Network/Security

Configure ASA device in GNS3

2016-12-30T00:41:00.001-08:00

This post is about how you can emulate ASA on GNS3

First Download GNS3 and install it on your OS
Then Download below essentials

Initrd: C:\ASA\asa842-initrd.gz
Kernel: C:\ASA\asa842-vmlinuz

Then need to create a FLASH file

Go to location of Qemu in the C Program files installation directory of GNS3 from CMD prompt and create a FLASH file
C:\system32>qemu-img create FLASH 512M
Copy it to the user's directory of GNS3, images directory

Then in preferances,

Name etc.

FLASH binary

Finally Intrid and kernel image

Done !!!!

ASA Failover Configuration

2016-12-29T10:50:00.000-08:00

For this configuration I'm going to use GNS3 with QEMU emulator to run a ASA in a virtual environment.

First get the files downloaded

GNS3 : https://www.gns3.com/

ASA Images :

ASA842-Intrid and ASA842vmlinuz

I'm not going to describe how to set the ASA in GNS3

For failover configuration

Node 01 :

(config)#failover lan unit primary

(config)#failover lan interface FOLINK Gi0/0

(config)#failover interface ip FOLINK 10.1.1.1 255.255.255.0 standby 10.1.1.2

(config)#failover

Node 02 :

(config)#failover lan unit secondary

(config)#failover lan interface FOLINK Gi0/0

(config)#failover interface ip FOLINK 10.1.1.1 255.255.255.0 standby 10.1.1.2

(config)#failover

P.S : You may also configure link failover (state failover) with the command

Node 01 & 02:

(config)#failover link FOLINK Gi0/1

Verification Commands,

#show failover

#show failover state

Failover Licenses:

activation-key 0x4a3ec071 0x0d86fbf6 0x7cb1bc48 0x8b48b8b0 0xf317c0b5

activation-key 0xb23bcf4a 0x1c713b4f 0x7d53bcbc 0xc4f8d09c 0x0e24c6b6

Configuring DNS Servers in Open Source

2015-10-06T19:31:00.002-07:00

I have come across through an issue with SunOS 11 which is, related to DNS. So I though of sharing, how to configure DNS in Open Source.

Issue : nslookup was working fine, but when pinging to a host, it says ping : Unknown host

Initially, I couldn't get domain names resolved in this specific node.

So, I created the resolv.conf file in /etc / location

root@~# vi /etc/resolv.conf
(In most of the OS's this file is already there, only you have to add name-servers)

Add DNS servers in the file as below
eg:
nameserver 8.8.8.8
nameserver 4.2.2.2

You can then check whether you can get domain names resolved, by the commands dig and nslookup

root@~#dig google.com
root@~# nslookup google.com

You will get some results for above commands. If not please check the resolv.conf file again.

------------------------------------------------------------------------------------------------------------------------

Next, I tried to ping google.com; it was saying that
root@~# ping google.com
ping: unknown host google.com
So, in this case, name resolution is working perfectly. But the issue is with the nsswitch, because it's configured only to check host file; dns is not checking. Below was the result for not working condition

/etc/nsswitch.conf:
hosts: files
# pretty much everything else set to files
Config should be as below to work
/etc/nsswitch.conf:
hosts: files dns
# pretty much everything else set to files
If you are using any other Open Source version, you can directly edit the file, but in Sun OS you have to edit it through the deamon.

So the question is how to make sure the Solaris Name Service knows that it has to lookup host names in both local files as well as in DNS. Remember that in Solaris 11 you are no longer supposed to / allowed to edit files such files as /etc/nsswitch.conf directly. They are controlled by daemons that run under SMF. Here is how to change it:

# svccfg
svc:> select name-service/switch
svc:/system/name-service/switch> setprop config/host = astring: "files dns"
svc:/system/name-service/switch> select system/name-service/switch:default
svc:/system/name-service/switch:default> refresh
svc:/system/name-service/switch:default> validate
svc:/system/name-service/switch:default> exit
# svcadm refresh name-service/switch

This should resolve domain resolving issue

Upload Service Request files to User Center

2014-08-18T04:14:00.003-07:00

After initiating the SR, you would need to upload files such as, *.cpinfo, configurations, Interface detials, messages files etc, to the Check Point user center for, more investigation.

For that you need to have a Check Point account with the Service Contracts

Below are the steps for a upload from a windows PC

1) Download the cp_uploeyder from the user center

2) Extract the files to a directory

3) Open CMD and change the path to extracted folder

4) Copy the files needed to be uploaded to the same folder

5) Run below command

C:\cp_uploader> cp_uploader.exe -u <username> -s 28-899191931 <*.cpinfo>

<username> : User Center account

<*.cpinfo> : File you need to upload for the SR

How to check System Information in Linux

2014-07-22T22:57:00.002-07:00

In Linux, there are several commands to get the system information/memory depending on the kernel. Below are some commands that works with most of the systems.

[Root]# dmidecode -t

Type number or keyword expected
Valid type keywords are:
bios
system
baseboard
chassis
processor
memory
cache
connector
slot

[Root]#free -m

Cisco ASA Debug Commands for Log Collection

2014-06-27T09:30:00.003-07:00

In Site to Site VPNs, it is necessary to do debugging in order to get some idea about tunnels, which are not coming UP.
If you use debugging, memory and CPU will be highly utilized, so that there's a workaround, which is you can set up a crypto condition only for a peer for debigging. Below are the CLI commands

SETUP (CLI)
===========

login as: admin
admin@10.10.48.100's password:
Type help or '?' for a list of available commands.
ciscoASA-act> enable
Password: **********
ciscoASA-act# configure terminal
ciscoASA-act(config)#
ciscoASA-act(config)# logging buffer-size 1048576
ciscoASA-act(config)#
ciscoASA-act(config)# logging buffered 7
ciscoASA-act(config)#
ciscoASA-act(config)# debug crypto condition peer 10.10.10.10
ciscoASA-act(config)#
ciscoASA-act(config)# debug crypto ipsec 127
INFO: 'logging debug-trace' is enabled. All debug messages are currently being redirected to syslog:711001 and will not appear in any monitor session
ciscoASA-act(config)#
ciscoASA-act(config)# debug crypto isakmp 127
INFO: 'logging debug-trace' is enabled. All debug messages are currently being redirected to syslog:711001 and will not appear in any monitor session
ciscoASA-act(config)#
ciscoASA-act(config)# end
ciscoASA-act#
ciscoASA-act# show debug
debug crypto ipsec enabled at level 127
debug crypto isakmp enabled at level 127

COLLECTION (FROM GUI)
=====================
Login into ASDM, click:

1. File -> Save Internal Log Buffer to Flash
2. Tools -> File Management
3. In the dialog click on File Transfer -> Between Local PC and Flash
4. In the right box, disk0: -> syslog, click on the file in the left box, pick a local folder
5. Press the left arrow button "<----" in the middle of the dialog
NOTE: if an error pops up regarding not being able to write the file, select a different
folder on your local system
6. Close
7. Verify that the file has been transfered correctly and is not empty.
8. Send us that file.

CLEANUP (CLI)
=============
login as: admin
admin@10.10.48.100's password:
Type help or '?' for a list of available commands.
ciscoASA-act> enable
Password: **********
ciscoASA-act# configure terminal
ciscoASA-act(config)#
ciscoASA-act(config)# no debug crypto condition peer 10.10.10.10
ciscoASA-act(config)#
ciscoASA-act(config)# no logging buffered 7
ciscoASA-act(config)#
ciscoASA-act(config)# no debug crypto ipsec
ciscoASA-act(config)#
ciscoASA-act(config)# no debug crypto isakmp
ciscoASA-act(config)#
ciscoASA-act(config)# end
ciscoASA-act(config)#
ciscoASA-act# show debug

Check Point Interface Traffic Counters

2014-04-13T22:02:00.001-07:00

How to get Check Point interface traffic rate, when the CPU utilization of Check Point gateways go high?

1) Through SMART view monitor
Selecting top interfaces

2)Through command line
[Expert@Gateway]# Sar -n DEV 1 1

Kill Processes in Check Point

2014-04-13T22:01:00.002-07:00

How to kill process that consumes a lot of CPU?

In Gaia(R74.40) I came across with several bugs and one of them is unwanted/low priority process consumes a lot of CPU, and cause utilization of the gateway to be increased.

monitord is such an unwanted process, that I came across with. And searchd is an example for a low priority process, sometimes eats the CPU highly.

[Expert@Gateway]# tellpm process:monitord

Above command kills the process you need. Only have to define the process needed to be killed after the semi colon.