seventhnetwork

Event Log Corrupted Message

2012-01-08T01:13:00.000-08:00

“The event log file is corrupt” message is received when trying to click the security log in event viewer.

According to Microsoft there are two possible causes as decried in following Knowledge Base

http://support.microsoft.com/kb/899416

http://support.microsoft.com/kb/888133

Apparently the Resolution for this error is only after applying the hot fix 975652 which can be downloaded from below link.

http://support.microsoft.com/kb/975652

Cisco Bootstrap or ROMMON Upgrade

2012-01-03T21:28:00.001-08:00

Every one of us in our career of networking will probably only do it a handful of times in life with what I am about to explain below. It is getting a hands-on on how to upgrade the Bootstrap on a Cisco 1841 ISR but would be the same on Cisco 2800 / 3800 series.

There really isn't a lot to it believe me...

First things that you need to do is download the latest image from Cisco and will look something like this.

C1841_RM2.srec.124-13r.T5

You can check to see what revision your router is running by entering this command:

#show version

Look for this line in the output, it will vary depending on your device and image.

ROM: System Bootstrap, Version 12.3(8r)T8, RELEASE SOFTWARE (fc1)

We are going to upgrade the current image to (124-13r)

Once you have the file, you need to get it onto your routers flash card or put it on a USB drive.

All you have to do is type this command and thats it.

Router#upgrade rom-monitor file flash:C1841_RM2.srec.124-13r.T5

This command will result in a 'power-on reset' of the router!
Continue? [yes/no]: y
ROMMON image upgrade in progress.
Erasing boot flash eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
Programming boot flash ppppppppppp

Now Reloading
System Bootstrap, Version 12.3(8r)T8, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 2004 by cisco Systems, Inc.

And here we are:

System Bootstrap, Version 12.4(13r)T5, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 2007 by cisco Systems, Inc.

That's it !!!!

Good Luck

MAC Security vs Windows

2011-12-04T05:53:00.001-08:00

I was reading a article online and found it to be interesting enough to paste it on my blogs. One of the main reason of share it is after reading his “interest of full disclosure” matches will everything that has happened to me i.e. how I become a Mac guy, I really don’t know how it happened.

This article is originally written by “Mike Chapple”, his details can be found at the end of this article. Hope people will enjoy it.

So where does the truth lie? Are Macs more secure than Windows boxes? It is safe to have them on your enterprise network? In this tip, we’ll offer a brief enterprise endpoint security comparsion, looking at how both device types fair in several key categories, and wrap up with some advice to help you assess the risk of adding more Mac endpoints to a Windows-dominant environment.

First, in the interest of full disclosure, I have only recently admitted to myself that I am, indeed, a Mac guy. I don’t exactly know how it happened, but a few years ago I bought a first-generation iPhone, and then, all of a sudden, my household and office were overrun by Apple products. I realized recently that the only Windows box at my ready disposal is an old clunker running Vista that my kids use for homework and games. Otherwise, Windows is now, to me, a completely virtual experience found by using Boot Camp or Parallels. I’ll set these personal preferences aside as we explore Windows vs Mac security on the network.

Let’s see how Macs shape up with Windows devices in the following categories:

Network security protocolsNetwork security professionals rely upon a common toolkit for protecting sensitive information in transit over the network. We use VPNs to protect remote users connecting back to the home network and depend upon strong IPsec and SSL VPNs to provide rock-solid security. We also spend a lot of time focusing on the security of wireless networks and depend upon the Wi-Fi Protected Access (WPA) standard to secure those communications.

The verdict?

It’s a draw. Both Macs and PCs support the basic set of network security tools needed to provide secure communications over both public and private networks. Neither platform has an advantage here, as long as you configure each to use strong encryption.

Network-based managementThe larger your enterprise, the more you probably rely upon centralized tools to manage your desktop configurations, antimalware protection, data loss prevention and other network security technologies. Windows shops typically rely upon Active Directory (AD) for many of these tasks and there’s simply not a reliable, consistent way to take AD policies and apply them to your average OS X box.

Even third-party products meant to ease centralized device management typically fall short when it comes to Mac support. They leave administrators with the impression (probably not a false one!) that the vendors’ developers focused for months or years on developing a Windows-based product and then quickly rushed out Mac support so they can say they have it. Indeed, I experienced this recently with the rollout of a popular DLP product. The PC deployment went smoothly with the assistance of Active Directory, while the Mac deployment required technicians to visit each machine individually and install the client. Not exactly a smooth experience!

The bottom line here is that PCs get the definite advantage for enterprise management. Apple hasn’t moved the ball far enough down the field to claim true enterprise support. The edge here goes to the folks in Redmond.

Server network securityAre you considering running a Mac OS X server in your environment? You might want to think again. From a network security perspective, Microsoft has simply put much more time and effort into developing a product that is enterprise-ready.

At a Black Hat 2011 presentation, researchers from iSEC Partners shared the results of a detailed side-by-side comparison of Windows and Macintosh security. In one section they compared the vulnerability of Windows Server 2008 R2 to Mac OS X 10.7 Server. The conclusion? Windows had the advantage across the board, with a shocking bottom line, according to iSEC, that “OS X networks are significantly more vulnerable to network privilege escalation. Almost every OS X Server service offers weak or broken authentication methods.”

Once again, Microsoft gets the nod in this category. In fact, I don’t know of a single enterprise that is trying to rely entirely upon Apple products. (Before you all start flaming me, I said I personally don’t know of such a case — I’m sure you’re out there somewhere!)

So what should you do?First, accept the fact that you most likely can’t run a pure Windows environment anymore. The combined forces of the consumerization of technology and the demand from users for Macs likely mean you’ll see Mac devices on your network in the near future, if they’re not there already.

That said, as much as the Mac lover in me hates to admit it, Apple just isn’t yet producing a product that’s ready to support in an enterprise environment on any large scale. I suspect they’ll remain in the hands of IT professionals (you’ll have to pry my MacBook out of my hands!) who can self-support their devices and creative types who need the unique tools available only on Macs (and have the dedicated IT support to back them up), but the crew in Cupertino still has a lot more work to do before enterprise can easily support and secure truly mixed environments.

So, in the meantime, make sure you carefully think about the network security implications of having Macs around. When you select and deploy configuration management products that contribute to your network security management, make sure Macs are represented in the use cases you consider. If you’re rolling out a VPN or wireless network, be sure you test it on a few different versions of Mac OS X before releasing it to production. The presence of Macs on our networks is inevitable, and it’s up to us to keep them secure.

About the author:

Mike Chapple, Ph.D., CISA, CISSP, is an IT security professional with the University of Notre Dame. He previously served as an information security researcher with the National Security Agency and the U.S. Air Force. Mike is a frequent contributor to SearchSecurity.com, a technical editor for Information Security magazine and the author of several information security titles, including the CISSP Prep Guide and Information Security Illuminated.

How to enable Packet Capture on Cisco ASA devices

2011-12-04T04:13:00.001-08:00

Alot of time in your career you would have to diagnos an connection issue and it could be either related to communication or application for that matter.

Personally I have come across this situation many times and technically there are ways to deal with it but if you happens to be a Network Administrator working in a company where you have Cisco ASA series Firewalls implemented and you are the one responisble to administrator them, then you have a very nice feature available on Cisco ASA to perform a capture within the appliance and diagnos the issue on run-time.

Below are the step to get it to work.

On the configuration mode use the following to create an access-list
access-list <name_of_access-list_for_inside> extended permit ip host <sender_ip> host <receiver_ip>
access-list <name_of_access-list_for_inside> extended permit ip host <receiver_ip> host <sender_ip>
access-list <name_of_access-list_for_outside> extended permit ip host <receiver_ip> host <sender_ip>
access-list <name_of_access-list_for_outside> extended permit ip host <sender_ip> host <receiver_ip>

On the priviledge mode use the following to start the capture
capture <capture_inside> interface inside access-list <name_of_access-list_for_inside>
capture <capture_outside> interface outside access-list <name_of_access-list_for_outside>

On the Priviledge mode entre the following to view the capture
show capture <capture_inside>
show capture <capture_outside>