myITmicroblog

With many VPN tunnels in your production environment you may be asked to modify some policies. What kind of tasks you can do without impact on the business traffic and what can be performed only during a change window? You can add a new ACE, it doesn’t terminate tunnels:   R4 ( config - ext - nacl )# do sh runn | s access ip access - list extended VPN permit ip host 150.1 . 4.4 20.0 . 0.0 0.0 . 0.255 R4 ( config - ext - nacl )# per R4 ( config - ext - nacl )# permit ip R4 ( config - ext - nacl )# permit ip 150.1 . 4.0 0.0 . 0.255 20.0 . 0.0 0.0 . 0.255 R4 ( config - ext - nacl )# R4 ( config - ext - nacl )# As you see nothing happened, but when you remove any entry, even not related with your SA you can see:   R4 ( config - ext - nacl )# do sh run | s access ip access - list extended VPN permit ip 150.1 . 4.0 0.0 . 0.255 20.0 . 0.0 0.0 . 0.255 permit ip host 150.1 . 4.4 20.0 . 0.0 0.0 . 0.255 R4 ( config - ext - nacl )# R4 ( config - ext - n...

http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/vpn_site2site.html#wp1042401 You can find one statement under the above link: “Configure ACLs that mirror each other on both sides of the connection.” The answer is: not really. Let’s test it: one peer has following encryption domain:   asa1 # sh run access-list access - list VPN extended permit ip 20.0 . 0.0 255.255 . 255.0 host 150.1 . 4.4 asa1 # one the second one:   R4 ( config - ext - nacl )# R4 ( config - ext - nacl )# do sh runn | s access ip access - list extended VPN permit ip 150.1 . 4.0 0.0 . 0.255 20.0 . 0.0 0.0 . 0.255 R4 ( config - ext - nacl )# As you see the ACL on my ASA is more specific (host 150.1.4.4). Before I initiate traffic let’s check the ipsec sessions:   R4 #sh crypto session Crypto session current status Interface : FastEthernet0 / 0 Session status : DOWN Peer : 10.0 . 0.1 port 500 IPSEC FLOW ...

In my today post I’d like analyze different version of traceroute on three platforms. You need to know exactly what protocols/types are used when you would like to permit them on your firewall. 1) Cisco version I’m going now traceroute from R17 to R18: This is what I captured on R17 interface: Let me explain what we see: R17 sends udp packet with ttl=1 to discover device in one hop distance. R16 decrements ttl by 1 and sees that ttl=0 and sends icmp packet ‘time exceeded): -> udp - dst port : 33434 , ttl = 1 <- icmp - time exceeded ( due to ttl = 0 ) - type 11 , code 0 - ttl = 255 -> udp - dst port : 33435 , ttl = 1 <- icmp - time exceeded ( due to ttl = 0 ) - type 11 , code 0 - ttl = 255 -> udp - dst port : 33436 , ttl = 1 <- icmp - time exceeded ( due to ttl = 0 ) - type 11 , code 0 - ttl = 255 After three repeats R17 increases ttl by 1 and sends next three packets. R15 receives them, decrease...

In today’s post I would like to look closer into one feature - proxy arp. On Cisco routers it is enabled by default and I think it’s worth of writing about possible pros and cons. To be on the same page just few words about ARP (Address Resolution Protocol). ARP is used to resolve IP addresses to MAC (physical). When we want to send packet to a host with known IP address, we need first know its MAC or MAC of a next hop. This is place where ARP start its job. Let’s look into below diagram. Assume that R1 has never contacted with R3 and I’m going to check its ARP table:   R1 #sh ip arp Protocol Address Age ( min ) Hardware Addr Type Interface Internet 10.0 . 0.1 - ca00 . 18c4.0008 ARPA FastEthernet0 / 0 R1 # As you see I have only one entry with IP and MAC of the local interface. Before I ping R3 I enable debugging to see what’s happening behind the scene.   R1 #debug arp ARP packet debugging is on R1 #...