networkhelps organisation

Cisco Switch Network commands for confiuration

2011-05-04T11:00:00.005+05:30

Basic Commands For Cisco Switch network Configuration

In this article I will introduce the Cisco Internetwork Operating System (IOS) command line interface (CLI) for the 2960 series switch. You will need to logon to a switch and become familiar with the different levels of access on the switch. You will also become familiar with the commands available to you in each mode (user or privileged) and the switch help facility, history, and editing features.

User vs. Privileged Mode

User mode is indicated with the > next to the switch name. You can look at settings but can not make changes from user mode. In Privilege mode, indicated by the #, you can do anything. To get into privilege mode the keyword is enable.

HELP

To view all commands available from this mode type:?This will give you the list of all available commands for the switch in your current mode. You can also use the question mark after you have started typing a command. For example if you want to use a show command but you do not remember which one it is, use the ? as this will output all commands that you can use with the show command.

Configuration Mode

From privilege mode you can enter configuration mode by typing config term command you can exit configuration mode type type end or +z

Configuration of Cisco 2960 Switch

To practically implement these command either create a simple topology on packet tracer or download this topology.

Example topology for basic switch commands

Now click on any switch and configure it as given below

To know all available command on user exec mode type ? and press enter

Switch>?
Exec commands:
    [1-99]         Session number to resume
    connect        Open a terminal connection
    disconnect     Disconnect an existing network connection
    enable         Turn on privileged commands
    exit           Exit from the EXEC
    logout         Exit from the EXEC
    ping           Send echo messages

[Output is omitted]

Three command can be used to logout from terminal use any one

Switch>enable
Switch#disable
Switch>exit

Switch con0 is now available

Press RETURN to get started.

Show version command will tell about the device platform and detected interface and ios name

Switch>enable


Switch#show version
Cisco IOS Software, C2960 Software (C2960-LANBASE-M), Version
12.2(25)FX, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Wed 12-Oct-05 22:05 by pt_team
ROM: C2960 Boot Loader (C2960-HBOOT-M) Version 12.2(25r)FX,
RELEASE SOFTWARE (fc4)
System returned to ROM by power-on
Cisco WS-C2960-24TT (RC32300) processor (revision C0) with
21039K bytes of memory.
24 FastEthernet/IEEE 802.3 interface(s)
2 Gigabit Ethernet/IEEE 802.3 interface(s)

[Output is omitted]

show mac address command will show all detected mac address dynamically and manually

Switch#show mac-address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----

   1    0001.643a.5501    DYNAMIC     Gig1/1

Run time configuration of ram can be any time by simple show run commands

Switch#show running-config
Building configuration...
Current configuration : 925 bytes
version 12.2
no service password-encryption
!
hostname Switch

[Output is omitted]

To view startup configuration [ Stored in NVRAM] use show start command

Switch#show startup-config
Current configuration : 925 bytes
version 12.2
no service password-encryption
!
hostname Switch

[Output is omitted]

show vlan command will give the detail overview of all vlan configured on switch

Switch#show vlan

VLAN Name                      Status    Ports
---- -------------------------------- --------- -----------------------
1    default                   active    Fa0/1, Fa0/2, Fa0/3, Fa0/4
                                         Fa0/5, Fa0/6, Fa0/7, Fa0/8
                                         Fa0/9, Fa0/10, Fa0/11, Fa0/12
                                         Fa0/13, Fa0/14, Fa0/15, Fa0/16
                                         Fa0/17, Fa0/18, Fa0/19, Fa0/20
                                         Fa0/21, Fa0/22, Fa0/23, Fa0/24
[Output is omitted]

show interface command will show all detected interface with their hardware description and configuration

Switch#show interfaces
FastEthernet0/1 is up, line protocol is up (connected)
  Hardware is Lance, address is 0060.2f9d.9101 (bia 0060.2f9d.9101)
  MTU 1500 bytes, BW 100000 Kbit, DLY 1000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set

 
[Output is omitted]

  interface vlan 1 is used to assign ip address and default gateway  to   switch. Show interface vlan 1 will give a over view of vlan1.

Switch#show interface vlan1
Vlan1 is administratively down, line protocol is down
  Hardware is CPU Interface, address is 0060.5c23.82ae
   (bia 0060.5c23.82ae)
  MTU 1500 bytes, BW 100000 Kbit, DLY 1000000 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  ARP type: ARPA, ARP Timeout 04:00:00

 

[Output is omitted]

  delete command is used to delete all vlan configuration from switch    Don’t add space between flash and vlan.dat  Run this exactly shown here    adding a space could erase flash entirely leaving switch blank

Switch#delete flash:vlan.dat
Delete filename [vlan.dat]?
Delete flash:/vlan.dat? [confirm]
%deleting flash:/vlan.dat

Startup configuration can be removed by erase commands

Switch#erase startup-config
Erasing the nvram filesystem will remove all configuration files!
Continue? [confirm]
[OK]
Erase of nvram: complete
%SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram

use configure terminal command to go in global configuration mode

Switch#configure terminal 
Enter configuration commands, one per line.  End with CNTL/Z.

Now change default switch name to switch 1

Switch(config)#hostname Switch1

Set enable password to vinita and secret to nikki

Switch1(config)#enable password vinita
Switch1(config)#enable secret nikki

 Set console password to vinita and enable it by login command, order of command is important set password before you enable it

Switch1(config)#line console 0
Switch1(config-line)#password vinita
Switch1(config-line)#login
Switch1(config-line)#exit

Enable 5 telnet session [ vty0 - vty4] for router and set their password to vinita

Switch1(config)#line vty 0 4
Switch1(config-line)#password vinita
Switch1(config-line)#login
Switch1(config-line)#exit

Now set switch ip address to 192.168.0.10 255.255.255.0 and default gateway to 192.168.0.5

Switch1(config)#interface vlan1
Switch1(config-if)#ip address 192.168.0.10 255.255.255.0
Switch1(config-if)#exit
Switch1(config)#ip default-gateway 192.168.0.5

Set a description finance VLAN to interface fast Ethernet 1

Switch1(config)#interface fastEthernet 0/1
Switch1(config-if)#description finance VLAN

By default switch automatically negotiate speed and duplex but you can adjust it manually

Switch1(config-if)#duplex full
%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1,
 changed state to downSwitch1

 
(config-if)#duplex auto
%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up

 
Switch1(config-if)#duplex half
%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to down
%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1,
changed state to down
%LINK-5-CHANGED: Interface FastEthernet0/1, changed state to up

 
Switch1(config-if)#duplex auto
Switch1(config-if)#speed 10
Switch1(config-if)#speed 100
Switch1(config-if)#speed auto
Switch1(config-if)#exit
Switch1(config)#exit

mac address table can be wiped out by clear commands

Switch1#show
Switch1#show mac-address-table
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----

   1    0001.643a.5501    DYNAMIC     Gig1/1

 
Switch1#clear mac-address-table
Switch1#clear mac-address-table ?
  dynamic  dynamic entry type

 
Switch1#clear mac-address-table dynamic

 To restart switch use reload command [ running configuration will be erased so copy it first to startup configuration ]

Switch1#reload
Proceed with reload? [confirm]
Switch con0 is now available
Press RETURN to get started.

Install and Configure Python in Windows Server 2008/2003 (IIS 6.0 or 7.0)? 1. Install Python

2011-02-17T16:19:00.000+05:30

1. Install Python

Go to Python official website http://www.python.org/download/ and download the latest Windows installer (.msi). Follow the screen and install it.

2. Configure IIS Web Service Extensions

Open Start -> Administrative Tools > Internet Information Services (IIS) Manager. Click "Web Service Extensions" and add a new web service 'C:\Python25\python.exe -u "%s" "%s"'.

3. Configure Website to Enable Python

Go to website that you want to eanble Phyton. Right click the website and go to Properties > Home Directory > Configurations > Mappings. Add a new script mapping ".py" with 'C:\Python25\python.exe -u "%s" "%s"'.

4. Test Python

Write a test file test.py and test it out. Everything should work now.

print
        print 'Status: 200 OK'
        print 'Content-type: text/html'
        print
        print ''
        print 'This is a header'

        print '' #this is a comment
        print 'See this is just like most other HTML'
        print '
'
        print ''

5. Configure Control Panel (Optional)

If you have a control panel for your server, you may need to configure it as well. Below is a sample for Helm control panel.

Use policy to control bluecoat ProxySG administrator access

2011-02-15T16:16:00.004+05:30

If you would like to control administrator access to the ProxySG Management Console and CLI, you can create policy to configure administrator access privileges.

Using policy rules, you can require administrators to identify themselves by entering a username and password and specify whether read-only or read-write access is given. You can make this policy contingent on IP address, user name, group membership (if credentials were required), and many other conditions.

This solution assumes you have already configured users and groups for authentication (using RADIUS, LDAP, Microsoft Active Directory, or other authentication servers) and created a realm on the ProxySG to connect to these servers.

Procedure to follow

To create policy for ProxySG administrator access:

1. Launch the Visual Policy Manager.
2. Create an Admin Authentication layer (Policy > Add Admin Authentication Layer ).
3. In the Admin Authentication layer, specify the authentication realm that will be used to authenticate administrative users of the ProxySG:
* Right-click in the Action column and choose Set.
* Select New > Authenticate.
* Select the authentication mode and realm. (See ProxySG Authentication Modes.)
* Close the dialogs.
4. Create an Admin Access layer (Policy > Add Admin Access Layer).
5. In the Admin Access layer, define who is allowed to access the ProxySG:

* Right-click in the Source column and choose Set.
* Select New.
* Select the entity (for example, Client IP address/subnet, User, Group) and configure the specifics.
* Close the dialogs.

6. Specify the type of administrator read/write access:

* Right-click the Action column and select Allow Read-only Access or Allow Read/Write Access.

7. By default, the policy applies to any service (HTTP/HTTPS in the Management Console and SSL in the CLI). If you want to control access to just the MC or just the CLI:

* Right-click in the Service column and choose Set.
* Select New > Service Name.
* Select the service you want the rule to apply to (HTTP-Console, HTTPS-Console, or SSH-Console).
* Close the dialogs.
8. Install the policy.

setup DHCP Server and Dynamic DNS with BIND in Debian

2011-02-14T16:13:00.000+05:30

This will explain Howto setup DHCP Server and Dynamic DNS with BIND in Debian.

Preparing you system

First you need to install DHCP,BIND servers using the following command

#aptitude install dhcp3-server bind9

This will complete the installation.

This is the network configuration of our DHCP/DNS server we are using for our tutorial
Hostname : router.static.example.org
WAN interface (eth0) : 192.168.99.254 mask 255.255.255.0
LAN interface (eth1) : 172.30.200.254 mask 255.255.0.0
Default gateway : 192.168.99.1

First, we need to tell the DHCP server to only run on eth1 you need to edit the /etc/default/dhcp3-server file using the following command

#vi /etc/default/dhcp3-server

enter the following line save and exit file.

INTERFACES="eth1"

Configuring DHCP Server Configuration

/etc/dhcp3/dhcpd.conf :

This is the DHCP server configuration.

When a computer requests network information from the DHCP server, the DHCP will update the DNS zones

- dyn.example.org : the zone that will map hostnames to IP address
- 201.30.172.in-addr.arpa : the zone in charge of reverse lookups

ddns-domainname is the domain name that the DHCP server will try to update in the zone. For example if my computer is named mycomputer, it will try to upload the dyn.example.org zone with mycomputer.dyn.example.org.

That option is absolutely needed if you have several domains in the “option domain-name” field (the “search” domains that will be in /etc/resolv.conf), or it could try to add the hostname mycomputer.static.example.org to the dyn.example.org zone.

If you only have one domain in the “option domain-name” field, you can go without ddns-domainname as it will upload the zone with the domain specified there.

ddns-update-style interim;
include "/etc/bind/rndc.key";

zone dyn.example.org. {
primary 127.0.0.1;
key "rndc-key";
}

ddns-domainname "dyn.example.org";
option domain-name "static.example.org dyn.example.org";
option domain-name-servers 172.30.200.254;
option routers 172.30.200.254;
option broadcast-address 172.30.255.255;
option ntp-servers 172.30.200.254;

default-lease-time 86400;
max-lease-time 86400;

authoritative;

log-facility local7;

subnet 172.30.0.0 netmask 255.255.0.0 {

range 172.30.201.10 172.30.201.200;

# DNS zones to update
zone 201.30.172.in-addr.arpa. {
primary 172.30.200.254;
key "rndc-key";
}

zone dyn.example.org. {
primary 172.30.200.254;
key "rndc-key";
}
}

Bind Server Configuration
/etc/bind9/named.conf :

Make sure the file contains the following :

include "/etc/bind/named.conf.local";

You should not change that file, as you will specify your options in two other files.

/etc/bind9/named.conf.options :

Your options.

The zone files will be stored under /var/cache/bind/

The queries for unauthoritative domains will be forwarded to 192.168.99.1. You can put the DNS provided by your ISP there (or put the DNS from opendns.com)

options {
directory "/var/cache/bind";

query-source address * ;

forwarders {
192.168.99.1;
};

recursion yes;

version "REFUSED";

allow-recursion {
127.0.0.1;
192.168.99.0/24;
172.30.0.0/16;
};

allow-query {
127.0.0.1;
192.168.99.0/24;
172.30.0.0/16;
};

};

/etc/bind9/named.conf.local :

This will contain your zone declarations

### options #########

include "/etc/bind/rndc.key";
controls {
inet 127.0.0.1 allow { localhost; } keys { "rndc-key"; };
};

### "static" zones #########

zone "static.example.org" {
type master;
file "db.static.example.org";
};

zone "200.30.172.in-addr.arpa" {
type master;
notify no;
file "db.172.30.200";
};

### dynamic zones (updated by DDNS) #########

zone "dyn.example.org" {
type master;
file "db.dyn.example.org";
allow-update { key "rndc-key"; };
};

zone "201.30.172.in-addr.arpa" {
type master;
notify no;
file "db.172.30.201";
allow-update { key "rndc-key"; };
};

Now let’s focus on DNS zones.

In this example we have several zones :

- static.example.org : static zone (like servers with static IP’s)
- dyn.example.org : dynamic zone, updated by DHCP when a computer gets an IP from it
- 172.30.200 : static zone (servers, etc.), which is not updated by DDNS
- 172.30.201 : dynamic zone, will contain information about machines using DHCP

My advise to split the static zones from the dynamic zones, DDNS has a tendency to mess up the zone files, which make them barely readable and manageable.

/var/cache/bind/db.172.30.200 :

$ORIGIN .
$TTL 86400    ; 1 day
200.30.172.in-addr.arpa    IN SOA    static.example.org. postmaster.example.org. (
200806299 ; serial
28800      ; refresh (8 hours)
7200       ; retry (2 hours)
2419200    ; expire (4 weeks)
86400      ; minimum (1 day)
)
NS    ns.static.example.org.
$ORIGIN 200.30.172.in-addr.arpa.
253            IN PTR    server.static.example.org.
254            IN PTR    router.static.example.org.

/var/cache/bind/db.172.30.201 :

$ORIGIN .
$TTL 86400    ; 1 day
201.30.172.in-addr.arpa    IN SOA    static.example.org. postmaster.example.org. (
200806327 ; serial
28800      ; refresh (8 hours)
7200       ; retry (2 hours)
2419200    ; expire (4 weeks)
86400      ; minimum (1 day)
)
NS    ns.static.example.org.
$ORIGIN 201.30.172.in-addr.arpa.

/var/cache/bind/db.static.example.org :

$ORIGIN .
$TTL 86400    ; 1 day
static.example.org    IN SOA    ns.static.example.org. postmaster.example.org. (
200806327 ; serial
28800      ; refresh (8 hours)
7200       ; retry (2 hours)
2419200    ; expire (4 weeks)
86400      ; minimum (1 day)
)
NS    ns.static.example.org.
A    172.30.200.254
$ORIGIN static.example.org.
server            A    172.30.200.253
router            A    172.30.200.254
ns            A    172.30.200.254

ntp            CNAME    router.static.example.org.
smtp            CNAME    router.static.example.org.

/var/cache/bind/db.dyn.example.org

$ORIGIN .
$TTL 86400    ; 1 day
dyn.example.org        IN SOA    ns.static.example.org. admin.example.org. (
200806341 ; serial
28800      ; refresh (8 hours)
7200       ; retry (2 hours)
2419200    ; expire (4 weeks)
86400      ; minimum (1 day)
)
NS    ns.dyn.example.org.
A    172.30.200.254
$ORIGIN dyn.example.org.

Now, make sure the zones will be writable by the user “bind” and restart the services :

# chown bind. /var/cache/bind/*

# /etc/init.d/bind restart

# /etc/init.d/dhcp3-server restart

On a computer on the network :

As root :

Edit /etc/dhcp3/dhclient.conf and set :
send host-name "mycomputer";

Now request an IP :
# dhclient eth0

Let’s imagine the computer has received the IP 172.30.201.200

You should see on the server’s syslog that the DNS zones have been updated.

- mycomputer.dyn.example.org is now bound to 172.30.201.200
- 172.30.201.200 will return mycomputer.dyn.example.org

From your computer, you should be able to verify the zones have been updated properly :

$ nslookup mycomputer
Server:        172.30.200.254
Address:    172.30.200.254#53

Name:    mycomputer.dyn.example.org
Address: 172.30.201.200

$ nslookup 172.30.201.200
Server:        172.30.200.254
Address:    172.30.200.254#53

200.201.30.172.in-addr.arpa    name = mycomputer.dyn.example.org.

You don’t need to type the whole mycomputer.dyn.example.org thing since it will lookup for either :
- mycomputer.dyn.example.org
- mycomputer.static.example.org if the previous wasn’t found
- mycomputer if the previous two were not found

This actually means that if you lookup www.google.com, it would try to resolve www.google.com.dyn.example.org first, then www.google.com.static.example.org, and finally www.google.com

You can avoid those unnecessary lookups by adding a dot to the end of the hostname you are trying to resolve :

# nslookup www.google.com.

This is the purpose of the search domains in /etc/resolv.conf

Upgrade Cisco IOS in a Router or a Switch

2011-02-13T16:07:00.000+05:30

upgrading IOS on Cisco routers and switches is hightly recommendable because of the following reasons

Patch critical vulnerabilities: Just like any other network device or application, Cisco routers and switches are also prone to security holes. And because routers and switches are critical to network infrastructure, you should plug these security holes as soon as possible.

Incorporate new features: Unless an update is simply a bug fix, every new release of the Cisco IOS includes new features. Upgrading your routers and switches in a timely manner means you’ll have more features to potentially make your job easier.

Stay current: “Staying current” with the latest IOS may sound like a flimsy justification to upgrade, especially when you consider your daily task list. However, when you consider the many different tools that communicate with the router’s IOS, staying current can take on a new importance. For example, if you’re using a SNMP network management tool, it may require your router to run a certain version of the IOS.

Follow this procedure if you want to upgrade cisco IOS

NOTE :- Before doing any upgrades plesae take a complete backup of your cisco device configuration for safer side

Download the Correct version of Cisco IOS for you from here http://www.cisco.com/tacpage/sw-center/index.shtml

Write Unsaved configurations

ciscorouter# write memory
Building configuration…
[OK]

Check space on Flash Memory

ciscorouter# show flash

Make sure you have the space left on your cisco device.

Backup Startup Configuration

Setup a TFTP server in the same IP range as the Cisco device to backup the configs, IOS image and also for later to upload the new IOS image.

testrouter# copy startup-config tftp
Address or name of remote host []? 10.10.10.2
Destination filename [startup-config]?
!!
1278 bytes c opied in 0.100 secs

Backup Current IOS Image

testrouter# copy flash: tftp:
Source filename []? xxxxx-xx-xx.121-x.XB
Address or name of remote host []? 10.10.10.2
Destination filename [xxxxx-xx-xx.121-x.XB]?

Now, Load the new IOS image from the TFTP onto the flash

ciscorouter#copy tftp: flash:
Address or name of remote host []? 10.10.10.2
Source filename []? c3560-ipbasek9-mz.122-40.SE.bin
Destination filename [c3560-ipbasek9-mz.122-40.SE.bin]?
Accessing tftp://10.10.10.2/c3560-ipbasek9-mz.122-40.SE.bin…
Loading c3560-ipbasek9-mz.122-40.SE.bin from 10.10.10.2 (via Vlan1): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!
[OK - 8295106 bytes]

8295106 bytes copied in 124.571 secs (66589 bytes/sec)

Now you need to make sure you are booting with the correct version of IOS image for this you need to use the following command to set.

testrouter(config)#boot system flash:/c3560-ipbasek9-mz.122-40.SE.bin

Now you need to reload the Cisco Router

testrouter# reload

After rebooting cisco device with the new Cisco IOS image you need to make sure this use the following command

testrouter# sh ver

That’s it now we are using the latest IOS on your cisco device

Configuring Cisco IOS

2011-02-12T16:03:00.001+05:30

Configuring Cisco IOS

General Information

Routers come with different memory sets:

    ROM
    Shared RAM
    RAM (routing tables and data structures)
    Flash (IOS)
    NVRAM (Configuration files)

Commands

    To select boot source: boot system flash/rom/filname IP-address
    To erase router configuration: write erase
    To display current configuration: sh conf (from NVRAM) or wri term (from RAM)
    To configure router: conf term (or mem, or net) Remember to type CTRL-Z to leave configuration mode
    To configure interface:
    int e0
            ip address 10.0.0.1 255.255.255.0
            no shutdown
    To show interface status: sh int e0
    To save configuration: wri mem
    enable password = password is shown in clear text when displaying configuration
    enable secret = password is shown encrypted when displaying configuration
    To set number of virtual terminals and password:
    line vty 0 4
            password access
    To disable name lookup: no ip domain-lookup
    To avoid assigning IP address to ethernet port for P-2-P connection:
    int s0
            ip unnumbered e0
    To configure route: ip route 120.0.0.0 255.255.255.0 150.1.1.1
    When connecting two routers with a cross-over cable, "clockrate 64000" is only needed on the router acting as DCE
    Password Recovery Procedure for the Cisco 2500 router: http://www.cisco.com/warp/public/474/pswdrec_2500.html
    Password Recovery Procedure for the Cisco 1600 router: http://www.cisco.com/warp/public/474/pswdrec_1600.shtml
    Do not use Hyperterminal to connect to Cisco routers through the Console plug
    Configuration register is 0x2102 for Cisco 2500 models, 0x102 for Cisco 1600 models
    To save the flash/NVRAM image on a remote TFTP server: #copy tftp flash
    To download a new IOS image into the router from a remote TFTP server: #copy flash tftp
    To update IOS:
        Install Cisco's TFTP Server
        Copy the new image with extension .bin into the TFTP Server's directory
        Launch the TFTP Server
        Connect to the Cisco router through the Console port, switch to admin mode, and type copy flash tftp. Follow the on-screen instructions to

        Note: under W2K, you might to add an extra ".bin" as file extension in addition to the default .bin extension

        Instead of "copy tftp flash", try "copy tftp: flash"
    To list images availables in flash memory, run "dir"
    To disable source-routing: no ip source-route
    Domain name and DNS server: ip domain-name example.com ip name-server 192.168.55.132 ip name-server 192.168.27.32
    To configure AAA user authentication. aaa new-model aaa authentication login lista tacacs+ enable

ALCs

Note: (CHECK) You cannot remove just one line from an existing ACL instruction, as this removes the entire section from IOS. You must type the entire section to add or remove one instruction.

Note: Watch out for the order of instructions in ACLs, as they are processed from top to bottom, ie."deny ip any any" followed by "allow tcp any any" means that a user will not be able to connect using a TCP-based application since the first line is interpreted first.

    access-list 110 permit tcp 172.16.120.0 0.0.0.255 any eq smtp
    access-list 110 permit tcp 172.16.120.0 0.0.0.255 any eq pop3
    access-list 110 permit tcp 172.16.120.0 0.0.0.255 any eq 110
    access-list 110 permit udp any any eq 137
    access-list 110 permit udp any any eq 138
    access-list 110 permit udp any any eq 139
    access-list 110 permit icmp any any
    access-list 110 deny ip any any!

Logging

IOS debugging messages use the same "facilities" for identification. They are, however, formatted differently than error messages, beginning with a timestamp followed only by the "facility" and the debug message output. IOS error and debug messages follow the Unix syslog severity format (0 emerg to 7 debug). Messages appear in the IOS reporting output action depending on the severity level defined.

The IOS provides four output actions for viewing system event and error data. Console logging is activated by default. In its default configuration, all (severity level 7, debugging) message data is sent to the router's console port (line con0). This approach is similar to Unix, where error and event data is sent to /dev/console or /dev/tty0. To disable console logging, use the configuration mode command . Sending logging data only to the console port may seem odd, since most interaction is done using vty sessions, but the console port can be connected to a terminal server, which buffers the message data or a serial line printer (just like Unix) that can print out event messages. While esoteric, these two methods of data collection were quite acceptable for many years and they are secure from a networking perspective since the data is sent via serial to a locally attached display device (just remember to lock the door).

To view system messages over a vty session (line vty 0 - 4), monitor logging must be configured. To view logging data, the enable exec command is run to activate logging output to the vty. To enable monitor logging, use the configuration command . The monitor logging option is the most practical method for viewing logging events in real time. It is highly recommended that you establish two vty sessions, one for displaying event reporting data, and the other for command execution. Often, when troubleshooting or running a debugging sequence, a large amount of logging data is generated. This obscures the vty with logging output, making command entry quite difficult at times. Once terminal monitoring is enables on a vty, it cannot be disabled (unless the logging monitor service is disabled using the configuration command ).

Local storage of logging messages on the router is also available via buffer logging. Since most routers do not have a hard disk, messages are saved in a DRAM buffer. While buffer logging does not directly affect the router's performance, it does consume memory. However, if your router is short on memory, you may see performance issues with processes that need memory if your logging buffer allocation is too large. To verify your router's memory configuration, use the enable exec command which will provide a variety of operational facts about your router, including the amount of DRAM allocated for packet buffers and the amount allocated for operational processes (i.e., routing tables, CEF tables, etc.) To see if you are having memory allocation issues, use the enable exec command . A reasonable buffer allocation is 64k; the "history" logfile is a rotating one, which overwrites the last log entry when the size limit has been reached. To configure buffered logging use the following configuration commands:

    Godzilla-ABR(config)#logging buffered notice
    Godzilla-ABR(config)#logging buffered 64000
    Godzilla-ABR(config)#logging history size 250

The above configuration sets the buffer size at 64k and sets the history count at 250 messages. To view the buffered logging data, use the exec command . This command performs two functions; it reports on the configuration of the router's various reporting display actions, and outputs the logging buffer history (if buffer logging is configured).

To send system messages to a remote syslog host, ;TRAP logging needs to be configured as a reporting output action. Remote reporting has two big advantages over local reporting.

    History and archiving: Storing logs remotely shifts the burden of storing log output to a device with an actual file system and cheap ample storage. This provides the option to keep large-sized log files and/or the ability to archive and store log files.
    Data Manipulation: Once the log data is on a system with tools that can manipulate it, log data can be used to generate and syndicate some very interesting and valuable reports, as you will see later with the SNMP scanner report script.

Configuring TRAP logging is a four step process:

    Define a syslog host using the configuration command .
    Define the logging severity of the messages to be sent using the configuration command .
    Define the IP address that will be associated as the origin address of the logging messages. This is set using the configuration command .
        The final step defines the syslog "facility" that the messages are sent to on the remote syslog server. Use the configuration command . Here is a trap reporting configuration example that uses the Loopback interface as the report origin address:

        Godzilla-ABR(config)#logging 64.128.20.12
        Godzilla-ABR(config)#logging trap informational
        Godzilla-ABR(config)#logging source-interface Loopback 0
        Godzilla-ABR(config)#logging facility local2

Cisco 3600 Series Routers (with PCMCIA cards) Upgrade Procedure

2011-02-11T16:02:00.003+05:30

Cisco 3600 Series Routers (with PCMCIA cards) Upgrade Procedure

    Establish a console session to the router
    Verify the amount of free space on the Flash memory card (PCMCIA slot)
    Verify that the TFTP server has IP connectivity to the router
    Copy the new image into the Flash memory card through the TFTP server
    Set boot statements to load the new image upon startup
    Reboot the router to load the new image
    Verify the upgrade

Step 1: Establish a console session to the router

See Establish a console session to the router for more information.

Note: Once connected to the router through the console port, if you get a ">" or "rommon >" prompt, your router is in ROM monitor (ROMmon) mode. If the router is showing the "router (boot)>" prompt, then the router is in boot mode. See booting problems for steps to handle either of these situations.

Step 2: Verify the amount of free space on the Flash memory card (PCMCIA slot)

At this point, you need to verify that you have enough space in the Flash memory card to copy the new image. If there is not enough memory, you need to delete some files to make enough space. In some situations, if the image is very large, you may need to delete the current image in the Flash memory card.

To determine the amount of free space, and to show files currently located in slot0: or slot1:, issue the dir{device:} command.

    3600#dir slot1:
    Directory of slot1:/

      1 -rw-     2779832    c3640-i-mz.113-11c.bin
      2 -rw-     3748760    c3640-i-mz.120-22.bin

Verify that the name and the file size are correct.

If you find that there is not enough space, you can delete the file. The delete{device:}[filename] command deletes the file.

    3600#delete slot1:
    Delete filename []? c3640-i-mz.113-11c.bin
    Delete slot1:c3640-i-mz.113-11c.bin? [confirm]y

Note: Do not reload or powercycle the router if there is not a valid image in the Flash; this causes the router to boot into rommon or bootmode.

Step 3: Verify that the TFTP server has IP connectivity to the router

The TFTP server must have a network connection to the router and must be able to ping the IP address of the router targeted for a TFTP software upgrade. To achieve this, the router interface and the TFTP server must have:

    an IP address in the same range, or

    a default gateway configured

To verify this, check the IP address of the TFTP server.

Step 4: Copy the new image into the Flash memory card through the TFTP server

Now that you have IP connectivity and can ping between the computer acting as a TFTP server and the router, you can copy the image into the right slot.

Note: Before copying, make sure you have started the TFTP server software on your PC and that you have the filename mentioned in the TFTP server root directory. We recommend that you keep a backup of the router/access server configuration before upgrading. The upgrade itself does not affect the configuration (which is stored in nonvolatile RAM -NVRAM). However, this may happen if the right steps are not followed properly.

For RCP applications, substitute RCP for every occurrence of TFTP. For example, use the copy rcp {device:} command instead of the copy tftp {device:} command.

If necessary, you can copy an image from one device to another.

    3600#copy tftp: slot1:
    Address or name of remote host []? 171.68.173.10
    Source filename []? c3640-i-mz.122-7b.bin
    Destination filename [c3640-i-mz.122-7b.bin]?
    Accessing tftp://171.68.173.10/c3640-i-mz.122-7b.bin...
    Erase slot1: before copying? [confirm]n !--- Here you are specifying "n"
                               !--- because there is enough memory available.
    Loading c3640-i-mz.122-7b.bin from 171.68.173.10 (via Ethernet1/0):
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!
    [OK - 5996844/11993088 bytes]

    Verifying checksum... OK (0x13F0)
    5996844 bytes copied in 67.708 secs (89505 bytes/sec)
    3600#

Use the dir slot1: command to check whether the image has been copied to slot1. Below, you can see that the new image c3640-i-mz.122-7b.bin has been copied on the PCMCIA slot1:

    3600#dir slot1:
    Directory of slot1:/

      2 -rw-     3748760    c3640-i-mz.120-22.bin
      3 -rw-     5996844    c3640-i-mz.122-7b.bin

Step 5: Set boot statements to load the new image upon startup

After copying the image through TFTP, you may need to tell the router which image to load upon boot up.

Checking Current Boot Statements

At this point, the new image is now in the slot1. You need to set the router to boot the new image. By default, the router boots the first available image (the default is enabled when there are no boot statements in the configuration).

    3600#show running-config
    Building configuration...

    Current configuration:
    !
    version 12.0
    service timestamps debug uptime
    service timestamps log uptime
    no service password-encryption
    !
    hostname 3600
    !
    boot system flash slot1:c3640-i-mz.120-22.bin
    !
    ip subnet-zero
    !

The commands appear at the begginning of the configuration. In our example above, it shows the router has a boot system command configured as boot system flash slot1:c3640-i-mz.120-22.bin.

If you have boot system command entries in your configuration, you need to remove them from the configuration. For more information on removing boot entries, refer to the next section.

Removing Previous Boot Statements

To remove the commands, enter into configuration terminal mode. From the configuration mode, you can negate any command by typing "no" in front of each boot statement. The following example illustrates the removal of an existing boot statement.

    3600#configure terminal
    Enter configuration commands, one per line. End with CNTL/Z.
    3600(config)#no boot system flash slot1:c3640-i-mz.120-22.bin
    3600(config)#^Z
    3600#

The statement "no boot system flash slot1:c3640-i-mz.120-22.bin" is removed from the configuration. Verify that the command has been removed by issuing the show running-config command.

Setting New Boot Statements

Now set the router to boot the new image. Issue the following command to set the boot system parameter:

    boot system flash slot#:{imagename} (imagename = name of the new Cisco IOS software image)

    3600#configure terminal
    Enter configuration commands, one per line. End with CNTL/Z.
    3600(config)#boot system flash slot1:c3640-i-mz.122-7b.bin
    3600(config)#^Z
    3600#write memory
    3d01h: %SYS-5-CONFIG_I: Configured from console by vty0
    Building configuration...
    3600#

Be sure to verify that you are using config-register 0x2102 by issuing the show version command. If it is set up differently, you can change it by issuing the following command in configuration mode:

    3600#configure terminal
    Enter configuration commands, one per line. End with CNTL/Z.
    3600(config)#config-register 0x2102
    3600(config)#^Z

After changing the config-register, the change takes place at the next reload.

Step 6: Reboot the router to load the new image

For the router to run the new Cisco IOS software image, you need to reload the router. Make sure you have saved the configuration by issuing the copy running-config starting-config or write memory commands.

    3600#write memory
    3d01h: %SYS-5-CONFIG_I: Configured from console by vty0 (127.0.0.11)
    Building configuration...
    3600#reload

Step 7: Verify the upgrade

After the router comes up, make sure you are currently running the new version of code, by issuing the show version command.

    3640#show version
    Cisco Internetwork Operating System Software
    IOS (tm) 3600 Software (C3640-I-M), Version 12.2(7b), RELEASE SOFTWARE (fc1)
    Copyright (c) 1986-2002 by cisco Systems, Inc.
    Compiled Mon 04-Mar-02 20:23 by pwade
    Image text-base: 0x600089A8, data-base: 0x60A6A000

    ROM: System Bootstrap, Version 11.1(19)AA, EARLY DEPLOYMENT RELEASE SOFTWARE (f)

    Router uptime is 2 minutes
    System returned to ROM by reload
    System image file is "slot1:c3640-i-mz.122-7b.bin"

    cisco 3640 (R4700) processor (revision 0x00) with 59392K/6144K bytes of memory.

    Processor board ID 10524422
    R4700 CPU at 100Mhz, Implementation 33, Rev 1.0
    Bridging software.
    X.25 software, Version 3.0.0.
    4 Ethernet/IEEE 802.3 interface(s)
    DRAM configuration is 64 bits wide with parity disabled.
    125K bytes of non-volatile configuration memory.
    4096K bytes of processor board System flash (Read/Write)
    20480K bytes of processor board PCMCIA Slot0 flash (Read/Write)
    20480K bytes of processor board PCMCIA Slot1 flash (Read/Write)

    Configuration register is 0x2102

Verify that the version 12.2(7b) is correct and the config-register is set to 0x2102.
Page last updated on: 05/19/2007 09:53:42
All contents are Copyright © 1992–2007 Cisco Systems, Inc. All rights reserved.

CISCO IOS Software Installation and Upgrade Procedure

2011-02-10T15:58:00.000+05:30

OS Software Installation and Upgrade Procedure

This procedure applies to the following Cisco products:

    Cisco 10001
    Cisco 14001
    Cisco 1600-R
    Cisco 1700
    Cisco 2600
    Cisco 3600

    Cisco 3700
    Cisco 4000
    Cisco 4500
    Cisco 4700
    Cisco AS53001
    Cisco MC3810

Introduction

This document explains the procedure for upgrading a Cisco IOS® Software image on Access router platforms. The examples provided from the 2600 and 3600 Series Routers also apply to the list of router platforms mentioned below. The Cisco IOS software file names may vary depending on the Cisco IOS software version, feature set, and platform.The following Cisco series routers are addressed in this document:

    Cisco 1000 Series Routers
    Cisco 1400Series Routers
    Cisco 1600-R Series Routers
    Cisco 1700 Series Routers
    Cisco 2600 Series Routers
    Cisco 3600 Series Routers
    Cisco 3700 Series Routers
    Cisco 4000 Series Routers
    Cisco 4700 Series Routers
    Cisco AS5300 Series Routers
    Cisco MC3810 Series Routers

The information in this document is based on Cisco IOS Software Release 12.0 or later.

The Field Engineer must receive permission from Cisco VISE that a software image upgrade is required, BEFORE carrying out any of these procedures.
Before You Begin

Step 1: Install a TFTP Server
A Trival File Transfer Protocol (TFTP) server or a Remote Copy Protocol (RCP) server application must be installed on a TCP/IP-ready workstation or PC. Once the application is installed, a minimal level of configuration must be performed.

    Note: Cisco no longer supply or support their own TFTP Server application, however searching within your favourite search engine for "TFTP Server" will locate a third party TFTP application for you. Alternatively, you may find Cisco's unsupported TFTP Server application on the COMPASS CD.

    First, the TFTP application must be configured to operate as a TFTP server as opposed to a TFTP client.

    The outbound file directory must be specified. This is the directory in which the Cisco IOS Software images are stored. Most TFTP applications provide a set-up routine to assist in these configuration tasks.

Step 2: Request which IOS Software Image is to be used.
The Field Engineer must ask the VISE engineer or the customer, which image is to be upgraded. It is not the responsibility of the Field Engineer to recommend software image versions. The software image may be provided by the customer, and so the Field Engineer must ask the Cisco VISE engineer for directions.

Step 3: Download the Cisco IOS Software Image
Download the Cisco IOS Software image into your workstation or PC from the Cisco website (http://www.cisco.com).
Software Installation and Upgrade Procedures

    Routers with Internal Flash (for example, 2600 Series Routers)
    Routers with PCMCIA Flash cards (for example, 3600 Series Routers)

Cisco 2600 Series Routers Upgrade Procedure

    Establish a console session to the router
    Verify that the TFTP server has IP connectivity to the router
    Copy the new image into the Flash memory of the 2600 Series Router through the TFTP server

Step 1: Establish a console session to the router

Even if it is possible to connect to the router through a telnet session, it is strongly recommended to be directly connected to the router using the console port. The reason is that if something goes wrong during the upgrade, it might be necessary to be physically located next to the router to power-cycle it. Moreover, the telnet connection will be lost while the router is rebooting during the upgrade procedure.

A rolled cable (usually a flat black cable) is used to connect the console port of the router to one of the COM ports of the PC.

Once the PC is connected to the console port of the router, you need to open Hyperterminal on the PC, and use the following settings:

         Speed 9600 bits per second

         8 databits

         0 parity bits

         1 stop bit

         No Flow Control

Note: If you are getting any garbage characters in the hyperterminal session, this means that you have not set the hyperterminal properties properly, or the config-register of the router is set to a non-standard value for which the console connection speed is higher than 9600 bps. Check the value of the config-register using the show version command (shown in the last line of the output) and ensure it is set to 0x2102 or 0x102. It is necessary to reload the router for a configuration register change to take effect. Once you are sure the console speed is set to 9600 bps on the router side, you should check the hyperterminal properties as above .

Booting Problems

Once you are connected to the console port of the router, you might notice that the router is either in ROMmon or Boot mode. These two modes are used for recovery and/or diagnostic procedures. If you do not see the usual router prompt, you should follow the recommendations below to proceed with the upgrade procedure installation.

    Router boots in rommon mode, and the following message appears when you issue dir flash: command.

        rommon 1 > dir flash:
        device does not contain a valid magic number
        dir: cannot open device "flash:"
        rommon 2 >

    When you see the above error message, it means the Flash is empty or the filesystem is corrupted. A Xmodem console download procedure using ROMmon may then be necessary.
    Router boots in boot mode, with the following messages on the console:

        router(boot)>
        device does not contain a valid magic number
        boot: cannot open "flash:"
        boot: cannot determine first file name on device "flash:"

    When you get the above error messages on the console output, it means the Flash is empty or the file system is corrupted. Copy a valid image on the Flash by following the procedures provided in this document.

Step 2: Verify that the TFTP server has IP connectivity to the router

The TFTP server must have a network connection to the router, and must be able to ping the IP address of the router targeted for a TFTP software upgrade. To achieve this, the router interface and the TFTP server must have:

        an IP address in the same range, or

        a default gateway configured.

To verify this, check the IP address of the TFTP server.
Step 3: Copy the new image into the Flash memory of the 2600 Series Router through the TFTP server

    Now that you have IP connectivity and can ping between the computer acting as a TFTP server and the router, you can copy the Cisco IOS Software image into the Flash.

    Note: Before copying, make sure you have started the TFTP server software on your PC and that you have the filename mentioned in the TFTP server root directory. We recommend that you keep a backup of the router/access server configuration before upgrading. The upgrade itself does not affect the configuration (which is stored in nonvolatile RAM (NVRAM). However, this might happen if the right steps are not followed properly.

    For RCP applications, substitute RCP for every occurrence of TFTP. For example, use the copy rcp flash command instead of the copy tftp flash command.

        2600> enable
        Password:xxxxx
        2600#
        2600# copy tftp flash

    If necessary, you can copy an image from one device to another.
    Specify the IP address of the TFTP server.

    When prompted, enter the IP address of the TFTP server as in the following example:

        Address or name of remote host []? 10.10.10.2

    Specify the filename of the new Cisco IOS Software image.

    When prompted, enter the filename of the Cisco IOS Software image to be installed, as in the following example:

        Source filename []? c2600-i-mz.121-14.bin

    Note: The filename is case sensitive, so be sure to enter it correctly.
    Specify the destination filename.

    This is the name the new software image will have when it is loaded onto the router. The image can be named anything, but common practice is to enter the same image filename.

        Destination filename []? c2600-i-mz.121-14.bin

    Note: If you see the below error message:

    %Error copying tftp://10.10.10.2/c2600-i-mz.121-14.bin
    (Not enough space on device)

    This indicates that there is not enough room available in Flash to copy the image. You need to erase a file(s) before copying the new image from the TFTP server.
    Upgrade the new image from a TFTP server

    2610#copy tftp flash
    Address or name of remote host []? 10.10.10.2
    Source filename []? c2600-i-mz.121-14.bin
    Destination filename [c2600-i-mz.121-14.bin]?y
    Accessing tftp://10.10.10.2/c2600-i-mz.121-14.bin...
    Erase flash: before copying? [confirm]y !---If there is not enough
                                     !--- memory available, erase the Flash
    Erasing the flash filesystem will remove all files! Continue? [confirm]y
    Erasing device... eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee
    eeeeeeeeee ...erased
    Erase of flash: complete
    Loading c2600-i-mz.121-14.bin from 10.10.10.2 (via Ethernet0/0): !!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    [OK - 4501480/9001984 bytes]

    Verifying checksum... OK (0xAC8A)
    4501480 bytes copied in 56.88 secs (80383 bytes/sec)

    The copying process takes several minutes; the time differs from network to network. During the copy process, messages are displayed to indicate which file has been accessed.

    The exclamation point "!" indicates that the copy process is taking place. Each exclamation point indicates that ten packets have been transferred successfully. A checksum verification of the image occurs after the image is written to Flash memory.

After you have upgraded the Flash, you need to reload the router using the reload command.

Before you reload the router, you need to check two things:

    The value of the config-register - You can check this using the show version command. The value is shown in the last line of the show version output. It should be set to 0x2102.

        2610#configure terminal
        Enter configuration commands, one per line. End with CNTL/Z.
        2610(config)#config-register 0x2102
        2610(config)#^Z

    The other files on the Flash - If the first file in the Flash is not the Cisco IOS Software image, but a configuration file or something else, then you need to configure a boot system statement in order to boot the specified image. Otherwise, the router will try to boot with the configuration file or the first file in the Flash; this will not work. If there is only one file in the Flash which is the Cisco IOS Software image, then this step is not necessary.

        2610#configure terminal
        Enter configuration commands, one per line. End with CNTL/Z.
        2610(config)#no boot system
        2610(config)#boot system flash c2600-i-mz.121-14.bin
        2610(config)#^Z

Note: If you type the reload command, the router asks you if you want to save the configuration. You should be very cautious here. The reason is that if the router is in boot mode for instance, it is a subset of the full Cisco IOS software which is running and there is no routing functionality. Therefore, all the routing configuration is gone in the running configuration and if you save the configuration at this time, then you erase the good startup-configuration in NVRAM and replace it by the incomplete running-configuration. Save the configuration only if you are sure that you have the full configuration in the output of show run. It is NOT necessary to save the configuration to take into account the new config-register if this one has been changed previously. That is done automatically.

    2610#reload

    System configuration has been modified. Save? [yes/no]: y
    Building configuration...
    [OK]
    Proceed with reload? [confirm]y

Verify that the router is running with the proper image. After the reload is complete, the router should be running the desired Cisco IOS Software image. Use the show version command to verify.

    2610#show version
    00:22:25: %SYS-5-CONFIG_I: Configured from console by console
    Cisco Internetwork Operating System Software
    IOS (tm) C2600 Software (C2600-I-M), Version 12.1(14), RELEASE SOFTWARE (fc1)
    Copyright (c) 1986-2002 by cisco Systems, Inc.
    Compiled Mon 25-Mar-02 20:33 by kellythw
    Image text-base: 0x80008088, data-base: 0x80828788

    ROM: System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1)

    2610 uptime is 22 minutes
    System returned to ROM by reload
    System image file is "flash:c2600-i-mz.121-14.bin"

What is EndPoint Connect

2011-02-09T15:42:00.000+05:30

Check Point`s Endpoint Connect software provides a number of client side security based features such as Anti-virus/Anti-spyware. Firewall/Email Protection, Program Control and Remote Access VPN. This document will only details and discuss the Remote Access VPN section of the Endpoint Connect Software. Note : This document will refer to the Endpoint Connect Remote Access VPN as just Endpoint Connect.

Endpoint Connect is built into the software for mangers and gateways running R70 and above. For R65 gateways that require Endpoint Connect a few additional configuration steps are required which are included within this document.

Please note : This testing and documentation is based on the Endpoint Connect R73 Client.

Advantages

Lightweight Client if you are using a single site or single entry point setup.
Can be installed onto Windows 7 64-bit.

Disadvantages

An additional SNX (SSL Network Extender License) is required due to that in which it authenticates across HTTPS (vistor mode)
Link Selection is disabled (this is due to sites being defined via a single IP address).
MEP configurations can only be achieved by using Geo-Cluster DNS name resolution.

Installation on an R65 Gateway

Upgrading a R65 Gateway to R65 Endpoint Connect:

Ensure that you are running HFA40 or higher.
Ensure that you are managing the gateway with R70 or higher.

You will now be able to configure the required Endpoint Connect settings via the Smart Dashboard.

Configuration

To enable Endpoint Connect configure/enable the following settings :

Under the Check Point Gateway Object

1. Enable VPN

2. Create a VPN domain

3. Enable NAT-T

4. Enable Visitor Mode :

5. Enable Office mode

6. Enable SSL Network Extender

7. Endpoint connect doesn`t support DES. If this is set please re-configure.

Additional Settings

Further settings can be set within the Global Properties:

Troubleshooting

Issue : Authenticating failed: GEN_application_error(0)

You may receive this error when trying to login.

This is down to your client being unable to authenticate with the VPN gateway using HTTPS. This can be caused by the following:

1. Port 443/tcp on the firewall is assigned to a web management GUI (WEBUI/Voyuger) instead of VPND.
2. Port 443/tcp is not listening due to no SNX (SSL Network Extender) License being present.

Issue : Failed to download topology

Endpoint Connect fails to connect to NGX R65 Security Gateways that are managed by an R70 Security Management server with error: "failed to download topology".

To resolve this run through the following steps :
1. On the R70 Security Management server, edit the file:

1./opt/CPNGXCMP-R70/lib/vpn_table.def

2. Scroll down to the section that starts with:

1./* Slim Client gateway tables */

3. Add the entry for the ccc_sessions table below it:

1.ccc_sessions = dynamic expires 900 keep sync kbuf 1;

4. After adding this entry to the vpn_table.def file, open SmartDashboard and re-install policy to the NGX R65 Security Gateway(s).

How to troubleshoot SSHd problems

2011-02-08T15:31:00.000+05:30

1. Is sshd wrapped with tcp-wrappers? Assuming the sshd daemon is invoked from inetd, your /etc/hosts.allow should list acceptable addresses from which connections are allowed.

2. Is sshd running on the standard port 22 or another? If running on a non-standard
port, make sure that your ssh client is specifying the target port.

3. Which sshd version is running? There are many problems with sshd2 used in
conjunction with tcp-wrappers. sshd1 runs with fewer difficulties wrapped. Also, the
ssh1 client has difficulty connecting to a sshd2 server.

4. Make sure that your /etc/services reflects the ssh service on the designated
port! /etc/services and tcp-wrappers work together when invoking the sshd daemon.

Example: sshd1 running on port 700 should have an entry in /etc/services as such:

ssh1        700/tcp    #ssh1
ssh1        700/udp

While in inetd.conf, the invoking line should read:

ssh1    stream tcp     nowait root    /usr/sbin/tcpd /usr/local/sbin/sshd1 -i -p 700

How to perform a clean installation of firewall-1 on a Nokia Platform

2011-02-07T15:30:00.000+05:30

   1) In the Voyager interface, use the Manage Installed Packages to turn off the package, then reboot
    2)In the Voyager interface, on the Manage Installed Packages page, there is a link to a page to delete packages. Follow this link and delete the package
    3)Use a console connection to delete any remaining log files. For example, FireWall-1 maintains its logs in the /var/fw/log directory. Simply issue an
    # rm /var/fw/log/*
    4)command to remove all log files.
    Use the "newpkg" command to reinstall the package.

How to switch logs on a Nokia system

2011-02-06T15:29:00.000+05:30

Here below is an example of log rotation for IPSO

#!/bin/sh
#
# Set environment variables
sh /var/etc/rcm_profile
#
cd /var/fw/log
#
# Switch CheckPoint log into dated file for saving
# Surpress resolving of IP/names
PERIOD=`date "+%d%m%y"`
$FWDIR/bin/fw logswitch $PERIOD 2> /dev/null
#
# output logfile to comma seperated variable file
$FWDIR/bin/fw logexport -d , -i $PERIOD.log -o yesterday -n 2> /dev/null
#
# search for all dropped packets
ATTACK=$PERIOD.attack
grep "drop" yesterday >> $ATTACK
#
# uuencoded files will be interpreted as an attachment by most mail clients
uuencode $ATTACK $PERIOD.csv > $PERIOD.csv
#
# mail attack to system administrator
mail -s "Fire Log Switch" fwadmin@corp.com < $PERIOD.csv

How to perform a local simulation for a remote module in order to configure it before shipment

2011-02-05T15:28:00.000+05:30

Simulation is usefull when you are preparing equipments for remote locations. From the management module you can prepare the policy. But then you will need to download it on the remote module. If you can simulate the remote network locally you will find it easier to prepare and troubleshoot configurations.

External interface is ethernet and will be connected to a router

For the simulation you will need to change the configuration of your Internet router. You will assign a secondary interface to the router's ethernet interface. This address is the one of the remote site Internet router.

!
interface Ethernet0
ip address 192.168.10.253 255.255.255.0 secondary
ip address 194.191.78.36 255.255.255.224

By extending the number of secondary addresses you can simulate several remote locations at the same time.

External interface is on serial Interface

You will need to simulate the serial connection locally. That kind of serial connection can be of type Cisco HDLC, Frame Relay or PPP. For the simulation you will need to use a local cisco router with an available serial port

If your external interface is serial 0 on a cisco router, you will configure it in DCE mode. For this use Cisco DCE cable. The fact to have a DCE cable put the cisco serial interface in a DCE mode. Then configure the serial interface to give a clock rate to the connection. The NAP cannot work in a DCE mode itself. The nokia V.35/X.21 cable will be connected to the cisco DCE cable, and bothe connected to their respectiv serial ports. The IP address given to the serial interface of the router is the one of the remote site Internet router.

!
interface Serial0
ip address 194.193.192.254 255.255.255.252
clockrate 64000

How to SYNC on Solaris 2.6/cluster patches and FW1-v3.0b 3064 patch

2011-02-04T15:26:00.000+05:30

I want to pass on some info about SYNC on Solaris 2.6/cluster patches
and FW1-v3.0b 3064 patch. This is undocumented but a must!

This seems to be crucial on systems where the control module and pfm
are not on the same system...

Our config has three systems. Non-vpn and no NAT just packet
filtering...

control
pfm
pfm

Creating /etc/fw/sync.conf and putkey on the pfm modules is not enough!

Modify the file below table.def and comment out the "#define sync"
command.
Then recompile and download your rule sets to the pfm modules...

This seems to be crucial on systems where the control module and pfm
are not on the same system...so if you have two systems

control/pfm
pfm

you will need to do this table.def mod...

$ more /etc/fw/lib/table.def
#ifndef __table_def__
#define __table_def__

//
// (c) Copyright 1993-1997 Check Point Software Technologies Ltd.
// All rights reserved.
//
// This is proprietary information of Check Point Software Technologies
// Ltd., which is provided for informational purposes only and for use
// solely in conjunction with the authorized use of Check Point Software
// Technologies Ltd. products. The viewing and use of this information
is
// subject, to the extent appropriate, to the terms and conditions of
the
// license agreement that authorizes the use of the relevant product.
//
//
// $Header: /fw/cvs/fw-1/fwlib/table.def,v 1.42.2.20 1998/01/01 08:09:47
ofer Ex
p $
//

// The following #define should be removed to enable FW-1
synchronization
//#define sync

What should I be aware of when upgrading from version 4.0 to 2000

2011-02-03T15:24:00.000+05:30

When upgrading from Version 4.0 to Check Point 2000, the Management Station checkbox in the Workstation Properties window will be checked only for the Management Station being upgraded. All other gateways defined on the Management Station will have the Management Station checkbox unchecked by default.

When you upgrade, the $FWDIR/lib/control.map file is replaced. If you have made any changes
to control.map, they will not be preserved in the new control.map, so you must make the same changes in the new version.

Session Authentication Agent — Installing the Version Check Point 2000 Session Authentication Agent does not overwrite the Version 4.0 Session Authentication Agent. You must uninstall the Version 4.0 Session Authentication Agent (using the Control Panel’s Add/Remove Programs applet) and then install the Version Check Point 2000 Session Authentication Agent. Note that the Session Authentication Agent is shut down as part of the uninstallation process, so you must manually restart it (or reboot).

VPN-1/FireWall-1 HP Open View Extension supports Solaris and HP-UX with HP OV version 4.x. HP-UX with HP OV versions 5.x and 6.x is not supported.

Synchronized VPN/FireWall Modules —

Synchronized VPN/FireWall Modules must be managed by the same Management Module.
SecuRemote connections can be synchronized.

Enable Exportable SKIP: If Enable Exportable SKIP (in the Encryption tab of the Properties Setup window) is checked, then if an internal VPN/FireWall Module has Local selected in the Key Manager tab of its SKIP Properties window, you must generate an exportable DH key for it (in its SKIP Properties window). Selective SKIP configuration (that is, some SKIP communications use exportable DH keys and some use non-exportable DH keys) can only be managed in the Rule Base.

Control channel encryption key If you change a Management Server’s control channel encryption key (for example, by using the fw putkey command), then you must restart any ELA proxy that is running on that Management Server. See "Uninstalling VPN-1/FireWall-1" on page 6 for information on how to stop the ELA proxy.

In a High Availability configuration, each VPN/FireWall Module’s license should be issued to its hostid or other unique ("heartbeat" or "configuration IP" interface), since any of the other interfaces can fail.

Do not rename a network object group that is used in the definition of a Logical Server.

Unix platforms — when remote modules are configured using the cpconfig program, if you try to add a new remote module you will not be able to see the list of previously configured modules. However, these modules are still defined and there is no need to reconfigure them. If you do reconfigure them, you must run fw putkey command again for each module.

backward compatibility feature: If you are using the VPN-1/FireWall-1 Check Point 2000 backward compatibility feature to manage VPN-1/FireWall-1 Version 4.0 SP1 or SP2 FireWall Modules and you use Client Authentication rules, the following workaround must be applied:

a. Edit the file $FWDIR/lib/base.def (where FWDIR specifies the directory in which the VPN-1/FireWall-1 Version 4.0 software or VPN-1/FireWall-1 Check Point 2000 backward compatibility module is installed), replacing the lines:

define pm_prog [(UDPDATA+40+rpc_cred_len+rpc_ver_len),b]
#define pm_prot [(UDPDATA+48+rpc_cred_len+rpc_ver_len),b]

by the lines:

#define pm_prog [68, b]
#define pm_prot [68+8, b]

b. Reinstall the Security Policy on the VPN/FireWall Module.

fw expdate command — This command changes the expiration date of the users in the VPN-1/FireWall-1 users database. Any open GUI Client should be closed before running the command, otherwise the GUI will override the changes made by the command. On NT only, if fw expdate is executed while the Management Server was running, the Management Server should be restarted in order for the command to take effect.

What's new in Checkpoint 2000 version 4.1

2011-02-02T15:20:00.000+05:30

1)High Availability — Two or more VPN/FireWall Modules can be configured so that each one acts as a backup to the others. Additionally, the VPN/FireWall Modules can be synchronized so that connections will not be lost when a VPN/FireWall

    2)Desktop Policy Verification — Policy Servers now maintain open connections with SecureClients and are immediately notified when a SecureClient is re-configured. Both Session Authentication and Client Encrypt rules can be applied only when a SecureClient is properly configured.
    3)SecuRemote
        i)The Secure Domain Logon feature enables Windows NT SecuRemote users to securely log on to a domain controller using both LAN and dial-up connections.
        ii)SecuRemote Clients can be configured to automatically update a site’s topology either when starting SecuRemote or just before the key exchange with that site.
        iii)SecuRemote Clients can be configured to automatically check the availability of a newer version of SecuRemote Client software before connecting to a site.
        iv)SecuRemote Clients can be pre-configured with a partial site topology to reduce exposure of sensitive network information. The first time the SecuRemote Client connects to a site, the user will be given the opportunity to download the complete topology over the authenticated connection.
        v)A smaller SecuRemote (Thin Client) Client installation file set (without the certificate functionality) is available ("Thin Client")

4)Hybrid Mode — VPN-1/FireWall-1 Hybrid Mode authentication extends IKE, enabling it to use any authentication method supported by VPN-1/FireWall-1.

5)Intel RNG — VPN-1/FireWall-1 and SecuRemote support the Intel RNG (pseudo random number generator) hardware for Windows NT 4.0, Windows 98, Windows 95 (OSR2 or later or Windows 95 with IE 3.02 or later).

6)Remote Licensing Management — This feature enables the system administrator to manage VPN-1/FireWall-1 licenses on remote VPN/FireWall Modules from the Management Station.

7)Malicious Activity Detection — VPN-1/FireWall-1’s Malicious Activity Detection (MAD) feature provides a mechanism for detecting intrusion attempts or other suspicious events and notifying the system administrator by an alert or email message.

How to debug IKE encryption problems

2011-02-01T15:19:00.000+05:30

If the IKE tunnel cannot be established have a look in the FireWall-1 logviewer. 
If the logviewer is not helpful, use the advanced IKE debugging option in FireWall-1:

Set the appropriate debug variable:

setenv FWISAKMP_DEBUG=1 (for FireWall-1 4.0)
setenv FWIKE_DEBUG=1 (for FireWall-1 4.1)

(On NT firewalls, use 'set' instead of setenv)

Rerun the FireWall-1 daemon (do: 'fwstop' and 'fwstart').

All subsequent IKE negotiations will be dumped in the file ISAKMP.log in FireWall-1 4.0 
or IKE.elg in FireWall-1 4.1 (both in $FWDIR/log.

An advanced IKE user can use this file to help detect IKE problems. This file should be sent whenever contacting Check Point

How to debug in kernel mode

2011-01-31T15:14:00.000+05:30

Here is a list of the FireWall-1 Kernel Debug Options

The FireWall-1 kernel module may be put into debug mode with the following command:

nokia_fw[admin]# fw ctl debug

The following are valid debug-options

0 - turn debugging off (fw ctl debug 0)

all (DO NOT USE)

all debug features

The output is excessive, making the system unresponsive. Often, only a cold reboot will restore

access to the system.

cookie - "cookie" (abstract data type of representing packets) related messages

crypt - encryption related information

domain - domain queries

driver - device driver operations

filter - filter loading and unloading

hold - packets held and released (related, among other things, to encryption)

if - interface binding

install - driver installation

ioctl - ioctl commands from the daemon

kbuf - kernel buffers (buffers allocated by the kernel for encryption purposes)

ld - operations on dynamic tables

log - log messages sent to the daemon

machine - virtual machine operation (the virtual machine which executes the INSPECT code compiled from .pf files)

memory - memory usage

misc - all others

packet - packet handling

profile - performance monitoring

q - streams and queues operations

synatk - operations related to syn attack protection

tcpseq - TCP sequence numbers changed

winnt - windows NT specific operations

xlate - address translation for new connections

xltrc - address translation for telnet and ftp

Redirecting Output to a File

The information is sent by default to the console. It can also be sent to a kernel buffer. This is necessary because the output often is to great to process real-time. Here are some examples of how to redirect the output to a file for examination later:

tla[admin]# fw ctl debug -buf [1024]

The default size is 1024 Kbytes. At this point, you have only enabled the redirection of stdout to a buffer, but the next step is retrieve the contents of this buffer. This is down with the following command

tla[admin]# fw ctl kdebug -f

This will now dump the buffer to stdout, but this is similar to before. The following are the steps to redirect the buffer to a file:

tla[admin]# fw ctl debug -buf

tla[admin]# fw ctl debug

tla[admin]# fw ctl kdebug -f > filespec

tla[admin]# tail -f filespec

When you have gathered enough information, press to stop the output to the file. You will have to issue `fw ctl debug 0` in order to actually restore the kernel to normal operation.

Debugging HTTP Security Server

We used these below when we debugged HTTP Security Server problems. One of the vulnerabilities in the HTTP Security Server is that it will block all network connections it is checking if a URL is not resolvable. This is serious in that a DOS of DNS to your firewall can cripple it. For example, if you create a URI resource object to explicitly block HTTP to www.somedomain.com and this does not resolve to an IP address, then all HTTP that is subject to Content Security will be blocked.

tla[admin]# setenv HTTP_DEBUG 1

tla[admin]# setenv FWAHTTPD_DEBUG 1

tla[admin]# setenv FW_DEBUG_EVENT 1

tla[admin]# setenv FWT_DEBUG all

tla[admin]# fw kill fwd; fwd `cat $FWDIR/conf/masters`

The later versions of FireWall-1 enable SMTP_DEBUG and MDQ_DEBUG in another way. These variables should be defined in the $FWDIR/conf/smtp.conf file and then the fwd process should be killed using the –USR1 switch, when this is done, the debugging information will start immediately without the need to restart the daemons.

To remove these environmental variables, execute unsetenv env_variable The output is directed to

$FWDIR/log/ahttpd.log

. This particular problem produced numerous duplicate entries in the log file that were of this form:

[port 1023:Connection refused Thu Aug 5 23:42:57 1999] [pid=764] Failed to connect to server for side = 1 at [Thu Aug 5 23:42:57 1999] [pid=764] write_from_queue : side = 1, clnt = 0,

buf = (

:data (

:resolved_name (www.unresolveable.com) :type (dns_resolve_byname)

) :chain_name (resolver_list) :call_function (cached_resolver_gethostbyname) :return_function () :serial_number_resolver_list0(2) :current_side(1)

)

The speculation was that FireWall-1 was attempting, over and over, to resolve to an IP address. It was verified that this particular destination was not resolvable. Once the rule using a URI resource object of type Wildcard, which explicitly specified this site, was removed, everything was restored. This bug was verified to be in 4.0 SP4 for Solaris on Aug 6th, 1999. The immediate solution is to not use a URI resource object of type Wildcard to drop or reject HTTP, but to only Accept HTTP.

Debugging SMTP Security Server

We use the following to debug SMTP Security Server. At this point in time, we do not have a good definition of what these variables do with the exception that they all increase the output of debug information. The variables with MDQ put the spool dequeuer process into debug mode. The SMTP_DEBUG environmental variable is shown with three levels. Choose one. FWT_DEBUG is associated with the fwd daemon. OPSEC_DEBUG_LEVEL

tla[admin]# setenv MDQ_DEBUG 1

tla[admin]# setenv FWMDQ_DEBUG 1

tla[admin]# setenv SMTP_DEBUG [1 2 3]

tla[admin]# setenv FWD_DEBUG cvp

tla[admin]# setenv FWT_DEBUG cvp

tla[admin]# setenv OPSEC_DEBUG_LEVEL [1 2 3]

tla[admin]# fw kill fwd;fwd `cat $FWDIR/conf/masters`

To remove these environmental variables, execute unsetenv env_variable.

Debugging SecuRemote/Encapsulation problem.

tla[admin]# fw ctl debug cookie

tla[admin]# fw ctl debug -buf 100

tla[admin]# fw ctl kdebug -f filespec

tla[admin]# tail -f filespec

We should see messages of the form "cookie data could not XXX". There will be messages that specifically complain about fragmentation.

(SecuRemote may be placed into debug mode by creating the file, fwenc.log, at the root of your system drive. For example, this might be c:\fwenc.log)

Debugging the in.pingd daemon

What are the switches to fwd

2011-01-30T15:10:00.000+05:30

Here are the current list of switches and what they do:

-u : run a SecuRemote server.
-n : management only (no module).
-s : no module (Supposedly doesn't do fw stat?)
-l : no logs.
-A : no alerts.
-d : debug
-D : log debugging

fwd by default will use -u. fwstart calls fwd -n on pure management consoles (i.e. one that don't contain a firewall module). The debug flags sends messages to stderr (or fwd.log on FireWall-1 4.x) and run the process in the foreground instead of background.

How to obtain debug information from the daemons

2011-01-29T15:08:00.000+05:30

You will need to kill the fwd daemon and restart it with a debug option
UNIX:

1. Go to $FWDIR/bin
2. Kill the relevant daemon with fw kill {fwd | fwm}
3. Restart the daemon with debug messages. Use 'fwd -d' or 'fwm -d'

NT:

1. Issue fwstop.
2. Enter %SystemRoot%\fw\bin and issue 'fw d -d' or 'fw m -d'.
3. Issue fwstart.

How to monitor what hapens on a management system, or on a system having an evaluation license

2011-01-28T15:06:00.000+05:30

fw monitor command allows you to monitor network traffic going through the FireWall-1 Kernel Module. This is sort of like tcpdump except that it shows you what things look like from the perspective of various parts of FireWall-1 and can be used to monitor all interfaces simultaneously.

fw monitor [-d] [-D] -e inspect-filter -f filter-file [-l len] [-m mask] [-x offset[,len]] [-o file]

Command Line Options
-d Turn on dodebugptr
-D Turn on dodebugptr
-e Specify an INSPECT program line (multiple -e options can be used)
-f INSPECT filter name ('-' can be used to specify standard input). The -f and -e options are mutually exclusive.
-l Specify how many bytes of the packet should be transferred from the kernel.
-m Specify inspection points mask, any one or more of i, I, o, O as explained above.
-o Specify an output file. They can be viewed with the 'snoop' command on Solaris. This is only valid on 4.0 SP3 and later.
-x Perform a hex dump of the received data, starting at specify offset and printing out 'len' bytes.

Examples
fw monitor -e '[9:1]=6, accept\;' -l 100 -m iO -x 20 will display all TCP packets entering and leaving FireWall-1. Up to 80 bytes of TCP header and data will be displayed (assuming no IP Options are used)

fw monitor -e 'accept\;' -m iI will display all packets entering and exiting FireWall-1 in the inbound direction (i.e. before the OS routes the packet).

fw monitor -e 'accept ifid=0,src=10.0.0.1 or dst=10.0.0.1\;' will show you all packets in interface ID 0 coming from or going to 10.0.0.1. The value used for ifid corresponds to a number given to an interface by FireWall-1. You can determine which interface has which number by using the command fw ctl iflist.

fw monitor -e 'accept ifid=0,src=10.0.0.1 or dst=10.0.0.1,ip_p=47\;' does the same thing as the previous command except it looks for packets of IP Protocol 47 only.

fw monitor -e 'accept tcp,dport=80 or sport=80,src=10.0.0.1 or dst=10.0.0.1\;' shows all tcp packets going to or from 10.0.0.1 with either a source port of 80 or a destination port of 80.

Does Webtrends use ELA

2011-01-27T15:04:00.000+05:30

Webtrends uses LEA (Log Export API), not ELA. LEA is the opposite of ELA; it allows FW-1 to send events to a 3rd party reporting application. Although it is possible to use Webtrends with manually exported log files, I believe they recommend using LEA as the preferred interface between the two.

Per Check Point: "WebTrends Firewall Suite integrates with the Log Export API (LEA) of the OPSEC architecture in VPN-1/FireWall-1. When LEA is used, a secure connection is set up between WebTrends Firewall Suite and VPN-1/FireWall-1. This connection provides the mechanism that safely and securely transfers data between the firewall and the analysis engine. By encrypting data at the firewall, LEA ensures that firewall logs are not tampered with during transport. The LEA connection also facilitates the creation of real-time reports without the need to export complete log files at every update interval, saving time and bandwidth resources."

How to redirect logs to a different partition

2011-01-26T14:52:00.000+05:30

For logging on Windows :
Regedit
go to HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\FW1\5.0
create FWLOGDIR and put the full path to the log you want to go to

For logging on Unix :
ln -s /path/to/new/logdir $FWDIR/log
If you're talking about Windows NT then there is a registry hack.

enter the HKEY_LOCAL_MACHINE\SOFTWARE\CheckPoint\FW1\4.1 path and add a new
string value form the edit-->new menu. name it FWLOGDIR.
add the directory name that you wsih to log to, and create the directory.
then bounce the firewall (fwstop/fwstart).

How do I Rotate the Audit Logs in FireWall-1 NG

2011-01-25T14:15:00.002+05:30

The VPN-1/FireWall-1 NG audit log type files are:

xx.adtlog - stores the audit log records.

xx.adtlogptr - provides pointers to the beginning of each log records.

xx.adtloginitial_ptr - provides pointers to the beginning of each log chain (logs that shared the same

connection ID - LUUID).

xx.adtlogaccount_ptr - provides pointers to the beginning of each accounting record.

To purge/delete the current audit log files without saving it to a backup file, run:

# fw logswitch -audit ""

To logswitch and save the logs to a file, run:

# fw logswitch -audit

Example :

# fw logswitch -audit
 Trying to switch audit logfile to 2002-06-07_150016.adtlog
 Log File was switched to : 2002-06-07_150016.adtlog

procedure for moving the management server on WIndows 2000

2011-01-24T14:13:00.000+05:30

1. Install the FireWall-1 software on the 2000 server. When setting this software up, designate the firewall module as a remote module. You will be prompted for a
secret key to authenticate management commands. YOU MUST USE THE SAME KEY OF THE FIRST TIME, OR EVEN DO PUTKEYS AGAIN.

2. Remove current objects.* from the 2000 server

3. Transfer these files from the SOLARIS management module to the new 2000 managment module (FTP is fine):

$FWDIR/conf/objects.C (objects and properties)
$FWDIR/conf/*.W (security policy)
$FWDIR/conf/rulebases.fws (Combined rule bases for GUI clients)
$FWDIR/conf/fwauth.NDB (User database)
$FWDIR/conf/fwmusers Adminstrators
$FWDIR/conf/gui-clients Allow GUI Adminstrative hosts

Note: Any *.NDB files must be transferred in binary mode. All other files should be transferred in ASCII mode.

3. Restart the 2000 management station.

4. Sometimes it is neccessary to regenerate the rulebases.fws file and objects.C files once moved to the new management station. This is done when you no longer see your rulebases or objects once you login to the Gui Client on the new mangement console.