Router # configure terminal ......... Router (config) #

Router (config) # interface fasethernet 0/0

Router (config-if) #


7: no shutdown

The no shutdown command enables an interface (brings it up). This command must be used in interface configuration mode. It is useful for new interfaces and for troubleshooting. When you’re having trouble with an interface, you may want to try a shut and no shut. Of course, to bring the interface down, reverse the command and just say shutdown. This command can be abbreviated no shut.

8: show ip route

The show ip route command is used to show the router’s routing table. This is the list of all networks that the router can reach, their metric (the router’s preference for them), and how to get there. This command can be abbreviated sh ip route and can have parameters after it, like shiproospf for all OSPF routers. To clear the routing table of all routes, you do clear ip route *. To clear it of just one route, do clear ip route 1.1.1.1 for clearing out that particular network.

Router # show ip route


9: show version

The show version command gives you the router’s configuration register (essentially, the router’s firmware settings for booting up), the last time the router was booted, the version of the IOS, the name of the IOS file, the model of the router, and the router’s amount of RAM and Flash. This command can be abbreviated shver.

10: debug

The debug command has many options and does not work by itself. It provides detailed debugging output on a certain application, protocol, or service. For example, debug ip route will tell you every time a router is added to or removed from the router.

Router # debug interface serial 0/1/0


I hope it will be informative for you :)

Thursday, August 6, 2009

Cisco HDLC (Why called Cisco HDLC ?)

High-level Data Link Control, a layer-2 (data-link layer) transmission protocol. The HDLC protocol embeds information in a data frame that allows devices to control data flow and correct errors. For any HDLC communications session, one station is designated primary and the other secondary. A session can use one of the following connection modes, which determine how the primary and secondary stations interact.

Normal unbalanced: The secondary station responds only to the primary station.

Asynchronous: The secondary station can initiate a message.

Asynchronous balanced: Both stations send and receive over its part of a duplex line. This mode is used for X.25 packet-switching networks.

The Link Access Procedure-Balanced (LAP-B) and Link Access Procedure D-channel (LAP-D) protocols are subsets of HDLC.

Q: Now question comes why it is called cisco HDLC? because cisco added some very important features like:

1. Keepalive Mechanism

2. Added serial link address resolution protocol (SLARP), It is used for the purpose of auto-installation like when router boot up so to fine the TFTP server, get the configuration including IP address etc.

I hope it will be informative for you!

3. Added STAC compression, Its a good one but very processor heavy.

4.
Performance Increase (7 - 12 Byte), The header size is increase and this is the beauty of HDLC and works efficiently across WAN.

I Hope this will be informative for You!

Error: %SNMP-3-DVR_DUP_REGN_ERR: Attempt for dupe

ERROR:

SEC 8:000049: Jan 31 22:25:00.760:
%SNMP-3-DVR_DUP_REGN_ERR: Attempt for dupe
regn with SNMP by driver having ifIndex 709 and ifDescr Tunnel0
-Traceback= 204128 204230 92DB90 92DF6C B2CF8C BBF368 BC00C8 1C4EFC 1C5524

1C60B8 1C655C 2EC5CC


Cisco IOS Release 12.4(13b) is a rebuild release for Cisco IOS Release 12.4(13). The caveats (warning) in this section are resolved in Cisco IOS Release 12.4(13b) but may be open in previous Cisco IOS releases.

The following information is provided for each caveat (warning):

•Symptoms—A description of what is observed when the caveat occurs.

•Conditions—The conditions under which the caveat has been known to occur.

•Workaround—Solutions, if available, to counteract the caveat.

Basic System Services
•CSCeb20967

Symptoms: A Route Switch Processor (RSP) may reload unexpectedly when a bus error with an invalid memory address occurs while packets are placed into a hold queue.

[1] "Conditions: This symptom is observed on a Cisco 7500 series that runs Cisco IOS Release 12.0 S, 12.1(14)E4, or 12.2 S when the following sequence of events occurs:

1. A packet is switched via Cisco Express Forwarding (CEF).

2. The egress interface has queueing/shaping configured.

3. The egress interface is congested, causing the packet to be placed into the hold queue."

Symptoms: The following SNMP error message and tracebacks are seen:

SEC 8:000049: Jan 31 22:25:00.760:
%SNMP-3-DVR_DUP_REGN_ERR: Attempt for dupe
regn with SNMP by driver having ifIndex 709 and ifDescr Tunnel0
-Traceback= 204128 204230 92DB90 92DF6C B2CF8C BBF368 BC00C8 1C4EFC 1C5524

1C60B8 1C655C 2EC5CC

Conditions: This symptom was see when new interfaces were added (or existing interfaces like tunnel come up) after bootup, or when new or existing interfaces come up after RPR+ switchover when running Cisco IOS Release 12.0(32)S6. Also, this symptom occurs if the snmp ifindex persist command is configured on the router.


Further Problem Description: Though customer traffic is not affected, this symptom does impact the SNMP stats and other SNMP data for both the original and the new interface. Usually the message is from the standby RP, so once that standby RP becomes active, the data from SNMP polls of these interfaces would not be accurate.

[1] www.cisco.com/en/US/docs/ios/12_4/release/notes

Monday, August 3, 2009

Virtual Links



Yesterday I was thinking of writing something related to OSPF so something crossed my mind and on that very moment I start to write about it, so here we go that is “VIRTUAL LINKS”.
Suppose we have a complicated network and we use OSPF as our IGP and we configure different areas in it, I assume that the reader of virtual link must know how to configure multiple area OSPF and what is the concept behind it, I will talk directly about the virtual link, what is it, how it works, and what is the purpose of virtual links.

When an area is not directly connected to area 0 (backbone area) so it can’t communicate, a concept is used for it and that is called Virtual Links make able the area to communicate. See figure a, we have two routers namely R1 and R2, The fastethernet of R1 is configured under area 0, link between R2 and R1 is configured under area 1 and R2 fastethernet is configured under area2, now the LAN of R2 will not be able to communicated to R1 as it is not directly connected to R1 so we have to configure Virtual Link between R1 and R2 so what it will do is that the area 0 will be expand logically to R2 covering area 1 with it, now from R2 point of view there will two areas area 0 and area 2.

1: In the figure, Area 2 is not directly connected to Area 0 so we have to create a transit link on Area 1 to make able the communication between Area 2 and Area 0.
2: Here the Area 0 expand logically
3: After Virtual the R2 becomes Area Boarder Router (ABR).

NOTE: If a router connects two areas but none of the area is Area 0 so the router will never be ABR.

Conditions for Virtual Links

1: Link between two routers when made so one of the router must be part of back-bone area (Area 0).
R1-------R2-------> Link can be configured
If we another router R3 connected to router R2
R2------R3------> Can’t configure link as non of the router is directly connected to area 0.
2: When link is made between two routers, so one area must be common between them like
R1-----R2 (Area 1 is common)
R1-----R3 (Nothing is common)

NOTE: For Virtual Link both he condition must be satisfied.

OSPF Configuration

A(config) # router ospf 1
A(config) # network 2.0.0.0 0.255.255.255 area 2
A(config) # network 200.100.100.0 0.0.0.255 area 2

B(config) # router ospf 1
B(config) # network 2.0.0.0 0.255.255.255 area 2
B(config) # network 3.0.0.0 0.255.255.255 area 1
B(config) # network 200.100.150.0 0.0.0.255 area 1

C(config) # router ospf 1
C(config) # network 3.0.0.0 0.255.255.255 area 1
C(config) # network 200.100.200.0 0.0.0.255 area 0


Virtual Link Configuration

B(config) # router ospf 1
B(config) # area 1 virtual-link 200.100.200.100

C(config) # router ospf 1
C(config) # area 1 virtual-link 200.100.150.100


Now check your Router-A routing table , the Router-C route will be there by using following command.

A # show ip route

Saturday, August 1, 2009

GUI Root Login Problem in Fedora-11

For the first time when i download Fedora-11 from the internet that was for "Live User" so after installation i try to login as a root from GUI so i was unable as it show "Unable to Authenticate User" so i thought may be it is not allowed for live user, but yesterday i installed the full version of Fedora-11 but still i was unable to login as root through GUI although i can from terminal so after some goggling i found that Fedora-11 by default doesn't allow someone to login as root through GUI. Instead you have to login as a normal user and become root through your terminal. However many users still want to login as root like me. Don't forget that once you login as root its easier to damage your system so don't do the following unless you are sure what you are doing.
Before doing any change just take backup of the file

$ cp /etc/pam.d/gdm /root

Step # 1

$ su -c 'gedit /etc/pam.d/gdm'

or

$ su

$ vi /etc/pam.d/gdm


Here in this file find the following line,

auth required pam_succeed_if.so user != root quiet

either delete or comment it better comment it

#auth required pam_succeed_if.so user != root quiet

Save the file and logout.

Step # 2

Do the same for /etc/pam.d/gdm-password

$ su -c 'gedit /etc/pam.d/gdm-password'

or

$ su

$ vi /etc/pam.d/gdm-password


Here in this file find the following line,

auth required pam_succeed_if.so user != root quiet

either delete or comment it better comment it

#auth required pam_succeed_if.so user != root quiet

Save the file and logout.

After this i was able to login successfully as a root through GUI.