Tag Archives: Cisco

Cisco develops smart robot nodes to maintain network connectivity.

I found this via slashdot ….

Military & Aerospace Electronics – Cisco develops smart robot nodes to maintain network connectivity while on the move Company engineers built prototype cube-shaped robots that sense when a laptop computer user is about to lose wireless network connectivity and move toward the user to maintain the network link, said Dave Buster, product marketing manager for the Cisco Global Government Solutions Group (GGSG) in Research Triangle Park, N.C.

Ok, on first glance you think, how cool what a gimmick, and then you smile as you see the colour from your IT security officers face drain away… the chances are that they have spent hours tuning the radios so that very little WIFI leaks outside the building, now imaging a robot that will follow you outside and all that effort is wasted. I think there’s a good lesson here, obscurity isn’t security, if your WIFI is rock solid then a little exposure won’t be a problem.

In general I think the idea is good, as it could allow you to cover area’s dynamically, i.e. if robots could make their way over to the meeting rooms or canteen when usage went up that would be cool, but I guess that would cause problems with free channels etc, what about the idea of a sony dog with a wi-fi repeater in ? You could have one AP inside, and that could follow you out to the garden ! Oh the possibilities ! :cool:

Nokia Console Cables

It’s been a while since I’ve been up close & personal with a nokia firewall , but recently I’ve needed to play.

The first thing I noticed was that the console cable has changed, now let’s not focus too much on the design floor where by you can’t actually get your fingers in properly to release the cable, but at least they got rid of the db9 type, serial thing that kept breaking.

The good news is, looking at the cable colours you can see that the cables are roll over cables – exactly the same as cisco use – great ! One less thing to carry around in the laptop bag :-D

HTTPS backups of Cisco ASA

Here you are, a cisco security “tid bit”, you can secure backup the running config of your Cisco ASA over https, now you should enable AAA and set a username, but for now, here’s default url & command for wget.

wget –http-user= –http-passwd=<YOUR PASSWORD> https://<IP ADDRESS >/admin/exec/show%20running-config%20asdm/show%20running-config#

:-D

Basic Example Cisco Switch Config

Layer 2 Overview

Layer 2 Overview
Figure 1

I’ve been meaning to add a dedicated cisco section to my site for a while, I thought it’d be helpful if I converged my rants with work a little ;) I’m hoping to build up a personal archive of notes for work, and in doing so help other with similar roles & problems. I’ve gone through and added any cisco related posts to my archive , useful cisco bookmarks have always been online with del.icio.us , and now to finish off I have a config files directory. Usual rules apply to this an all other posts – see disclaimer.

Moving from a general security reseller to a “cisco cisco cisco” house has meant that templates have become important in my life; lets take security products like checkpoint or websense, not only are they gui driven (which makes templating difficult) but their implementation is very specific to their environment, as such companies that install with templates here usually aren’t doing a very good job. Switches or Routers on the other had can be templated, because there are only a few design scenarios (engineers usually stick to a favourite) and once you’re happy with a design, moving it from customer to customer usually only involves changing ip’s and passwords (of course a little intelligence to spot what else might need changing also helps).

This is a switch design my boss has handed down, it’s a basic collapsed core (i.e. no distribution layer) site campus implementation. I’m not going to take all the credit for the content as Frank helped a great deal (thanks mate).

Each access layer switch has two connections up to the core, and the core has an etherchannel link to provide the resilient triangle loop – See Figure 1. There a couple of things you need to pay attention two within this design…

1. The obvious one is that all the layer3 takes place in the core, now there is currently a cisco document circulating that we should be pushing the layer3 to the edge to take advantage of QoS for all things new like voice and video, I am aware of these considerations, but I haven’t found it entirely applicable*, which brings me to…
2. The design relies on having two VLANS on each access layer switch. Why ? Because is my experience cable and physical faults occur more often (human errors excluded of course) in cisco networks than switch failure, as such it’s good to have a design where by all cables have traffic flow. If traffic flows down all ports then MRTG can be used to view the usage, and if the “bloke that changes the light bulb” accidentally cuts through a fibre link you’re aware… this is much more preferable than having a standby link that’s never used/tested fail just as you need it. In short why two vlans, traffic for both routes. – See Figure 2. *why do I need QoS on my campus if I have two vlans, one dedicated for voice, and the other for data ;)

Splitting the VLANS

Splitting the VLANS
Figure 2

Hopefully I’ve explained this well enough, if you take a look at the configs you’ll see that I’ve mirrored up the active HSRP SVI with the STP root bridge. This implementation ensures that I get the desired traffic flow, and distributed processing, i.e. if I force a route bridge on core b, why send it to core a for layer3 ? With all the technologies working correctly we have a completely resilient solution.

Mainly for my reference the example configs have some default security settings, these settings closely meet the safe blueprint but may need tuning, i.e. if you have a large campus you should be using TACACS+ rather than local user names and passwords…. it’s also important to note, if you don’t know what some of this does, you should probably google for it to find out ;) The configs have been applied to cat4500/6k type devices in the core, and a stack of 4 3750′s at the edge (access layer). You should be aware that not all functionality is available on all switches , note I’m using vlan acls for rfc 2827 filtering, this probably isn’t available on lesser switches.

Anyway, enjoy !

Evolution of Cisco.com

Looks like cisco have given their website an image overhaul…..

Evolution of Cisco.com – Cisco Systems
A transformation is occurring on the Web. The end user is more in charge, creating collaborative websites and blogs, generating, mixing and sharing content, and having more of a say in how companies do business with them. The potential of the Internet is being fulfilled by more than the physical network alone, it is the human network where people are connecting and collaborating, enabling ideas and opportunities. This represents an ideal time for Cisco to transform our website, into a platform for collaboration, interaction and innovation.

Today is our first step. We’re launching a “new face” for Cisco.com with a redesigned home page…

It took me by surprise actually, it’s not very often such large companies make this kind of statement, notice there is less “cisco green”, and even a new logo, very 2.0 ;)

Revision Notes:Cisco Wiressless Fundamentals

Below are some revision notes I have made, Cisco have recently changed the certification requirements for wireless examination, I am yet undecided if these notes shall be finished. Some of this material is old, it’s usefulness may vary !

I thought it’d be cool to share some of my revision notes :cool:

Chap 1: Introduction.
Wireless started out in the mid eighties (1986) for warehouses & retail business to ease stock control. It was from this technology that Enterprise and HomeUsers saw that they could be freed from the wires on their desks. Wireless data networks span a large area of technologies from infrared to satellite, fortunately cisco’s Fundamentals course only covers LANS (Local Area Networks), Cisco is also part of the body which standardises wireless communications - Wireless Fidelity (WI-FI), This is apparently important to remember because they provide a stamp of approval, which means different vendors will interact. Here a table about wireless tech’s which is shown on the presentation:

Wireless Technologies

  PAN
Personal Area Network		 LAN
Local Area Network		 MAN
Metropolitan Area Network		 WAN
Wide Area Network
Standards Bluetooth 802.11a, 802.11b, 802.11g, HiperLAN2 802.11 MMDS, LMDS GSM, GPRS, CDMA, 2.5 – 3G
Range Short Medium Medium to Long Long
Application Peer2Peer or Device to Device Enterprise Networks Fixed, Last Mile Access Mobile Phones, PDAs.

Chap 2: Radio Freq Spread Spectrum.
This chapter talks about radio transmission, mainly frequency modulation type stuff, points I’ve picked up….
Radio Frequencies are licensed, i.e. Radio & TV stations need licences to broadcast; the powers that be put aside a portion of the frequency spectrum for unlicensed use. The part that Cisco use is the ISM (Inductrial, Scientific & Medical) Frequencies. In the spectrum of frequencies, from low to high, where audio is at the low end, and light, x-rays etc. are at the higher, these frequencies are available to use:

  • 902 – 928 MHz & 26MHz
  • 2.4 – 2.4835 GHz & 83.5MHz
    IEEE 802.11b & 802.11g
  • 5GHz
    HyperLan, HyperLan2 & 802.11a

IEEE 802.11 is the industry standard for wireless lans, and it comes in 3 flavours:

  802.11b 802.11a 802.11g
Freq Band 2.4GHz 5GHz 2.4GHz
Availability World USA & Asia + Percific Wold
Max Data Rate 11Mbs 54Mbs 54Mbs
Sources of Interference Cordless Phone, Microwaves , Wireless Video or Bluetooth HyperLan Devices Same as .11b

Notice, that 802.11a isn’t available worldwide, so Cisco don’t use it so much in their products, 802.11g is the way forward ;)
A Note about the Laws of Radio Dynamics:

  • The Higher the Data Rate, the Shorter the Range (Distance)
  • The Higher the Power Output, The Longer the Range, the lower the Battery Life (Obviously)
  • The Higher the Radio Frequency, The Higher the Data Rate, but the Shorter the Range

RF Technologies is DATA sent over the air waves, with a primary goal of sending as much as quickley as possible.It is a half duplex technology, using the same frequency to send and recieve – devices take in turns, and because they use the ISM frequencies no Licenses are needed.
Different Spread Spectrum RF Technologies are:

  • FHSS (Frequency Hopping Spread Spectrum)
  • DSSS (Direct Sequence Spread Spectrum)
  • OFDM (Orthogonal Frequency Division Modulation)

Noise or Interference is caused by other transmissions; The further away you move from a transmission source, the more the noise interfers. Other factors that affect the transmission is the complexity of the modulation; The more complex the modulation, the shorter the distance away from the transmitter the noise begins to interfere… The more noise there is on a signal, the slower the data rate.

Simple Signal Modulation

Simple Signal Modulation

Signal Modulation is produced by the input of data and a carrier signal, the picture show’s (roughly/badly) what happens. Aironet devices have 3 type of modulations, and what is used depends on the data rate:

  • BPSK (Binary Phase Shift Keyed) for 1Mbs
  • QPSK (Quardrature Phase Shift Keying) for 2Mbs
  • CCK (Complementary Code Keying) or 5.5Mbs & 11Mbs

Direct Sequence Modulation in DSSS:
The data is broken into chunks, which can be send simultaneously down different channels. The chunks are combined with a chipping code – this is the chipping sequence, this special code allows one of the chunks to do missing (due to interference) and it’s contents can be calculated from the other chunks – a little like RAID5 I guess.

The DSSS 2.4Ghz can be boken into 11Channels of 22Mhz, but these overlap – there is a set of 3 Channels which don’t overlap, so different devices can use the same frequency with different channels so they don’t interfere with each other.

Note: The more data you want to send, the more bandwidth you need i.e. the more of the frequency spectrum you will need to use. This combined with the LAWS of RF , i.e. the further away from a signal you are the less bandwidth you have available causes a problem with Data Comms.
Cisco implement Rate shifting, this is where as your signal drops then so does your connection speed. In the case of 802.11b DSSS the stages are 11Mbs -> 5.5Mbs -> 2 Mbs -> 1Mbs.

From the above two paragraphs you can work out the maxium available bandwidth for 802.11b, assuming you were close enough to the AP, you could have 3 devices on different channels running at 11Mbs which is a total bandwith of 33Mbs :)

802.11b uses OFDM as it’s RF Technology, the main thing about this is it converts the frequency into sub carriers (or sub channels) if you use different modulation on these channels you get different speeds:

  • BPSK = 6 & 9 Mbs
  • QPSK = 12 & 18 Mbs
  • 16QAM = 24 & 36 Mbs
  • 64QAM = 48 & 54 Mbs

The 5GHz Range can be broken into 52 of the avilable 64 sub carriers, and 48 of those are used to transmit data (12 are used as zero side guards & 4 are used for sync + tracking) The 5GHz are broken into UNII Bands, what’s important is UNII 1 & UNII 2 are for inside use and UNII 3 is for out-doors !
Rate shifing in 802.11a is the same as in .11b other than there are more layers of bandwidth degredation.
802.11a has 8 channels avilable in it’s UNII bands. It also has different scaleability , 8 x 54 is 432Mbs of bandwidth but 802.11a doesn’t have as far range as 802.11b on the 2.5GHz frequency.

My 1st 100%

It’s a shame it’s not an important exam, but the satisfaction remains the same. I’m planning to make this year quite exam heavy so I don’t suppose I’ll see this again so excuse me as I revel in my own smugness !

I’ve been thinking hard (i.e. before I posted this), and really don’t think I’ve received 100% in a formal exam before; the results in the screen shot are for Cisco’s IOS Discovery Assessment, ok yeah there was only 13 questions but hey, 100% is 100% ;)

Debug Packet command missing on PIX 7

I’ve been googling & searching through cisco release notes to find out what happened to the pix debug packet command after I upgraded from v6.3 to v7, you know it really shouldn’t have taken that long because the first answer on google groups found it :$

The message suggest using the capture command and points to the cisco documentation : http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_70/cref_txt/c.htm#wp1910869.

The first thing that strikes me is that the command isn’t a real time view like the old debug, but it will offer you a file that you can open in ethereal – now that’s quite cool :cool:
To get started you need to knock up an access list to capture the traffic, something like:

access-list sniffer permit ip host 192.168.1.1 host 192.168.2.2

should do the job, then start the capture on the interface where the traffic passes:

capture testcap access-list sniffer interface inside

before the next step you need to make sure you have the ADSM installed, and http server enable in your config, and a http line that allows you access, if you already use the ADSM you’re already set up, die hard ssh’ers like me need to set this up.

Once you’re happy adsm is running you can now browse to the results of you cap

https://securityappliance-ip-address/capture/capture_name

add a /pcap on the end if you want a version of the capture to load into ethereal.

You can use the no syntax to stop the capture

no capture testcap

Happy Debuggin’ !!!