Upgrade Cisco IOS in a Router or a Switch

upgrading IOS on Cisco routers and switches is hightly recommendable because of the following reasons

Patch critical vulnerabilities: Just like any other network device or application, Cisco routers and switches are also prone to security holes. And because routers and switches are critical to network infrastructure, you should plug these security holes as soon as possible.

Incorporate new features: Unless an update is simply a bug fix, every new release of the Cisco IOS includes new features. Upgrading your routers and switches in a timely manner means you’ll have more features to potentially make your job easier.

Stay current: “Staying current” with the latest IOS may sound like a flimsy justification to upgrade, especially when you consider your daily task list. However, when you consider the many different tools that communicate with the router’s IOS, staying current can take on a new importance. For example, if you’re using a SNMP network management tool, it may require your router to run a certain version of the IOS.

Follow this procedure if you want to upgrade cisco IOS

NOTE :- Before doing any upgrades plesae take a complete backup of your cisco device configuration for safer side

Download the Correct version of Cisco IOS for you from here http://www.cisco.com/tacpage/sw-center/index.shtml

Write Unsaved configurations

ciscorouter# write memory
Building configuration…
[OK]

Check space on Flash Memory

ciscorouter# show flash

Make sure you have the space left on your cisco device.

Backup Startup Configuration

Setup a TFTP server in the same IP range as the Cisco device to backup the configs, IOS image and also for later to upload the new IOS image.

testrouter# copy startup-config tftp
Address or name of remote host []? 10.10.10.2
Destination filename [startup-config]?
!!
1278 bytes c opied in 0.100 secs

Backup Current IOS Image

testrouter# copy flash: tftp:
Source filename []? xxxxx-xx-xx.121-x.XB
Address or name of remote host []? 10.10.10.2
Destination filename [xxxxx-xx-xx.121-x.XB]?

Now, Load the new IOS image from the TFTP onto the flash

ciscorouter#copy tftp: flash:
Address or name of remote host []? 10.10.10.2
Source filename []? c3560-ipbasek9-mz.122-40.SE.bin
Destination filename [c3560-ipbasek9-mz.122-40.SE.bin]?
Accessing tftp://10.10.10.2/c3560-ipbasek9-mz.122-40.SE.bin…
Loading c3560-ipbasek9-mz.122-40.SE.bin from 10.10.10.2 (via Vlan1): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!
[OK - 8295106 bytes]

8295106 bytes copied in 124.571 secs (66589 bytes/sec)

Now you need to make sure you are booting with the correct version of IOS image for this you need to use the following command to set.

testrouter(config)#boot system flash:/c3560-ipbasek9-mz.122-40.SE.bin

Now you need to reload the Cisco Router

testrouter# reload

After rebooting cisco device with the new Cisco IOS image you need to make sure this use the following command

testrouter# sh ver

That’s it now we are using the latest IOS on your cisco device

CISCO IOS Software Installation and Upgrade Procedure

 OS Software Installation and Upgrade Procedure

This procedure applies to the following Cisco products:

    Cisco 10001
    Cisco 14001
    Cisco 1600-R
    Cisco 1700
    Cisco 2600
    Cisco 3600

    Cisco 3700
    Cisco 4000
    Cisco 4500
    Cisco 4700
    Cisco AS53001
    Cisco MC3810

Introduction

This document explains the procedure for upgrading a Cisco IOS® Software image on Access router platforms. The examples provided from the 2600 and 3600 Series Routers also apply to the list of router platforms mentioned below. The Cisco IOS software file names may vary depending on the Cisco IOS software version, feature set, and platform.The following Cisco series routers are addressed in this document:

    Cisco 1000 Series Routers
    Cisco 1400Series Routers
    Cisco 1600-R Series Routers
    Cisco 1700 Series Routers
    Cisco 2600 Series Routers
    Cisco 3600 Series Routers
    Cisco 3700 Series Routers
    Cisco 4000 Series Routers
    Cisco 4700 Series Routers
    Cisco AS5300 Series Routers
    Cisco MC3810 Series Routers

The information in this document is based on Cisco IOS Software Release 12.0 or later.

The Field Engineer must receive permission from Cisco VISE that a software image upgrade is required, BEFORE carrying out any of these procedures.
Before You Begin

Step 1: Install a TFTP Server
A Trival File Transfer Protocol (TFTP) server or a Remote Copy Protocol (RCP) server application must be installed on a TCP/IP-ready workstation or PC. Once the application is installed, a minimal level of configuration must be performed.

    Note: Cisco no longer supply or support their own TFTP Server application, however searching within your favourite search engine for "TFTP Server" will locate a third party TFTP application for you. Alternatively, you may find Cisco's unsupported TFTP Server application on the COMPASS CD.

    First, the TFTP application must be configured to operate as a TFTP server as opposed to a TFTP client.

    The outbound file directory must be specified. This is the directory in which the Cisco IOS Software images are stored. Most TFTP applications provide a set-up routine to assist in these configuration tasks.

Step 2: Request which IOS Software Image is to be used.
The Field Engineer must ask the VISE engineer or the customer, which image is to be upgraded. It is not the responsibility of the Field Engineer to recommend software image versions. The software image may be provided by the customer, and so the Field Engineer must ask the Cisco VISE engineer for directions.

Step 3: Download the Cisco IOS Software Image
Download the Cisco IOS Software image into your workstation or PC from the Cisco website (http://www.cisco.com).
Software Installation and Upgrade Procedures

    Routers with Internal Flash (for example, 2600 Series Routers)
    Routers with PCMCIA Flash cards (for example, 3600 Series Routers)

Cisco 2600 Series Routers Upgrade Procedure

    Establish a console session to the router
    Verify that the TFTP server has IP connectivity to the router
    Copy the new image into the Flash memory of the 2600 Series Router through the TFTP server

Step 1: Establish a console session to the router

Even if it is possible to connect to the router through a telnet session, it is strongly recommended to be directly connected to the router using the console port. The reason is that if something goes wrong during the upgrade, it might be necessary to be physically located next to the router to power-cycle it. Moreover, the telnet connection will be lost while the router is rebooting during the upgrade procedure.

A rolled cable (usually a flat black cable) is used to connect the console port of the router to one of the COM ports of the PC.

Once the PC is connected to the console port of the router, you need to open Hyperterminal on the PC, and use the following settings:

         Speed 9600 bits per second

         8 databits

         0 parity bits

         1 stop bit

         No Flow Control

Note: If you are getting any garbage characters in the hyperterminal session, this means that you have not set the hyperterminal properties properly, or the config-register of the router is set to a non-standard value for which the console connection speed is higher than 9600 bps.  Check the value of the config-register using the show version command (shown in the last line of the output) and ensure it is set to 0x2102 or 0x102. It is necessary to reload the router for a configuration register change to take effect. Once you are sure the console speed is set to 9600 bps on the router side, you should check the hyperterminal properties as above .

Booting Problems

Once you are connected to the console port of the router, you might notice that the router is either in ROMmon or Boot mode. These two modes are used for recovery and/or diagnostic procedures. If you do not see the usual router prompt, you should follow the recommendations below to proceed with the upgrade procedure installation.

    Router boots in rommon mode, and the following message appears when you issue dir flash: command.

        rommon 1 > dir flash:
        device does not contain a valid magic number
        dir: cannot open device "flash:"
        rommon 2 >

    When you see the above error message, it means the Flash is empty or the filesystem is corrupted. A Xmodem console download procedure using ROMmon may then be necessary.
    Router boots in boot mode, with the following messages on the console:

        router(boot)>
        device does not contain a valid magic number
        boot: cannot open "flash:"
        boot: cannot determine first file name on device "flash:"

    When you get the above error messages on the console output, it means the Flash is empty or the file system is corrupted. Copy a valid image on the Flash by following the procedures provided in this document.

Step 2: Verify that the TFTP server has IP connectivity to the router

The TFTP server must have a network connection to the router, and must be able to ping the IP address of the router targeted for a TFTP software upgrade. To achieve this, the router interface and the TFTP server must have:

        an IP address in the same range, or

        a default gateway configured.

To verify this, check the IP address of the TFTP server.
Step 3: Copy the new image into the Flash memory of the 2600 Series Router through the TFTP server

    Now that you have IP connectivity and can ping between the computer acting as a TFTP server and the router, you can copy the Cisco IOS Software image into the Flash.

    Note: Before copying, make sure you have started the TFTP server software on your PC and that you have the filename mentioned in the TFTP server root directory. We recommend that you keep a backup of the router/access server configuration before upgrading. The upgrade itself does not affect the configuration (which is stored in nonvolatile RAM (NVRAM). However, this might happen if the right steps are not followed properly.

    For RCP applications, substitute RCP for every occurrence of TFTP. For example, use the copy rcp flash command instead of the copy tftp flash command.

        2600> enable
        Password:xxxxx
        2600#
        2600# copy tftp flash

    If necessary, you can copy an image from one device to another.
    Specify the IP address of the TFTP server.

    When prompted, enter the IP address of the TFTP server as in the following example:

        Address or name of remote host []? 10.10.10.2

    Specify the filename of the new Cisco IOS Software image.

    When prompted, enter the filename of the Cisco IOS Software image to be installed, as in the following example:

        Source filename []? c2600-i-mz.121-14.bin

    Note: The filename is case sensitive, so be sure to enter it correctly.
    Specify the destination filename.

    This is the name the new software image will have when it is loaded onto the router. The image can be named anything, but common practice is to enter the same image filename.

        Destination filename []? c2600-i-mz.121-14.bin

    Note: If you see the below error message:

    %Error copying tftp://10.10.10.2/c2600-i-mz.121-14.bin
    (Not enough space on device) 

    This indicates that there is not enough room available in Flash to copy the image. You need to erase a file(s) before copying the new image from the TFTP server.
    Upgrade the new image from a TFTP server

    2610#copy tftp flash
    Address or name of remote host []? 10.10.10.2
    Source filename []? c2600-i-mz.121-14.bin
    Destination filename [c2600-i-mz.121-14.bin]?y
    Accessing tftp://10.10.10.2/c2600-i-mz.121-14.bin...
    Erase flash: before copying? [confirm]y !---If there is not enough
                                     !--- memory available, erase the Flash
    Erasing the flash filesystem will remove all files! Continue? [confirm]y
    Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
    eeeeeeeeee ...erased
    Erase of flash: complete
    Loading c2600-i-mz.121-14.bin from 10.10.10.2 (via Ethernet0/0): !!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    [OK - 4501480/9001984 bytes]

    Verifying checksum...  OK (0xAC8A)
    4501480 bytes copied in 56.88 secs (80383 bytes/sec)

    The copying process takes several minutes; the time differs from network to network. During the copy process, messages are displayed to indicate which file has been accessed.

    The exclamation point "!" indicates that the copy process is taking place. Each exclamation point indicates that ten packets have been transferred successfully. A checksum verification of the image occurs after the image is written to Flash memory.

After you have upgraded the Flash, you need to reload the router using the reload command.

Before you reload the router, you need to check two things:

    The value of the config-register - You can check this using the show version command. The value is shown in the last line of the show version output. It should be set to 0x2102.

        2610#configure terminal
        Enter configuration commands, one per line.  End with CNTL/Z.
        2610(config)#config-register 0x2102
        2610(config)#^Z

    The other files on the Flash - If the first file in the Flash is not the Cisco IOS Software image, but a configuration file or something else, then you need to configure a boot system statement in order to boot the specified image. Otherwise, the router will try to boot with the configuration file or the first file in the Flash; this will not work. If there is only one file in the Flash which is the Cisco IOS Software image, then this step is not necessary.

        2610#configure terminal
        Enter configuration commands, one per line.  End with CNTL/Z.
        2610(config)#no boot system
        2610(config)#boot system flash c2600-i-mz.121-14.bin
        2610(config)#^Z

Note: If you type the reload command, the router asks you if you want to save the configuration. You should be very cautious here. The reason is that if the router is in boot mode for instance, it is a subset of the full Cisco IOS software which is running and there is no routing functionality. Therefore, all the routing configuration is gone in the running configuration and if you save the configuration at this time, then you erase the good startup-configuration in NVRAM and replace it by the incomplete running-configuration. Save the configuration only if you are sure that you have the full configuration in the output of show run. It is NOT necessary to save the configuration to take into account the new config-register if this one has been changed previously. That is done automatically.

    2610#reload
    
    System configuration has been modified. Save? [yes/no]: y
    Building configuration...
    [OK]
    Proceed with reload? [confirm]y

Verify that the router is running with the proper image. After the reload is complete, the router should be running the desired Cisco IOS Software image. Use the show version command to verify.

    2610#show version
    00:22:25: %SYS-5-CONFIG_I: Configured from console by console
    Cisco Internetwork Operating System Software
    IOS (tm) C2600 Software (C2600-I-M), Version 12.1(14), RELEASE SOFTWARE (fc1)
    Copyright (c) 1986-2002 by cisco Systems, Inc.
    Compiled Mon 25-Mar-02 20:33 by kellythw
    Image text-base: 0x80008088, data-base: 0x80828788

    ROM: System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1)

    2610 uptime is 22 minutes
    System returned to ROM by reload
    System image file is "flash:c2600-i-mz.121-14.bin"

Does Webtrends use ELA

Webtrends uses LEA (Log Export API), not ELA.  LEA is the opposite of ELA; it allows FW-1 to send events to a 3rd party reporting application. Although it is possible to use Webtrends with manually exported log files, I believe they recommend using LEA as the preferred interface between the two.

Per Check Point: "WebTrends Firewall Suite integrates with the Log Export API (LEA) of the OPSEC architecture in VPN-1/FireWall-1. When LEA is used, a secure connection is set up between WebTrends Firewall Suite and VPN-1/FireWall-1. This connection provides the mechanism that safely and securely transfers data between the firewall and the analysis engine. By encrypting data at the firewall, LEA ensures that firewall logs are not tampered with during transport. The LEA connection also facilitates the creation of real-time reports without the need to export complete log files at every update interval, saving time and bandwidth resources."

How to configure SecuRemote for a split DNS configuration, to make it get the Secure Domain Login functions working with a 4.1 SP2 firewall and a Windows 98 client

Many pointed out that getting SDL to work correctly can be very challenging.  From Gregor Munro an exact fix that worked for him.  He suggests cutting and pasting the solution (included below), directly into your $FWDIR/conf/dnsinfo.C file, and then editing it to suit your network.  The reason you should not try to start this file from scratch is that spacing and case are extremely important.  For example, using an "LMData" tag will not work - it needs to be "LMdata."

--Begin $FWDIR/conf/dnsinfo.C-- 
( 
:LMdata ( 
: ( 
:ipaddr (10.0.0.1) 
:name (MERLIN) 
:domain (ROUNDTABLE) 
) 
: ( 
:ipaddr (10.0.0.1) 
:name (MERLIN) 
) 
) 
) 
--End $FWDIR/conf/dnsinfo.C-- 

How to block Kazaa and other network sharing programs

Blocking of Kazaa under NG AI is as follows

Open SmartDefence window

Application Intelligence / Web / HTTP Protocol Inspection / Peer to Peer

You will see the application, chech which you want to blok and check Peer to Peer.

Select the configuration apply to all connection in HTTP Protocol Inspection.



If you want to know more about Kazaa or you run a version previous to NG AI



Initial configuration of Kazaa version 1
Kazaa is only one of a whole culture of peer-to-peer file-sharing networks/programs:  Gnutella, eDonkey, BearShare, etc ad infinitum

Kazaa version 2 uses dynamic ports

How to block it on a firewall
Block them by port number.  This doesn't scale well, and fails completely with the ones that search for unblocked port numbers to
use.  (While to you, a firewall should be a "policy enforcement device", to your users and the authors of these applications, it's just an obstacle to be surmounted.)
If a client uses a HTTP port program like KazaaHTTP, there are very few options that you have as it will tunnel the kazaa traffic over HTTP from the client’s desktop. If you have a novice userbase, simply blocking the port of 1214 should suffice.
If you are using Checkpoint NG, FP3 is supposed to include the additional content filtering needed to block applications like Kazaa.
If you are blocking port 1214, you also have to block all outgoing socks-traffic, because kazaa-client supports Socks-Proxy and
there exists enough free socks-proxy.  The second thing, if you are blocking socks then you also have to block all outgoing http/https-traffic, because you can tunnel socks-traffic over http/https with tools like httport.


How to block it on a Cisco router
access-list 101 deny   tcp any any eq 1214

What measure you should take
Add a content-filtering solution to your border security.  This is about the only way you're going to block stuff that piggy-backs on
well-known service ports (80, 25, etc) in order to circumvent firewalls.



What you should also know about Kazaa

Unfortunately when you install KaZaa you also get at least one virus installed on your computer. I call it a virus because by most descriptions I've seen of the term, TopText qualifies as a virus. You don't ask for it. It takes control of your browser and makes changes to everything you read on the Internet.

TopText operates with a browser to highlight words on every web page, inserting a yellow background behind keywords that have been purchased through their media sales company eZula, Inc. If a web user clicks on one of those yellow highlighted words on a web page, the user is whisked away to the site of the company paying the most that day for each click-through. If a user whose browser is infected with TopText visits your web site, they will be offered links to competitor's web sites for every keyword they find on your site for which they have a buyer.

This is not much, if any, different from the Smart Tags system that Microsoft announced for their Windows XP browser. Media and webmaster pressure and outrage caused Microsoft to cancel, for now, their release of that feature.

Boot Image Recovery on Cisco ASA firewall

Here are the required steps to recover from a missing or corrupt boot image:

• Connect a console cable from the ASA to your computer and open up a serial connection using Putty
• Disable any software firewall on your computer
• Install TFTP server software on your computer – I used Solarwinds TFTP server
• Place the Cisco software image in the TFTP-Root folder (asa821-k8.bin) and start the TFTP service
• Assign a static IP address to your computer – I used 192.168.20.1 (an address outside of my existing subnet)
• Connect an Ethernet cable between your computer and port 0/0 on the ASA
• Power off the ASA then power it back on
• Press the escape key to boot into ROMMON mode
• Enter the following commands in the ASA (the first part of these commands must be in caps)
  rommon #1> ADDRESS=192.168.20.10
  rommon #2> SERVER=192.168.20.1
  rommon #3> GATEWAY=192.168.20.1
  rommon #4> IMAGE=asa821-k8.bin
  rommon #5> PORT=Ethernet0/0
• These commands assign an IP address of 192.168.20.10 to port 0/0 on the ASA and tell it to look at your TFTP server 192.168.20.1 and to select the ASA software image.
• Next, execute the command to transfer the image from the TFTP server to the ASA
  rommon #6> tftp

Client and Server side NAT relates to when we perform destination NAT`ing.
The "Translate destination on Server side" option is an legacy option which was included due to pre NG versions of checkpoint using Server-Side NAT.

• Client Side NAT - The destination address is NAT`d by the inbound Kernel
• Server Side NAT - The destination address is NAT`d by the outbound Kernel

Note !! Source NAT always happens on the Outbound Kernel.
Note !! Rule > NAT - The kernels will  always process the rules before the NAT.
So why does this matter ?
Well when we use client side NAT the IP address is NAT`d before it hits the routing table. So we can route the packet based on the real IP. 
But when we use Server side NAT the IP is NAT`d after passing the routing table so there has to be a route for NAT`d (fake) IP in the routing table so that the operating system can pass the packet to the correct interface.
To explain things a little easier have a look at the diagram below,

So we want to access the server (10.8.8.1). If we use Client Side NAT the inbound kernel will NAT the destination IP (192.168.8.1) to the real IP (10.8.8.1) and then pass the packet to the (OS) routing table. Which as you can see will have the routing entry for this subnet and pass it out (via the outbound kernel) to the interface (eth0).
But if we use Server Side NAT the packet would not get NAT`d by the inbound kernel. It would get to the (OS) routing table with a destination of 192.168.8.1. Which, there is no entry for. We would need to add an entry to the routing table.  Once added the operating system would know where to route this packet, the packet would pass through the outbound kernel which would NAT the destination IP to 10.8.8.1.
Note: Client AND Server side NAT are options ONLY for destination NAT.

IGMP

To Allow multicast traffic from 224.0.1.50 on the outside and traffic to go through the PIX to outside interface.

(config)#Access-list 109 permit udp any host 224.0.1.50

(config)#Interface Ethernet0

(config-if)#Igmp access-group 109

(config)#Interface ethernet1

(config-if)#Igmp forward interface outside

(config-if)#Igmp join-group 224.0.1.50

Multicast IP range

224.0.0.0 239.255.255.255

224.0.0.1 multicast broadcast

Protocol Independent Multicast Sparse Mode

Saves flooding the networks with multicast packets. Using a R Point.

Below Enables multicast routing.

Sets the address of the RP
Sets the priority of PIX interface to 5 (default 1)

(config)#multicast-routing

(config)#pim rp-address 172.16.10.1

(config)#interface ethernet1

(config-if)pim dr-priority 5

General show commands for multicast forwarding information database

Show mfib
Show mrib
Debug igmp
Debug mfib
Debug mrib

Cisco PIX - Routing

Static
To send all traffic to 192.168.0.1 out the outside interface.
To send any traffic in 10.0.1.0/24 to 10.0.0.1 out the inside interface

(config)#Route outside 0 0 192.168.0.1
(config)#Route inside 10.0.1.0 255.255.255.0 10.0.0.1

RIP
Allow RIP updates to be received on the outside interface with a key of cisco and id of 2.
Pass RIP updates out the inside interface

(config)#rip outside passive version 2 authentication md5 cisco 2
(config)#rip inside default

Allow RIP v2 passive on the the outside and dmz interface and Allow RIP v1 passive on the inside

(config)#rip outside passive version 2 authentication md5 cisco 2
(config)#rip inside passive
(config)#rip dmz passive version 2

OSPF

To configure OSPF with the standard 3 interfaces (inside,outside,DMZ)

(config)#router ospf 1
(config-router)#network 1.1.1.0 255.255.255.0 area 0
(config-router)network 172.16.0.0 255.255.0.0 area 172.16.0.0
(config-router)network 10.0.0.0 255.255.255.0 area 10.0.0.0

To filter LSA3 advertisments out from area 0 so that the internal network is denied but the DMZ is allowed.
(config-router)area 0 filter-list prefix testlist
(config)#prefix-list testlist deny 10.0.0.0/16
(config)#perfix-list testlist permit 172.16.0.0/16

PIX - Active-Active Configuration

To enable active-active 2 security contexts on both PIXs will need to be created. One context being active and one stand by.

Create a stateful link

hostname(config)#failover link if_name phy_if

hostname(config)#failover interface ip if_name ip_addr mask standby ip_addr

hostname(config)#interface phy_if

hostname(config-if)#no shutdown

Create Groups

hostname(config)#failover group 1

hostname(config-fover-group)#primary

hostname(config-fover-group)#exit

hostname(config)#failover group 2

hostname(config-fover-group)#secondary

hostname(config-fover-group)#exit

The admin context is always a member of failover group 1

hostname(config)#context context_name

hostname(config-context)#join-failover-group {1 | 2}

hostname(config-context)#exit

Enable on Primary device first

hostname(config)#failover

PIX - BGP Advanced Protocol Inspection

Summary

When passing BGP traffic through a PIX you will need to configure the PIX to disable random sequence numbers to prevent MD5 Digest mismatches on either router.

Please Note : Below presumes you all ready have a policy map defined with the name of global_policy and this has already been assigned to your device using the service-policy command.

Commands

access-list BGP-MD5-ACL permit tcp host [BGP ROUTER IP] host [BGP ROUTER IP] eq bgp

tcp-map BGP-MD5

tcp-options range 19 19 allow

class-map BGP-MD5-CLASSMAP

match access-list BGP-MD5-ACL

policy-map global_policy

class BGP-MD5-CLASSMAP

set connection random-sequence-number disable

set connection advanced-options BGP-MD5

PIX / ASA - Display Encrypted Pre-Shared Keys.

To allow you to view your preshared keys on your PIX ASA use the command `more system:running-config`.

You can also view the preshared password with some versions of ASDM. Below shows the example of the command.

pixfirewall# show run

!

tunnel-group mytunnel type ipsec-ra

pre-shared-key *

telnet timeout 5

Your preshared key .....

pixfirewall# more system:running-config

!

tunnel-group mytunnel type ipsec-ra

pre-shared-key MYPRESHAREDKEY

telnet timeout 5

How do I configure shared licensing on an ASA

A shared license lets you purchase a large number of SSL VPN sessions and share the sessions as needed amongst a group of security appliances by configuring one of the security appliances as a shared licensing server, and the rest as shared licensing participants.
Further information on shared licensing can be found here

Below shows the steps on how to configure a Shared License server.

1. Install Cisco license key, run the commands:

1.activation-key key

2.reload

2. Configure license server :

1.license-server enable interface (Inside interface)           

2.license-server secret   ‘your-password’

3.license-server port port  50554

4.license-server refresh-interval 100

5.wr mem

3.  Configure shared license ASA’s.

1.license-server address  X.X.X.X  secret [password] port 50554

2.wr mem

4.  Confirming shared license  - show shared license

01.hostname >  show shared license

02.Primary License Server : 10.3.32.20

03.Version              : 1

04.Status               : Inactive

05. 

06.Shared license utilization:

07.SSLVPN:

08.Total for network :     5000

09.Available         :     5000

10.Utilized          :        0

11.This device:

12.Platform limit    :      250

13.Current usage     :        0

14.High usage        :        0

15.Messages Tx/Rx/Error:

16.Registration    : 0 / 0 / 0

17.Get             : 0 / 0 / 0

18.Release         : 0 / 0 / 0

19.Transfer        : 0 / 0 / 0

ASA 8.3 - How to configure NAT

As you will have heard (and if not you will do soon) the new ASA 8.3 brings massive changes. The main change is the way in which the ASA handles NAT. Rather the configuring NAT at purley the interface level NAT is now configured within network objects.
That way in which is now configured is :

1. Create a network object.
2. Within this object define the Real IP/Network to be translated.
3. Also within this object you can use the the nat commands to specifiy whether the translation will be dynamic or static.

Examples

Configuring Dynamic NAT
The following example configures dynamic NAT that hides 192.168.2.0 network behind a range of outside addresses 2.2.2.1-2.2.2.10:

1.hostname(config)# object network my-range-obj

2.hostname(config-network-object)# range 2.2.2.1 2.2.2.10

3.hostname(config)# object network my-inside-net

4.hostname(config-network-object)# subnet 192.168.2.0 255.255.255.0

5.hostname(config-network-object)# nat (inside,outside) dynamic my-range-obj

Dynamic PAT (Hide NAT)
The following example configures dynamic PAT that hides the 192.168.2.0 network behind address 2.2.2.2:

1.hostname(config)# object network my-inside-net

2.hostname(config-network-object)# subnet 192.168.2.0 255.255.255.0

3.hostname(config-network-object)# nat (inside,outside) dynamic 2.2.2.2

The following example configures dynamic PAT that hides the 192.168.2.0 network behind the outside interface address:

1.hostname(config)# object network my-inside-net

2.hostname(config-network-object)# subnet 192.168.2.0 255.255.255.0

3.hostname(config-network-object)# nat (inside,outside) dynamic interface

Configuring Static NAT or Static NAT with Port Translation
The following example configures static NAT for the real host 1.1.1.1 on the inside to 2.2.2.2 on the outside with DNS rewrite enabled.

1.hostname(config)# object network my-host-obj1

2.hostname(config-network-object)# host 1.1.1.1

3.hostname(config-network-object)# nat (inside,outside) static 2.2.2.2 dns

The following example configures static NAT for the real host 1.1.1.1 on the inside to 2.2.2.2 on the outside using a mapped object.

1.hostname(config)# object network my-mapped-obj

2.hostname(config-network-object)# host 2.2.2.2

3.hostname(config-network-object)# object network my-host-obj1

4.hostname(config-network-object)# host 1.1.1.1

5.hostname(config-network-object)# nat (inside,outside) static my-mapped-obj

The following example configures static NAT with port translation for 1.1.1.1 at TCP port 21 to the outside interface at port 2121.

1.hostname(config)# object network my-ftp-server

2.hostname(config-network-object)# host 1.1.1.1

3.hostname(config-network-object)# nat (inside,outside) static interface service tcp 21 2121

ASA Capture Examples

Below are a couple of ASA caputre examples. This is meant for more of a copy and paste function then an overall capture tutorial.

access-list based

1.access-list capture1-acl permit ip host [ip] host [ip]

2.capture capture1 type access-list capture1-acl interface [interface]

 

host / port based

1.capture capture2 [interface] match ip host [ip] host [ip]

2.capture capture3 [interface] match udp host [ip] host [ip] eq 500

Cisco ASA MPF URL Filtering

Within this tutorial will will look at 2 configuration examples in which we will use HTTP inspection within the Cisco ASA to allow access for certain hosts based on specific URL headers.

EXAMPLE 1

This example will show the required syntax to allows access to yahoo.com for any host within the network 10.1.1.0 255.255.0.0. HTTP traffic for any other host is denied.
In addition to the commands below you will also need to grant the relevant access via your interface based ACL`s. This is because your HTTP traffic will first hit interface based ACL`s before reaching the ASA`s application inspection layer.
Your access-list will need to consist of a permit for http traffic from your host(s) through to any. An example would be :

access-list acl-inside-in extended permit tcp any any eq www

Steps

1. Create regular expressions

regex urlallow1 "yahoo\.com"

2. Define hosts that are either allowed access or not.

access-list acl-mpf-http1 extended permit tcp 10.1.1.0 255.255.0.0 any eq www
    access-list acl-mpf-http1 extended deny ip any any

3. Define match conditions - here we match any header that is not equal to the previous defined regular expressions (urlallow1).

class-map type inspect http match-all class-http1
match not request header host regex urlallow1

4. Assign previous access-lists to class-map.

class-map class-http-match1
match access-list acl-mpf-http1

5. Create policy map and assign the class map (class-http1). Against this class map an action is assigned.

policy-map type inspect http policy-http1
parameters
   class class-http1
      drop-connection log

6. Under the global_policy map,  assign the http inspection policy map against the match class map (class-http-match1) .

policy-map global_policy
class class-http-match1
    inspect http policy-http1

7. Assign global_policy to all interfaces.

service-policy global_policy global

EXAMPLE 2

This example will show the required syntax to allows access to yahoo.com for any host apart from 192.168.1.100.
In addition to the commands below you will also need to grant the relevant access via your interface based ACL`s. This is because your HTTP traffic will first hit interface based ACL`s before reaching the ASA`s application inspection layer.
Your access-list will need to consist of a permit for http traffic from your host(s) through to any. An example would be :
access-list acl-inside-in extended permit tcp any any eq www

Steps

1. Create regular expressions

regex urlallow1 "yahoo\.com"

2. Define hosts that are either allowed access or not.

access-list acl-mpf-http1 extended deny tcp host 192.168.1.100 any eq www
    access-list acl-mpf-http1 extended permit ip any any

3. Define match conditions - here we match any header that is not equal to the previous defined regular expressions (urlallow1).

class-map type inspect http match-all class-http1
match not request header host regex urlallow1

4. Assign previous access-lists to class-map.

class-map class-http-match1
match access-list acl-mpf-http1

5. Create policy map and assign the class map (class-http1). Against this class map an action is assigned.

policy-map type inspect http policy-http1
parameters
   class class-http1
      drop-connection log

6. Under the global_policy map,  assign the http inspection policy map against the match class map (class-http-match1) .

policy-map global_policy
class class-http-match1
    inspect http policy-http1

7. Assign global_policy to all interfaces.

service-policy global_policy global

How to clear an ASA`s configuration

You may find that there is a time in which you havent got access via the standard ASAOS CLI to change, amend or edit your current configuration.
In this example we will show you the steps required for removing the configuation via ROMMON mode.
Here are the steps :
1. Reboot the device

2. On boot hit `escape` so that you break the normal startup process and enter ROMMON.

3. Change the current confreg so that you can bypass the current startup config sing the command:

1.rommon #1>confreg 0x41

 

4. Reset the appliance with the boot command,

1.rommon #2>boot

 

5. You will then be presented with the ScreenOS CLI and the ASA having a completey clear config. Run the commands :

1.ciscoasa > en [when asked for password just press enter]

2.ciscoasa # conf t

3.ciscoasa (config)# config-register 0x01

4.ciscoasa (config)# copy run start

5.ciscoasa (config)# reload

 

6. Your ASA will now be rebooted and the device will be booted into a blank configuration.