PROTECTED PORTS & PRIVATE VLANS

Protected Ports

• 2  Protected port  on switch in the same vlan cannot exchange l2 frame with each other
• used to prevent devices on same vlan from communicating at layer 2
•  Both port must be on the same switch for this feature to work
• You will still recieve traffic from unkown unicast and multicast 

Commands

int fa0/1
switchport protected

sh switchport protected
Private Vlans

• can work across multiple switches
• sub vlans are community or isolated
• promiscious ports can speak to all usually layer 3 interface
• community can speak to all ports in its own community and promiscious port
• isolated can only speak to promiscious port
• urpf will not work with pvlans
• the vtp mode on switches for pvlan must be transparent
• cannot include vlan 1 or 1002-1005
• does not work with etherchannel if both are configured on port pvlan superside etherchannel
• You can use span destination ports in pvlans span supersides pvlan
• you can use span source port in pvlans
• enable portfast + bpduguard on pvlan to prevent loops from misconfig
• qos is supported
• acl should not be applied to isolated or community
• dynamic acl should not be applied to primary vlan
• same config is required on all switches
• vtp v3 supports but not vtpv1 or vtpv2

Commands

vtp mode transparent
vlan 112
primary-vlan primary
private-vlan association 113 114
vlan 113
private-vlan community
vlan 114
private-vlan isolated

int fa0/1
switchport mode private-vlan promiscious
switchport private-vlan mapping 112 add 113,114,115

int fa0/5
switchport mode private-vlan host
switchport private vlan host 112 113 - so primary 112 and subvlan 112

sh vlan private-vlan


LAB
----

Protected Port
---------------

so i am configuring all the ports on s1 in the same vlan
s1(config)#int fa0/1
s1(config-if)#switchport access vlan 112
% Access VLAN does not exist. Creating vlan 112
s1(config-if)#int fa0/3
s1(config-if)#switchport access vlan 112
Command rejected: Fa0/3 not a switching port.
s1(config-if)#int fa0/5
s1(config-if)#switchport access vlan 112
s1(config-if)#

All the routers connecting in will go in 10.229.254.0/24 subnet
r1(config)#int fa0/0
r1(config-if)#ip address 10.229.254.1 255.255.255.0
r1(config-if)#

r3(config)#int fa0/0
r3(config-if)#ip address 10.229.254.3 255.255.255.0
r3(config-if)#no shut

r5(config)#int fa0/0
r5(config-if)#ip address 10.229.254.5 255.255.255.0

ok so we will have r1 r3 not able to communicate with each other but a;; communicate with r5

s1(config)#int fa0/1
s1(config-if)#switchport protected
s1(config-if)#int fa0/3
s1(config-if)#switchport protected

From R1
--------
r1#ping 10.229.254.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r1#ping 10.229.254.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
r1#

FROM R3
--------

r3#ping 10.229.254.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
r3#ping 10.229.254.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
r3#

From R5
--------
r5#ping 10.229.254.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r5#ping 10.229.254.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r5#


Private VLAN
-------------
I will take the protected port of but we will keep the new address all in vlan 112 i will also do this to the routers connected to sw2 r2,r4,r6
10.229.254.2 and 10.229.254.4 and 10.229.254.6 all in vlan 112

routers
--------

r2(config)#int fa0/0
r2(config-if)#ip address 10.229.254.2 255.255.255.0
r2(config-if)#

r4(config)#int fa0/0
r4(config-if)#ip address 10.229.254.4 255.255.255.0
r4(config-if)#

r6(config)#int fa0/0
r6(config-if)#ip address 10.229.254.6 255.255.255.0
r6(config-if)#

switch 2
---------

s2(config)#int fa0/2
s2(config-if)#switchport mode access
s2(config-if)#switchport access vlan 112
s2(config-if)#int fa0/4
s2(config-if)#switchport mode access
s2(config-if)#switchport access vlan 112
s2(config-if)#int f0/6
s2(config-if)#switchport mode access
s2(config-if)#switchport access vlan 112
ok as per lab diagram r1 is going promicious will able to connect to everyone r3 + r2 will able to connect to each other and r1  r5 and r4 will able to
connect to each other and r1
r6 will only able to connect to r1 they will all be in the same main vlan


We will start the config on s1
first things first put the vtp mode to transparent

s1(config)#vtp mode transparent
Setting device to VTP TRANSPARENT mode.
create the vlans
s1(config)#vlan 112
s1(config-vlan)#private-vlan primary
s1(config-vlan)#vlan 113
s1(config-vlan)#private-vlan community
s1(config-vlan)#vlan 114
s1(config-vlan)#private-vlan community
s1(config-vlan)#vlan 115
s1(config-vlan)#private-vlan isolated
s1(config-vlan)#

s1(config)#vlan 112
s1(config-vlan)#private-vlan association 113,114,115

this same config needs to be put on s2

S2
---
s2(config)#vtp mode transparent
Setting device to VTP TRANSPARENT mode.
s2(config)#vlan 112
s2(config-vlan)#  private-vlan primary
s2(config-vlan)#  private-vlan association 113-115
s2(config-vlan)#!
s2(config-vlan)#vlan 113
s2(config-vlan)#  private-vlan community
s2(config-vlan)#!
s2(config-vlan)#vlan 114
s2(config-vlan)#  private-vlan community
s2(config-vlan)#!
s2(config-vlan)#vlan 115
s2(config-vlan)#  private-vlan isolated

s1
---
we will start with inteface fa0/1 setting as the promiscious port
s1(config)#int fa0/1
s1(config-if)#switchport mode private-vlan promiscuous
s1(config-if)#switchport private-vlan mapping 112 add 113,114,115

now on to the community ports
so for r3 in community vlan 113

s1(config-if)#int fa0/3
s1(config-if)#switchport mode private-vlan host
s1(config-if)#switchport private-vlan host 112 113
for r5 in community vlan 114
s1(config)#int fa0/5
s1(config-if)#switchport mode private-vlan host
s1(config-if)#switchport private-vlan host 112 114

S2
---
for r2 in community vlan 113

s2(config)#int fa0/2
s2(config-if)#switchport mode private-vlan host
s2(config-if)#switchport private-vlan host 112 113

for r4 in private vlan 114
s2(config)#int fa0/4
s2(config-if)#switchport mode private-vlan host
s2(config-if)#switchport private-vlan host 112 114
for r6 who is in the isolated vlan
s2(config)#int fa0/6
s2(config-if)#switchport mode private-vlan host
s2(config-if)#switchport private-vlan host 112 115

ok lets test the config

r1
---
r1#ping 10.229.254.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.3, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/3/4 ms
r1#ping 10.229.254.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.4, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms
r1#ping 10.229.254.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r1#ping 10.229.254.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.6, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms
r1#

can ping everything


r5
---
r5#ping 10.229.254.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r5#ping 10.229.254.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.4, timeout is 2 seconds:
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/1 ms
r5#ping 10.229.254.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
r5#ping 10.229.254.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.6, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
r5#

it can ping it fellow community member r4 and the promiscious port but not memeber from other communties or isolated group

r6
---
r6#ping 10.229.254.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r6#ping 10.229.254.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
r6#ping 10.229.254.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.5, timeout is 2 seconds:
..

can only ping r1 which is what was expected

say i decided r4 should not be in community but be isolated


s2(config-if)#switchport private-vlan host 112 115
s2(config-if)#exit
s2(config)#do sh run int fa0/4
Building configuration...
Current configuration : 146 bytes
!
interface FastEthernet0/4
 switchport access vlan 112
 switchport private-vlan host-association 112 115
 switchport mode private-vlan host
end
s2(config)#

it is using the same vlan id as r6 115

r4#ping 10.229.254.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.5, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
r4#ping 10.229.254.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
r4#ping 10.229.254.6
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.229.254.6, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

it can not ping it ex community member it can ping the promicious port
it cannot ping r6 even though they are in the same secondary vlan meaning we can use the
same secondary isolated vlan over and over

ADDITIONAL LAYER 2 SECURITY

ADDITIONAL LAYER 2 SECURITY


DHCP SNOOPING

• This is a way of enforcing the dhcp server role on ports.
• The potential issue that dhcp snooping is that a man in the middle attack on the dhcp.
• The way dhcp works is that dhcp request (broadcast) is sent out by the host onto the segement the router on the segement will usually configured to pass this broadcast to dhcp server the dhcp server then unicast back a dhcp offer with the  ip address on offer etc.The client will  sent back dhcprequest(broadcast) saying it would like to reserve this and the dhcp server replies with unicast dhcppack As we see the initial request is broadcast so other devices on the segment recieve this. So this what DHCP attack could be is that you would setup a DHCP server on the segment when the broadcast is recieved you will send back the offer the router will go with the first dhcp server that responds back so the ogue dhcp server sends an offer setting itself as the default gateway.
• So DHCP snooping will validate dhcp message from untrusted source ports and filter out messages. So if dhcp offer is coming out an access port that is not the dhcp server if dhcp snooping is enabled it will filter this
• DHCP snooping will only allow trusted ports respons to dhcp request broadcast. So you would set your user acccess ports to untrusted and your uplink towards the designated dhcp server as trusted so only offers can comes in trusted ports.
• Also when you enable dhcp snooping it creates the dhcp database which will keep track of your mac to IP to port bindings. This is also used by other security features
• it can also rate limit dhcp traffic from trusted and untrusted port
• it is enabled on per vlan basis
• if dhcp mac verification os on the snooping check the source mac and dhcp client hardware address if they do not match it is not allowed

DHCP SNOOPING CAVEATS

• Do not forget to trust port to dhcp server
• in multiswitch scenerio trust trunk links
• keep in mind that dhcp snooping inser option 82 information option into packet some servers do not support this if it is the case you can disable it

no ip dhcp snooping information-option

• Alternatively configure server to trust empty giaddress

Commands

ip dhcp snooping
ip dhcp snooping vlan 146
int fa0/1
ip dhcp snooping trust

all other ports in vlan 146 are set to untrusted


LAB

S4
---
so i have switched vlan snooping on and added vlan 146
s4(config)#ip dhcp snooping
s4(config)#ip dhcp snooping vlan 146
s4#sh ip dhcp snoop
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
146
DHCP snooping is configured on the following Interfaces:
Insertion of option 82 is enabled
   circuit-id format: vlan-mod-port
    remote-id format: MAC
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Interface                    Trusted     Rate limit (pps)
------------------------     -------     ----------------
s4#

ok so i will enable a trusted interface where the dhcp server is

s4(config)#int fa0/1
s4(config-if)#ip dhcp snooping trust

s4#sh ip dhcp snooping
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
146
DHCP snooping is configured on the following Interfaces:
Insertion of option 82 is enabled
   circuit-id format: vlan-mod-port
    remote-id format: MAC
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Interface                    Trusted     Rate limit (pps)
------------------------     -------     ----------------
FastEthernet0/1              yes         unlimited
s4#

that is really all that is required you just need to watch out if the dhcp server is not connected trust the trunk links
watch out for the option 82 particular if using cisco ios as dhcp server it does not support so you need to disable option 82

s4(config)#no ip dhcp snooping information option

Dynamic ARP Inspection (DAI)

• This is in response to arp poisoning attack. So the attack is that a client will arp out for the mac of the default gateway as per normal The rogue attacker will reply back saying i have the default gateway ip and my mac is this. The user will then forward the packets at layer 2 to the rogue device again the attacker will most likely forward the packets on to the legitmate default gateway so the attack becomes transparent to the user they do not know that it is happening
• ARP inspection (DAI) is way of dealing with this type of attack It inspects arp request+ response and compare them to the dhcp snooping database if it is conflict with this the arp is ignored
• There is a second part to this if dhcp snooping or dhcp is not been used i.e we are using static mapping we could configure statically the arp address for the default gateway
• static is preffered over dynamic

Commands

ip arp inspection vlan 146

int fa0/1
ip arp inspection trust

Static config
arp access-list
permit ip host 10.229.254.1 mac host 0000.0000.000.0001

we apply to the vlan

ip arp inspection filter 'myfilter' vlan 146


LAB

we will look at the config for both scenerios
for Dynamic with dhcp address
s4(config)#ip arp inspection vlan 146
this willl enable inspection for arp request responses on the segment it will check the dhcp database for binding for port to mac to ip

we will configure our trunks to be trusted as this will carry multiple macs for multiple vlans

s4(config)#int fa0/4
s4(config-if)#ip arp inspection trust

for the static mappings
------------------------
We do not have the dhcp binding entry for statically assigned addresses so we can manually create a entry for the inspection to use
we use and arp access-list
s4(config)#arp access-list MYFILTER
s4(config-arp-nacl)#permit ip host 10.229.254.1 mac host 0000.0000.0001

we apply this to the vlan with
s4(config)#ip arp inspection filter MYFILTER vlan 146


IP SOURCE GUARD

• Prevents IP address Spoofing
• Same concept as arp inspection but at layer 3
• Uses the dhcp snooping database to filter ip on the port dynamically
• Port secuirty must be enabled
• Ip source guard is not supported on etherchannels

Commands
ip verify source (interface command)
Mac address filtering could also be enforced
Requires port security enable on interface
additinal paramters

ip verify souce port security

static ip to mac mapping on vlan
ip source binding (global comman

SNMP & RMON

SNMP & RMON


SNMP

• runs over udp ports 161/162 - non reliable
• Mangement information base- used to read/write variables in device config
• Network Management station (NMS) asks managed device the status of the MIB. This is called SNMP Polling
• Managed device may also report unsolicted events called SNMP Traps or informs - difference been informs require ack

SNMP VERSIONS

3 main versions
v1- supports only community authentication
v2c- supports community authentication and views
v3- support users/groups - encryption and secure authentication

SNMPv1/2c

Configured as snmp-server community {string} {ro|rw} {acl}
community string
   - clear text passwords for NMS to poll device
2 types of community strings
   - read only
   - read write
ACL defines who can poll device

SNMP Traps

Device reports unsolicted events to NMS
Reports could be
   - unreliable- traps
   - reliable- informs
   - both are sent using UDP to port 162
SNMP V1/V2
-----------
Define events to trap
All traps
snmp-server enable traps
specfic
snmp-server enable traps {notification-type}
Define a host to send the traps to

all Enabled traps
  snmp-server host "host addr community-string"
subset of enabled traps
snmp-server host " host add community-sting {notification type}

A common mistake is to define the hosts but not actual enable the traps globally i.e skipping
step 1

sh snmp ifmib ifindex - this is a good command to look at what assigned index was givn to a  
                      particular interface. IFindex can change when new interfaces come on
                        line new interface include sub interface and loopback in order to
                        keep persistent values for assigned interfaces we can use the command
snmp=server ifindex persist
sh snmp mib- will give you a list of all possible mibs some are hard to decipher what they do
             from the name there is snmp mib translator on the net to assist

SNMP V3
--------
3 main entites
Users- operators accessing the routers
Groups - group users access privilges is then asssigned to groups
Views - define subset of mib visible to groups
so it sort similar to windows group you put a user in a group and group then is assigned
access to the view


SNMPV3 Security
----------------
Access to mib is either
    - unauthenticated/unencrypted - No AuthNoPRiv
    - authenticated only - AuthnoPriv
    - authenticated and encrypted - AuthPriv
SNMPv3 Traps
------------
Support traps/informs
AUthentication model is different
Traps need to have a user associated
User credentials are used to authenticate
The nms need to implement authentication


RMON
-----
Remote Monitoring
  - used to monitor MIB variables
Monitoring has two components
   - alarm
      condition to trigger events
   -event
      action to associate to alarm
      normally a syslog/snmp trap


RMON ALarm
-----------
Rmon alarm defines how mib is sampled
you have 2 types

1) DELTA sampling- used for variables that accumalted like packet counter,crc errror these
vairiable never go down always up. Having just a value for these is not much use as it is
hard to decipher the time period the value was obtained. WHat delta gives you is the
difference in each time period so like if you get syslog saying you have had 6 crc errrors on
interface in the last 10 minutes is alot easier to act on then just getting you had 6 crc
ever.
_ difference between MIB value at time index a compared to time index B
- Used for values that only increase/accumalate
- Tracks rate of change for variable
-Sampling intervals define the time period
2) ABosulute sammpling- Is for exact match of the MIB at time of index A
  You use this for values that are going go up and down and for variables that just given the
value at that specfic is going be useful for example
CPU Utilization memory utilization error % on interfaces size of routing table
Used for values that increase and decrease

The parser will not guide you to say you should use this variable with delta so you neeed to
look at it and think about it in general if it variable that just goes up - delta if it
variable that goes up and down- abosulute
 
LAB
----
FOR SNMPV1/V2

First we will define our polling
we will define a subnet that has access
r4(config)#ip access-list standard EIGRP-SNMP
r4(config-std-nacl)#permit 192.168.1.0 0.0.0.255
r4(config-std-nacl)#

r4(config)#snmp-server community EIGRP-SNMP-COM ro EIGRP-SNMP


Next in global config we need to enable our traps

r4(config)#snmp-server enable traps ?
  atm                Enable SNMP atm traps
  authenticate-fail  Enable SNMP 802.11 Authentication Fail Trap
  bgp                Enable BGP traps
  bstun              Enable SNMP BSTUN traps
  bulkstat           Enable Data-Collection-MIB Collection notifications
  cnpd               Enable NBAR Protocol Discovery traps
  config             Enable SNMP config traps
  config-copy        Enable SNMP config-copy traps
  cpu                Allow cpu related traps
  deauthenticate     Enable SNMP 802.11 Deauthentication Trap
  disassociate       Enable SNMP 802.11 Disassociation Trap
  dlsw               Enable SNMP dlsw traps
  dot11-qos          Enable SNMP 802.11 QoS Change Trap
  ds0-busyout        Enable ds0-busyout traps
  ds1                Enable SNMP DS1 traps
  ds1-loopback       Enable ds1-loopback traps
  dsp                Enable SNMP dsp traps
  eigrp              Enable SNMP EIGRP traps
  entity             Enable SNMP entity traps
  envmon             Enable SNMP environmental monitor traps
  event-manager      Enable SNMP Embedded Event Manager traps
  firewall           Enable SNMP Firewall tra
this is partial list we can enable traps based on specfic technologies etc rather than all
traps
this would be for eigrp info
r4(config)#snmp-server enable traps eigrp

if i wanted all trap i would use the below
r4(config)#snmp-server enable traps

next we define the host to send traps to

r4(config)#snmp-server host 192.168.2.1 EIGRP-SNMP-COM eigrp

so this server would be sent the traps for eigrp

sh snmp mib will show you all the preconfigured mibs availible to use
if we are looking at interfaces
r4#sh snmp mib ifmib ifindex
FastEthernet0/0: Ifindex = 1
Loopback0: Ifindex = 8
Null0: Ifindex = 5
Serial0/0/0: Ifindex = 3
Async2: Ifindex = 6
FastEthernet0/1: Ifindex = 2
Serial0/1/0: Ifindex = 4
Async18: Ifindex = 7
r4#
and we want to keep the index persistent for our logging of particular interfaces

r4(config)#snmp-server ifindex pers

SNMP V3
-------

FIrst we create our view
r4(config)#snmp-server view MYVIEW cisco included
create the group
r4(config)#snmp-server group MYGOUP v3 priv read MYVIEW

Create the user
snmp-server user MYUSER MYGROUP v3 auth md5 PASSWORD priv 3des SECRETKEY
so we have created a user who will be in the group MTGROUP with md5 authentication and
encyption of 3des


define a trap
r4(config)#snmp-server host 192.168.2.1 trap version 3 auth MYUSER eigrp

RMON
-----
OK i will do rmon on interface f0/1 for an alarm for if we get 1000 packets in  60 seconds

r4#sh snmp mib ifmib ifindex
FastEthernet0/0: Ifindex = 1
Loopback0: Ifindex = 8
Null0: Ifindex = 5
Serial0/0/0: Ifindex = 3
Async2: Ifindex = 6
FastEthernet0/1: Ifindex = 2
Serial0/1/0: Ifindex = 4
Async18: Ifindex = 7
r4#

r4#sh run
*Feb 24 13:11:08.895: %SYS-5-CONFIG_I: Configured from console by console| inc rmon
rmon alarm 1 ifOutUcastPkts.2 60 delta rising-threshold 1000 2 falling-threshold 1 3 owner
config
r4#

ok so this command is saying the first rmon alarm we will check interface output unicast
packets it is for the ifindex 2 so that is fa0/1 delta rising value is 100 packets so this
trigger it if this happens we will use alarm 2 the falling-treeshold is 1 packet and will
trigger alarm 3

we now need to define the event
r4(config)#rmon event 2 log description interface-fa0/1-over-100ppm
so for event 2 we will get a log saying interface-fa0/1-over-100ppm

for alarm 3

r4(config)#rmon event 3 log description interface-fa0/1-is-not-transmitting

r4#sh rmon alarms
Alarm 1 is active, owned by config
 Monitors ifOutUcastPkts.2 every 60 second(s)
 Taking delta samples, last value was 6
 Rising threshold is 1000, assigned to event 2
 Falling threshold is 1, assigned to event 3
 On startup enable rising or falling alarm
r4#

r4#
*Feb 24 13:23:01.855: %RMON-5-RISINGTRAP: Rising trap is generated because the value of
ifOutUcastPkts.2 exceeded the rising-threshold value 1000

r4#sh rmon alarms
Alarm 1 is active, owned by config
 Monitors ifOutUcastPkts.2 every 60 second(s)
 Taking delta samples, last value was 1106
 Rising threshold is 1000, assigned to event 2
 Falling threshold is 1, assigned to event 3
 On startup enable rising or falling alarm
r4#

LAYER 2 SECURITY

LAYER 2 SECURITY FEATURES


Port Security

• Default violate mode shutdown,protect (do not allow),restirct(do not allow + generate a log)
• if port is shutdown all dynamically learnt mac address are removed
• if using a phone set maximum to at least 2 1 for pc and 1 for phone
• aging can be used to age out mac address
• default allowed mac addresses is 1
• you can enable port security on a trunk
• port secuirty supports pvlan ports
• supports 802.1q tunnel ports
• does not support span destination ports
• only supports nonegotiate trunks
• flex link and port security are not compatiable
• keep in fhrp like hrsp vrrp glbp they use virtual macs

Commands

int fa0/1

switchport port-security mac-address sticky/"48 bit mac"

switchport port-security maximum 1

switchport port-secuirty aging "minutes"

switchport port security violation " shutdown/protect/restrict"

LAB


OK so I am on s4 which has r4 connected on it fa0/4 int it is not trunk but just access port
s4>en
s4#sh mac address-table dynamic int fa0/4
          Mac Address Table
-------------------------------------------
Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
 146    0012.d993.728d    DYNAMIC     Fa0/4
Total Mac Addresses for this criterion: 1
s4#

s4(config)#int fa0/4
s4(config-if)#switchport port-security
s4(config-if)#switchport port-security ?
  aging        Port-security aging commands
  mac-address  Secure mac address
  maximum      Max secure addresses
  violation    Security violation mode
  <cr>
s4(config-if)#switchport port-security violation protect

s4(config-if)#switchport port-security maximum 1
s4(config-if)#switchport port-security mac-address ?
  H.H.H   48 bit mac address
  sticky  Configure dynamic secure addresses as sticky
s4(config-if)#switchport port-security mac-address sticky

s4#sh run int fa0/4
Building configuration...
Current configuration : 260 bytes
!
interface FastEthernet0/4
 switchport access vlan 146
 switchport mode access
 switchport port-security
 switchport port-security violation protect
 switchport port-security mac-address sticky
 switchport port-security mac-address sticky 0012.d993.728d
end

notice it dynamically learns the mac and puts it in the running config as i specfied sticky i
could alternatively by just doing

switchport port-security mac-address "mac"
s4#sh port-security int fa0/4
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Protect
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 1
Total MAC Addresses        : 1
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 1
Last Source Address:Vlan   : 0012.d993.728d:146
Security Violation Count   : 0
s4#

one of things to note that the mac asssigned to the port will not age out as it set to
abosulte so unless the port goes down it will not age out the mac if want to put in aging
s4(config-if)#switchport port-security aging time 30
it is in minutes so that is 30 mins

On trunk link fa0/13

s4(config)#int fa0/13
s4(config-if)#switchport port-security ?
  aging        Port-security aging commands
  mac-address  Secure mac address
  maximum      Max secure addresses
  violation    Security violation mode
  <cr>
s4(config-if)#switchport port-security
s4(config-if)#
00:24:53: %PM-4-ERR_DISABLE: psecure-violation error detected on Fa0/13, putting Fa0/13 in
err-disable state
00:24:53: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC
address 0011.bb89.6e43 on port FastEthernet0/13.
00:24:54: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEtherne
the minute i put it on it shut it down as the default is 1 mac and default violate mode is
shutdown

s4(config)#int fa0/13
s4(config-if)#switchport port-security max 65
s4(config-if)#shut
s4(config-if)#no shut

s4#sh port-security int fa0/13
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Shutdown
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 65
Total MAC Addresses        : 33
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 0
Last Source Address:Vlan   : 0011.bb89.6e15:1
Security Violation Count   : 0
s4#sh port-security int fa0/13
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Shutdown
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 65
Total MAC Addresses        : 35
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 0
Last Source Address:Vlan   : 0011.bb89.6e42:67
Security Violation Count   : 0

we are on 35 at the moment

Static CAM Enteries

• Switches learn mac adddress dynamically from traffic flow it takes the source mac we can disabl this and decide to statically populate the cam table in very secure access

layer enviorments

LAB

I removed the above config

to put static entry
s4(config)#mac address-table static 0012.d993.728d vlan 146 int fastethernet0/4

no mac address-table dynamic vlan 146 - to disable  dynamically learning mac

Storm Control

• Storm Control is like like policing at layer 2
• You can limit the amount of unicast/broadcast/multicast accepted in port
•  ingress rate limiting only
• A caveat of storm control Violating multicast rate will affect and suppress unicast broadcast + multicast
• A violate in unicast will only affect unicast
• A violate in broadcast will only affect broadcast
• Also anothe caveat is %  is of the interface not the bandwidth. So it is percent of the negotiated speed so if for some reason you negotiated 10 mbs on 100 mbs link it % of 10 mbs
• You can configure traffic storm control on an EtherChannel (a port channel interface).
• Do not configure traffic storm control on ports that are members of an EtherChannel.
• Configuring traffic storm control on ports that are configured as members of an EtherChannel puts the ports into a suspended state.
• Storm Control uses rising and falling threshold. The rising threshold is if the number you need to go above before dropping will start the falling threshold is the number you need to go below to retrainsmit so the sample interval is a second so if you go above the rising threshold it will start dropping if in the next second you are below the rising threshold but above the falling threshold it will continue to block once you go below the falling threshold it will start retrainsmitting and you will need to go above the rising threshold for the process to start again

LAB

s4(config-if)#int fa0/4
s4(config-if)#storm-control broadcast level 2 1  - 2 is the high rate 1 is the low rate

s4#sh storm
Interface  Filter State   Upper        Lower        Current
---------  -------------  -----------  -----------  ----------
Fa0/4      Forwarding       2.00%        1.00%        0.00%
s4#



802.1X Authentication

• Autthenticates a port by requesting credentials from attached host
• uses EAP over lan protocol _ switch relay authentication packets to radius server
• Your end client must support eap
• you also need aaa and a radius server configured on your network
• force authorized disables 802.1x on a port
• force unauthorized - disables the port authentication will not even take place it will go into un authorized

Commands
s4(config)#aaa new-mode
s4(config)#aaa authentication dot1x default group radius
s4(config)#radius-server host 1.2.3.4 key PASSWORD

to enable 802.1x gloabally
s4(config)#dot1x system-auth-control

Then on interface

s4(config)#int fa0/4
s4(config-if)#dot1x port-control auto

PACL

• applies to layer 2 port only on incoming direction
• filter transit traffic only
• can be a ip or mac match

Commands

S4(config)#access-list 101 deny icmp 4.4.4.4 0.0.0.0 1.1.1.1 0.0.0.0
s4(config)#access-list 101 permit ip any any
s4(config)#int fa0/4
s4(config-if)#ip access-group 101 in

r4#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r4#ping 1.1.1.1 source 4.4.4.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 4.4.4.4
.....
Success rate is 0 percent (0/5)
r4#

ROUTED ACL

Same as pacl but only apply on l3 interface like routed port or svi
can be applied in both directions but can only filter on ipv4 standard/extended ACL not layer
2 acl

VACL

• VLan ACL or Vlan map
• Appy to a vlan/svi effective for all ports in the vlan
• if acl applied to router interface in the vlan and vlan acl. The vlan acl is checked first
• TCP intercept + reflexive acl take precendence over vlan acl
• vacl+ cbac can not be configured on the same interface

Commands
vlan access-map "Name"
match ip address 101
action drop
vlan access-map "Name" 20
match mac address 'name'
action drop

access-list 101 permit tcp any any eq 23
mac-access-list exteneded "name"
permit host 0012.d9993.7289 host 0013.80e4.901a

To apply to vlan

vlan-filter "nameofaccessmap" vlan-list 146
LAB
----
ok SO We will apply vlan access-map to deny telnet to anywhere on the vlan ports and also
deny traffic to r6 from r4
r4
---
s4(config)#access-list 101 permit tcp any any eq 23
s4(config)#mac access-list extended TRAFFIC
s4(config-ext-macl)#permit host 0012.d993.728d host 0013.80e4.901a

we will create the vlan access-map matching the mac access-list and the extended ip access
list for these it will drop for everything else it will forward

s4(config)#vlan access-map FILTER
s4(config-access-map)#match ip address 101
s4(config-access-map)#action drop
s4(config-access-map)#exit
s4(config)#vlan access-map FILTER 20
s4(config-access-map)#match mac address TRAFFIC
s4(config-access-map)#action drop
s4(config-access-map)#exit
s4(config)#vlan access-map FILTER 30
s4(config-access-map)#action forward
s4(config-access-map)#

to apply it to vlan 146
s4(config)#vlan filter FILTER vlan-list 146

AAA and LOCAL AUTHORIZATION

AAA

Authentication = how you authenicate
Authorization = what you can do once authenticated
Accounting = keep track of what was done by person authenticated

There are two models in cisco mainly
the old model - local authentication local authorization based on the line or configured
usernames. So basically you are authenticating to the cisco device locally by the configured
locally configured username and password

New Model
    - supports AAA list that define sequence of methods
So we authenticate to tacas or radius server also we can get what commands we are authorized
depending on our login from the tacas server also this server will keep track of our changes
accounting what has been done in the session
So you autheniticate of a radius or tacas server first and maybe fall back to the local
method if it is not availible
THe advantages of using AAA is that you can centrally control all Authentication
Authorization and Accounting. Also you can bind it to other authentication for example Active
Directory authentication to cisco devices that you autheticate to your active directory and
if your in particular group you can access the cisco devices this way you get active
directory username security features like lock out etc.
You can use groups in AAA so certain group or types autheticate to one server while others
authenticate to another

It is not just user ssh/telnetting/console user that we can authenicate we can authenticate
our ppp sessions or control plane sessions to AAA
We need to be careful that we always leave ourselves a get out clause in case our tacas or
down or unreachable so ideally we want to as last resort leave in login local so if the
servers are unreachable we can still authenticate to the local box.


LCOAL COMMAND AUTHORIZATION
-----------------------------

Typically if we were using AAA we would get our server to do authorization  but we can do it
locally on the Cisco IOS

First way we could do this is with
1) Privilige level so we can control access to exec commands via privilge level
   0- no access
   1- user mode access
   15- full access
User defined privilge levels are avaible for 2-14
This is considered the messier\legacy option for authorization as it can be quite difficult
to get desired config. The main reason being the way privilge level work. They are not
completely indpendent from each other in that if iam given privelege 5 it means i can run
privilge level 0 1 2 3 4 5 commands this may seem desirable but if want to limit down user to
specfic it can get quite cumbersome. The way we do limit is that we either if we do not want
a user to run a command we would move the command to the privilge level above what the user
is if we do want to user command we would move them down to the privilge level they are on
2)Role BAsed Access Contol (CBAC(
Replacement for privilige levels - we got more flexible in terms of command allocation
A role is a group of commands in CBAC they are know as parser view
ROles can be manually switch to (enable view) and assigned to users
ROles are configured from root view (enable view)
RBAC requires AAA enabled on router but no neccessarily using AAA server for authorization

LAB
----
Ok we will configure r5 for AAA authentication to a tacas server
first things first we will configure a local username and login local on telnet lines

r5(config)#line vty 0 4
r5(config-line)#login local
r5(config-line)#username cisco password cisco
r5(config)#
r5(config)#enable password cisco

r4
---

so r4 can telnet no problem to r5 it authenicating locally to the r5 database
r4#telnet 5.5.5.5
Trying 5.5.5.5 ... Open

User Access Verification
Username: cisco
Password:
r5>en
Password:
r5#

r5
--
r5(config)#aaa new-model
r5(config)#
next we will specify the tacas servers
r5(config)#tacacs-server host 10.229.254.1 key MySecretKey1
r5(config)#tacacs-server host 10.229.254.2 key MySecretKey
In this scenerio I want .1 server for authenticating users and .2 server for authenticating
ppp

r5(config)#aaa group server tacacs+ USER
r5(config-sg-tacacs+)#server 10.229.254.1
r5(config-sg-tacacs+)#exit
r5(config)#aaa group server tacacs+ PPP
r5(config-sg-tacacs+)#server 10.229.254.2
r5(config-sg-tacacs+)#
Now we need to configure the default method list

r5(config)#aaa authentication login default group USER local
if we had put default instead of user after group it would authenticate to either of the
defined tacas servers. The local after the group USER means if we can not reach the tacas
server authenticate locally to the device
here is the ppp
r5(config)#aaa authentication ppp default group PPP local

so now we need to apply it to the terminal lines

r5(config)#line vty 0 15
r5(config-line)#login authentication default

r4
---
r4#telnet 5.5.5.5
Trying 5.5.5.5 ... Open

User Access Verification
Username: cisoc
Password:
% Authentication failed
Username: cisco
Password:
r5>en
so this working i have no tacacs server configured so it is falling back off the local
database

If i have configured on r5
r5(config)#aaa authentication login default group USER

r4
---
r4#telnet 5.5.5.5
Trying 5.5.5.5 ... Open
% Authentication failed
% Authentication failed
% Authentication failed
[Connection to 5.5.5.5 closed by foreign host]
r4#

i can no longer telnet as there is only the server specfied no faill back group

We will take a quick look at the privilige commands for authorization locally on the cisco
ios

when you are looking at this we need to now that
sh ip int brief is an exec command
int fa0/0- is run configuration mode
while ip adddress "ip" is interface level command
so we need to be aware of the different cli levels in the ios
r5
---

we will create a few accounts with different priv levels
r5(config)#username eoghan privilege 1 password eoghan
r5(config)#username tom privilege 2 password tom

r4
--

r4#telnet 5.5.5.5
Trying 5.5.5.5 ... Open

User Access Verification
Username: eoghan
Password:
r5>sh priv
Current privilege level is 1
r5>

r5>sh ip int brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            155.0.58.5      YES NVRAM  up                    down
FastEthernet0/1            unassigned      YES NVRAM  administratively down down
Serial0/0/0                155.0.0.5       YES NVRAM  down                  down
Serial0/1/0                155.0.45.5      YES NVRAM  up                    up 
Loopback0                  5.5.5.5         YES NVRAM  up                    up 
r5>ping 4.4.4.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
r5>en
% No password set

ok now i will authenticate with the username tom

r4#telnet 5.5.5.5
Trying 5.5.5.5 ... Open

User Access Verification
Username: tom
Password:
r5#
r5#

i am straigh away in privlige mode
r5#sh privi
Current privilege level is 2
r5#
i can not do
r5#config t

or
r5#sh run
       ^
% Invalid input detected at '^' marker.
r5#

so different levels will get you different privilges

we can edit

r5
---
r5(config)#privilege exec level 0 show run int serial0/1/0

so this is say privilge for the exec command sh run int s0/1/0 will be allowed for priv 0

we will have quick look at the run int on r5 before we telnet in as priv 0
r5#sh run int s0/1/0
Building configuration...
Current configuration : 86 bytes
!
interface Serial0/1/0
 ip address 155.0.45.5 255.255.255.0
 ip pim sparse-mode
end
r5#

r4
--
r4#telnet 5.5.5.5
Trying 5.5.5.5 ... Open

User Access Verification
Username: eoghan
Password:
r5>sh run int

r5>sh run int s0/1/0
Building configuration...
Current configuration : 29 bytes
!
interface Serial0/1/0
end

so we can see now on r4 telnetting into r5 with the username eoghan which is priv 1 we can
issue the command sh run int BUT as we have no rights to configure any the options like ip
etc we can not see the ip address. In privilge modes if you do not have the rights to
configure you do not have the rights to see the configuration

r5
---
r5(config)#privilege interface level 0 ip address so we want to see the ip address under show
serial 0/1/0 we need to give them privilege to configure

r4
---
back on r4 and the telnet session
r5>sh run int s0/1/0
Building configuration...
Current configuration : 66 bytes
!
interface Serial0/1/0
 ip address 155.0.45.5 255.255.255.0
end
r5>

we can now see the ip

This can quickly get very messy with all the different modes additional rights you need to
give to view certain pareters etc so ROLE BASED ACCESS CONTROL (RBAC) was introduced

we will look the rbac approach to the authorization

first we need to enable aaa

r5(config)#aaa new-model
r5(config)#enable password cisco - this will be the password to get into enable view
To get into the root view

r5#enable view
Password:
r5#
*Feb 23 13:04:57.199: %PARSER-6-VIEW_SWITCH: successfully set to view 'root'.

Ok so i configured a view or a role called show and included all show commands
r5(config)#parser view SHOW
r5(config-view)#
*Feb 23 13:05:38.851: %PARSER-6-VIEW_CREATED: view 'SHOW' successfully created.
r5(config-view)#secret PASSWORD
r5(config-view)#commands exec include all show
r5(config-view)#

r4
---
r4#telnet 5.5.5.5
Trying 5.5.5.5 ... Open

User Access Verification
Username: eoghan
Password:
r5>enable view SHOW
Password:
% Authentication failed
r5>enable view SHOW
Password:
r5#

i am telnettting in as eoghna priv 1 and i use the enable view show command but in the
password set of PASSWORD and i am in the enable view show

I can not config t  but i can do all the show commands note the running config will not show
me everything as i have no acccess to configure
r5#config t
   ^
% Invalid input detected at '^' marker.
r5#sh run
Building configuration...
Current configuration : 13 bytes
!
!
!
!
end
r5#sh ip int brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            155.0.58.5      YES NVRAM  up                    down
FastEthernet0/1            unassigned      YES NVRAM  administratively down down
Serial0/0/0                155.0.0.5       YES NVRAM  down                  down
Serial0/1/0                155.0.45.5      YES NVRAM  up                    up 
Loopback0                  5.5.5.5         YES NVRAM  up                    up 

r5#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     155.0.0.0/24 is subnetted, 1 subnets
C       155.0.45.0 is directly connected, Serial0/1/0
     4.0.0.0/32 is subnetted, 1 subnets
D       4.4.4.4 [90/2297856] via 155.0.45.4, 01:52:13, Serial0/1/0
     5.0.0.0/32 is subnetted, 1 subnets
C       5.5.5.5 is directly connected, Loopback0
r5#

r5
---
lets configure another view on r5

r5(config)#parser view SHOW-IP-ROUTE
r5(config-view)#
*Feb 23 13:11:17.995: %PARSER-6-VIEW_CREATED: view 'SHOW-IP-ROUTE' successfully created.
r5(config-view)#secret TEST
r5(config-view)#command exec include-exclusive sh ip route
r5(config-view)#

so sh ip route we have said that this is exclusive to this view meaning on

r4
---
i can no longer do ip route logged in as the view of SHOW i can do all other show but show ip
route is exclusively to the SH-IP-ROUTE VIEW
r5#sh ip route
          ^
% Invalid input detected at '^' marker.
r5#

ok lets log in to the SHOW-IP-ROUTE VIEW To be sure
r4#telnet 5.5.5.5
Trying 5.5.5.5 ... Open

User Access Verification
Username: eoghan
Password:
r5>enable view SHOW-IP-ROUTE
Password:
% Authentication failed
r5>enable view SHOW-IP-ROUTE
Password:
r5#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     155.0.0.0/24 is subnetted, 1 subnets
C       155.0.45.0 is directly connected, Serial0/1/0
     4.0.0.0/32 is subnetted, 1 subnets
D       4.4.4.4 [90/2297856] via 155.0.45.4, 01:56:28, Serial0/1/0
     5.0.0.0/32 is subnetted, 1 subnets
C       5.5.5.5 is directly connected, Loopback0
r5#sh ip int
         ^
% Invalid input detected at '^' marker.
r5#

notice i can not do any other sh commands sh ip route under SH-IP-ROUTE view

We can make super view combining views
r5
---
so we are combining the 2 views in superview

r5(config)#parser view SHOW-AND-ROUTE superview
r5(config-view)#
*Feb 23 13:18:36.183: %PARSER-6-SUPER_VIEW_CREATED: super view 'SHOW-AND-ROUTE' successfully
created.
r5(config-view)#secret PASSWORD
r5(config-view)#view SHOW
r5(config-view)#view
*Feb 23 13:19:21.235: %PARSER-6-SUPER_VIEW_EDIT_ADD: view SHOW added to superview SHOW-AND-R
r5(config-view)#VIEW SHOW-IP-ROUTE
r5(config-view)#
*Feb 23 13:19:37.655: %PARSER-6-SUPER_VIEW_EDIT_ADD: view SHOW-IP-ROUTE added to superview
SHOW-AND-ROUTE.

To assign view to usernames

r5(config)#username newuser password newuser
r5(config)#username newuser view SHOW-AND-ROUTE

we also need to tell aaa to look for authorization locally

r5(config)#aaa authorization exec default local

r4
---
r4#telnet 5.5.5.5
Trying 5.5.5.5 ... Open

User Access Verification
Username: newuser
Password:
r5#config t
   ^
% Invalid input detected at '^' marker.
r5#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route
Gateway of last resort is not set
     155.0.0.0/24 is subnetted, 1 subnets
C       155.0.45.0 is directly connected, Serial0/1/0
     4.0.0.0/32 is subnetted, 1 subnets
D       4.4.4.4 [90/2297856] via 155.0.45.4, 02:04:30, Serial0/1/0
     5.0.0.0/32 is subnetted, 1 subnets
C       5.5.5.5 is directly connected, Loopback0
r5#sh ip int brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            155.0.58.5      YES NVRAM  up                    down
FastEthernet0/1            unassigned      YES NVRAM  administratively down down
Serial0/0/0                155.0.0.5       YES NVRAM  down                  down
Serial0/1/0                155.0.45.5      YES NVRAM  up                    up 
Loopback0                  5.5.5.5         YES NVRAM  up                    up 

working as expected

ZONE BASED FIREWALL (ZBF)

Zone Based Firewall

•  Use the same inspection engine as CBAC the main difference is that it works with security zones not interfaces and can support policing
• zones group multiple interface togther traffic is allowed inside one zone but prohibted between
• A zone is defined via  zone security  commmand
• Special zone self is allocated to router by default all traffic to/from this zone is allowed so we do not have to manually account for the control plane traffic
• interzone communication requires "zone pairing"
•  define with zone-pair then associated policy-map type inspect ot permit traffic action inspect vs action pass
• ZFQ configuarion use mqx syntax class-map/policy-map of type inspect traffic classified with match protocolapplication still defined with ip port-map
• We can also use paremeter map to define specfic features advanced features we want enabled
• 2 type of parmaeter map Parameter map type inspect - defines tcp intercept and global cbac setting or Parameter-map type inspect "protocol"- may be used to enforce application like for example smtp we can limit the recipents to 50 users or do advanced matches filtering based on regexpressions
• Parameter maps can also be used for turning on auditing
• virtual templates can be memeber of zones
• ios firewall is vrf aware
•  We can apply policy in ZFW Traffic Policing Action not availible in CBAC MQC  policing could be used per-interface
• Supports policing of interzone trafficintra zone traffic not policed
• We need to create zone-pair for each direction if bidirectional communication is required
• cisco ios firewall can be configured to be transparent nbar is not fully supported in transparent mode though

    -command police under policy map type inspect

• Zone Self Special zone that repersents the router all traffic permitted in/out by default
• It does not support protocol inspection only tcp/udp and icmp supported
• Could be paired with other zones e.g to control acccess to the router

 Commands

Creating zones

zone security 'Inside'
zone security 'outside'

Assigning interfaces to zones

int fa0/0
zone-member security inside
int fa0/2
zone-member secuirty inside

int serial 0/0
zone-member secuirty outside

Creating Zone-Pair

zone-pair security "Inside-to-Outside" source inside destination outside

Class traffic to Inspect

class-map type inspect match "HTTP"
match protocol http

Policy Map

Policy-map type inspect "HTTP-OUT"
class type inspect "HTTP"

Then apply to the zone

zone-pair security "Inside-to-Outside"
service-policy type "inspect HTTP-OUT"

Paramater map can be advanced inspection

parameter-map type inspect "httpmore"
max-incomplete high 20
audit-trail on

this is applied under the policy-map

Policy-map type inspect "HTTP-OUT"
class type inspect "HTTP"
inspect "httpmore"


LAB


OK for the lab r5 will be zone based firewall so sw2 and sw4 section of the network will be inside
the r4 section of the network will be dmz and everything else will be outside

R5
---
Ok first things first we will define our 3 zones
r5#config t
Enter configuration commands, one per line.  End with CNTL/Z.
r5(config)#zone security INSIDE
r5(config-sec-zone)#exit
r5(config)#zone security OUTSIDE
r5(config-sec-zone)#exit
r5(config)#zone security DMZ
r5(config-sec-zone)#?
Zone configuration commands:
  description  Zone description
  exit         Exit from zone configuration mode
  no           Negate or set default values of a command
r5(config-sec-zone)#

Ok we will define the classes i have just done tcp udp and icmp we could more granular on the inspection on specfic protocols like http to look for urls via regexp

r5(config)#class-map type inspect TCP
r5(config-cmap)#match protocol tcp
r5(config-cmap)#class-map type inspect UDP
r5(config-cmap)#match protocol UDP
r5(config-cmap)#class-map type inspect ICMP
r5(config-cmap)#match protocol ICMP
r5(config-cmap)#

Now we will define a policy-map inspect so it basically what we will do with the traffic once it matched drop drop and log pass without inspection inspect ( allowing return traffic)

r5(config)#policy-map type inspect INSIDE_TO_OUTSIDE
r5(config-pmap)#class TCP
r5(config-pmap-c)#inspect
r5(config-pmap-c)#class UDP
r5(config-pmap-c)#inspect
r5(config-pmap-c)#class ICMP
r5(config-pmap-c)#inspect
r5(config-pmap-c)#
the above is my policy map for going outbound so all i want to do is allow the traffic and allow return traffic so i will inspect.
Next step is to create the zone-pair to apply the policy to
r5(config)#zone-pair security INSIDE-TO-OUTSIDE-PAIR source INSIDE destination$
r
r5(config-sec-zone-pair)#service-policy type inspect INSIDE_TO_OUTSIDE

i will just do sh run as there is bit cut off
r5#sh run | sec zone-pair
zone-pair security INSIDE-TO-OUTSIDE-PAIR source INSIDE destination OUTSIDE
 service-policy type inspect INSIDE_TO_OUTSIDE
so we define the flow of traffic from source inside to outside and we assign the policy INSIDE_TO_OUTSIDE which is doing inspect of tcp

next we need to assign the interfaces i will just start with zone inside and zone outside

r5(config)#int s0/0/0
r5(config-if)#zone-member security OUTSIDE
r5(config-if)#int f0/0
r5(config-if)#zone-member security INSIDE
r5(config-if)#

ok so now that assigned at the moment from s2 we should be able to ping s1 but s1 should not be able to ping s2
So we will just make sure we are on the right track

s1#ping 22.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 22.2.2.2, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
s1#

s2#ping 2.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 58/65/68 ms
s2#
so looks good

one of the potential issue we have at the moment is that r5 as the zone self allows everything could be accessed from outside

s1
---
so i can succesifully telnet r5
s1#telnet 5.5.5.5
Trying 5.5.5.5 ... Open

User Access Verification
Username: cisco
Password:
r5>

just can not transit it
s1#telnet 22.2.2.2
Trying 22.2.2.2 ...
% Connection timed out; remote host not responding

this would be a fairly large security hole allowing outside to telnet our firewall device

what we will do is we will allow s1 to ping our device and other devices outside can not connect at all

r5
---
r5(config)#ip access-list extended PINGFRMS1
r5(config-ext-nacl)#permit icmp host 2.1.1.1 any echo
r5(config-ext-nacl)#permit eigrp any any
r5(config-ext-nacl)#

I also allowed eigrp any any just to maintain the underlying igp.

so i will create the class map
r5(config)#class-map type inspect FROMOUTSIDE
r5(config-cmap)#match access-group name PINGFRMS1
r5(config-cmap)#
now policy-map
r5(config)#policy-map type inspect OUTSIDE_TO_SELF
r5(config-pmap)#class FROMOUTSIDE
r5(config-pmap-c)#pass
r5(config-pmap-c)#class class-default
r5(config-pmap-c)#drop log
r5(config-pmap-c)#
so everything match in the class FROMOUTSIDE will be allowed (pass) and everything else will hit class default and will dropped + we have asked for it to be logged.
Ok as i tested telnet above i will also allow telent to the allowed from s1 for consistence of testing

r5(config)#ip access-list extended PINGFRMS1
r5(config-ext-nacl)#30 permit tcp any any eq 23
r5(config-ext-nacl)#40 deny ip any any
r5(config-ext-nacl)#

next we need to assign the zone pair
r5(config)#zone-pair security OUTSIDE_TO_SELF source OUTSIDE destination self
r5(config-sec-zone-pair)#service-policy type inspect OUTSIDE_TO_SELF
s1#ping 5.5.5.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.5, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
s1#ping 5.5.5.5 source 2.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.5, timeout is 2 seconds:
Packet sent with a source address of 2.1.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 59/65/68 ms
s1#

i can also telnet
s1#telnet 5.5.5.5
Trying 5.5.5.5 ... Open

User Access Verification
Username:

if i go to s3
--------------
s3#ping 5.5.5.5
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 5.5.5.5, timeout is 2 seconds:
..
i can not ping i will be able to telnet as i did not lock down the acl to 2.1.1.1 for telnet i done tcp any any but not been able to ping proves it is working.

r5
---
[Resuming connection 5 to r5 ... ]
*Feb 22 16:33:39.391: %FW-6-DROP_PKT: Dropping icmp pkt 155.0.37.1:8 => 5.5.5.5:0
*Feb 22 16:35:04.979: %FW-6-DROP_PKT: Dropping icmp pkt 155.0.79.3:8 => 5.5.5.5:0
r5#
we can see there is logging in regard to dropping the icmp packet
r5#show policy-map type inspect zone-pair OUTSIDE_TO_SELF
 Zone-pair: OUTSIDE_TO_SELF
  Service-policy inspect : OUTSIDE_TO_SELF
    Class-map: FROMOUTSIDE (match-all)
      Match: access-group name PINGFRMS1
      Pass
        20 packets, 735 bytes
    Class-map: class-default (match-any)
      Match: any
      Drop
        10 packets, 800 bytes
we can see matches  on both passes and drops

OK we will add third zone mainly DMZ which will connect to r4 which is webserver for the sake of the lab. We will look at doing the parameter maps for more advance config

so firstly acccess list
r5(config)#ip access-list ext R4_WEB_SERVER_ACL
r5(config-ext-nacl)#permit tcp any host 4.4.4.4

next i will do my class-map

r5(config)#class-map type inspect R4
r5(config-cmap)#match protocol http
r5(config-cmap)#match access-group name R4_WEB_SERVER_ACL
r5(config-cmap)#
OK i will do a parameter for more advanced options

r5(config)#parameter-map type inspect R4-WEB-PARAMETER
r5(config-profile)#?
parameter-map commands:
  alert           Turn on/off alert
  audit-trail     Turn on/off audit trail
  dns-timeout     Specify timeout for DNS
  exit            Exit from parameter-map
  icmp            Config timeout values for icmp
  max-incomplete  Specify maximum number of incomplete connections before
                  clamping
  no              Negate or set default values of a command
  one-minute      Specify one-minute-sample watermarks for clamping
  sessions        Maximum number of inspect sessions
  tcp             Config timeout values for tcp connections
  udp             Config timeout values for udp flows
r5(config-profile)#max-incomplete ?
  high  Specify high-watermark for clamping
  low   Specify low-watermark for clamping
r5(config-profile)#max-incomplete high 20
%New high threshold 20 cannot be smaller than low threshold 400
r5(config-profile)#max-incomplete high 420
r5(config-profile)#max-incomplete low 400

r5(config-profile)#audit-trail on
r5(config-profile)#tcp ?
  finwait-time    Specify timeout for TCP connections after a FIN
  idle-time       Specify idle timeout for tcp connections
  max-incomplete  Specify max half-open connection per host
  synwait-time    Specify timeout for TCP connections after a SYN and no
                  further data
r5(config-profile)#tcp synwait-time ?
  <1-2147483>  Timeout in seconds
r5(config-profile)#tcp synwait-time 20
r5(config-profile)#
so i have created a few tcp intercept parameters and logging i need to associate this with our policy map
so a policy and within the class r4 we specify the parameter map
r5(config)#policy-map type inspect DMZ
r5(config-pmap)#class type inspect R4
r5(config-pmap-c)#inspect R4-WEB-PARAMETER
r5(config-pmap-c)#exit
r5(config-pmap)#class class-default
r5(config-pmap-c)#drop log
r5(config-pmap-c)#exit

Ok create the zone pair
r5(config)#zone-pair security OUTSIDE-TO-DMZ source OUTSIDE destination DMZ
r5(config-sec-zone-pair)#service-policy type inspect DMZ
r5(config-sec-zone-pair)#
just before i forget i need to add r5 s0/1/0 to dmz zone
r5(config-if)#int s0/1/0
r5(config-if)#zone-member security DMZ
r5(config-if)#

r4
---
r4(config)#ip http server
r4(config)#ip http authentication local
r4(config)#username cisco password cisco

s1
---
s1#connect 5.5.5.5 www
Trying 5.5.5.5, 80 ...
% Connection timed out; remote host not responding
s1#connect 4.4.4.4 www
Trying 4.4.4.4, 80 ... Open

we can make http connection to 4.4.4.4 as expected

but we can not ping it
s1#ping 4.4.4.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:
.


r5
---

we can see some audit trail info here
access#5
[Resuming connection 5 to r5 ... ]
*Feb 22 17:36:03.551: %FW-6-SESS_AUDIT_TRAIL_START: (target:class)-(OUTSIDE-TO-DMZ:R4):Start http session: initiator (155.0.37.1:11003) -- responder (4.4.4.4:80)
*Feb 22 17:36:22.647: %FW-6-SESS_AUDIT_TRAIL: (target:class)-(OUTSIDE-TO-DMZ:R4):Stop http session: initiator (155.0.37.1:11003) sent 9 bytes -- responder (4.4.4.4:80) sent 122 bytes
r5#sh parameter-map type inspect R4-WEB-PARAMETER
 parameter-map type inspect R4-WEB-PARAMETER
  audit-trail on
  alert on
  max-incomplete low 400
  max-incomplete high 420
  one-minute low 400
  one-minute high 500
  udp idle-time 30
  icmp idle-time 10
  dns-timeout 5
  tcp idle-time 3600
  tcp finwait-time 5
  tcp synwait-time 20
  tcp max-incomplete host 50 block-time 0
  sessions maximum 0

r5#sh policy-map type inspect zone-pair OUTSIDE-TO-DMZ
 Zone-pair: OUTSIDE-TO-DMZ
  Service-policy inspect : DMZ
    Class-map: R4 (match-all)
      Match: protocol http
      Match: access-group name R4_WEB_SERVER_ACL
      Inspect
        Packet inspection statistics [process switch:fast switch]
        tcp packets: [0:34]
        Session creations since subsystem startup or last reset 2
        Current session counts (estab/half-open/terminating) [0:0:0]
        Maxever session counts (estab/half-open/terminating) [1:1:1]
        Last session created 00:03:45
        Last statistic reset never
        Last session creation rate 0
        Last half-open session total 0
    Class-map: class-default (match-any)
      Match: any
      Drop
        5 packets, 400 bytes
r5#

Ok if we want to allow the inside network connect to dmz

r5(config)#zone-pair security INSIDE-TO-DMZ source INSIDE destination DMZ
r5(config-sec-zone-pair)#service-policy type inspect DMZ
r5(config-sec-zone-pair)#

s2
---
s2>en
s2#connect 4.4.4.4 www
Trying 4.4.4.4, 80 ... Open
it is working

r4
---
r4#ping 2.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2.1.1.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
r4#ping 22.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 22.2.2.2, timeout is 2 seconds:
..
can not connect out as expected

TCP INTERCEPT AND CBAC

TCP INTERCEPT

• Defence tcp syn attacks where attacker tries to overload server with half open tcp connections limiting other connections
• TCP intercept can run in 2 modes 1) intercept mode - router acts as proxy it will not forward the connections to the server till   they are complete. This is not usually used that much as your effectively moving the issue from the server to the router so not great solution 2)Watch mode - passively monitor sesssion establishement. Send tcp rst if 3 way handshake does              not complete in time
• You can set the drop mode to oldest or random oldest it will drop the oldest half opening connectios first if limit is reached random it randomly drops the half open connections
• By default it will start dropping at 1100 half open connections
• Also 30 seconds is the default wait for full session establishment

Commands

access-list 101 perit tcp any "ip" "mask" -  so this is the subnet or ip you want the inspect done for

tcp intercept list "intcept acl"

ip tcp intercept mode "watch/intercept" - intercept default


Content Based Access Control

•    protocols are matched based on port numbers and inspection
• We define inspection based on inspect map and what protocols we want to inspect then this is applied to the interface. Then it will keep track of the traffic going out and allow traffic back in will work better than reflexive as it stateful inspects the traffic at layer 4-7 so can deal with non standard.
• This can be complex if there is more than two interface i.e the inside/outside if we add it third it is more complicated configuration ways so if we have more than 2 cisco ios firewall is better option
• Alerts are on by default
• It supports session logging via audit trail
• We can also allow locally generate traffic.
• CBAC also does not wait for timeout of tcp traffic it will close session once the fin is recieved so it is more secure we are not open to attacks waiting for timeouts
• UDP traffic as there is no control protocol to signify the end of transmission will remain timeout based
• cbac supports inspection of smtp,realaudio,rpc,sqlnet,rcmd,vdolive,tftp,udp,tcp,ftp,h323,cuseeme,https

Commands

ip inspect name "inspectname" "protocol to inspect"
ip inspect name "inspectname" "protocol2toinspect"

interface fa0/0
ip address 10.10.10.1 255.255.255.0
ip inspect "inspectname" in/outbound

LAB
----

TCP intercept so we will say we have a few servers in lan segment 155.0.58.0/24
so first things first we create the acl
r5(config)#access-list 108 permit tcp any 155.0.58.0 0.0.0.255
we enable tcp intercept for acl 108
r5(config)#ip tcp intercept list 108
command accepted, interfaces with mls configured might cause inconsistent behavior
r5(config)#ip tcp intercept mode watch

r5#show tcp intercept ?
  connections  Connection information
  statistics   Statistics
r5#show tcp intercept connections
Incomplete:
Client                Server                State    Create   Timeout  Mode
Established:
Client                Server                State    Create   Timeout  Mode
r5#show tcp intercept stat
Watching new connections using access-list 108
0 incomplete, 0 established connections (total 0)
0 connection requests per minute
r5#
CBAC
------
Ok so s2 is inside the network wanting to connect out to s2 we want s1 to be able to connnect and form 3 way handshake etc but we do not want s1 to be able to iniate connections to s2

so we start of by configuring what protocols we want to inspect

r5(config)#ip inspect name EXAMPLE  telnet
r5(config)#ip inspect name EXAMPLE  icmp
r5(config)#ip inspect name EXAMPLE  ?
  802-11-iapp       IEEE 802.11 WLANs WG IAPP
  ace-svr           ACE Server/Propagation
  appfw             Application Firewall
  appleqtc          Apple QuickTime
  bgp               Border Gateway Protocol
  biff              Bliff mail notification
  bittorrent        bittorrent
  bootpc            Bootstrap Protocol Client
  bootps            Bootstrap Protocol Server
  cddbp             CD Database Protocol
  cifs              CIFS
  cisco-fna         Cisco FNATIVE
  cisco-net-mgmt    cisco-net-mgmt
  cisco-svcs        cisco license/perf/GDP/X.25/ident svcs
  cisco-sys         Cisco SYSMAINT
  cisco-tdp         Cisco TDP
  cisco-tna         Cisco TNATIVE
  citrix            Citrix IMA/ADMIN/RTMP
  citriximaclient   Citrix IMA Client
  clp               Cisco Line Protocol
  creativepartnr    Creative Partnr
  creativeserver    Creative Server
  cuseeme           CUSeeMe Protocol
  daytime           Daytime (RFC 867)
  dbase             dBASE Unix
  dbcontrol_agent   Oracle dbControl Agent po
  ddns-v3           Dynamic DNS Version 3
  dhcp-failover     DHCP Failover
  directconnect     Direct Connect Version 2.0
there is a whole bunch of protocols which are preconfigured i have cut off the list it is similar to nbar list

we can see the port-map

r5#sh ip port-map
Default mapping:  snmp                 udp port 161                        system defined
Default mapping:  echo                 tcp port 7                          system defined
Default mapping:  echo                 udp port 7                          system defined
Default mapping:  telnet               tcp port 23                         system defined

we can edit it like bar
r5(config)#ip port-map http port 8002
r5(config)#do sh ip port-map http
Default mapping:  http                 tcp port 80                         system defined
Default mapping:  http                 tcp port 8002                       user defined

ok first of all i will create the access list denying incoming traffic i will allow eigrp to keep underlying igp
r5(config)#access-list 120 permit eigrp any any
r5(config)#access-list 120 deny ip any any

r5(config)#int s0/0/0
r5(config-if)#ip access-group 120 in

i will apply the access-list

i will also add the cbac inspection map example

r5(config)#int s0/0/0
r5(config-if)#ip inspect EXAMPLE out

s2
---
s2>en
s2#telnet 2.1.1.1
Trying 2.1.1.1 ... Open

User Access Verification
Username: cisco
Password:
s1>

r5
---
r5#sh ip inspect sess
Established Sessions
 Session 651B7EC8 (155.0.58.2:11023)=>(2.1.1.1:23) telnet SIS_OPEN
r5#

s1
---

i can not telnet in

s1#telnet 22.2.2.2
Trying 22.2.2.2 ...
% Destination unreachable; gateway or host down
s1#telnet 22.2.2.2
Trying 22.2.2.2 ...
% Destination unreachable; gateway or host down