tag:blogger.com,1999:blog-46822592203569145002024-08-29T03:57:21.957-07:00CISCO-HP-ONLYkhanhttp://www.blogger.com/profile/09978368963730080846noreply@blogger.comBlogger12125tag:blogger.com,1999:blog-4682259220356914500.post-5583107952591882082010-11-20T22:29:00.000-08:002010-11-20T22:29:01.594-08:00VOIP with H323 GW and GK and SKINNY too within INTRANET<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxh-_R371APjJD0wOjmRQLq3hPVzuUO7wkM2bCNlQMLbi3LHqHaxsFjkAsF02gKPQU-ts2gPYWeRzMBiFPqlNe3l0to2ZBUQiK15pOCI0pkMLTJQBbj56GkNYckL0IFy7UKd_4UJqK8uP3/s1600/VOIP+GK+GW.jpeg.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="263" ox="true" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjxh-_R371APjJD0wOjmRQLq3hPVzuUO7wkM2bCNlQMLbi3LHqHaxsFjkAsF02gKPQU-ts2gPYWeRzMBiFPqlNe3l0to2ZBUQiK15pOCI0pkMLTJQBbj56GkNYckL0IFy7UKd_4UJqK8uP3/s320/VOIP+GK+GW.jpeg.jpeg" width="320" /></a></div><br /> <a name='more'></a><br /> GateKeeper is GK in network, GW are R6 and R7 acting as H323 and Skinny GWs.<br /> <br /> In this I designed a network which supports Voip only network and I leveraged my network with GK and GWfor voip support&nbsp;. Where GK handles two intranet sites(zones). &nbsp;GWs&nbsp;&nbsp;having both telephony and H323 GW functionality configured. <br /> Routing Protocol I used here is OSPF for routing the call and load balancing purpose also.<br /> C1 and C2 are two sites. I used cisco communicator in my scenario at C1 and C2 sites.<br /> <br /> Here is the configuration details of routers (I am configuration of GK and GWs only. Routing protocol is your choice which one you want to implement). <br /> <strong>Note:</strong>&nbsp;Loopback is used as source interface for GK and GW&nbsp;service listening. I highlighted main GW and GK configuration in effected routers.<br /> <br /> <strong><u>GK configuration:</u></strong><br /> <br /> !<br /> <br /> <br /> version 12.4<br /> <br /> service timestamps debug datetime msec<br /> <br /> service timestamps log datetime msec<br /> <br /> no service password-encryption<br /> <br /> !<br /> <br /> hostname GK<br /> <br /> !<br /> <br /> boot-start-marker<br /> <br /> boot-end-marker<br /> <br /> !<br /> <br /> !<br /> <br /> no aaa new-model<br /> <br /> !<br /> <br /> resource policy<br /> <br /> !<br /> <br /> ip cef<br /> <br /> <br /> !<br /> <br /> interface Loopback0<br /> <br /> ip address 10.10.10.10 255.255.255.255<br /> <br /> ip ospf 1 area 0<br /> <br /> !<br /> <br /> interface FastEthernet0/0<br /> <br /> ip address 172.16.1.1 255.255.255.252<br /> <br /> ip ospf 1 area 0<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> interface FastEthernet0/1<br /> <br /> ip address 172.16.1.5 255.255.255.252<br /> <br /> ip ospf 1 area 0<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> router ospf 1<br /> <br /> log-adjacency-changes<br /> <br /> !<br /> <br /> no ip http server<br /> <br /> no ip http secure-server<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> logging alarm informational<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> control-plane<br /> <br /> !<br /> !<br /> <br /> <strong>gatekeeper</strong><br /> <strong><br /> </strong><br /> <strong>zone local zone1 khanrahil.com 10.10.10.10 enable-intrazone</strong><br /> <strong><br /> </strong><br /> <strong>zone local zone2 khanrahil.com enable-intrazone</strong><br /> <strong><br /> </strong><br /> <strong>zone prefix zone1 1.</strong><br /> <strong><br /> </strong><br /> <strong>zone prefix zone2 2.</strong><br /> <strong><br /> </strong><br /> <strong>bandwidth total zone zone1 1200</strong><br /> <strong><br /> </strong><br /> <strong>bandwidth total zone zone2 1200</strong><br /> <strong><br /> </strong><br /> <strong>bandwidth session default 128</strong><br /> <strong><br /> </strong><br /> <strong>bandwidth session zone zone1 128</strong><br /> <strong><br /> </strong><br /> <strong>bandwidth session zone zone2 128</strong><br /> <strong><br /> </strong><br /> <strong>bandwidth remote 1500</strong><br /> <strong><br /> </strong><br /> <strong>bandwidth check-destination</strong><br /> <strong><br /> </strong><br /> <strong>no shutdown</strong><br /> <br /> !<br /> <br /> !<br /> <br /> line con 0<br /> <br /> exec-timeout 0 0<br /> <br /> logging synchronous<br /> <br /> stopbits 1<br /> <br /> line aux 0<br /> <br /> stopbits 1<br /> <br /> line vty 0 4<br /> <br /> login<br /> <br /> !<br /> <br /> !<br /> <br /> end<br /> <br /> <strong><u>R6 Configuration:</u></strong><br /> <br /> !<br /> <br /> <br /> version 12.4<br /> <br /> service timestamps debug datetime msec<br /> <br /> service timestamps log datetime msec<br /> <br /> no service password-encryption<br /> <br /> !<br /> <br /> hostname R6<br /> <br /> !<br /> <br /> boot-start-marker<br /> <br /> boot-end-marker<br /> <br /> !<br /> <br /> !<br /> <br /> no aaa new-model<br /> <br /> memory-size iomem 5<br /> <br /> !<br /> <br /> !<br /> <br /> ip cef<br /> <br /> !<br /> !<br /> <br /> interface Loopback0<br /> <br /> ip address 30.30.30.30 255.255.255.255<br /> <br /> ip ospf 1 area 2<br /> <br /> <strong>h323-gateway voip interface</strong><br /> <strong><br /> </strong><br /> <strong>h323-gateway voip id zone1 ipaddr 10.10.10.10 1719</strong><br /> <strong><br /> </strong><br /> <strong>h323-gateway voip h323-id R6</strong><br /> <strong><br /> </strong><br /> <strong>h323-gateway voip bind srcaddr 30.30.30.30</strong><br /> <br /> !<br /> <br /> interface FastEthernet0/0<br /> <br /> ip address 10.1.2.22 255.255.255.252<br /> <br /> ip ospf 1 area 2<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> interface FastEthernet0/1<br /> <br /> ip address 10.1.2.26 255.255.255.252<br /> <br /> ip ospf 1 area 2<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> interface FastEthernet1/0<br /> <br /> ip address 192.168.1.10 255.255.255.0<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> !<br /> <br /> router ospf 1<br /> <br /> router-id 6.6.6.6<br /> <br /> log-adjacency-changes<br /> <br /> summary-address 0.0.0.0 0.0.0.0 not-advertise<br /> <br /> default-information originate<br /> <br /> !<br /> <br /> ip http server<br /> <br /> no ip http secure-server<br /> <br /> ip forward-protocol nd<br /> <br /> ip route 0.0.0.0 0.0.0.0 192.168.1.1<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> control-plane<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> <strong>dial-peer voice 20 voip</strong><br /> <strong><br /> </strong><br /> <strong>destination-pattern ..</strong><br /> <strong><br /> </strong><br /> <strong>session target ras</strong><br /> <strong><br /> </strong><br /> <strong>codec g711alaw</strong><br /> <br /> !<br /> <br /> <strong>gateway </strong><br /> <strong><br /> </strong><br /> <strong>timer receive-rtp 1200</strong><br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> <strong>telephony-service</strong><br /> <strong><br /> </strong><br /> <strong>max-ephones 1</strong><br /> <strong><br /> </strong><br /> <strong>max-dn 1</strong><br /> <strong><br /> </strong><br /> <strong>ip source-address 192.168.1.10 port 2000</strong><br /> <strong><br /> </strong><br /> <strong>auto assign 1 to 1</strong><br /> <strong><br /> </strong><br /> <strong>create cnf-files version-stamp Jan 01 2002 00:00:00</strong><br /> <strong><br /> </strong><br /> <strong>max-conferences 8 gain -6</strong><br /> <br /> <strong>transfer-system full-consult</strong><br /> <br /> !<br /> <br /> !<br /> <br /> <strong>ephone-dn 1</strong><br /> <strong><br /> </strong><br /> <strong>number 10</strong><br /> <br /> !<br /> <br /> !<br /> <br /> <strong>ephone 1</strong><br /> <br /> <strong>mac-address 001C.C088.0461</strong><br /> <br /> <strong>type CIPC</strong><br /> <strong><br /> </strong><br /> <strong>button 1:1</strong><br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> line con 0<br /> <br /> exec-timeout 0 0<br /> <br /> logging synchronous<br /> <br /> line aux 0<br /> <br /> line vty 0 4<br /> <br /> login<br /> <br /> !<br /> <br /> !<br /> <br /> end<br /> <br /> <strong><u>R7 Configuration:</u></strong><br /> <br /> !<br /> <br /> <br /> version 12.4<br /> <br /> service timestamps debug datetime msec<br /> <br /> service timestamps log datetime msec<br /> <br /> no service password-encryption<br /> <br /> !<br /> <br /> hostname R7<br /> <br /> !<br /> <br /> boot-start-marker<br /> <br /> boot-end-marker<br /> <br /> !<br /> <br /> !<br /> <br /> no aaa new-model<br /> <br /> memory-size iomem 5<br /> <br /> !<br /> <br /> !<br /> <br /> ip cef<br /> <br /> no ip domain lookup<br /> <br /> !<br /> <br /> <br /> !<br /> !<br /> <br /> interface Loopback0<br /> <br /> ip address 20.20.20.20 255.255.255.255<br /> <br /> ip ospf 1 area 1<br /> <br /> <strong>h323-gateway voip interface</strong><br /> <strong><br /> </strong><br /> <strong>h323-gateway voip id zone2 ipaddr 10.10.10.10 1719</strong><br /> <strong><br /> </strong><br /> <strong>h323-gateway voip h323-id R7</strong><br /> <strong><br /> </strong><br /> <strong>h323-gateway voip bind srcaddr 20.20.20.20</strong><br /> <br /> !<br /> <br /> interface FastEthernet0/0<br /> <br /> ip address 192.168.2.1 255.255.255.0<br /> <br /> ip ospf 1 area 1<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> interface FastEthernet0/1<br /> <br /> no ip address<br /> <br /> shutdown<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> interface Serial1/0<br /> <br /> ip address 10.1.1.2 255.255.255.252<br /> <br /> ip ospf 1 area 1<br /> <br /> serial restart-delay 0<br /> <br /> !<br /> <br /> interface Serial1/1<br /> <br /> ip address 10.1.1.14 255.255.255.252<br /> <br /> ip ospf 1 area 1<br /> <br /> serial restart-delay 0<br /> <br /> !<br /> <br /> interface Serial1/2<br /> <br /> no ip address<br /> <br /> shutdown<br /> <br /> serial restart-delay 0<br /> <br /> !<br /> <br /> interface Serial1/3<br /> <br /> no ip address<br /> <br /> shutdown<br /> <br /> serial restart-delay 0<br /> <br /> !<br /> <br /> !<br /> <br /> router ospf 1<br /> <br /> router-id 7.7.7.7<br /> <br /> log-adjacency-changes<br /> <br /> passive-interface FastEthernet0/0<br /> <br /> !<br /> <br /> ip http server<br /> <br /> no ip http secure-server<br /> <br /> ip forward-protocol nd<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> control-plane<br /> <br /> !<br /> <br /> !<br /> <br /> <strong>dial-peer voice 10 voip</strong><br /> <strong><br /> </strong><br /> <strong>destination-pattern ..</strong><br /> <strong><br /> </strong><br /> <strong>session target ras</strong><br /> <strong><br /> </strong><br /> <strong>codec g711alaw</strong><br /> <br /> !<br /> <br /> <strong>gateway </strong><br /> <strong><br /> </strong><br /> <strong>timer receive-rtp 1200</strong><br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> <strong>telephony-service</strong><br /> <strong><br /> </strong><br /> <strong>max-ephones 1</strong><br /> <strong><br /> </strong><br /> <strong>max-dn 1</strong><br /> <strong><br /> </strong><br /> <strong>ip source-address 192.168.2.1 port 2000</strong><br /> <strong><br /> </strong><br /> <strong>auto assign 1 to 1</strong><br /> <strong><br /> </strong><br /> <strong>create cnf-files version-stamp Jan 01 2002 00:00:00</strong><br /> <strong><br /> </strong><br /> <strong>max-conferences 8 gain -6</strong><br /> <strong><br /> </strong><br /> <strong>transfer-system full-consult</strong><br /> <br /> !<br /> <br /> !<br /> <br /> <strong>ephone-dn 1</strong><br /> <strong><br /> </strong><br /> <strong>number 20</strong><br /> <br /> !<br /> <br /> !<br /> <br /> <strong>ephone 1</strong><br /> <br /> <strong>mac-address 000C.29C0.A452</strong><br /> <br /> <strong>type CIPC</strong><br /> <strong><br /> </strong><br /> <strong>button 1:1</strong><br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> line con 0<br /> <br /> exec-timeout 0 0<br /> <br /> logging synchronous<br /> <br /> line aux 0<br /> <br /> line vty 0 4<br /> <br /> login<br /> <br /> !<br /> <br /> !<br /> <br /> end<br /> <br /> <br /> <strong></strong>khanhttp://www.blogger.com/profile/09978368963730080846noreply@blogger.com0tag:blogger.com,1999:blog-4682259220356914500.post-70231210139449019932010-11-20T00:08:00.000-08:002010-11-20T22:49:02.451-08:00Configuring voip with CME 3.3 tunnelling voice traffic on IPSEC based site-to-site VPN<div class="separator" style="clear: both; text-align: center;"></div><br /> <br /> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7piIL6A-u1lWdzZriKTpHegAX25xS9jaxxCs6jXIAUSKz4l4df9-RLIZGEMKXAJbLySauAr0MaDyTGS7AMBH2LJiQ2SM0k81Hb-QfaCatCjTBqw8nLiUHfOtMRyQKnvULTz_WPrF3yDOL/s1600/voice_with+two+sites+c1+and+c2.jpeg.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="248" ox="true" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi7piIL6A-u1lWdzZriKTpHegAX25xS9jaxxCs6jXIAUSKz4l4df9-RLIZGEMKXAJbLySauAr0MaDyTGS7AMBH2LJiQ2SM0k81Hb-QfaCatCjTBqw8nLiUHfOtMRyQKnvULTz_WPrF3yDOL/s320/voice_with+two+sites+c1+and+c2.jpeg.jpeg" width="320" /></a></div>Here in this scenario I configured IPSEC based&nbsp;site-to-site&nbsp;VPN. Motivation for creating VPN is that I want to make my voip traffic encrypted on public network. 10.10.10.0/24 subnet is assumed to be&nbsp;public network. Here in network diagram R2,R3 and FW1 are enabled for IPSEC&nbsp;site-to-site VPN.&nbsp; Below is the configuration&nbsp;of all devices which I configured.<br /> <br /> Here&nbsp;in this scenario&nbsp;three site are involved in VPN. Where GW is behind firewall. and other sites are c1 and c2 where cisco phone are located. With E.164 numbers configured 100 and 101. Dial peers are configured on R2 and R3. Telephony service is configured on R1 for two IP Phone can&nbsp;only communicate.<br /> <br /> <br /> <br /> <a name='more'></a><br /> <strong>FW1 Configuration:</strong><br /> <br /> pixfirewall# sh run<br /> <br /> <br /> : Saved<br /> <br /> :<br /> <br /> PIX Version 8.0(4)<br /> <br /> !<br /> <br /> hostname pixfirewall<br /> <br /> enable password 8Ry2YjIyt7RRXU24 encrypted<br /> <br /> passwd 2KFQnbNIdI.2KYOU encrypted<br /> <br /> names<br /> <br /> !<br /> <br /> interface Ethernet0<br /> <br /> nameif outside<br /> <br /> security-level 0<br /> <br /> ip address 10.10.10.3 255.255.255.0<br /> <br /> !<br /> <br /> interface Ethernet1<br /> <br /> nameif inside<br /> <br /> security-level 100<br /> <br /> ip address 20.20.20.2 255.255.255.0<br /> <br /> !<br /> <br /> interface Ethernet2<br /> <br /> shutdown<br /> <br /> no nameif<br /> <br /> no security-level<br /> <br /> no ip address<br /> <br /> !<br /> <br /> interface Ethernet3<br /> <br /> shutdown<br /> <br /> no nameif<br /> <br /> no security-level<br /> <br /> no ip address<br /> <br /> !<br /> <br /> interface Ethernet4<br /> <br /> nameif mgmt<br /> <br /> security-level 50<br /> <br /> ip address 192.168.46.2 255.255.255.0<br /> <br /> management-only<br /> <br /> !<br /> <br /> ftp mode passive<br /> <br /> clock timezone IN 5 30<br /> <br /> access-list h323_access extended permit ip any host 10.10.10.3<br /> <br /> access-list outside_1_cryptomap extended permit ip 20.20.20.0 255.255.255.0 192.168.1.0 255.255.255.0<br /> <br /> access-list inside_nat0_outbound extended permit ip 20.20.20.0 255.255.255.0 192.168.1.0 255.255.255.0<br /> <br /> access-list inside_nat0_outbound extended permit ip 20.20.20.0 255.255.255.0 192.168.2.0 255.255.255.0<br /> <br /> access-list outside_2_cryptomap extended permit ip 20.20.20.0 255.255.255.0 192.168.2.0 255.255.255.0<br /> <br /> pager lines 24<br /> <br /> logging enable<br /> <br /> logging asdm informational<br /> <br /> mtu outside 1500<br /> <br /> mtu inside 1500<br /> <br /> mtu mgmt 1500<br /> <br /> no failover<br /> <br /> icmp unreachable rate-limit 1 burst-size 1<br /> <br /> asdm image flash:/asdm-602.bin<br /> <br /> no asdm history enable<br /> <br /> arp timeout 14400<br /> <br /> global (outside) 1 interface<br /> <br /> nat (inside) 0 access-list inside_nat0_outbound<br /> <br /> nat (inside) 1 0.0.0.0 0.0.0.0<br /> <br /> access-group h323_access in interface outside<br /> <br /> route outside 0.0.0.0 0.0.0.0 10.10.10.1 1<br /> <br /> route outside 192.168.1.0 255.255.255.0 10.10.10.1 1<br /> <br /> route outside 192.168.2.0 255.255.255.0 10.10.10.2 1<br /> <br /> timeout xlate 3:00:00<br /> <br /> timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02<br /> <br /> timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00<br /> <br /> timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00<br /> <br /> timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute<br /> <br /> dynamic-access-policy-record DfltAccessPolicy<br /> <br /> http server enable<br /> <br /> http 0.0.0.0 0.0.0.0 mgmt<br /> <br /> http 0.0.0.0 0.0.0.0 outside<br /> <br /> no snmp-server location<br /> <br /> no snmp-server contact<br /> <br /> snmp-server enable traps snmp authentication linkup linkdown coldstart<br /> <br /> crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac<br /> <br /> crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac<br /> <br /> crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac<br /> <br /> crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac<br /> <br /> crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac<br /> <br /> crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac<br /> <br /> crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac<br /> <br /> crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac<br /> <br /> crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac<br /> <br /> crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac<br /> <br /> crypto ipsec security-association lifetime seconds 28800<br /> <br /> crypto ipsec security-association lifetime kilobytes 4608000<br /> <br /> crypto map outside_map 1 match address outside_1_cryptomap<br /> <br /> crypto map outside_map 1 set pfs<br /> <br /> crypto map outside_map 1 set peer 10.10.10.1<br /> <br /> crypto map outside_map 1 set transform-set ESP-3DES-SHA<br /> <br /> crypto map outside_map 1 set security-association lifetime seconds 28800<br /> <br /> crypto map outside_map 1 set security-association lifetime kilobytes 4608000<br /> <br /> crypto map outside_map 2 match address outside_2_cryptomap<br /> <br /> crypto map outside_map 2 set pfs<br /> <br /> crypto map outside_map 2 set peer 10.10.10.2<br /> <br /> crypto map outside_map 2 set transform-set ESP-3DES-SHA<br /> <br /> crypto map outside_map 2 set security-association lifetime seconds 28800<br /> <br /> crypto map outside_map 2 set security-association lifetime kilobytes 4608000<br /> <br /> crypto map outside_map interface outside<br /> <br /> crypto isakmp enable outside<br /> <br /> crypto isakmp policy 5<br /> <br /> authentication pre-share<br /> <br /> encryption 3des<br /> <br /> hash sha<br /> <br /> group 2<br /> <br /> lifetime 86400<br /> <br /> crypto isakmp policy 10<br /> <br /> authentication pre-share<br /> <br /> encryption des<br /> <br /> hash sha<br /> <br /> group 2<br /> <br /> lifetime 86400<br /> <br /> telnet timeout 5<br /> <br /> ssh timeout 5<br /> <br /> console timeout 0<br /> <br /> threat-detection basic-threat<br /> <br /> threat-detection statistics access-list<br /> <br /> no threat-detection statistics tcp-intercept<br /> <br /> ntp server 10.10.10.1 prefer<br /> <br /> group-policy DfltGrpPolicy attributes<br /> <br /> vpn-tunnel-protocol IPSec<br /> <br /> tunnel-group 10.10.10.1 type ipsec-l2l<br /> <br /> tunnel-group 10.10.10.1 ipsec-attributes<br /> <br /> pre-shared-key *<br /> <br /> tunnel-group 10.10.10.2 type ipsec-l2l<br /> <br /> tunnel-group 10.10.10.2 ipsec-attributes<br /> <br /> pre-shared-key *<br /> <br /> !<br /> <br /> class-map default<br /> <br /> match default-inspection-traffic<br /> <br /> !<br /> <br /> !<br /> <br /> policy-map default<br /> <br /> class default<br /> <br /> inspect icmp<br /> <br /> inspect skinny<br /> <br /> inspect tftp<br /> <br /> inspect ipsec-pass-thru<br /> <br /> inspect icmp error<br /> <br /> !<br /> <br /> service-policy default global<br /> <br /> prompt hostname context<br /> <br /> Cryptochecksum:5843d46469c3d5aa800c57144586496a<br /> <br /> : end<br /> <br /> pixfirewall#<br /> <br /> <br /> <br /> <br /> <br /> <br /> <strong>R1 configuration:</strong><br /> <br /> !<br /> <br /> <br /> ! Last configuration change at 12:34:22 IN Sat Nov 20 2010<br /> <br /> ! NVRAM config last updated at 12:56:25 IN Sat Nov 20 2010<br /> <br /> !<br /> <br /> version 12.4<br /> <br /> service timestamps debug datetime msec<br /> <br /> service timestamps log datetime msec<br /> <br /> no service password-encryption<br /> <br /> !<br /> <br /> hostname GW<br /> <br /> !<br /> <br /> boot-start-marker<br /> <br /> boot-end-marker<br /> <br /> !<br /> <br /> !<br /> <br /> no aaa new-model<br /> <br /> memory-size iomem 5<br /> <br /> clock timezone IN 5 30<br /> <br /> !<br /> <br /> !<br /> <br /> ip cef<br /> <br /> <br /> !<br /> <br /> username rahilkhan privilege 15 password 0 cisco<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> interface FastEthernet0/0<br /> <br /> ip address 20.20.20.1 255.255.255.0<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> interface FastEthernet0/1<br /> <br /> no ip address<br /> <br /> shutdown<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> !<br /> <br /> ip http server<br /> <br /> no ip http secure-server<br /> <br /> ip forward-protocol nd<br /> <br /> ip route 0.0.0.0 0.0.0.0 20.20.20.2<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> control-plane<br /> <br /> !<br /> <br /> <br /> <br /> !<br /> <br /> telephony-service<br /> <br /> max-ephones 2<br /> <br /> max-dn 2<br /> <br /> ip source-address 20.20.20.1 port 2000<br /> <br /> auto assign 1 to 2<br /> <br /> create cnf-files version-stamp 7960 Nov 20 2010 12:34:07<br /> <br /> max-conferences 8 gain -6<br /> <br /> transfer-system full-consult<br /> <br /> !<br /> <br /> !<br /> <br /> ephone-dn 1<br /> <br /> number 100<br /> <br /> !<br /> <br /> !<br /> <br /> ephone-dn 2<br /> <br /> number 101<br /> <br /> !<br /> <br /> !<br /> <br /> ephone 1<br /> <br /> mac-address 001C.C088.0461<br /> <br /> type CIPC<br /> <br /> button 1:1<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> ephone 2<br /> <br /> mac-address 000C.29C0.A452<br /> <br /> type CIPC<br /> <br /> button 1:2<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> line con 0<br /> <br /> exec-timeout 0 0<br /> <br /> logging synchronous<br /> <br /> line aux 0<br /> <br /> line vty 0 4<br /> <br /> login<br /> <br /> !<br /> <br /> ntp clock-period 17179872<br /> <br /> ntp server 10.10.10.1 prefer<br /> <br /> !<br /> <br /> end<br /> <br /> <strong>R2 Configuration:</strong><br /> <br /> !<br /> <br /> <br /> ! Last configuration change at 12:56:21 IN Sat Nov 20 2010<br /> <br /> ! NVRAM config last updated at 12:56:22 IN Sat Nov 20 2010<br /> <br /> !<br /> <br /> version 12.4<br /> <br /> service timestamps debug datetime msec<br /> <br /> service timestamps log datetime msec<br /> <br /> no service password-encryption<br /> <br /> !<br /> <br /> hostname R2<br /> <br /> !<br /> <br /> boot-start-marker<br /> <br /> boot-end-marker<br /> <br /> !<br /> <br /> no logging buffered<br /> <br /> !<br /> <br /> no aaa new-model<br /> <br /> memory-size iomem 5<br /> <br /> clock timezone IN 5 30<br /> <br /> !<br /> <br /> !<br /> <br /> ip cef<br /> <br /> !<br /> <br /> !<br /> <br /> username rahilkhan privilege 15 password 0 cisco<br /> <br /> !<br /> <br /> !<br /> <br /> ! <br /> <br /> !<br /> <br /> crypto isakmp policy 1<br /> <br /> encr 3des<br /> <br /> authentication pre-share<br /> <br /> group 2<br /> <br /> crypto isakmp key cisco address 10.10.10.2<br /> <br /> crypto isakmp key cisco address 10.10.10.3<br /> <br /> !<br /> <br /> !<br /> <br /> crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac <br /> <br /> crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac <br /> <br /> crypto ipsec transform-set ESP-3DES-SHA3 esp-3des esp-sha-hmac <br /> <br /> crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac <br /> <br /> !<br /> <br /> crypto map SDM_CMAP_1 1 ipsec-isakmp <br /> <br /> description Tunnel to10.10.10.2<br /> <br /> set peer 10.10.10.2<br /> <br /> set transform-set ESP-3DES-SHA3 <br /> <br /> match address 104<br /> <br /> crypto map SDM_CMAP_1 2 ipsec-isakmp <br /> <br /> description Tunnel to10.10.10.3<br /> <br /> set peer 10.10.10.3<br /> <br /> set transform-set ESP-3DES-SHA <br /> <br /> match address 100<br /> <br /> !<br /> <br /> interface FastEthernet0/0<br /> <br /> ip address 10.10.10.1 255.255.255.0<br /> <br /> ip nat outside<br /> <br /> ip virtual-reassembly<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> crypto map SDM_CMAP_1<br /> <br /> !<br /> <br /> interface FastEthernet0/1<br /> <br /> ip address 192.168.1.7 255.255.255.0<br /> <br /> ip nat inside<br /> <br /> ip virtual-reassembly<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> !<br /> <br /> ip http server<br /> <br /> no ip http secure-server<br /> <br /> ip forward-protocol nd<br /> <br /> ip route 0.0.0.0 0.0.0.0 192.168.1.1<br /> <br /> ip route 20.20.20.0 255.255.255.0 10.10.10.3<br /> <br /> ip route 192.168.2.0 255.255.255.0 10.10.10.2<br /> <br /> !<br /> <br /> !<br /> <br /> ip nat source static udp 192.168.1.3 69 10.10.10.33 69 extendable<br /> <br /> ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0/0 overload<br /> <br /> !<br /> <br /> access-list 1 permit any<br /> <br /> access-list 100 remark CCP_ACL Category=4<br /> <br /> access-list 100 remark IPSec Rule<br /> <br /> access-list 100 permit ip 192.168.1.0 0.0.0.255 20.20.20.0 0.0.0.255<br /> <br /> access-list 101 remark CCP_ACL Category=2<br /> <br /> access-list 101 remark IPSec Rule<br /> <br /> access-list 101 deny ip 192.168.1.0 0.0.0.255 20.20.20.0 0.0.0.255<br /> <br /> access-list 101 remark IPSec Rule<br /> <br /> access-list 101 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255<br /> <br /> access-list 101 permit ip any any<br /> <br /> access-list 102 remark CCP_ACL Category=4<br /> <br /> access-list 102 remark IPSec Rule<br /> <br /> access-list 102 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255<br /> <br /> access-list 103 remark CCP_ACL Category=4<br /> <br /> access-list 103 remark IPSec Rule<br /> <br /> access-list 103 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255<br /> <br /> access-list 104 remark CCP_ACL Category=4<br /> <br /> access-list 104 remark IPSec Rule<br /> <br /> access-list 104 permit ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255<br /> <br /> !<br /> <br /> route-map SDM_RMAP_1 permit 1<br /> <br /> match ip address 101<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> control-plane<br /> <br /> !<br /> <br /> !<br /> <br /> dial-peer voice 100 voip<br /> <br /> destination-pattern 101<br /> <br /> session target ipv4:10.10.10.2<br /> <br /> codec g711alaw<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> line con 0<br /> <br /> exec-timeout 0 0<br /> <br /> logging synchronous<br /> <br /> line aux 0<br /> <br /> line vty 0 4<br /> <br /> login<br /> <br /> !<br /> <br /> ntp master 2<br /> <br /> ntp server 207.46.197.32 prefer<br /> <br /> !<br /> <br /> end<br /> <br /> R3 Configuration:<br /> <br /> !<br /> <br /> <br /> version 12.4<br /> <br /> service timestamps debug datetime msec<br /> <br /> service timestamps log datetime msec<br /> <br /> no service password-encryption<br /> <br /> !<br /> <br /> hostname R3<br /> <br /> !<br /> <br /> boot-start-marker<br /> <br /> boot-end-marker<br /> <br /> !<br /> <br /> !<br /> <br /> no aaa new-model<br /> <br /> memory-size iomem 5<br /> <br /> clock timezone IN 5 30<br /> <br /> !<br /> <br /> !<br /> <br /> ip cef<br /> <br /> !<br /> <br /> !<br /> <br /> username rahilkhan privilege 15 password 0 cisco<br /> <br /> !<br /> <br /> !<br /> <br /> ! <br /> <br /> !<br /> <br /> crypto isakmp policy 1<br /> <br /> encr 3des<br /> <br /> authentication pre-share<br /> <br /> group 2<br /> <br /> crypto isakmp key cisco address 10.10.10.1<br /> <br /> crypto isakmp key cisco address 10.10.10.3<br /> <br /> !<br /> <br /> !<br /> <br /> crypto ipsec transform-set ESP-3DES-SHA1 esp-3des esp-sha-hmac <br /> <br /> crypto ipsec transform-set ESP-3DES-SHA2 esp-3des esp-sha-hmac <br /> <br /> crypto ipsec transform-set ESP-3DES-SHA3 esp-3des esp-sha-hmac <br /> <br /> crypto ipsec transform-set ESP-3DES-SHA4 esp-3des esp-sha-hmac <br /> <br /> crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac <br /> <br /> !<br /> <br /> crypto map SDM_CMAP_1 1 ipsec-isakmp <br /> <br /> description Tunnel to10.10.10.1<br /> <br /> set peer 10.10.10.1<br /> <br /> set transform-set ESP-3DES-SHA3 <br /> <br /> match address 104<br /> <br /> crypto map SDM_CMAP_1 2 ipsec-isakmp <br /> <br /> description Tunnel to10.10.10.3<br /> <br /> set peer 10.10.10.3<br /> <br /> set transform-set ESP-3DES-SHA <br /> <br /> match address 100<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> interface FastEthernet0/0<br /> <br /> ip address 10.10.10.2 255.255.255.0<br /> <br /> ip nat outside<br /> <br /> ip virtual-reassembly<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> crypto map SDM_CMAP_1<br /> <br /> !<br /> <br /> interface FastEthernet0/1<br /> <br /> ip address 192.168.2.1 255.255.255.0<br /> <br /> ip nat inside<br /> <br /> ip virtual-reassembly<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> !<br /> <br /> ip http server<br /> <br /> no ip http secure-server<br /> <br /> ip forward-protocol nd<br /> <br /> ip route 0.0.0.0 0.0.0.0 10.10.10.1<br /> <br /> ip route 20.20.20.0 255.255.255.0 10.10.10.3<br /> <br /> ip route 192.168.1.0 255.255.255.0 10.10.10.1<br /> <br /> !<br /> <br /> !<br /> <br /> ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0/0 overload<br /> <br /> !<br /> <br /> access-list 1 permit any<br /> <br /> access-list 100 remark CCP_ACL Category=4<br /> <br /> access-list 100 remark IPSec Rule<br /> <br /> access-list 100 permit ip 192.168.2.0 0.0.0.255 20.20.20.0 0.0.0.255<br /> <br /> access-list 101 remark CCP_ACL Category=2<br /> <br /> access-list 101 remark IPSec Rule<br /> <br /> access-list 101 deny ip 192.168.2.0 0.0.0.255 20.20.20.0 0.0.0.255<br /> <br /> access-list 101 remark IPSec Rule<br /> <br /> access-list 101 deny ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255<br /> <br /> access-list 101 permit ip any any<br /> <br /> access-list 102 remark CCP_ACL Category=4<br /> <br /> access-list 102 remark IPSec Rule<br /> <br /> access-list 102 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255<br /> <br /> access-list 103 remark CCP_ACL Category=4<br /> <br /> access-list 103 remark IPSec Rule<br /> <br /> access-list 103 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255<br /> <br /> access-list 104 remark CCP_ACL Category=4<br /> <br /> access-list 104 remark IPSec Rule<br /> <br /> access-list 104 permit ip 192.168.2.0 0.0.0.255 192.168.1.0 0.0.0.255<br /> <br /> access-list 105 remark CCP_ACL Category=4<br /> <br /> access-list 105 remark IPSec Rule<br /> <br /> access-list 105 permit ip 192.168.1.0 0.0.0.255 20.20.20.0 0.0.0.255<br /> <br /> !<br /> <br /> route-map SDM_RMAP_1 permit 1<br /> <br /> match ip address 101<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> control-plane<br /> <br /> !<br /> <br /> !<br /> <br /> dial-peer voice 101 voip<br /> <br /> destination-pattern 100<br /> <br /> session target ipv4:10.10.10.1<br /> <br /> codec g711alaw<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> line con 0<br /> <br /> exec-timeout 0 0<br /> <br /> logging synchronous<br /> <br /> line aux 0<br /> <br /> line vty 0 4<br /> <br /> login<br /> <br /> !<br /> <br /> ntp clock-period 17179855<br /> <br /> ntp server 10.10.10.1 prefer<br /> <br /> !<br /> <br /> endkhanhttp://www.blogger.com/profile/09978368963730080846noreply@blogger.com0tag:blogger.com,1999:blog-4682259220356914500.post-48362479655736542032010-08-18T09:15:00.000-07:002010-08-18T09:15:01.031-07:00How to connect two links between cisco asa 5510 and cisco asa 5505<div class="separator" style="border-bottom: medium none; border-left: medium none; border-right: medium none; border-top: medium none; clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgz-ZDAMjnqdtHb0ArlUPdDR0BkVYh4NO89oxCGqw6X_ZDKC3ZjUvzIqBnXqY12cxT8mxUK797MxrYZBGHwFX7vf1Ivq6sWpSkO6dr0OxXuAOJpwmQLtVy2wDQAgw-Kir61GZkQ7_cTa_o6/s1600/cisco+asa.JPG" imageanchor="1" style="clear: left; cssfloat: left; float: left; height: 41px; margin-bottom: 1em; margin-right: 1em; width: 417px;"><img border="0" height="43" ox="true" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgz-ZDAMjnqdtHb0ArlUPdDR0BkVYh4NO89oxCGqw6X_ZDKC3ZjUvzIqBnXqY12cxT8mxUK797MxrYZBGHwFX7vf1Ivq6sWpSkO6dr0OxXuAOJpwmQLtVy2wDQAgw-Kir61GZkQ7_cTa_o6/s320/cisco+asa.JPG" width="320" /></a></div>Now this scenario depicts that two cisco firewalls are connected which each other.&nbsp;And want&nbsp;to connect both firewalls&nbsp;wih dual&nbsp;links.&nbsp;But problem is cisco asa 5505 supports VLAN concept. And only let you interact to its interface via vlan only. There is no way to access interface directly or&nbsp;convert interface&nbsp;to layer 3 mode. And cisco asa 5510+ doesn't support vlan concept directly on its interface. If you would configure cisco asa 5510+ interfaces can do directly. As there is no vlan concept hence there is no port membership and so there is no bridging between ports. So which feature is required to make this connectivity successful? No worries, implementation can be leveraged by powerful features provided in cisco firewall software <strong>Redundant interface support</strong>. It is just like teaming&nbsp;of nics&nbsp;in server OS like windows , linux etc you can achieve virtual link spanning accross multiple physical links. And providing redundancy so that if one phyiscal link member of redundant interface goes down doesn't hampers communication going on between two devices. And if primary physical links goes down traffic switchover to secondary link&nbsp;is completely transparent. No connectivty loss happens. <br /> <br /> <br /> Here is how you can make your scenario successful just by simply configuring cisco asa 5510+ using following commands: <br /> <br /> Here is the excerpt of cisco asa 5510+ firewall:<br /> <br /> !<br /> <br /> <br /> interface Ethernet1<br /> no nameif<br /> no security-level<br /> no ip address<br /> <br /> !<br /> <br /> interface Ethernet2<br /> no nameif<br /> no security-level<br /> no ip address<br /> <br /> !<br /> <strong>interface Redundant1</strong><br /> <br /> <strong>member-interface Ethernet1</strong><br /> <strong>member-interface Ethernet2</strong><br /> nameif inside<br /> security-level 100<br /> ip address 10.10.10.1 255.255.255.252<br /> !<br /> <br /> Now you can also check which physical interface&nbsp; is primary which belongs to redundant interface:<br /> <br /> hostname# <strong>show interface redundant</strong> number&nbsp;<strong>detail</strong> <strong>|</strong> <strong>grep</strong> Member <br /> <br /> Now how to make one of the physical interface active here is how you can make it:<br /> <br /> hostname# <strong>redundant-interface redundant </strong>number <strong>active-member</strong> physical_interfacekhanhttp://www.blogger.com/profile/09978368963730080846noreply@blogger.com0tag:blogger.com,1999:blog-4682259220356914500.post-7153311190095870222010-03-12T08:14:00.000-08:002010-03-12T08:14:50.010-08:00BGP BASIC CONFIGURATION<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifH8UjFutMTPVPJ-2eWnQuG5RwsYTXVqpgoEJRz3FRS_Hbwv3CLvQ7eM_mxdpbgcEocqnRy5tmbTG8YFej9Dy3owWCs3YSINDvfFlaSr9zT50GITKzjNK3ErufTdX15ZcYQ-rQtd-1kQ2c/s1600-h/bgp+basix.jpeg.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifH8UjFutMTPVPJ-2eWnQuG5RwsYTXVqpgoEJRz3FRS_Hbwv3CLvQ7eM_mxdpbgcEocqnRy5tmbTG8YFej9Dy3owWCs3YSINDvfFlaSr9zT50GITKzjNK3ErufTdX15ZcYQ-rQtd-1kQ2c/s320/bgp+basix.jpeg.jpeg" vt="true" /></a><br /> <br /> Configuration of BGPv4 is simple on Cisco. Here in this scenario R2 is on AS 1 and rest of the other routers i.e. R1,R5 and R3 are on AS 2. <br /> <br /> Configuration Objective is to achieve inter AS communication.&nbsp;Simple BGP configuration neigbourship and broadcasting network.&nbsp;LANs shown as clouds C1 and C2.<br /> Internet is connected through C2 cloud. Actually I used DSL modem located in C2 clound. And put routes into it for 192.168.56.0/24 towards R3. So that returning traffic can come in 192.168.56.0/24 network.<br /> In C1&nbsp; cloud I used VM OS to test all connectivity.<br /> <br /> Traffic from VM OS passess through AS 1,AS 2 and to internet. Here is the trace from R2 router for e.g. gmail.com.<br /> <br /> <strong>Version of IOS on all routers 12.4</strong><br /> <br /> R2#traceroute gmail.com source f0/0<br /> Type escape sequence to abort.<br /> Tracing the route to gmail.com (72.14.204.83)<br /> <br /> <br /> <br /> 1 172.16.1.2 [AS 2] 56 msec 24 msec 48 msec<br /> <br /> 2 10.1.1.2 [AS 2] 36 msec 44 msec 48 msec<br /> <br /> 3 10.1.1.6 [AS 2] 24 msec 48 msec 64 msec<br /> <br /> <span style="color: red;">4 * * * #DSL Hop found</span><br /> <br /> 5 59.95.96.1 [AS 2] 128 msec 156 msec 136 msec<br /> <br /> 6 218.248.255.90 [AS 2] 124 msec 140 msec 148 msec<br /> <br /> 7 121.244.78.166 [AS 2] 116 msec 136 msec 172 msec<br /> <br /> 8 59.163.25.242 [AS 2] 116 msec 148 msec 148 msec<br /> <br /> 9 121.240.0.18 [AS 2] 156 msec 140 msec 152 msec<br /> <br /> 10 216.239.43.214 [AS 2] 124 msec 148 msec 132 msec<br /> <br /> 11 72.14.232.93 [AS 2] [MPLS: Label 697405 Exp 4] 216 msec<br /> <br /> 72.14.232.100 [AS 2] [MPLS: Label 391761 Exp 4] 168 msec 160 msec<br /> <br /> 12 66.249.94.74 [AS 2] 228 msec<br /> <br /> 66.249.94.72 [AS 2] 200 msec<br /> <br /> 66.249.94.74 [AS 2] 252 msec<br /> <br /> 13 209.85.254.155 [AS 2] [MPLS: Label 509864 Exp 4] 500 msec<br /> <br /> 72.14.232.115 [AS 2] [MPLS: Label 416579 Exp 4] 432 msec<br /> <br /> 209.85.254.155 [AS 2] [MPLS: Label 520248 Exp 4] 464 msec<br /> <br /> 14 209.85.255.59 [AS 2] [MPLS: Label 481915 Exp 4] 464 msec 460 msec 480 msec<br /> <br /> 15 216.239.43.212 [AS 2] [MPLS: Label 729408 Exp 4] 468 msec 476 msec 448 msec<br /> <br /> 16 209.85.241.210 [AS 2] [MPLS: Label 780964 Exp 4] 448 msec<br /> <br /> 216.239.43.81 [AS 2] [MPLS: Label 715357 Exp 4] 420 msec 432 msec<br /> <br /> 17 209.85.248.222 [AS 2] 460 msec 584 msec 472 msec<br /> <br /> 18 66.249.94.54 [AS 2] 416 msec<br /> <br /> 209.85.242.209 [AS 2] [MPLS: Label 752323 Exp 4] 444 msec<br /> <br /> 209.85.248.222 [AS 2] 432 msec<br /> <br /> 19 72.14.204.83 [AS 2] 440 msec 436 msec 452 msec <br /> &nbsp; <br /> and from VM OS: <br /> &nbsp; <br /> C:\&gt;tracert -d gmail.com <br /> <br /> <br /> <br /> <br /> Tracing route to gmail.com [72.14.204.19]<br /> <br /> over a maximum of 30 hops:<br /> <br /> <br /> <br /> 1 70 ms 17 ms 2 ms 192.168.56.2<br /> <br /> 2 35 ms 40 ms 10 ms 172.16.1.2<br /> <br /> 3 37 ms 27 ms 49 ms 10.1.1.2<br /> <br /> 4 51 ms 27 ms 19 ms 10.1.1.6<br /> <br /> <span style="color: red;">5 * * * Request timed out. #this hop&nbsp;&nbsp;is the DSL modem connected</span><br /> <br /> 6 151 ms 147 ms 147 ms 59.95.96.1<br /> <br /> 7 145 ms 180 ms 169 ms 218.248.255.90<br /> <br /> 8 143 ms 124 ms 130 ms 115.113.128.17<br /> <br /> 9 134 ms 126 ms 122 ms 59.163.25.242<br /> <br /> 10 223 ms 135 ms 126 ms 121.240.0.18<br /> <br /> 11 124 ms 134 ms 127 ms 216.239.43.214<br /> <br /> 12 158 ms 188 ms 174 ms 72.14.232.93<br /> <br /> 13 187 ms 189 ms 215 ms 66.249.94.74<br /> <br /> 14 498 ms 455 ms 422 ms 209.85.254.155<br /> <br /> 15 492 ms 429 ms 444 ms 209.85.255.37<br /> <br /> 16 453 ms 431 ms 433 ms 216.239.43.212<br /> <br /> 17 426 ms 431 ms 459 ms 216.239.43.81<br /> <br /> 18 446 ms 432 ms 431 ms 209.85.248.222<br /> <br /> 19 429 ms 490 ms 429 ms 209.85.242.209<br /> <br /> 20 458 ms 486 ms 433 ms 72.14.204.19<br /> <br /> Trace complete.<br /> <br /> <br /> <br /> <br /> First We focus on R2. This router resides in AS 1 as a whole.<br /> <br /> <strong>Its configuration is as follow:</strong><br /> <br /> interface FastEthernet0/0<br /> ip address 192.168.56.2 255.255.255.0<br /> duplex auto<br /> speed auto<br /> <br /> interface Serial1/0<br /> <br /> ip address 172.16.1.1 255.255.255.252<br /> serial restart-delay 0<br /> <br /> router bgp 1<br /> no synchronization<br /> bgp log-neighbor-changes<br /> redistribute connected route-map allowed<br /> neighbor 172.16.1.2 remote-as 2<br /> no auto-summary<br /> <br /> <strong>! Only these routes will be broadcasted</strong><br /> <br /> ip access-list standard allowed<br /> permit 192.168.56.0<br /> <br /> route-map allowed permit 10<br /> match ip address allowed<br /> <br /> <br /> <strong>Configuration of R1</strong><br /> <br /> interface Loopback0<br /> ip address 10.81.199.1 255.255.255.255<br /> <br /> interface Serial1/0<br /> ip address 172.16.1.2 255.255.255.252<br /> serial restart-delay 0<br /> <br /> interface Serial1/2<br /> ip address 10.1.1.1 255.255.255.252<br /> serial restart-delay 0<br /> <br /> <strong>! IGP for intra AS&nbsp;domain routing</strong><br /> <br /> router ospf 1<br /> log-adjacency-changes<br /> network 10.1.1.0 0.0.0.255 area 0<br /> network 10.81.199.0 0.0.0.255 area 0<br /> <br /> router bgp 2<br /> <strong>! Will not rely on IGP for routes</strong><br /> no synchronization<br /> bgp log-neighbor-changes<br /> <br /> <strong>!Neigbor relationship</strong><br /> neighbor 10.81.199.2 remote-as 2<br /> <br /> <strong>! update source will be lo0</strong><br /> neighbor 10.81.199.2 update-source Loopback0<br /> <br /> <strong>!for routes to be seen from iBGP&nbsp;hop coming from eBGP hop</strong><br /> neighbor 10.81.199.2 next-hop-self<br /> <br /> neighbor 10.81.199.3 remote-as 2<br /> neighbor 10.81.199.3 update-source Loopback0<br /> neighbor 10.81.199.3 next-hop-self<br /> neighbor 172.16.1.1 remote-as 1<br /> no auto-summary<br /> <br /> <strong>R5 configuration:</strong><br /> <br /> interface Loopback0<br /> <br /> ip address 10.81.199.3 255.255.255.255<br /> <br /> interface Serial1/1<br /> <br /> ip address 10.1.1.5 255.255.255.252<br /> serial restart-delay 0<br /> !<br /> interface Serial1/2<br /> ip address 10.1.1.2 255.255.255.252<br /> serial restart-delay 0<br /> <br /> router ospf 1<br /> <br /> log-adjacency-changes<br /> network 10.1.1.0 0.0.0.255 area 0<br /> network 10.81.199.0 0.0.0.255 area 0<br /> <br /> router bgp 2<br /> <br /> no synchronization<br /> bgp log-neighbor-changes<br /> neighbor 10.81.199.1 remote-as 2<br /> neighbor 10.81.199.1 update-source Loopback0<br /> neighbor 10.81.199.2 remote-as 2<br /> neighbor 10.81.199.2 update-source Loopback0<br /> no auto-summary<br /> !<br /> <br /> <strong>R3 Configuration:</strong><br /> <br /> interface Loopback0<br /> ip address 10.81.199.2 255.255.255.255<br /> !<br /> interface FastEthernet0/0<br /> <br /> ip address dhcp<br /> duplex auto<br /> speed auto<br /> <br /> interface Serial1/1<br /> <br /> ip address 10.1.1.6 255.255.255.252<br /> serial restart-delay 0<br /> !<br /> router ospf 1<br /> <br /> log-adjacency-changes<br /> network 10.1.1.0 0.0.0.255 area 0<br /> network 10.81.199.0 0.0.0.255 area 0<br /> !<br /> router bgp 2<br /> <br /> no synchronization<br /> bgp log-neighbor-changes<br /> <br /> <strong>! Default route redistribution</strong>network 0.0.0.0<br /> <br /> network 192.168.1.0<br /> neighbor 10.81.199.1 remote-as 2<br /> neighbor 10.81.199.1 update-source Loopback0<br /> neighbor 10.81.199.3 remote-as 2<br /> neighbor 10.81.199.3 update-source Loopback0<br /> no auto-summary<br /> !<br /> ! Default route towards DSL modem<br /> ip route 0.0.0.0 0.0.0.0 192.168.1.1khanhttp://www.blogger.com/profile/09978368963730080846noreply@blogger.com0tag:blogger.com,1999:blog-4682259220356914500.post-76593003512144002002010-01-03T05:51:00.000-08:002010-01-03T05:54:17.639-08:00Types of NAT on Cisco PIX 525 using Version 8.0<div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhot56UrWVaGyDZONNYMmYnh_lTpHZGF96SAdSQ3VQ6-pRAtQKIpHhhGGvc_2GCCWl6ldhVYGROnneiSZBo8v3uwMLJ9ozZv8Aogvz9EH3wzf3M-_GGYNEymSyhocnXBv8dsn5JUY1PPr9X/s1600-h/types+of+nat+on+ver+8.jpeg.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" ps="true" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhot56UrWVaGyDZONNYMmYnh_lTpHZGF96SAdSQ3VQ6-pRAtQKIpHhhGGvc_2GCCWl6ldhVYGROnneiSZBo8v3uwMLJ9ozZv8Aogvz9EH3wzf3M-_GGYNEymSyhocnXBv8dsn5JUY1PPr9X/s320/types+of+nat+on+ver+8.jpeg.jpeg" /></a><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div>In above network I have used 5 routers and used different types of NATs. Check the configuration of firewall. And rest of part of ip addressing is given in the diagram. <br /> <br /> <br /> <strong>PAT tracking for any source</strong><br /> <br /> <br /> nat (inside) 1 0.0.0.0 0.0.0.0<br /> global (outside) 1 interface<br /> <strong></strong>&nbsp; <br /> <strong>Dynamic Nating:</strong> <br /> &nbsp; <br /> nat (inside) 2 192.168.20.0 255.255.255.0 <br /> <br /> global (outside) 2 192.168.1.20-192.168.1.30 netmask 255.255.255.0<br /> <br /> <br /> <strong>Identity Nating:</strong><br /> <br /> nat (inside) 0 192.168.30.0 255.255.255.0<br /> <br /> <br /> <strong>Static Nating:</strong> <br /> &nbsp; <br /> static (inside,outside) 192.168.1.60 192.168.40.2 netmask 255.255.255.255 <br /> &nbsp; <br /> <strong>Outside Interface:</strong> <br /> &nbsp; <br /> interface Ethernet1 <br /> <br /> nameif outside<br /> security-level 0<br /> ip address dhcp setroute<br /> <br /> <br /> <strong>Inside Interface:</strong> <br /> &nbsp; <br /> interface Ethernet0 <br /> <br /> nameif inside<br /> security-level 100<br /> ip address 192.168.100.2 255.255.255.0<br /> <br /> <strong>routes:</strong> <br /> &nbsp; <br /> route outside 0.0.0.0 0.0.0.0 192.168.1.1 1 <br /> <br /> route inside 192.168.0.0 255.255.0.0 192.168.100.1 1<br /> <br /> <strong>Access-lists:</strong><br /> <br /> access-list outside_to_inside extended permit tcp any host 192.168.1.60 eq telnet<br /> <br /> access-list outside_to_inside extended permit icmp any any echo-reply<br /> <br /> <strong>applied on:</strong><br /> <br /> access-group outside_to_inside in interface outside<br /> <br /> <br /> <strong>Checking translation for each type of translation:</strong><br /> <br /> debug icmp trace<br /> show conn<br /> show xlate<br /> <br /> Note: There more options for above commands to be used. So explore yourself.khanhttp://www.blogger.com/profile/09978368963730080846noreply@blogger.com0tag:blogger.com,1999:blog-4682259220356914500.post-43603197690385284972009-12-20T01:03:00.000-08:002009-12-20T01:03:36.607-08:00OPENING NETMEETING ON INTERNETHi, in this tutorial I will explain how to open netmeeting connections between two remote sites across internet. For&nbsp;this I am using 256 kbps connection by applying Committed Access Rate&nbsp;(CAR). consider the scenario:<br /> <img border="0" ps="true" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjF-ZIYRo69VUiY0xICsecqKe29rPS1DC9T2uEdaRAYWpHeU0ngY0TTe-r0RH0aNCZ9zsB4fNRoqiPfXV3UQiva__e5kPLyhyaP1A47PYtGrUNnH8I-vZFZA_bsmRGQIz1-nxfhnrxmVu49/s640/netmeeting.jpeg.jpeg.jpeg" /><br /> <br /> Here&nbsp; I have used two routers as&nbsp; shown&nbsp;in diagram. Ports I used to map statically to public are as follows:<br /> <br /> To establish outbound NetMeeting connections through a natting, the natting must be configured to do the following: <br /> <br /> <br /> *&nbsp;Pass through primary TCP connections on ports 522, 389, 1503, 1720 and 1731.<br /> * Pass through secondary UDP connections on dynamically assigned ports (1024-65535).<br /> &nbsp; <br /> For furhtur info. u can access this site: <a href="http://support.microsoft.com/kb/158623">http://support.microsoft.com/kb/158623</a> <br /> &nbsp; <br /> &nbsp; <br /> &nbsp; <br /> static&nbsp;natting configuration on both routers are nearly&nbsp;same: <br /> &nbsp; <br /> On R0: <br /> &nbsp; <br /> ip nat inside source static tcp 192.168.1.3 389 10.1.1.1 389 extendable <br /> <br /> ip nat inside source static tcp 192.168.1.3 522 10.1.1.1 522 extendable<br /> ip nat inside source static tcp 192.168.1.3 1503 10.1.1.1 1503 extendable<br /> ip nat inside source static tcp 192.168.1.3 1720 10.1.1.1 1720 extendable<br /> ip nat inside source static tcp 192.168.1.3 1731 10.1.1.1 1731 extendable<br /> &nbsp; <br /> &nbsp; <br /> On R1: <br /> &nbsp; <br /> ip nat inside source static tcp 192.168.56.200 389 10.1.1.2 389 extendable<br /> ip nat inside source static tcp 192.168.56.200 522 10.1.1.2 522 extendable<br /> ip nat inside source static tcp 192.168.56.200 1503 10.1.1.2 1503 extendable<br /> ip nat inside source static tcp 192.168.56.200 1720 10.1.1.2 1720 extendable<br /> ip nat inside source static tcp 192.168.56.200 1731 10.1.1.2 1731 extendable <br /> &nbsp; <br /> <strong>Note:</strong> <br /> &nbsp; <br /> I didn't check audio after configuring these above commands on routers. Pls, feel free to give comments on if you have any update on this <br /> &nbsp; <br /> Commands for applying CAR on both routers on&nbsp;serial interfaces: <br /> &nbsp; <br /> &nbsp; <br /> interface Serial1/0 <br /> <br /> ip address 10.1.1.2 255.255.255.252<br /> ip nat outside<br /> ip virtual-reassembly<br /> <strong>rate-limit input access-group 1 256000 64000 64000 conform-action transmit exceed-action drop</strong><br /> <strong>rate-limit output access-group 1 256000 64000 64000 conform-action transmit exceed-action drop</strong><br /> serial restart-delay 0<br /> end<br /> <br /> <br /> <br /> <br /> <div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div><div class="separator" style="clear: both; text-align: center;"><br /> </div>khanhttp://www.blogger.com/profile/09978368963730080846noreply@blogger.com0tag:blogger.com,1999:blog-4682259220356914500.post-52624521718525088602009-12-15T13:44:00.000-08:002009-12-15T13:44:26.790-08:00Cisco Password Encryption Published<pre>Hey Programmer's, need to know something. Dont take this in a destructive</pre><pre>way, it is just provided for recovery purposes. </pre><pre>Cisco PIX passwords are limited to a length of 16 Bytes, so in theory there are 255^16 possible passwords, but in real life there are about 80^16 useful password combinations, take a look at your keyboard to verify, even if strong passwords are used. Cisco's password encryption is based on base64 encoded MD5 hashes. Routers IOS uses 1000 MD5 Update rounds to make password brute forcing attacks harder, but the PIX firewall uses only one MD5 update and then the digest is base64 encoded. For base64 encoding Cisco uses the _crypt_to64() Function of the FreeBSD libcrypt library. Here's the code to compute PIX password hashes: MD5Context ctx1; unsigned char final[MD5_SIZE+1]; unsigned char cleartext [16+1]; unsigned char cisco_encoded [16+1]; memset(cisco_encoded,0,sizeof(cisco_encoded)); memset(cleartext,0,sizeof(cleartext)); strcpy((char*) cleartext,"test"); MD5Init2(&amp;ctx1); MD5Update2(&amp;ctx1,(unsigned char*) cleartext,16); MD5Final2(final,&amp;ctx1); char* p = (char*) cisco_encoded; _crypt_to64(p,*(unsigned long*) (final+0),4); p += 4; _crypt_to64(p,*(unsigned long*) (final+4),4); p += 4; _crypt_to64(p,*(unsigned long*) (final+8),4); p += 4; _crypt_to64(p,*(unsigned long*) (final+12),4); p += 4;</pre><pre></pre><pre>Regards,</pre><pre>Ashish Saretia.</pre><pre>+919893876066 </pre>Unknownnoreply@blogger.com0tag:blogger.com,1999:blog-4682259220356914500.post-87382057764435884222009-12-13T05:38:00.000-08:002009-12-13T05:38:16.390-08:00Use of GLBP, HSRP and Active/Standby FAILOVERConsider this type of scenario shown below:<br /> <br /> <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiV5jibNtCHurp0zAj_T3hkWluGjE7HVOs4yfQJvoNkhK9v9xPYPYpi0sek7Ub8Jd6TtXPh-GBIiJLI6kLJG1fzfVJx2TQYuyDGjjf6nZ501p97TlJ2h6hWs8yTqowjuDtM1R6_EkeX4D5P/s1600-h/glbp+and+failover.jpeg.jpeg.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" ps="true" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiV5jibNtCHurp0zAj_T3hkWluGjE7HVOs4yfQJvoNkhK9v9xPYPYpi0sek7Ub8Jd6TtXPh-GBIiJLI6kLJG1fzfVJx2TQYuyDGjjf6nZ501p97TlJ2h6hWs8yTqowjuDtM1R6_EkeX4D5P/s320/glbp+and+failover.jpeg.jpeg.jpeg" /></a><br /> </div><br /> <strong>Components used:</strong><br /> <br /> Cisco PIX 525 with 8.0 version.<br /> c3600 router with&nbsp; 16ESW module for emulating as layer 3 switch.<br /> <br /> <br /> Lower half is configured with GLBP and upper half is configured with HSRP.<br /> <br /> Why I used both protocols? So that anybody wants to know&nbsp;about the mechanics how they work can able to check&nbsp; configuration of both protocols. ethernet 2 of both firewalls is used as management interface.<br /> <br /> Briefings of both protocols:<br /> <br /> <ul><li>Both are cisco proprietory.</li> <li>They can do interface monitoring so that is any interface fails&nbsp; or active router or L3 switch goes down switchover will take place.</li> <li>&nbsp;GLBP is somewhat different than HSRP in one feature that it provides loadbalancing among gateways. Can be on host based mac address, Round Robin Loadbalancing(default) or weighted.</li> </ul>Ofcourse, I have used failover on both firewalls FW0(Active) and FW1(Standby) for redundancy purpose.<br /> <br /> Before configuring firewall always remember these points:<br /> <br /> <ul><li>Firewall model should be same</li> <li>No. of interfaces must be same</li> <li>OS version should be same</li> <li>Memories should be same</li> <li>For more you can refer to <a href="http://www.cisco.com/">http://www.cisco.com/</a></li> </ul><br /> <br /> You can go through BCMSN guide for further studies. I will not explain too much.<br /> <br /> <strong>Configuration part:</strong><br /> <br /> <br /> <strong>FW0(PRIMARY) configuration:</strong><br /> <br /> !<br /> <br /> <br /> hostname FW0<br /> <br /> enable password 8Ry2YjIyt7RRXU24 encrypted<br /> <br /> names<br /> <br /> !<br /> <br /> interface Ethernet0<br /> <br /> nameif Outside<br /> <br /> security-level 0<br /> <br /> ip address 192.168.10.250 255.255.255.0<br /> <br /> !<br /> <br /> interface Ethernet1<br /> <br /> nameif Inside<br /> <br /> security-level 100<br /> <br /> ip address 192.168.200.1 255.255.255.0<br /> <br /> !<br /> <br /> interface Ethernet2<br /> <br /> nameif mgmt<br /> <br /> security-level 99<br /> <br /> ip address 192.168.4.253 255.255.255.0 standby 192.168.4.254<br /> <br /> management-only<br /> <br /> !<br /> <br /> interface Ethernet3<br /> <br /> !<br /> <br /> interface Ethernet4<br /> <br /> !<br /> <br /> interface Redundant1<br /> <br /> description LAN/STATE Failover Interface<br /> <br /> member-interface Ethernet3<br /> <br /> member-interface Ethernet4<br /> <br /> !<br /> <br /> passwd 2KFQnbNIdI.2KYOU encrypted<br /> <br /> ftp mode passive<br /> <br /> access-list Outside_access_in extended permit icmp any any<br /> <br /> pager lines 24<br /> <br /> mtu Outside 1500<br /> <br /> mtu Inside 1500<br /> <br /> mtu mgmt 1500<br /> <br /> failover<br /> <br /> failover lan unit primary<br /> <br /> failover lan interface fail_int Redundant1<br /> <br /> failover lan enable<br /> <br /> failover polltime unit msec 200 holdtime msec 800<br /> <br /> failover polltime interface msec 500 holdtime 5<br /> <br /> failover key *****<br /> <br /> failover link fail_int Redundant1<br /> <br /> failover interface ip fail_int 1.1.1.1 255.255.255.252 standby 1.1.1.2<br /> <br /> no monitor-interface mgmt<br /> <br /> icmp unreachable rate-limit 1 burst-size 1<br /> <br /> asdm image flash:/asdm-602.bin<br /> <br /> no asdm history enable<br /> <br /> arp timeout 14400<br /> <br /> nat-control<br /> <br /> global (Outside) 1 interface<br /> <br /> nat (Inside) 1 0.0.0.0 0.0.0.0<br /> <br /> access-group Outside_access_in in interface Outside<br /> <br /> route Outside 0.0.0.0 0.0.0.0 192.168.10.254 1<br /> <br /> route Inside 192.168.56.0 255.255.255.0 192.168.200.100 1<br /> <br /> timeout xlate 3:00:00<br /> <br /> timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02<br /> <br /> timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00<br /> <br /> timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00<br /> <br /> timeout uauth 0:05:00 absolute<br /> <br /> dynamic-access-policy-record DfltAccessPolicy<br /> <br /> http server enable<br /> <br /> http 192.168.4.0 255.255.255.0 mgmt<br /> <br /> no snmp-server location<br /> <br /> no snmp-server contact<br /> <br /> snmp-server enable traps snmp authentication linkup linkdown coldstart<br /> <br /> no crypto isakmp nat-traversal<br /> <br /> telnet timeout 5<br /> <br /> ssh timeout 5<br /> <br /> console timeout 0<br /> <br /> dhcp-client broadcast-flag<br /> <br /> threat-detection basic-threat<br /> <br /> threat-detection statistics access-list<br /> <br /> !<br /> <br /> !<br /> <br /> prompt hostname context<br /> <br /> Cryptochecksum:2dba6cd4479e3e98aa10893eec4c2862<br /> <br /> : end <br /> &nbsp; <br /> <strong>FW1(SECONDARY) configuration:</strong> <br /> <strong></strong>&nbsp; <br /> <strong></strong>&nbsp; <br /> &nbsp;PIX Version 8.0(2)<br /> <br /> <br /> !<br /> <br /> hostname FW0<br /> <br /> enable password 8Ry2YjIyt7RRXU24 encrypted<br /> <br /> names<br /> <br /> !<br /> <br /> interface Ethernet0<br /> <br /> nameif Outside<br /> <br /> security-level 0<br /> <br /> ip address 192.168.10.250 255.255.255.0<br /> <br /> !<br /> <br /> interface Ethernet1<br /> <br /> nameif Inside<br /> <br /> security-level 100<br /> <br /> ip address 192.168.200.1 255.255.255.0<br /> <br /> !<br /> <br /> interface Ethernet2<br /> <br /> nameif mgmt<br /> <br /> security-level 99<br /> <br /> ip address 192.168.4.253 255.255.255.0 standby 192.168.4.254<br /> <br /> management-only<br /> <br /> !<br /> <br /> interface Ethernet3<br /> <br /> !<br /> <br /> interface Ethernet4<br /> <br /> !<br /> <br /> interface Redundant1<br /> <br /> description LAN/STATE Failover Interface<br /> <br /> member-interface Ethernet3<br /> <br /> member-interface Ethernet4<br /> <br /> !<br /> <br /> passwd 2KFQnbNIdI.2KYOU encrypted<br /> <br /> ftp mode passive<br /> <br /> access-list Outside_access_in extended permit icmp any any<br /> <br /> pager lines 24<br /> <br /> mtu Outside 1500<br /> <br /> mtu Inside 1500<br /> <br /> mtu mgmt 1500<br /> <br /> failover<br /> <br /> failover lan unit secondary<br /> <br /> failover lan interface fail_int Redundant1<br /> <br /> failover lan enable<br /> <br /> failover polltime unit msec 200 holdtime msec 800<br /> <br /> failover polltime interface msec 500 holdtime 5<br /> <br /> failover key *****<br /> <br /> failover link fail_int Redundant1<br /> <br /> failover interface ip fail_int 1.1.1.1 255.255.255.252 standby 1.1.1.2<br /> <br /> no monitor-interface mgmt<br /> <br /> icmp unreachable rate-limit 1 burst-size 1<br /> <br /> asdm image flash:/asdm-602.bin<br /> <br /> no asdm history enable<br /> <br /> arp timeout 14400<br /> <br /> nat-control<br /> <br /> global (Outside) 1 interface<br /> <br /> nat (Inside) 1 0.0.0.0 0.0.0.0<br /> <br /> access-group Outside_access_in in interface Outside<br /> <br /> route Outside 0.0.0.0 0.0.0.0 192.168.10.254 1<br /> <br /> route Inside 192.168.56.0 255.255.255.0 192.168.200.100 1<br /> <br /> timeout xlate 3:00:00<br /> <br /> timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02<br /> <br /> timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00<br /> <br /> timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00<br /> <br /> timeout uauth 0:05:00 absolute<br /> <br /> dynamic-access-policy-record DfltAccessPolicy<br /> <br /> http server enable<br /> <br /> http 192.168.4.0 255.255.255.0 mgmt<br /> <br /> no snmp-server location<br /> <br /> no snmp-server contact<br /> <br /> snmp-server enable traps snmp authentication linkup linkdown coldstart<br /> <br /> no crypto isakmp nat-traversal<br /> <br /> telnet timeout 5<br /> <br /> ssh timeout 5<br /> <br /> console timeout 0<br /> <br /> dhcp-client broadcast-flag<br /> <br /> threat-detection basic-threat<br /> <br /> threat-detection statistics access-list<br /> <br /> !<br /> <br /> !<br /> <br /> prompt hostname context<br /> <br /> Cryptochecksum:da40a422579a902a3ccf7899907ba015<br /> <br /> : end<br /> <br /> <br /> <br /> <strong>R0(GLBP ACTIVE)&nbsp;configuration:</strong> <br /> <strong></strong>&nbsp; <br /> <br /> !<br /> <br /> <br /> version 12.4<br /> <br /> service timestamps debug datetime msec<br /> <br /> service timestamps log datetime msec<br /> <br /> no service password-encryption<br /> <br /> !<br /> <br /> hostname Router<br /> <br /> !<br /> <br /> boot-start-marker<br /> <br /> boot-end-marker<br /> <br /> !<br /> <br /> !<br /> <br /> no aaa new-model<br /> <br /> memory-size iomem 5<br /> <br /> !<br /> <br /> !<br /> <br /> ip cef<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> spanning-tree vlan 1 priority 8192<br /> <br /> spanning-tree vlan 99 priority 8192<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> interface Port-channel1<br /> <br /> switchport trunk native vlan 99<br /> <br /> switchport mode trunk<br /> <br /> !<br /> <br /> interface FastEthernet0/0<br /> <br /> no ip address<br /> <br /> shutdown<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> interface FastEthernet0/1<br /> <br /> no ip address<br /> <br /> shutdown<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> interface FastEthernet1/0<br /> <br /> switchport access vlan 99<br /> <br /> !<br /> <br /> interface FastEthernet1/1<br /> <br /> !<br /> <br /> interface FastEthernet1/2<br /> <br /> !<br /> <br /> interface FastEthernet1/3<br /> <br /> !<br /> <br /> interface FastEthernet1/4<br /> <br /> !<br /> <br /> interface FastEthernet1/5<br /> <br /> !<br /> <br /> interface FastEthernet1/6<br /> <br /> !<br /> <br /> interface FastEthernet1/7<br /> <br /> !<br /> <br /> interface FastEthernet1/8<br /> <br /> !<br /> <br /> interface FastEthernet1/9<br /> <br /> !<br /> <br /> interface FastEthernet1/10<br /> <br /> !<br /> <br /> interface FastEthernet1/11<br /> <br /> !<br /> <br /> interface FastEthernet1/12<br /> <br /> !<br /> <br /> interface FastEthernet1/13<br /> <br /> no switchport<br /> <br /> ip address 192.168.56.2 255.255.255.0<br /> <br /> glbp 1 ip 192.168.56.254<br /> <br /> glbp 1 priority 150<br /> <br /> glbp 1 preempt<br /> <br /> !<br /> <br /> interface FastEthernet1/14<br /> <br /> switchport trunk native vlan 99<br /> <br /> switchport mode trunk<br /> <br /> channel-group 1 mode on<br /> <br /> !<br /> <br /> interface FastEthernet1/15<br /> <br /> switchport trunk native vlan 99<br /> <br /> switchport mode trunk<br /> <br /> channel-group 1 mode on<br /> <br /> !<br /> <br /> interface Vlan1<br /> <br /> no ip address<br /> <br /> !<br /> <br /> interface Vlan99<br /> <br /> ip address 192.168.200.254 255.255.255.0<br /> <br /> glbp 2 ip 192.168.200.100<br /> <br /> glbp 2 priority 150<br /> <br /> glbp 2 preempt<br /> <br /> glbp 2 authentication md5 key-string cisco<br /> <br /> !<br /> <br /> !<br /> <br /> ip http server<br /> <br /> no ip http secure-server<br /> <br /> ip route 0.0.0.0 0.0.0.0 Vlan99 192.168.200.1<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> mac-address-table static 0007.b400.0202 interface FastEthernet1/15 vlan 99<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> control-plane<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> line con 0<br /> <br /> exec-timeout 0 0<br /> <br /> logging synchronous<br /> <br /> line aux 0<br /> <br /> line vty 0 4<br /> <br /> login<br /> <br /> !<br /> <br /> !<br /> <br /> end<br /> <br /> <strong>R1(GLBP STANDBY) Configuration:</strong> <br /> <strong></strong>&nbsp; <br /> <strong></strong>&nbsp; <br /> ! <br /> <br /> <br /> version 12.4<br /> <br /> service timestamps debug datetime msec<br /> <br /> service timestamps log datetime msec<br /> <br /> no service password-encryption<br /> <br /> !<br /> <br /> hostname Router<br /> <br /> !<br /> <br /> boot-start-marker<br /> <br /> boot-end-marker<br /> <br /> !<br /> <br /> !<br /> <br /> no aaa new-model<br /> <br /> memory-size iomem 5<br /> <br /> !<br /> <br /> !<br /> <br /> ip cef<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> vtp file nvram:vlan.dat<br /> <br /> <br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> interface Port-channel1<br /> <br /> switchport trunk native vlan 99<br /> <br /> switchport mode trunk<br /> <br /> !<br /> <br /> interface FastEthernet0/0<br /> <br /> no ip address<br /> <br /> shutdown<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> interface FastEthernet0/1<br /> <br /> no ip address<br /> <br /> shutdown<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> interface FastEthernet1/0<br /> <br /> switchport access vlan 99<br /> <br /> !<br /> <br /> interface FastEthernet1/1<br /> <br /> !<br /> <br /> interface FastEthernet1/2<br /> <br /> !<br /> <br /> interface FastEthernet1/3<br /> <br /> !<br /> <br /> interface FastEthernet1/4<br /> <br /> !<br /> <br /> interface FastEthernet1/5<br /> <br /> !<br /> <br /> interface FastEthernet1/6<br /> <br /> !<br /> <br /> interface FastEthernet1/7<br /> <br /> !<br /> <br /> interface FastEthernet1/8<br /> <br /> !<br /> <br /> interface FastEthernet1/9<br /> <br /> !<br /> <br /> interface FastEthernet1/10<br /> <br /> !<br /> <br /> interface FastEthernet1/11<br /> <br /> !<br /> <br /> interface FastEthernet1/12<br /> <br /> !<br /> <br /> interface FastEthernet1/13<br /> <br /> no switchport<br /> <br /> ip address 192.168.56.3 255.255.255.0<br /> <br /> glbp 1 ip 192.168.56.254<br /> <br /> glbp 1 timers 1 2<br /> <br /> glbp 1 preempt<br /> <br /> !<br /> <br /> interface FastEthernet1/14<br /> <br /> switchport trunk native vlan 99<br /> <br /> switchport mode trunk<br /> <br /> channel-group 1 mode on<br /> <br /> !<br /> <br /> interface FastEthernet1/15<br /> <br /> switchport trunk native vlan 99<br /> <br /> switchport mode trunk<br /> <br /> channel-group 1 mode on<br /> <br /> !<br /> <br /> interface Vlan1<br /> <br /> no ip address<br /> <br /> !<br /> <br /> interface Vlan99<br /> <br /> ip address 192.168.200.253 255.255.255.0<br /> <br /> glbp 2 ip 192.168.200.100<br /> <br /> glbp 2 preempt<br /> <br /> glbp 2 authentication md5 key-string cisco<br /> <br /> !<br /> <br /> !<br /> <br /> ip http server<br /> <br /> no ip http secure-server<br /> <br /> ip route 0.0.0.0 0.0.0.0 Vlan99 192.168.200.1<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> mac-address-table static 0007.b400.0201 interface FastEthernet1/15 vlan 99<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> control-plane<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> line con 0<br /> <br /> exec-timeout 0 0<br /> <br /> logging synchronous<br /> <br /> line aux 0<br /> <br /> line vty 0 4<br /> <br /> login<br /> <br /> !<br /> <br /> !<br /> <br /> end <br /> &nbsp; <br /> &nbsp; <br /> <strong>R3(HSRP ACTIVE) Configuration:</strong> <br /> &nbsp; <br /> &nbsp; <br /> ! <br /> <br /> <br /> version 12.4<br /> <br /> service timestamps debug datetime msec<br /> <br /> service timestamps log datetime msec<br /> <br /> no service password-encryption<br /> <br /> !<br /> <br /> hostname Router<br /> <br /> !<br /> <br /> boot-start-marker<br /> <br /> boot-end-marker<br /> <br /> !<br /> <br /> !<br /> <br /> no aaa new-model<br /> <br /> memory-size iomem 5<br /> <br /> !<br /> <br /> !<br /> <br /> ip cef<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> spanning-tree vlan 1 priority 8192<br /> <br /> spanning-tree vlan 99 priority 8192<br /> <br /> vtp file nvram:vlan.dat<br /> <br /> <br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> interface Port-channel1<br /> <br /> switchport trunk native vlan 99<br /> <br /> switchport mode trunk<br /> <br /> !<br /> <br /> interface FastEthernet0/0<br /> <br /> no ip address<br /> <br /> shutdown<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> interface FastEthernet0/1<br /> <br /> no ip address<br /> <br /> shutdown<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> interface FastEthernet1/0<br /> <br /> switchport access vlan 99<br /> <br /> !<br /> <br /> interface FastEthernet1/1<br /> <br /> !<br /> <br /> interface FastEthernet1/2<br /> <br /> !<br /> <br /> interface FastEthernet1/3<br /> <br /> !<br /> <br /> interface FastEthernet1/4<br /> <br /> !<br /> <br /> interface FastEthernet1/5<br /> <br /> !<br /> <br /> interface FastEthernet1/6<br /> <br /> !<br /> <br /> interface FastEthernet1/7<br /> <br /> !<br /> <br /> interface FastEthernet1/8<br /> <br /> !<br /> <br /> interface FastEthernet1/9<br /> <br /> !<br /> <br /> interface FastEthernet1/10<br /> <br /> !<br /> <br /> interface FastEthernet1/11<br /> <br /> !<br /> <br /> interface FastEthernet1/12<br /> <br /> !<br /> <br /> interface FastEthernet1/13<br /> <br /> no switchport<br /> <br /> ip address 192.168.1.252 255.255.255.0<br /> <br /> standby 3 ip 192.168.1.254<br /> <br /> standby 3 timers 1 3<br /> <br /> standby 3 priority 150<br /> <br /> standby 3 preempt<br /> <br /> !<br /> <br /> interface FastEthernet1/14<br /> <br /> switchport trunk native vlan 99<br /> <br /> switchport mode trunk<br /> <br /> channel-group 1 mode on<br /> <br /> !<br /> <br /> interface FastEthernet1/15<br /> <br /> switchport trunk native vlan 99<br /> <br /> switchport mode trunk<br /> <br /> channel-group 1 mode on<br /> <br /> !<br /> <br /> interface Vlan1<br /> <br /> no ip address<br /> <br /> !<br /> <br /> interface Vlan99<br /> <br /> ip address 192.168.10.1 255.255.255.0<br /> <br /> standby 4 ip 192.168.10.254<br /> <br /> standby 4 timers 1 3<br /> <br /> standby 4 priority 150<br /> <br /> standby 4 preempt<br /> <br /> standby 4 authentication md5 key-string cisco<br /> <br /> !<br /> <br /> !<br /> <br /> ip http server<br /> <br /> no ip http secure-server<br /> <br /> ip route 0.0.0.0 0.0.0.0 192.168.1.1<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> mac-address-table static 0000.0c07.ac04 interface FastEthernet1/15 vlan 99<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> control-plane<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> line con 0<br /> <br /> exec-timeout 0 0<br /> <br /> logging synchronous<br /> <br /> line aux 0<br /> <br /> line vty 0 4<br /> <br /> login<br /> <br /> !<br /> <br /> !<br /> <br /> end<br /> <br /> <strong>R2(HSRP STANBY) Configuration:</strong> <br /> <strong></strong>&nbsp; <br /> ! <br /> <br /> <br /> version 12.4<br /> <br /> service timestamps debug datetime msec<br /> <br /> service timestamps log datetime msec<br /> <br /> no service password-encryption<br /> <br /> !<br /> <br /> hostname Router<br /> <br /> !<br /> <br /> boot-start-marker<br /> <br /> boot-end-marker<br /> <br /> !<br /> <br /> !<br /> <br /> no aaa new-model<br /> <br /> memory-size iomem 5<br /> <br /> !<br /> <br /> !<br /> <br /> ip cef<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> vtp file nvram:vlan.dat<br /> <br /> <br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> interface Port-channel1<br /> <br /> switchport trunk native vlan 99<br /> <br /> switchport mode trunk<br /> <br /> !<br /> <br /> interface FastEthernet0/0<br /> <br /> no ip address<br /> <br /> shutdown<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> interface FastEthernet0/1<br /> <br /> no ip address<br /> <br /> shutdown<br /> <br /> duplex auto<br /> <br /> speed auto<br /> <br /> !<br /> <br /> interface FastEthernet1/0<br /> <br /> switchport access vlan 99<br /> <br /> !<br /> <br /> interface FastEthernet1/1<br /> <br /> !<br /> <br /> interface FastEthernet1/2<br /> <br /> !<br /> <br /> interface FastEthernet1/3<br /> <br /> !<br /> <br /> interface FastEthernet1/4<br /> <br /> !<br /> <br /> interface FastEthernet1/5<br /> <br /> !<br /> <br /> interface FastEthernet1/6<br /> <br /> !<br /> <br /> interface FastEthernet1/7<br /> <br /> !<br /> <br /> interface FastEthernet1/8<br /> <br /> !<br /> <br /> interface FastEthernet1/9<br /> <br /> !<br /> <br /> interface FastEthernet1/10<br /> <br /> !<br /> <br /> interface FastEthernet1/11<br /> <br /> !<br /> <br /> interface FastEthernet1/12<br /> <br /> !<br /> <br /> interface FastEthernet1/13<br /> <br /> no switchport<br /> <br /> ip address 192.168.1.253 255.255.255.0<br /> <br /> standby 3 ip 192.168.1.254<br /> <br /> standby 3 timers 1 3<br /> <br /> standby 3 preempt<br /> <br /> !<br /> <br /> interface FastEthernet1/14<br /> <br /> switchport trunk native vlan 99<br /> <br /> switchport mode trunk<br /> <br /> channel-group 1 mode on<br /> <br /> !<br /> <br /> interface FastEthernet1/15<br /> <br /> switchport trunk native vlan 99<br /> <br /> switchport mode trunk<br /> <br /> channel-group 1 mode on<br /> <br /> !<br /> <br /> interface Vlan1<br /> <br /> no ip address<br /> <br /> !<br /> <br /> interface Vlan99<br /> <br /> ip address 192.168.10.2 255.255.255.0<br /> <br /> standby 4 ip 192.168.10.254<br /> <br /> standby 4 timers 1 3<br /> <br /> standby 4 preempt<br /> <br /> standby 4 authentication md5 key-string cisco<br /> <br /> !<br /> <br /> !<br /> <br /> ip http server<br /> <br /> no ip http secure-server<br /> <br /> ip route 0.0.0.0 0.0.0.0 192.168.1.1<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> control-plane<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> !<br /> <br /> line con 0<br /> <br /> exec-timeout 0 0<br /> <br /> logging synchronous<br /> <br /> line aux 0<br /> <br /> line vty 0 4<br /> <br /> login<br /> <br /> !<br /> <br /> !<br /> <br /> endkhanhttp://www.blogger.com/profile/09978368963730080846noreply@blogger.com1tag:blogger.com,1999:blog-4682259220356914500.post-52458487926869241742009-12-06T05:51:00.000-08:002009-12-06T06:01:27.188-08:00Cut Through Proxy<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEic_9rYzeuiUqMcAuClGF8Qu70f_JwjlmLoSEsq_taej4sPvzxVRjDLKA8Y7lWaBPXqRpuwHwQVT_FEpQsLo909_0iguDOXU0mrxTZ2tuY-22G7hCB32Cc6FFrcPsFprVNopkT7njnmUgzQ/s1600-h/PIX+CUT+THRU+PROXY.jpeg.jpeg.jpeg"><img style="MARGIN: 0px 10px 10px 0px; WIDTH: 400px; FLOAT: left; HEIGHT: 171px; CURSOR: hand" id="BLOGGER_PHOTO_ID_5412120687814476370" border="0" alt="" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEic_9rYzeuiUqMcAuClGF8Qu70f_JwjlmLoSEsq_taej4sPvzxVRjDLKA8Y7lWaBPXqRpuwHwQVT_FEpQsLo909_0iguDOXU0mrxTZ2tuY-22G7hCB32Cc6FFrcPsFprVNopkT7njnmUgzQ/s400/PIX+CUT+THRU+PROXY.jpeg.jpeg.jpeg" /></a><br /><div>This is not full fledged Proxy. This I call it Stateful Proxy. Here right side of firewall is inside network. Left side is unsecure connection. Test was done with VMWARE host as inside host. and outside network was accessed via DSL connection with host host OS windows XP. And was successful. When accessing any website traffic was intercepted by security appliance. Asking for username and password. If not correct drop the connections. Here in this configuration cut thru proxy is used to intercept egress tcp connections only. </div><div> </div><div><strong><span style="font-size:130%;">Configuration of Firewall:</span></strong></div><div> </div><div><br />hostname pixfirewall<br />domain-name default.domain.invalid<br />enable password oyM4X.DeOBQWUivD encrypted<br />names<br />!<br />interface Ethernet0<br />nameif outside<br />security-level 0<br />ip address 192.168.1.254 255.255.255.0<br />!<br />interface Ethernet1<br />shutdown<br />no nameif<br />no security-level<br />no ip address<br />!<br />interface Ethernet2<br />nameif inside<br />security-level 100<br />ip address 192.168.56.254 255.255.255.0<br />!<br />interface Ethernet3<br />shutdown<br />no nameif<br />no security-level<br />no ip address<br />!<br />interface Ethernet4<br />shutdown<br />no nameif<br />no security-level<br />no ip address<br />!<br />passwd Q6PcEw0JPNC8SDNU encrypted<br />ftp mode passive<br />dns server-group DefaultDNS<br />domain-name default.domain.invalid<br />access-list icmp_in extended permit icmp any any<br />access-list private_ip_from_outside extended deny ip 10.0.0.0 255.0.0.0 any<br />access-list private_ip_from_outside extended deny ip 172.16.0.0 255.248.0.0 any<br />access-list private_ip_from_outside extended permit icmp any any<br />access-list private_ip_from_outside extended deny tcp any any eq 445<br />access-list private_ip_from_outside extended deny tcp any any eq 137<br />access-list deny_inside_to_outside extended deny tcp 192.168.0.0 255.255.0.0 any eq 445<br />access-list deny_inside_to_outside extended permit ip any any<br />pager lines 24<br />logging enable<br />mtu outside 1500<br />mtu inside 1500<br />no failover<br />icmp unreachable rate-limit 1 burst-size 1<br />no asdm history enable<br />arp timeout 14400<br />! for letting data traffic flow from inside to outside<br />global (outside) 1 192.168.1.100<br />global (outside) 1 192.168.1.101<br />global (outside) 1 interface<br />nat (inside) 1 0.0.0.0 0.0.0.0<br />access-group private_ip_from_outside in interface outside<br />access-group deny_inside_to_outside in interface inside<br />! default route to outside hop ip i.e. 192.168.1.1<br />route outside 0.0.0.0 0.0.0.0 192.168.1.1 1<br />timeout xlate 3:00:00<br />timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02<br />timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00<br />timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00<br />timeout uauth 3:00:00 absolute<br />dynamic-access-policy-record DfltAccessPolicy<br />! authentication based on service accessed in this case all tcp based services(i.e. http , ftp, telnet etc)<br /><strong>aaa authentication include tcp/0 inside 0.0.0.0 0.0.0.0 0.0.0.0 0.0.0.0 LOCAL<br />aaa authentication secure-http-client</strong><br />no snmp-server location<br />no snmp-server contact<br />snmp-server enable traps snmp authentication linkup linkdown coldstart<br />no crypto isakmp nat-traversal<br />telnet 192.168.56.0 255.255.255.0 inside<br />telnet timeout 5<br />ssh timeout 5<br />console timeout 0<br />threat-detection basic-threat<br />threat-detection scanning-threat shun<br />threat-detection statistics access-list<br />!<br />!</div>khanhttp://www.blogger.com/profile/09978368963730080846noreply@blogger.com0tag:blogger.com,1999:blog-4682259220356914500.post-28679438865091989442009-12-06T05:05:00.000-08:002009-12-06T05:39:31.600-08:00Limiting Number of TCP and UDP Connections on FirewallDear All,<br />I somehow know about configuring natting on cisco firewall. But how about cool feature of controlling TCP and UDP connections on your security appliance. Remember when you try to configure nat on internal network or static natting for internal/DMZ server on outside interface for persistent connection from server to outside, you have an option for limiting TCP and UDP connections.<br /><br />This is like this:<br />nat (inside) 1 0 0 tcp 25 25 udp 25<br />Irrespective of global command used, u can only control tcp and udp connections when using nat command.<br />Explaination:<br />Above nat command tells that any number of hosts from any hosts can xlated but each host will only can make 25 tcp established connections, 25 tcp embryonic connections can be made(those connections whose sys flag is on), and 25 udp connections. Remember, this configuration applies to each and every hosts trying to initiate connection from inside(Egress Traffic).<br /><strong></strong><br /><strong></strong><br /><strong><span style="font-size:130%;">What About Static natting:</span></strong><br />I take an example:<br /><br />static (dmz,outside) tcp 1.1.1.1 21 192.168.1.3 21 netmask 255.255.255.255 tcp 0 25 udp 0<br /><br />Here you see that mapping is done of inside host 192.168.1.3 which is ftp server with mask 255.255.255.255 i.e. only one host mapped on 1.1.1.1 which is outside ip. tcp 0 25 instructs that unlimited connections from outside can be made(0 means unlimited). Ebryonic connections cannot be more than 25. after 25 embryonic connections.<br /><br /><strong><span style="font-size:130%;">What happens after limit reaches:</span></strong><br /><br />Security appliance uses tcp cookie and behaves as proxy between host to host connection. when see's any emryonic connection more than 25 connections from any host, will intercept and behalf of that connecting host security appliance will recalculate the syn segment and send it to target host. If it gets syn ack segment it redirects to connecting host, can be called as source host. If security appliance gets ack segment back then it will allow connection or else drop that traffic.<br /><br />By virtue of tcp cookie technology, tcp connections are not stored in DRAM. On the fly security appliance does processing. So by this, DoS can be mitigated.khanhttp://www.blogger.com/profile/09978368963730080846noreply@blogger.com0tag:blogger.com,1999:blog-4682259220356914500.post-5132288615866578222009-12-06T04:38:00.001-08:002009-12-06T04:58:21.067-08:00Deploying Networks by using IGPs (OSPF and EIGRP) Redistribution BASIX ONLY<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvdiFOKc-M71nInAX3b-pd8RWtd6EUxH1ZNNt7vg7WQiftvojQHkh_jdXfmrOJiLLLEdMoeRsOqNHznTv0oeKKenn5HMl9R7hpanAKWmMODmBTjqa6orm15ZceZlyxrnDAwG8VaEmu3CX9/s1600-h/eigrp+and+ospf.jpeg.jpeg"><img style="MARGIN: 0px 10px 10px 0px; WIDTH: 400px; FLOAT: left; HEIGHT: 219px; CURSOR: hand" id="BLOGGER_PHOTO_ID_5412102448626862978" border="0" alt="" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjvdiFOKc-M71nInAX3b-pd8RWtd6EUxH1ZNNt7vg7WQiftvojQHkh_jdXfmrOJiLLLEdMoeRsOqNHznTv0oeKKenn5HMl9R7hpanAKWmMODmBTjqa6orm15ZceZlyxrnDAwG8VaEmu3CX9/s400/eigrp+and+ospf.jpeg.jpeg" /></a><br /><div>This is my simple network but intuitive. Hear I will not explain too much but some lit on it. </div><div>Upper half of the network is configured with OSPF(R1, R2, R3).</div><div>Lower half is configured with EIGRP(R3, R4, R5). You might be thinking why R3 is common in this network configuration. Coz it is only router where redistribution taking place. </div><div> There is one thing more in R3 configuration. The cloud C1 which is connected to R3. What is the purpose of this. This is your assignment to understand. LOL! </div><div><strong>Configuration of R3 is:</strong></div><div><br /><strong>!</strong><br /><span style="font-size:85%;">upgrade fpd auto<br />version 12.4<br />service timestamps debug datetime msec<br />service timestamps log datetime msec<br />no service password-encryption<br />!<br />hostname R3<br />!<br />boot-start-marker<br />boot-end-marker<br />!<br />logging message-counter syslog<br />!<br />no aaa new-model<br />ip source-route<br />ip cef<br />!<br />!<br />!<br />!<br />no ipv6 cef<br />!<br />multilink bundle-name authenticated<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />memory-size iomem 0<br />archive<br />log config<br />hidekeys<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />interface FastEthernet0/0<br />ip address dhcp<br />ip nat outside<br />ip virtual-reassembly<br />duplex half<br />!<br />interface Ethernet1/0<br />ip address 192.168.3.6 255.255.255.252<br />ip nat inside<br />ip virtual-reassembly<br />ip ospf 1 area 0<br />duplex half<br />!<br />interface Ethernet1/1<br />ip address 192.168.3.2 255.255.255.252<br />ip nat inside<br />ip virtual-reassembly<br />ip ospf 1 area 0<br />duplex half<br />!<br />interface Ethernet1/2<br />ip address 192.168.2.6 255.255.255.252<br />ip nat inside<br />ip virtual-reassembly<br />duplex half<br />!<br />interface Ethernet1/3<br />ip address 192.168.2.2 255.255.255.252<br />ip nat inside<br />ip virtual-reassembly<br />duplex half<br />!<br />router eigrp 1<br />redistribute static<br />redistribute ospf 1 metric 10000 1000 255 1 1500<br />network 192.168.2.0 0.0.0.7<br />auto-summary<br />!<br />router ospf 1<br />log-adjacency-changes<br />redistribute static subnets<br />redistribute eigrp 1 subnets<br />default-information originate<br />!<br />no ip classless<br />ip forward-protocol nd<br />no ip http server<br />no ip http secure-server<br />!<br />!<br />ip nat inside source list 1 interface FastEthernet0/0 overload<br />!<br />access-list 1 permit any<br />!<br />!<br />!<br />!<br />!<br />!<br />control-plane<br />!<br />!<br />!<br />mgcp fax t38 ecm<br />!<br />!<br />!<br />!<br />gatekeeper<br />shutdown<br />!<br />!<br />line con 0<br />exec-timeout 0 0<br />logging synchronous<br />stopbits 1<br />line aux 0<br />stopbits 1<br />line vty 0 4<br />login<br />!<br />end</span></div><div><span style="font-size:85%;"></span> </div><div><strong><span style="font-size:130%;">Configuration of R4:</span></strong></div><div><strong><span style="font-size:130%;"></span></strong> </div><div> </div><div><span style="font-size:85%;"><br />!<br />version 12.4<br />service timestamps debug datetime msec<br />service timestamps log datetime msec<br />no service password-encryption<br />!<br />hostname R4<br />!<br />boot-start-marker<br />boot-end-marker<br />!<br />!<br />no aaa new-model<br />memory-size iomem 5<br />!<br />!<br />ip cef<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />interface FastEthernet0/0<br />no ip address<br />shutdown<br />duplex auto<br />speed auto<br />!<br />interface FastEthernet0/1<br />no ip address<br />shutdown<br />duplex auto<br />speed auto<br />!<br />interface Ethernet1/0<br />ip address 192.168.2.9 255.255.255.252<br />half-duplex<br />!<br />interface Ethernet1/1<br />no ip address<br />shutdown<br />half-duplex<br />!<br />interface Ethernet1/2<br />no ip address<br />shutdown<br />half-duplex<br />!<br />interface Ethernet1/3<br />ip address 192.168.2.1 255.255.255.252<br />half-duplex<br />!<br />!<br />router eigrp 1<br />network 192.168.2.1 0.0.0.0<br />network 192.168.2.9 0.0.0.0<br />auto-summary<br />!<br />ip http server<br />no ip http secure-server<br />no ip classless<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />control-plane<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />line con 0<br />exec-timeout 0 0<br />logging synchronous<br />line aux 0<br />line vty 0 4<br />!<br />!<br />end</span></div><div><span style="font-size:85%;"></span> </div><div><strong><span style="font-size:130%;">R5 Configurtion:</span></strong></div><div><strong><span style="font-size:130%;"></span></strong> </div><div><br /><span style="font-size:85%;">!<br />version 12.4<br />service timestamps debug datetime msec<br />service timestamps log datetime msec<br />no service password-encryption<br />!<br />hostname R5<br />!<br />boot-start-marker<br />boot-end-marker<br />!<br />!<br />no aaa new-model<br />memory-size iomem 5<br />!<br />!<br />ip cef<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />interface FastEthernet0/0<br />no ip address<br />shutdown<br />duplex auto<br />speed auto<br />!<br />interface FastEthernet0/1<br />no ip address<br />shutdown<br />duplex auto<br />speed auto<br />!<br />interface Ethernet1/0<br />ip address 192.168.2.10 255.255.255.252<br />half-duplex<br />!<br />interface Ethernet1/1<br />no ip address<br />shutdown<br />half-duplex<br />!<br />interface Ethernet1/2<br />ip address 192.168.2.5 255.255.255.252<br />half-duplex<br />!<br />interface Ethernet1/3<br />no ip address<br />shutdown<br />half-duplex<br />!<br />!<br />router eigrp 1<br />network 192.168.2.5 0.0.0.0<br />network 192.168.2.10 0.0.0.0<br />auto-summary<br />!<br />ip http server<br />no ip http secure-server<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />control-plane<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />line con 0<br />exec-timeout 0 0<br />logging synchronous<br />line aux 0<br />line vty 0 4<br />!<br />!<br />end</span></div><div><span style="font-size:85%;"></span> </div><div><strong><span style="font-size:130%;">R1 Configuration:</span></strong></div><div><strong></strong> </div><div><br /><span style="font-size:85%;">!<br />version 12.4<br />service timestamps debug datetime msec<br />service timestamps log datetime msec<br />no service password-encryption<br />!<br />hostname R1<br />!<br />boot-start-marker<br />boot-end-marker<br />!<br />!<br />no aaa new-model<br />memory-size iomem 5<br />!<br />!<br />ip cef<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />interface FastEthernet0/0<br />no ip address<br />shutdown<br />duplex auto<br />speed auto<br />!<br />interface FastEthernet0/1<br />no ip address<br />shutdown<br />duplex auto<br />speed auto<br />!<br />interface Ethernet1/0<br />no ip address<br />shutdown<br />half-duplex<br />!<br />interface Ethernet1/1<br />ip address 192.168.3.1 255.255.255.252<br />ip ospf 1 area 0<br />half-duplex<br />!<br />interface Ethernet1/2<br />ip address 192.168.3.10 255.255.255.252<br />ip ospf 1 area 0<br />half-duplex<br />!<br />interface Ethernet1/3<br />no ip address<br />shutdown<br />half-duplex<br />!<br />!<br />router ospf 1<br />log-adjacency-changes<br />!<br />ip http server<br />no ip http secure-server<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />control-plane<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />line con 0<br />exec-timeout 0 0<br />logging synchronous<br />line aux 0<br />line vty 0 4<br />!<br />!<br />end</span></div><div> </div><div><strong><span style="font-size:130%;">R2 Configuration:</span></strong></div><div><strong><span style="font-size:130%;"></span></strong> </div><div><br /><span style="font-size:85%;">!<br />version 12.4<br />service timestamps debug datetime msec<br />service timestamps log datetime msec<br />no service password-encryption<br />!<br />hostname R2<br />!<br />boot-start-marker<br />boot-end-marker<br />!<br />!<br />no aaa new-model<br />memory-size iomem 5<br />!<br />!<br />ip cef<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />interface FastEthernet0/0<br />no ip address<br />shutdown<br />duplex auto<br />speed auto<br />!<br />interface FastEthernet0/1<br />no ip address<br />shutdown<br />duplex auto<br />speed auto<br />!<br />interface Ethernet1/0<br />ip address 192.168.3.5 255.255.255.252<br />ip ospf 1 area 0<br />half-duplex<br />!<br />interface Ethernet1/1<br />no ip address<br />shutdown<br />half-duplex<br />!<br />interface Ethernet1/2<br />ip address 192.168.3.9 255.255.255.252<br />ip ospf 1 area 0<br />half-duplex<br />!<br />interface Ethernet1/3<br />no ip address<br />shutdown<br />half-duplex<br />!<br />!<br />router ospf 1<br />log-adjacency-changes<br />!<br />ip http server<br />no ip http secure-server<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />control-plane<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />line con 0<br />exec-timeout 0 0<br />logging synchronous<br />line aux 0<br />line vty 0 4<br />!<br />!<br />end</span></div><div> </div><div> </div><div><span style="font-size:85%;"></span> </div>khanhttp://www.blogger.com/profile/09978368963730080846noreply@blogger.com0tag:blogger.com,1999:blog-4682259220356914500.post-72334539071621076612009-12-06T01:42:00.001-08:002009-12-06T05:42:03.305-08:00<strong><span style="font-size:130%;">How to configure FAILOVER on cisco pix in GNS3.</span></strong><br /><br /><br /><br /><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvoIvtgu5ziyoIKT9Ne7-OUN-HGwLUZGLPt7nIAcLLxgkypwnWfjfhe4xrF_6io6Fq0NIzPfiLY8h51tAHia4Sm2K8x9cIv1juvAlk5C-nmxuZaYTb2PoGZ_PLGH1okke58gLe5RT9PPOh/s1600-h/cisco+pix+failover.jpeg.jpeg"><img style="MARGIN: 0px 10px 10px 0px; WIDTH: 400px; FLOAT: left; HEIGHT: 157px; CURSOR: hand" id="BLOGGER_PHOTO_ID_5412057409308304546" border="0" alt="" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvoIvtgu5ziyoIKT9Ne7-OUN-HGwLUZGLPt7nIAcLLxgkypwnWfjfhe4xrF_6io6Fq0NIzPfiLY8h51tAHia4Sm2K8x9cIv1juvAlk5C-nmxuZaYTb2PoGZ_PLGH1okke58gLe5RT9PPOh/s400/cisco+pix+failover.jpeg.jpeg" /></a><br /><br /><br /><br /><br /><br /><br /><br /><br />Configuration according to diagram.<br /><br />As with all cisco firewall the rule of thumb is traffic traverse from higher security level to lower security level, without applying any ACL whereby applying only nat or no nat-control(i.e. only with routing suffices without any translation). If outside hosts(lower security level) want to initiate connection to inside host(higher security level), appliance must have static nat and ACL configured. As of above scenario, I used nat-control. Inside network in network diagram is right side of firewalls (security level 100) and outside network is left side of firewalls(security level 0). Failover is configured on FW0 and FW1.<br /><br /><strong>How is host on the same computer is connected in inside network?</strong><br /><br />This was done via VMWARE OS and given default gateway ip of failover ip of firewalls. Interesting feature of failover is when you try to configure Active appliance(FW1) and save it. It replicates to standby firewall(FW0) for e.g. ip addresses of interfaces, routing, natting etc. In other words, they are mirror of each other.<br /><br /><strong><span style="font-size:130%;">So here is the configuration for FW1(Active):</span></strong><br />PIX Version 8.0(2)<br />!<br />hostname PIXDOWN<br />domain-name domain.local<br />enable password 8Ry2YjIyt7RRXU24 encrypted<br />names<br />!<br />interface Ethernet0<br />nameif outside<br />security-level 0<br />ip address 192.168.1.250 255.255.255.0<br />!<br />interface Ethernet1<br />nameif inside<br />security-level 100<br />ip address 192.168.56.2 255.255.255.0<br />!<br />interface Ethernet2<br />description Management Interface<br />nameif MGMT_INT<br />security-level 99<br />ip address 192.168.200.1 255.255.255.0<br />management-only<br />!<br />interface Ethernet3<br />nameif DMZ<br />security-level 50<br />ip address 10.81.200.1 255.255.255.252 standby 10.81.200.2<br />!<br />interface Ethernet4<br />description LAN/STATE Failover Interface<br />!<br />passwd 2KFQnbNIdI.2KYOU encrypted<br />banner motd This is CISCO PIX 525<br />ftp mode passive<br />clock timezone IST 5 30<br />dns server-group DefaultDNS<br />domain-name domain.local<br />access-list outside_access_in extended permit icmp any any echo-reply<br />access-list outside_access_in extended permit icmp any any<br />access-list outside_access_in extended permit icmp any any traceroute<br />pager lines 24<br />logging enable<br />logging standby<br />logging asdm errors<br />mtu outside 1500<br />mtu inside 1500<br />mtu MGMT_INT 1500<br />mtu DMZ 1500<br />failover<br />failover lan unit primary<br />failover lan interface LANFAIL Ethernet4<br />failover lan enable<br />failover polltime unit 5 holdtime 15<br />failover replication http<br />failover link LANFAIL Ethernet4<br />failover interface ip LANFAIL 10.81.199.1 255.255.255.252 standby 10.81.199.2<br />icmp unreachable rate-limit 1 burst-size 1<br />asdm image flash:/asdm-602.bin<br />no asdm history enable<br />arp timeout 14400<br />nat-control<br />global (outside) 1 192.168.1.20<br />global (outside) 1 192.168.1.21<br />nat (inside) 1 0.0.0.0 0.0.0.0 tcp 0 25 udp 25<br />access-group outside_access_in in interface outside<br />route outside 0.0.0.0 0.0.0.0 192.168.1.1 1<br />timeout xlate 3:00:00<br />timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02<br />timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00<br />timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00<br />timeout uauth 0:05:00 absolute<br />dynamic-access-policy-record DfltAccessPolicy<br />http server enable<br />http 192.168.56.0 255.255.255.0 outside<br />no snmp-server location<br />no snmp-server contact<br />snmp-server enable traps snmp authentication linkup linkdown coldstart<br />no crypto isakmp nat-traversal<br />telnet 192.168.56.1 255.255.255.255 outside<br />telnet timeout 5<br />ssh scopy enable<br />ssh 192.168.56.1 255.255.255.255 outside<br />ssh timeout 5<br />console timeout 0<br />dhcpd address 192.168.200.10-192.168.200.254 MGMT_INT<br />dhcpd enable MGMT_INT<br />!<br />threat-detection basic-threat<br />threat-detection statistics access-list<br />!<br />class-map inspection_default<br />match default-inspection-traffic<br />!<br />!<br /><--- More --->.<br />No Response from Mate<br />policy-map type inspect dns preset_dns_map<br />parameters<br />message-length maximum 512<br />policy-map global_policy<br />class inspection_default<br />inspect dns preset_dns_map<br />inspect ftp<br />inspect h323 h225<br />inspect h323 ras<br />inspect rsh<br />inspect rtsp<br />inspect esmtp<br />inspect sqlnet<br />inspect skinny<br />inspect sunrpc<br />inspect xdmcp<br />inspect sip<br />inspect netbios<br />inspect tftp<br />!<br />service-policy global_policy global<br />ntp authenticate<br />ntp server 207.46.232.182 prefer<br />username admin password f3UhLvUj1QsXsuK7 encrypted privilege 15<br />prompt hostname context<br />Cryptochecksum:27b6669bbc3bab31a8254dca80e44377<br />: end<br /><br /><strong><span style="font-size:130%;">Here is the configuration for FW0(Standby):</span></strong><br /><strong><span style="font-size:130%;"></span></strong><br /><span style="font-size:130%;"><br /></span><span style="font-size:85%;">PIX Version 8.0(2)<br />!<br />hostname PIXDOWN<br />domain-name domain.local<br />enable password 8Ry2YjIyt7RRXU24 encrypted<br />names<br />!<br />interface Ethernet0<br />nameif outside<br />security-level 0<br />ip address 192.168.1.250 255.255.255.0<br />!<br />interface Ethernet1<br />nameif inside<br />security-level 100<br />ip address 192.168.56.2 255.255.255.0<br />!<br />interface Ethernet2<br />description Management Interface<br />nameif MGMT_INT<br />security-level 99<br />ip address 192.168.200.1 255.255.255.0<br />management-only<br />!<br />interface Ethernet3<br />nameif DMZ<br />security-level 50<br />ip address 10.81.200.1 255.255.255.252 standby 10.81.200.2<br />!<br />interface Ethernet4<br />description LAN/STATE Failover Interface<br />!<br />passwd 2KFQnbNIdI.2KYOU encrypted<br />banner motd This is CISCO PIX 525<br />ftp mode passive<br />clock timezone IST 5 30<br />dns server-group DefaultDNS<br />domain-name domain.local<br />access-list outside_access_in extended permit icmp any any echo-reply<br />access-list outside_access_in extended permit icmp any any<br />access-list outside_access_in extended permit icmp any any traceroute<br />pager lines 24<br />logging enable<br />logging standby<br />logging asdm errors<br />mtu outside 1500<br />mtu inside 1500<br />mtu MGMT_INT 1500<br />mtu DMZ 1500<br />failover<br />failover lan unit secondary<br />failover lan interface LANFAIL Ethernet4<br />failover lan enable<br />failover polltime unit 5 holdtime 15<br />failover replication http<br />failover link LANFAIL Ethernet4<br />failover interface ip LANFAIL 10.81.199.1 255.255.255.252 standby 10.81.199.2<br />icmp unreachable rate-limit 1 burst-size 1<br />asdm image flash:/asdm-602.bin<br />no asdm history enable<br />arp timeout 14400<br />nat-control<br />global (outside) 1 192.168.1.20<br />global (outside) 1 192.168.1.21<br />nat (inside) 1 0.0.0.0 0.0.0.0 tcp 0 25 udp 25<br />access-group outside_access_in in interface outside<br />route outside 0.0.0.0 0.0.0.0 192.168.1.1 1<br />timeout xlate 3:00:00<br />timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02<br />timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00<br />timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00<br />timeout uauth 0:05:00 absolute<br />dynamic-access-policy-record DfltAccessPolicy<br />http server enable<br />http 192.168.56.0 255.255.255.0 outside<br />no snmp-server location<br />no snmp-server contact<br />snmp-server enable traps snmp authentication linkup linkdown coldstart<br />no crypto isakmp nat-traversal<br />telnet 192.168.56.1 255.255.255.255 outside<br />telnet timeout 5<br />ssh scopy enable<br />ssh 192.168.56.1 255.255.255.255 outside<br />ssh timeout 5<br />console timeout 0<br />dhcpd address 192.168.200.10-192.168.200.254 MGMT_INT<br />dhcpd enable MGMT_INT<br />!<br />threat-detection basic-threat<br />threat-detection statistics access-list<br />!<br />class-map inspection_default<br />match default-inspection-traffic<br />!<br />!<br />policy-map type inspect dns preset_dns_map<br />parameters<br />message-length maximum 512<br />policy-map global_policy<br />class inspection_default<br />inspect dns preset_dns_map<br />inspect ftp<br />inspect h323 h225<br />inspect h323 ras<br />inspect rsh<br />inspect rtsp<br />inspect esmtp<br />inspect sqlnet<br />inspect skinny<br />inspect sunrpc<br />inspect xdmcp<br />inspect sip<br />inspect netbios<br />inspect tftp<br />!<br />service-policy global_policy global<br />ntp authenticate<br />ntp server 207.46.232.182 prefer<br />username admin password f3UhLvUj1QsXsuK7 encrypted privilege 15<br />prompt hostname context<br />Cryptochecksum:a1c86e0759da13e6ca07ec971350e88a<br />: end</span><br /><span style="font-size:85%;"></span><br />And on both routers I configured bridging on interfaces F0/0 and vlan 1<br /><span style="font-size:85%;"><strong>Here is the configuration for both router and is nearly same for both. Oh! by the way used cisco 3660 with ESW module</strong><br />!<br />version 12.4<br />service timestamps debug datetime msec<br />service timestamps log datetime msec<br />no service password-encryption<br />!<br />hostname R2<br />!<br />boot-start-marker<br />boot-end-marker<br />!<br />!<br />no aaa new-model<br />memory-size iomem 5<br />!<br />!<br />ip cef<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />bridge irb<br />!<br />!<br />!<br />interface FastEthernet0/0<br />no ip address<br />duplex auto<br />speed auto<br />bridge-group 1<br />!<br />interface FastEthernet0/1<br />no ip address<br />shutdown<br />duplex auto<br />speed auto<br />!<br />interface FastEthernet1/0<br />!<br />interface FastEthernet1/1<br />!<br />interface FastEthernet1/2<br />!<br />interface FastEthernet1/3<br />!<br />interface FastEthernet1/4<br />!<br />interface FastEthernet1/5<br />!<br />interface FastEthernet1/6<br />!<br />interface FastEthernet1/7<br />!<br />interface FastEthernet1/8<br />!<br />interface FastEthernet1/9<br />!<br />interface FastEthernet1/10<br />!<br />interface FastEthernet1/11<br />!<br />interface FastEthernet1/12<br />!<br />interface FastEthernet1/13<br />!<br />interface FastEthernet1/14<br />!<br />interface FastEthernet1/15<br />!<br />interface Vlan1<br />no ip address<br />bridge-group 1<br />!<br />interface BVI1<br />ip address dhcp<br />!<br />!<br />ip http server<br />no ip http secure-server<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />control-plane<br />!<br />bridge 1 protocol ieee<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />!<br />line con 0<br />exec-timeout 0 0<br />logging synchronous<br />line aux 0<br />line vty 0 4<br />login<br />!<br />!<br />end</span><br /><span style="font-size:85%;"></span>khanhttp://www.blogger.com/profile/09978368963730080846noreply@blogger.com0