Tag: Cisco

Cisco ASA Debug a Specific VPN Tunnel

Just a quick note to myself on debugging VPN connectivity;  you can specify a peer, user, etc. as a condition to the crypto debug.
Here’s how I did it from the CLI:

ciscoasa# debug crypto condition peer 1.2.3.4
ciscoasa# debug crypto isakmp 255
ciscoasa# debug crypto ipsec 255
ciscoasa# term mon

This will allow you to just narrow in on the debug information for the specific VPN peer specified in the first line.

Cacti Cisco ASA Host Template

Came across a decent host template for Cisco ASA devices that works well with Cacti.
Grab the CISCO-FIREWALL-MIB if you don’t already have them.  Get either Version 1 or Version 2 directly from Cisco and also get CISCO-SMI Version 1 or Version 2:

Determine where your MIBs are stored on your linux system:

linuxhost:~# snmptranslate -Dinit_mib .1.3|grep MIBDIRS
init_mib: Seen MIBDIRS: Looking in [...snip...] for mib dirs ...

You can use wget to download the MIB file version you want and specify where to save it according to one of the paths in the MIBDIRS output…  I like putting them in /usr/share/snmp/mibs.  Make sure the directory exists, if it doesn’t, just issue the following command:

linuxhost:~# mkdir -p /usr/share/snmp/mibs

Now, download the each of the MIBs (CISCO-FIREWALL-MIB and CISCO-SMI).   Use the above links to get a direct link.  I’m getting Version 2 of each of the MIBs.

linuxhost:~# wget -d -O /usr/share/snmp/mibs/CISCO-FIREWALL-MIB "ftp://ftp.cisco.com/pub/mibs/v2/CISCO-FIREWALL-MIB.my"
linuxhost:~# wget -d -O /usr/share/snmp/mibs/CISCO-SMI "ftp://ftp.cisco.com/pub/mibs/v2/CISCO-SMI.my"

After it’s downloaded, run a test on the server and see if you can poll an ASA in your network.  I’ll test the ConnectionStat entry:

linuxhost:~# snmpwalk -m +CISCO-FIREWALL-MIB  -c public -v 2c 192.168.9.253 -OS ConnectionStat
CISCO-FIREWALL-MIB::cfwConnectionStatDescription.protoIp.currentInUse = STRING: number of connections currently in use by the entire firewall
CISCO-FIREWALL-MIB::cfwConnectionStatDescription.protoIp.high = STRING: highest number of connections in use at any one time since system startup
CISCO-FIREWALL-MIB::cfwConnectionStatCount.protoIp.currentInUse = Counter32: 0
CISCO-FIREWALL-MIB::cfwConnectionStatCount.protoIp.high = Counter32: 0
CISCO-FIREWALL-MIB::cfwConnectionStatValue.protoIp.currentInUse = Gauge32: 113
CISCO-FIREWALL-MIB::cfwConnectionStatValue.protoIp.high = Gauge32: 508

It works without errors!
Notice you must specify the CISCO-FIREWALL-MIB using the -m +CISCO-FIREWALL-MIB argument.
To make this load automatically, modify your snmp.conf file.  This is typically located in /etc/snmp/snmp.conf on Sys-V systems;  To figure out where snmp reads it’s configuration file from, issue the following:

linuxhost:~# net-snmp-config --snmpconfpath
/etc/snmp:/usr/share/snmp:/usr/lib/snmp:/root/.snmp:/var/lib/snmp

This shows it checks each of those paths, in order, until it finds the snmp.conf;  So, modify your snmp.conf file and add the following line: mibs +CISCO-FIREWALL-MIB

There may be an existing line mibs : — you can remove the colon and replace it with +CISCO-FIREWALL-MIB.
Next, run the snmpget command without the -m +CISCO-FIREWALL-MIB”and you should have success and no errors.
To get this setup in Cacti, log in to your cacti server as admin. In the console tab, navigate to the “Import Templates” menu item and click on it.

Download the Host Template zip file (from original site http://forums.cacti.net/download/file.php?id=7607 ).
Extract the files to your desktop or wherever.
In the Import Templates window, click “Browse…” and choose the cacti_host_template ZIP file to import.

You are now done.
You can create a new device and choose the Cisco ASA – Security Device from the host templates now.

How to factory reset Cisco Small Business SLM2048

One of the Cisco Small Business Smart Switches, this easy-to-install, high-speed small-business switch offers many of the same quality of service (QoS) and security features found in Cisco’s premium managed switches, but without the complexity. The intuitive, easy-to-use web interface allows you to fully utilize the switch’s spectrum of features.
The SLM2048 bundles traffic-shaping capabilities into its assortment of features, prioritizing your network’s high-bandwidth applications to deliver consistent, quality feeds for voice and video. Should you interconnect multiple switches, the redundancy features can keep the totality of your network alive if a connection fails.
Additional features of the SLM2048 Gigabit Smart Switch include:

  • 48 10/100/1000 Gigabit copper ports with two shared copper or optical (SFP) uplink interfaces
  • A nonblocking switching capacity of 96 Gbps
  • Port-level security using 802.1x authentication
  • Support for port-based and 802.1q-based VLANs
  • Two mini-GBIC/SFP slots for Gigabit Ethernet expansion
  • Options including link aggregation and spanning tree
  • 802.1x port authentication and MAC address filtering
  • Numerous QoS features
  • Limited lifetime warranty with one year of technical support and free software fixes

How To Factory Reset the Cisco SLM2048 Small Business Smart Switch

Press and hold the reset button on the front of the switch for 10 seconds while the switch is powered on.

Default Information
Cisco SLM2048 Default IP Address is 192.168.1.254
Cisco SLM2048 Default Login is admin/admin

Cisco IOS ACL for DNSChanger

I added this to my edge router to block DNSChanger trojan. I created a new ACL (101) and then applied it to my fast ethernet interface (Fa0/0) outbound. This blocks outound domain requests (DNS) to the netblock specified for each rule. You have to convert subnet masks to wildcard netmasks. You can do this with ipcalc easily.

ip access-list extended 101
! 85.255.112.0/20 DNSChanger
10 deny udp any 85.255.112.93 0.0.15.255 eq domain log
! 67.210.0.0/20 DNSChanger
20 deny udp any 67.210.0.0 0.0.15.255 eq domain log
! 93.188.160.0/21 DNSChanger
30 deny udp any 93.188.160.0 0.0.7.255 eq domain log
! 77.67.83.0/24 DNSChanger
40 deny udp any 77.67.83.0 0.0.0.255 eq domain log
! 213.109.64.0/20 DNSChanger
50 deny udp any 213.109.64.0 0.0.15.255 eq domain log
! 64.28.176.0/20 DNSChanger
60 deny udp any 64.28.176.0 0.0.15.255 eq domain log
70 permit ip any any
int fa0/0
ip access-group 101 out

To see how bad things are on the network, I can show the access-list hits by using:

cisco# sh access-list 101
Extended IP access list 101
    10 deny udp any 85.255.112.0 0.0.15.255 eq domain log (5 matches)
    20 deny udp any 67.210.0.0 0.0.15.255 eq domain log
    30 deny udp any 93.188.160.0 0.0.7.255 eq domain log
    40 deny udp any 77.67.83.0 0.0.0.255 eq domain log
    50 deny udp any 213.109.64.0 0.0.15.255 eq domain log
    60 deny udp any 64.28.176.0 0.0.15.255 eq domain log
    70 permit ip any any (3058492 matches)

I see that there are 5 matches to the first rule (my tests after I implemented it to ensure it was blocking it). Cool, eh?
More information on DNSChanger:
FBI