IOS: Alias commands

alias exec srb sh run | beg
alias exec srs sh run | sec
alias exec srii sh run | incl
alias exec sri sh run interface

alias exec sib sh ip int brief
alias exec sibi sh ip int brief | inc 

alias exec sid show int description
alias exec sidi show int description | inc

alias exec sis show int status
alias exec sise show int status err
alias exec sisi show int status | inc 

alias exec sir sh ip route
alias exec siri sh ip route | inc 

alias exec mac show mac address-table | inc
alias exec arp show ip arp | inc

alias exec dhcp show ip dhcp snoop bind
alias exec hsrp show stand brief
alias exec proch show proc cpu history
alias exec proc show proc cpu sort | exc 0.00%  0.00%  0.00%
alias exec snmp show run | sec snmp-

alias exec ospf show run | sec router ospf
alias exec ospfn show ip ospf neigh 
alias exec ospfi show ip ospf interf brief
alias exec bgp show run | sec router bgp
alias exec cdp show cdp ne | ex SEP

alias exec ntpa show ntp assoc
alias exec ntps show ntp status

Essential Network Tools

Putty
An open source telnet and SSH Client for the Windows and Unix platforms.
http://www.chiark.greenend.org.uk/~sgtatham/putty/

Putty Connection Manager
PuTTY Connection Manager is a windows PuTTY tool to manage multiple PuTTY instances using tabs in a single window.
http://puttycm.free.fr/

Wireshark

Wireshark is a network protocol analyzer for Unix and Windows
http://www.wireshark.org/

Network Scanner
Network Scanner is a free multi-threaded IP, NetBIOS and SNMP scanner with a modern interface and several advanced features.
http://www.softperfect.com/products/networkscanner/

LAN Search Pro
LAN Search Pro is a free utility for fast file searching across your LAN. You can search for specific file names or for specific file types (e.g. all MP3 files).
http://www.softperfect.com/products/lspro/

Solarwinds TFTP Server / Client
SolarWinds free TFTP Server is a multi-threaded TFTP server commonly used to upload and download executable images and backup configurations for routers and switches.
http://www.solarwinds.com/products/freetools/free_tftp_server.aspx

RealVNC
RealVNC provides remote control software which lets you see and interact with desktop applications across any network.
http://www.realvnc.com/products/free/4.1/index.html

WinSCP
Open source freeware SFTP, FTP and SCP client for Windows.
http://winscp.net/

IPv4 Multicast cheat sheet

Useful:

http://www.packetlife.net/blog/2008/jun/9/ipv4-multicast-cheat-sheet/

Putty - but better

Most people will have likely come across PuTTY, the Open Source terminal emulator. It's quick, easy and pretty ubiquitous in it's accessibility (to devices).

One annoyance is that it is a single-window application, and that firing up multiple SSH or Telnet sessions created lots of individual windows. In these tabbed-app days, that seems a bit Windows95.

However, this somewhat stodgy way of working can now be relieved with the use of an application called PuTTY Connection Manager, which can fire up individual SSH or Telnet sessions as tabs. Additionally, your saved PuTTY sessions can be presented as a folder tree, which simplifies opening the individual sessions.

It still uses PuTTY as the underlying engine, but overlays the Connection Manager to give an easier working experience.

How Not To Use BGP

When the Pakistani government took umbrage at YouTube and unilaterally decided to block it's evil content from the innocent minds of the populace, some bright spark decided the best way would be for the Pakistani ISP(s) to highjack one of the YouTube IP prefixes, as advertised via BGP.

The result?
One of the biggest sites on the Internet blown out of the water, and millions of global web users sending their YouTube requests to the hapless Pakistani ISP(s).

An object lesson in how not use BGP.

The RIPE site has an excellent technical brief on this...

http://www.ripe.net/news/study-youtube-hijacking.html

How to setup IAS to use radius to authenticate Cisco device

Rather than go out and buy the Cisco ACS server, and then have to setup a new user/device database, it's quite easy to use an existing Windows (Active Directory) user database.

The Cisco-preferred method is of course the Cisco ACS server and TACACS+ - nothing wrong with that; it works fine, is feature rich and is quite easy to set-up and get going. The downside is that someone has to manage the ACS server (or appliance, if you go down that road), and maintain the user database (although it's possible to get the user data from AD...)

I reckon it's better to:

• Utilise an existing user database, freeing up network guys to do what they do best - networking stuff.
• Let the server bods worry about looking after server stuff - the server itself , Windows updates, Anti Virus, etc. etc.
• Leverage something that comes free - in this case Windows IAS (Internet Authentication Service), thus saving dosh for more interesting things

However, it's not all a bed of roses - this isn't really a scalable solution for dozens of devices. There's no way to wild card Radius requests from your devices, so you need to add each router/switch/firewall/etc. individually, so it can be a bit laborious.

So how to set it up?
Firstly, the Cisco device (I'll call them switches from now on, and assume that we're running Cisco IOS, not ye olde Catalyst OS) will be using Radius to authenticate, not TACACS+. This part is quite easy, as the commands to set up Radius authentication is pretty straightforward.

Secondly, we need to set up the Windows IAS server. This is less straightforward, as it involves lots of mouse clicking and menus. It works fine, but needs careful attention to detail.

I won't go through the whole "how to set up IAS" thing, because there are other sites out there that have already done this work. See links below:
Cisco AAA login with Radius (MS IAS)
How to setup IAS to use radius to authenticate Cisco device

In our organisation, we have several AD Domain Controllers - a pair at head office and a pair at our data centre. So I installed IAS on all four, and as the majority of our kit is located at head office, the head office pair authenticate access to head office kit, and the data centre pair authenticate access to kit at the data centre and remote sites.

To set up the Cisco side, the following commands should entered from Exec mode:

aaa new-model
aaa authentication login default group radius local line
aaa authorization exec default group radius local
aaa accounting exec default start-stop group radius
aaa accounting network default start-stop group radius
aaa accounting connection default start-stop group radius
radius-server host [IP ADDRESS] auth-port 1812 acct-port 1813
radius-server host [IP ADDRESS] auth-port 1812 acct-port 1813
radius-server source-ports 1645-1646
radius-server retransmit 1
radius-server timeout 2
radius-server key [SECRET KEY]
radius-server vsa send accounting
radius-server vsa send authentication

and on the CON & VTY lines, make sure you add:

login authentication default

And that's it. Test drive before you go live.

Dynamips, dynagen and GNS3

I've recently been playing around with these router emulators, and I can honestly say I've been impressed. I've tried the three above-mentioned applications in various combinations on differing platforms (Windows XP and Ubuntu Linux), and have had some degree of success in simulating a new project I'm currently working on.

In terms of application, dynamips and dynagen on both XP and Ubuntu are pretty solid. I've tested various platforms (7200, 2600, etc.) and various WAN and LAN scenarios and have been happy with the results.

GNS3 I've only played with on XP, and whilst it's extremely useful, I found it a bit buggy and crash prone. But I guess it's early days for that application, so I won't be too harsh - and I've recomended it to colleagues to try out, which is a kind of endorsement.

What did this help me with? Well, we're in the process of moving from a single ISP to dual ISP configuration, each providing 100Mbps circuits, and we are therefore getting 'provider independent' IP address space and our own BGP ASN.

So I plotted out a scenario with two local internet routers, connecting to two separate ISP routers and an Internet mesh behind them. Internal BGP, external BGP, firewalling and dynamic failover of Internet. All tested on a single XP machine. It makes that test rig I built almost redundant...

Links:

Dynamips
Dynagen
GNS3

Cisco IOS Hardening

When I started at my current job, the various Cisco gear (routers, switches, firewalls, APs), as is usual in a small-but-growing-fast company, had a variety of configuration standards, IOS versions and access policies. So one of the first things I did was tidy up the standard part of the configs, such as banners, SNMP, NTP and remote access (Telnet/SSH) access. Happily, most of this kind of thing is pretty much boilerplate these days, and I'd done it previously (in another job), so it was quite quick to implement.

I've published it below, for your own use, but remember to test anything before deploying it.

References and source material for the template include:

Secure IOS template at Cymru.com
US National Security Agency Secure Configuration Guides
The O'Reilly Hardening Cisco Routers book
Plus the Cisco website

Some stuff that is recommended to be disabled, such as SNMP and CDP, I leave running. Less secure overall, but I think that is offset by usefulness. You can go further than I have, and secure NTP traffic for example, and I haven't mentioned securing routing protocols (OSPF, EIGRP).

Nor have I mentioned that we offload local access authentication to RADIUS - I'll save that for another day.

The template:

###########################################################################
#
# Secure IOS Template
#
# The Network Guy 2005,2006,2007,2008.
#
# You are free to use this template, but you use it at
# your own risk. Test before deploy.
# You have been warned.
# IF IN DOUBT - RTFM (http://www.cisco.com/univercd/home/home.htm)
#
###########################################################################
#
# GLOBAL COMMANDS
#
# Turn off non-required services
#
no service tcp-small-servers
no service udp-small-servers
no ip bootp server
no ip finger
no ip source-route
no ip gratuitous-arps
no service finger
no service config
no boot host
no boot network
no boot system
no service pad
no ip http server
no ip domain-lookup
###########################################################################
# Miscellaneous
######
# Set enable secret password
enable secret
######
# allow the zero subnet as host
ip subnet-zero
######
# stop icmp flood attacks using rate limiting
ip icmp rate-limit unreachable 1000
######
# stop syn-flood attacks by timing out orphaned syns after 10s
ip tcp synwait-time 10
######
# Stop any single process from hogging CPU
scheduler interval
scheduler allocate
######
# Generate tcp keepalive packets
service tcp-keepalives-in
service tcp-keepalives-out
######
# Ensure copious timestamp info
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
######
# Ensure passwords are encrypted by default
service password-encryption
######
# Turn on multicast
ip multicast-routing
#
######
# Enable SSH access - note I specifiy 1024 bit key gen -
# SSH client PUTTY don't like the default 512 bit
#
ip domain-name
crypto key generate rsa
1024
ip ssh time-out 60
ip ssh authentication-retries 2
######
# ensure a local username of last resort is configured
username admin priv 15 password
###########################################################################
# Logging Details
#
logging
logging
logging facility local7
logging trap informational
logging history warning
logging buffered 100000 notifications
###########################################################################
# SNMP Details
# Annoyingly, in 12.2 IOS on Catalyst 6500 switches
# you have to use numbered ACL to secure SNMP
# See ACL section below
#
snmp-server community ro
snmp-server community rw
snmp-server ifindex persist
snmp-server trap-source loopback0
snmp-server enable traps
snmp-server host
#
###########################################################################
# Secure Banners
# Banner below is 'best practice' secure from NSA
#
#
banner login %

*** WARNING ***

If has not authorised your access to this system, you
will be committing an offence under the Computer Misuse Act
1990 if you attempt to proceed.

Authorised users may access only such systems and
information as they need in the course of their work for
. All other actions are unauthorised.

UNAUTHORISED ACCESS IS STRICTLY PROHIBITED

Any unauthorised access will be considered an act of gross
misconduct and will render you liable to disciplinary action,
possibly including dismissal and/or prosecution.





%
###########################################################################
# Logs are no good if every device has a different timestamp -
# Use NTP
# Set timezone (for the UK) and clock details
# Set NTP Servers
#
clock timezone GMT 0
clock summer-time BST recurring last Sun Mar 2:00 last Sun Oct 2:00
ntp server
ntp server
#
#################################################################
#
# Access Lists
#
######
# Which hosts are allowed to access this device
ip access-list standard mgmt-access
permit
permit host
# Same but numbered
ip access-list 97 permit
ip access-list 97 permit host
#
######
#
# Which hosts can telnet in as a last resort
ip access-list standard mgmt-access-last-resort
permit host
permit host
# Same but numbered
ip access-list 98 permit
ip access-list 98 permit host
######
#
# Deny any access list - used to stop stuff leaving the router
ip access-list extended deny-all
deny ip any any log
#
# Same, but numbered.
access-list 99 deny any log
######
#
#################################################################
#
# Secure access to the actual device
#
######
# Secure the console
#
line con 0
password
exec-timeout 5 0
logging synchronous
escape-character 23
login
######
# Secure the VTY terminals
#
line vty 0 3
password
access-class mgmt-access in
access-class deny-all out
exec-timeout 10 0
logging synchronous
transport input telnet ssh
escape-character 23
login
#
# Create an emergency VTY terminal
#
line vty 4
password
access-class mgmt-access-last-resort in
access-class deny-all out
exec-timeout 10 0
logging synchronous
transport input telnet ssh
escape-character 23
login
######
###########################################################################
# Disable potentially malicious services per interface (inc. physical, VLAN, loopback)
# To be applied to all LAN, WAN and logical ports
#
#
Interface
no ip proxy-arp
no ip unreachables
no ip redirects
no ip mask-reply
no ip directed-broadcast
###########################################################################