Facebook Twitter Gplus RSS
formats

BGP – Load Sharing, Multihomed to Two ISPs Through Multiple Local Routers

Published on March 31, 2012 by in 2012, BGP

This is from a session I have been doing. BGP, how to load share while multihomed to two ISPs through multiple routers.

 

All of the BGP peering have been setup and are working.

  1. Traffic that is destined to AS22 goes through R9 (ISP A) link

On R9 I need to add a as-path list to identify which traffic to match in a route map, the commands used were as follows:

Create an as-path list;

ip as-path access-list 1 permit ^22$

 

Then create a route-map called AS-22-INCOMING and match updates using as-path list 1 and set the local preference to be 200

route-map AS-22-INCOMING permit 10
match as-path 1
Set local-pref 200

Then I add the route-map to the bgp neighbor statement;

router bgp 89
neighbor 172.16.29.2 route-map AS-22-INCOMING in
  1. Traffic that is destined for AS3 goes through the R8 (ISP B) link.

On R8 I need to add a as-path list to identify which traffic to match in a route map, the commands used were as follows:

Create an as-path list;

ip as-path access-list 1 permit ^3$

 

Then create a route-map called AS-22-INCOMING and match updates using as-path list 1 and set the local preference to be 150

route-map AS-3-INCOMING permit 10
match as-path 1
set local-pref 150

Then I add the route-map to the bgp neighbor statement;

router bgp 89
neighbor 192.168.68.6 route-map AS-3-INCOMING in

 

  1. All other traffic should prefer the default route 0.0.0.0 through R9 (ISP-A) link
  2. If the R9 (ISP-A) link fails all traffic should go through the R8 (ISP-B) link.

Both of these objectives are achieved by setting the local preference on the incoming updates originated for the two respective ISPs, both of the ISPs are sending us default routes. When we set the local preference on incoming updates from AS22 on R9 we set it to 200 which is higher than the default value (100) and higher than the value we set on R8 for incoming updates for AS3. If the link between R9 and R2 then the traffic will fail over to the link between R8 and R6.

 

 

 

  1. Traffic that is destined for network 99.99.99.0/24 from the internet should come from ISP (A) R2-R9 link.

 

To do this I used a route-map call “AS-22-OUTBOUND” on R9. In this route-map I matched the networks advertised by AS89 using an ACL, for network 88.88.88.0/24 I added a prepend for ASN 89 and for network 99.99.99.0/24 I didn’t.

route-map AS-22-OUTBOUND permit 10
match ip address 10
set as-path prepend 89
!
route-map AS-22-OUTBOUND permit 20
match ip address 20
!
access-list 10 permit 88.88.88.0 0.0.0.255
access-list 20 permit 99.99.99.0 0.0.0.255

neighbor 172.16.29.2 route-map AS-22-OUTBOUND out

 

  1. Traffic that is destined for network 88.88.88.0/24 from the internet should come from ISP (B) R6-R8 link

 

 

To do this I used a route-map call “AS-3-OUTBOUND” on R8. In this route-map I matched the networks advertised by AS89 using an ACL, for network 99.99.99.0/24 I added a prepend for ASN 89 and for network 88.88.88.0/24 I didn’t. So with this configuration and the (kind of opposite) config applied to R9 we are load sharing traffic for the networks within AS89.

 route-map AS-3-OUTBOUND permit 10
match ip address 20
set as-path prepend 89
!
route-map AS-3-OUTBOUND permit 20
match ip address 10
!
access-list 10 permit 99.99.99.0 0.0.0.255
access-list 20 permit 88.88.88.0 0.0.0.255

neighbor 192.168.68.6 route-map AS-3-OUTBOUND out

 

To verify I look at the BGP table on R1, I can see that network 88.88.88.0/24 has two paths, one to 172.16.13.3 (Router in AS3, ISP-B) & 172.16.12.2 (R2 in AS22, ISP-A). The path through 172.16.13.3 is the best, this is what as we expected. I can also see that for network 99.99.99.0/24 we have two router, one to 172.16.13.3 (Router in AS3, ISP-B) & 172.16.12.2 (R2 in AS22, ISP-A) for this network the path through 172.16.12.2 is the best, this is as we expected to. So this section is working as per our policy:

 

R1#sh ip bgp
BGP table version is 34, local router ID is 1.1.1.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path
*> 1.1.1.0/24 0.0.0.0 0 32768 i
*> 2.2.2.0/24 172.16.12.2 0 0 22 i
*> 3.3.3.0/24 172.16.13.3 0 0 3 i
*> 4.4.4.0/24 172.16.13.3 0 3 i
*> 5.5.5.0/24 172.16.13.3 0 3 i
*> 6.6.6.0/24 172.16.13.3 0 3 i
*> 7.7.7.0/24 172.16.13.3 0 3 i
*> 10.10.10.0/24 172.16.12.2 0 22 100 i
*> 11.11.11.0/24 172.16.12.2 0 22 100 i
*> 12.12.12.0/24 172.16.12.2 0 22 100 i
*> 13.13.13.0/24 172.16.12.2 0 22 100 300 i
*> 14.14.14.0/24 172.16.12.2 0 22 100 300 i
*> 15.15.15.0/24 172.16.12.2 0 22 100 300 200 i
*> 16.16.16.0/24 172.16.12.2 0 22 100 300 200 i
*> 17.17.17.0/24 172.16.12.2 0 22 100 300 i
*> 18.18.18.0/24 172.16.12.2 0 22 100 300 i
*> 19.19.19.0/24 172.16.12.2 0 22 100 300 400 i
Network Next Hop Metric LocPrf Weight Path
*> 20.20.20.0/24 172.16.12.2 0 22 100 300 400 i
*> 88.88.88.0/24 172.16.13.3 0 3 89 i
* 172.16.12.2 0 22 89 89 i
* 99.99.99.0/24 172.16.13.3 0 3 89 89 i
*> 172.16.12.2 0 22 89 i
 
 Share on Facebook Share on Twitter Share on Reddit Share on LinkedIn
No Comments  comments 
formats

Implement the Cisco IOS IPS feature set using SDM

Published on March 31, 2012 by in 2012

In this post I will be covering the following topics from the CCNA Security exam topics blue print.

• Define network based vs. host based intrusion detection and prevention

• Explain IPS technologies, attack responses, and monitoring options

• Enable and verify Cisco IOS IPS operations using SDM

 

Network vs. Host Based Intrusion Detection & Prevention

 

What is IDS & IPS? Well the simple explanation is “Intrusion Detection” has a copy of the traffic and isn’t in the traffic path where are “Intrusion Prevention” is in the traffic path. This means that IPS reacts to stop malicious traffic as soon as “sensor” detects it, as seen in fig 2. With IDS having a copy of the traffic it won’t be able to react immediately and a small amount of malicious data will get through, as seen in fig 1. IDS will either send an alert or a notification to another device to take action. Both of these scenarios are considered Network biased solutions.

Fig 1 – Network IDS

Fig 2 – Network IPS

Hack attempt stopped by NIPS

What is a HIPS & HIDS? Host based intrusion detection/prevention are software products that are installed on end points, these end points can be Servers, PCs or Laptops to name a few. The complete list of functions that a HIDS varies from vendor to vendor but their main job is to permit or deny System calls from Applications or other parts of the OS to the Kernel.

Fig 3 – Abstract of Application system call.

 

IPS technologies, attack responses, and monitoring options

 

Well we have briefly discussed the difference between NIPS/NIDS & HIPS/HIDS, so we can move onto looking at what form of devices these come in. Cisco has a range of product that act as “sensors”, the table below lists them ASA5500 firewall with the AIP-SSM

ASA5505 with AIP-SSM Adaptive Security Appliance 5500 with the Advanced Inspection & Prevention Security Services Module
IPS 4200 Series Sensor
Catalyst 6500 with IDSM-2 module Intrusion Detection System Service Module
IPS AIM for ISR routers Advanced Integration Module for Integrated Services routers

 

All of the above devices run the same code which make moving to a more capable platform easier.

 

 

This Table lists terms specific to this topic and the meaning of them, this is what I think will be relevant for the exam.

Term Meaning
IPS Signature Alarms
False Positive Normal traffic or a non-malicious action causes the signature to fire.
True Positive An attack is properly detected by the IPS.
False Negative An attack is not detected by the IPS
True Negative Legitimate traffic does not cause signatures to fire
Sensor One of the IPS/IDS products,

 

 

Enable and verify Cisco IOS IPS operations using SDM

 

From within SDM click configure > Intrusion Prevention, then click the Launch IPS rules Wizard.

 

You will then see the following screen, reading the blurb you can see what the wizard will configure. It will configure which interfaces will have IPS rules applied, the direction in which the rules will be applied & it will specify the SDF (Signature Definition File) used. Click next

Now select the interface or interfaces and the direction in which the rules will be applied, I have selected the vLAN 1 (outside) & vLAN2 (inside) both in the inbound direction. Once selected click next.

Now we can select the SDF files to use, the router I have been using already had the 128MB.sdf located in flash but you should be able to download an SDF file from Cisco (if you have a CCO login).

The SDF file you use depends on the amount of RAM on the router, this router has 128mb

I selected the add button

Then I selected the 128MB.sdf from the flash directory on the router. Clicked ok

Notice the tick “Use built-in signatures (as backup) this will load the limited backup signatures from the IOS in the event of missing or failed signatures.

Click next

You now get a Summary of what will be applied

The commands will then be delivered to the router, also the signatures will get built an applied. You should then be automatically presented with the Edit IPS TAB, showing the IPS Polices. In this windows you can see the interfaces, IP addresses and if/what direction the IPS rules are applied. VFR = virtual fragment reassembly = the router will reassemble fragmented packets so the IPS engine can inspect them.

Selecting one of the rule will display information about it in the below panel, notice vLAN1 is selected and the info about it reads “IPS rule is enabled, but there is no filter configured for this rule, IPS will scan all Inbound traffic.”

Now looking at the “Global Settings” I can see IPS option and where the SDM files are located.

Clicking the Signature button on the left will show you the signatures that are loaded. I can see that I have 351 signatures. I can see all the signatures or I can select different folders in the tree to view groups of signatures.

 

If I want to see if any signatures have been fired then I can go into the Monitor tab at the top of SDM and then into the logging screen. The tab at the top SDEE Message log will show you a the logs generated from the IPS, I can see that there are lots of messages.

Moving over to the IPS button with in the monitoring tab show all of the signature and a Hit & Drop count. The alerts relate to DNS queries. If I wanted to change what action the signature take then I can go over to the configure section and then find the signature.

 

In the edit window under the Signatures button on the left I can look in the tree for DNS and then for signature, I noted that it was signature 4620 sub-signature 0, so I select it.

I then see this screen, under EventAction its usually a green square when its configured as default to change it I select the square then the action I want. This occasion its “denyFlowInline” then I click OK.

Now I am back looking at the signatures, notice the orange circle next to the signature number, this means that the changes haven’t yet been applied by SDM, the commit the changes select Apply Changes at the bottom.

You will then see the Signature Compilation Status window and when its done you will see the below. Notice the changes only effected the ATOMIC:UDP micro engine.

 

Supplemental – Enable and verify Cisco IOS IPS operations using the cli

 

LAB-877w#sh ip ips all
Configured SDF Locations:
 flash://sdmips.sdf
 flash://128MB.sdf
Builtin signatures are enabled but not loaded
Last successful SDF load time: 11:40:32 UTC Jan 30 2011
IPS fail closed is disabled
Fastpath ips is enabled
Quick run mode is enabled
Event notification through syslog is enabled
Event notification through SDEE is enabled
Total Active Signatures: 351
Total Inactive Signatures: 0
Signature 11207:0 disable
Signature 11208:0 disable
Signature 11209:0 disable
Signature 3325:0 disable
Signature 11200:0 disable
Signature 11201:0 disable
Signature 11202:0 disable
Signature 11222:0 disable
Signature 11224:0 disable
Signature 11225:0 disable
Signature 5050:0 disable
Signature 5085:0 disable
Signature 5322:0 disable
Signature 5322:1 disable
Signature 11210:0 disable
Signature 11211:0 disable
Signature 11212:0 disable
Signature 50000:0 disable
Signature 50000:2 disable
Signature 50000:1 disable
IPS Rule Configuration
 IPS name sdm_ips_rule
Interface Configuration
 Interface Vlan2
 Inbound IPS rule is sdm_ips_rule
 Outgoing IPS rule is not set
 Interface Vlan1
 Inbound IPS rule is sdm_ips_rule
 Outgoing IPS rule is not set
Established Sessions 

 Session 8378EF0C (10.99.99.3:51937)=>(10.56.87.31:80) tcp SIS_OPEN
 Session 837884AC (10.99.99.3:51370)=>(10.56.87.73:1433) tcp SIS_OPEN
 Session 83788A6C (10.99.99.3:49501)=>(10.0.0.77:13510) tcp SIS_OPEN
 Session 8378B86C (10.99.99.3:49556)=>(10.56.87.14:8194) tcp SIS_OPEN
 Session 837850EC (10.99.99.3:51372)=>(10.56.87.73:1433) tcp SIS_OPEN
 Session 837811AC (10.99.99.3:51718)=>(4.26.237.126:80) tcp SIS_OPEN
 Session 83789BAC (10.99.99.3:50038)=>(128.242.250.183:443) tcp SIS_OPEN
 Session 8378708C (10.99.99.3:51721)=>(10.56.87.55:21295) tcp SIS_OPEN
 Session 837898CC (10.99.99.3:49523)=>(10.0.0.77:13510) tcp SIS_OPEN
 Session 8378736C (10.99.99.3:51349)=>(10.56.87.9:1025) tcp SIS_OPEN
 Session 837839EC (10.99.99.3:51719)=>(209.85.146.118:80) tcp SIS_OPEN 

LAB-877w#clear ip ips con
LAB-877w#clear ip ips configuration
LAB-877w#
000616: Jan 30 11:50:05.052 UTC: %IPS-2-DISABLED: IPS removed from all interfaces - IPS disabled
LAB-877w#conf t
Enter configuration commands, one per line. End with CNTL/Z.
LAB-877w(config)#ip
LAB-877w(config)#ip ips
LAB-877w(config)#ip ips ?
 deny-action Specify Deny action
 fail Specify what to do during any failures
 name Specify an IPS rule
 notify Specify the notification mechanisms (SDEE, nr-director or log)
 for the alarms
 sdf Specify the location of the signature definition file
 signature Add a policy to a signature 

LAB-877w(config)#exit
LAB-877w#
LAB-877w#
LAB-877w#
000617: Jan 30 11:51:24.514 UTC: %SYS-5-CONFIG_I: Configured from console by console
LAB-877w# 

LAB-877w#sh ip ips configuration
Configured SDF Locations:
 flash://sdmips.sdf
 flash://128MB.sdf
Builtin signatures are enabled but not loaded
Last successful SDF load time: 11:40:32 UTC Jan 30 2011
IPS fail closed is disabled
Fastpath ips is enabled
Quick run mode is enabled
Event notification through syslog is enabled
Event notification through SDEE is enabled
Total Active Signatures: 0
Total Inactive Signatures: 0 

LAB-877w#conf t
Enter configuration commands, one per line. End with CNTL/Z.
LAB-877w(config)#ip ips name cli_ips_rule
LAB-877w(config)#int vlan 1
LAB-877w(config-if)#ip ips cli_ips_rule in ?
  

LAB-877w(config-if)#ip ips cli_ips_rule in 

000618: Jan 30 11:58:28.693 UTC: %IPS-6-SDF_LOAD_SUCCESS: SDF loaded successfully from flash://sdmips.sdf
000619: Jan 30 11:58:28.697 UTC: %IPS-6-ENGINE_BUILDING: OTHER - 8 signatures - 1 of 15 engines
000620: Jan 30 11:58:28.697 UTC: %IPS-6-ENGINE_READY: OTHER - 0 ms - packets for this engine will be scanned
000621: Jan 30 11:58:28.697 UTC: %IPS-6-ENGINE_BUILDING: MULTI-STRING - 0 signatures - 2 of 15 engines
000622: Jan 30 11:58:28.697 UTC: %IPS-6-ENGINE_BUILD_SKIPPED: MULTI-STRING - there are no new signature definitions for this engine
000623: Jan 30 11:58:28.697 UTC: %IPS-6-ENGINE_BUILDING: STRING.ICMP - 2 signatures - 3 of 15 engines
000624: Jan 30 11:58:28.721 UTC: %IPS-6-ENGINE_READY: STRING.ICMP - 24 ms - packets for this engine will be scanned
000625: Jan 30 11:58:28.721 UTC: %IPS-6-ENGINE_BUILDING: STRING.UDP - 24 signatures - 4 of 15 engines
000626: Jan 30 11:58:29.532 UTC: %IPS-6-ENGINE_READY: STRING.UDP - 812 ms - packets for this engine will be scanned
000627: Jan 30 11:58:29.532 UTC: %IPS-6-ENGINE_BUILDING: STRING.TCP - 125 signatures - 5 of 15 engines
000628: Jan 30 11:58:50.056 UTC: %IPS-6-ENGINE_READY: STRING.TCP - 20528 ms - packets for this engine will be scanned
000629: Jan 30 11:58:50.056 UTC: %IPS-6-ENGINE_BUILDING: SERVICE.FTP - 1 signatures - 6 of 15 engines
000630: Jan 30 11:58:50.072 UTC: %IPS-6-ENGINE_READY: SERVICE.FTP - 16 ms - packets for this engine will be scanned
000631: Jan 30 11:58:50.072 UTC: %IPS-6-ENGINE_BUILDING: SERVICE.SMTP - 3 signatures - 7 of 15 engines
000632: Jan 30 11:58:50.124 UTC: %IPS-6-ENGINE_READY: SERVICE.SMTP - 52 ms - packets for this engine will be scanned
000633: Jan 30 11:58:50.124 UTC: %IPS-6-ENGINE_BUILDING: SERVICE.RPC - 38 signatures - 8 of 15 engines
000634: Jan 30 11:58:50.288 UTC: %IPS-6-ENGINE_READY: SERVICE.RPC - 164 ms - packets for this engine will be scanned
000635: Jan 30 11:58:50.288 UTC: %IPS-6-ENGINE_BUILDING: SERVICE.DNS - 29 signatures - 9 of 15 engines
000636: Jan 30 11:58:50.324 UTC: %IPS-6-ENGINE_READY: SERVICE.DNS - 36 ms - packets for this engine will be scanned
000637: Jan 30 11:58:50.324 UTC: %IPS-6-ENGINE_BUILDING: SERVICE.HTTP - 100 signatures - 10 of 15 engines
000638: Jan 30 11:58:58.221 UTC: %IPS-6-ENGINE_READY: SERVICE.HTTP - 7900 ms - packets for this engine will be scanned
000639: Jan 30 11:58:58.221 UTC: %IPS-6-ENGINE_BUILDING: ATOMIC.TCP - 7 signatures - 11 of 15 engines
000640: Jan 30 11:58:58.229 UTC: %IPS-6-ENGINE_READY: ATOMIC.TCP - 8 ms - packets for this engine will be scanned
000641: Jan 30 11:58:58.229 UTC: %IPS-6-ENGINE_BUILDING: ATOMIC.UDP - 3 signatures - 12 of 15 engines
000642: Jan 30 11:58:58.233 UTC: %IPS-6-ENGINE_READY: ATOMIC.UDP - 4 ms - packets for this engine will be scanned
000643: Jan 30 11:58:58.233 UTC: %IPS-6-ENGINE_BUILDING: ATOMIC.ICMP - 3 signatures - 13 of 15 engines
000644: Jan 30 11:58:58.233 UTC: %IPS-6-ENGINE_READY: ATOMIC.ICMP - 0 ms - packets for this engine will be scanned
000645: Jan 30 11:58:58.237 UTC: %IPS-6-ENGINE_BUILDING: ATOMIC.IPOPTIONS - 2 signatures - 14 of 15 engines
000646: Jan 30 11:58:58.237 UTC: %IPS-6-ENGINE_READY: ATOMIC.IPOPTIONS - 0 ms - packets for this engine will be scanned
000647: Jan 30 11:58:58.237 UTC: %IPS-6-ENGINE_BUILDING: ATOMIC.L3.IP - 6 signatures - 15 of 15 engines
LAB-877w(config-if)#
LAB-877w(config-if)#int vlan 2
LAB-877w(config-if)#ip ips cli_ips_rule in
LAB-877w(config-if)#exit
LAB-877w(config)#exit 

000649: Jan 30 11:59:37.057 UTC: %SYS-5-CONFIG_I: Configured from console by console 

LAB-877w#sh ip ips conf
Configured SDF Locations:
 flash://sdmips.sdf
 flash://128MB.sdf
Builtin signatures are enabled but not loaded
Last successful SDF load time: 11:58:28 UTC Jan 30 2011
IPS fail closed is disabled
Fastpath ips is enabled
Quick run mode is enabled
Event notification through syslog is enabled
Event notification through SDEE is enabled
Total Active Signatures: 351
Total Inactive Signatures: 0
Signature 11207:0 disable
Signature 11208:0 disable
Signature 11209:0 disable
Signature 3325:0 disable
Signature 11200:0 disable
Signature 11201:0 disable
Signature 11202:0 disable
Signature 11222:0 disable
Signature 11224:0 disable
Signature 11225:0 disable
Signature 5050:0 disable
Signature 5085:0 disable
Signature 5322:0 disable
Signature 5322:1 disable
Signature 11210:0 disable
Signature 11211:0 disable
Signature 11212:0 disable
Signature 50000:0 disable
Signature 50000:1 disable
Signature 50000:2 disable
IPS Rule Configuration
 IPS name cli_ips_rule
Interface Configuration
 Interface Vlan1
 Inbound IPS rule is cli_ips_rule
 Outgoing IPS rule is not set
 Interface Vlan2
 Inbound IPS rule is cli_ips_rule
 Outgoing IPS rule is not set
LAB-877w#sh ip ips ?
 all IPS all available information
 configuration IPS configuration
 interfaces IPS interfaces
 name IPS name
 sessions IPS sessions
 signatures IPS signatures
 statistics IPS statistics 

LAB-877w#sh ip ips sessions
Established Sessions 

 Session 8378F1EC (10.99.99.3:52074)=>(75.101.142.23:80) tcp SIS_OPEN
 Session 83785F4C (10.99.99.3:51964)=>(72.21.211.174:80) tcp SIS_OPEN
 Session 83788A6C (10.99.99.3:52062)=>(173.230.154.207:80) tcp SIS_OPEN
 Session 8377FD8C (10.99.99.3:52068)=>(90.84.54.35:80) tcp SIS_OPEN
 Session 8378C9AC (10.99.99.3:51971)=>(199.93.42.126:80) tcp SIS_OPEN
 Session 83789BAC (10.99.99.3:52063)=>(74.125.77.121:80) tcp SIS_OPEN
 Session 837853CC (10.99.99.3:51966)=>(74.125.77.121:80) tcp SIS_OPEN
 Session 8378DDCC (10.99.99.3:52075)=>(128.242.250.183:443) tcp SIS_OPEN
 Session 8378B86C (10.99.99.3:49556)=>(10.56.87.14:8194) tcp SIS_OPEN
 Session 8378902C (10.99.99.3:51968)=>(217.89.107.16:80) tcp SIS_OPEN
 Session 837850EC (10.99.99.3:51372)=>(10.56.87.73:1433) tcp SIS_OPEN
 Session 837811AC (10.99.99.3:51718)=>(4.26.237.126:80) tcp SIS_OPEN
 Session 8378C3EC (10.99.99.3:52073)=>(10.0.200.9:445) tcp SIS_OPEN
 Session 8378708C (10.99.99.3:51721)=>(10.56.87.55:21295) tcp SIS_OPEN
 Session 83787C0C (10.99.99.3:52067)=>(90.84.54.35:80) tcp SIS_OPEN
 Session 8378EF0C (10.99.99.3:51969)=>(199.93.42.126:80) tcp SIS_OPEN
 Session 83783FAC (10.99.99.3:51967)=>(217.89.107.50:80) tcp SIS_OPEN
 Session 8378736C (10.99.99.3:52064)=>(217.89.107.49:80) tcp SIS_OPEN
 Session 8378BB4C (10.99.99.3:52072)=>(10.56.87.52:139) tcp SIS_OPEN
 Session 837825CC (10.99.99.3:52066)=>(217.89.107.49:80) tcp SIS_OPEN
 Session 837822EC (10.99.99.3:51970)=>(217.89.107.49:80) tcp SIS_OPEN
 Session 837884AC (10.99.99.3:52060)=>(72.21.211.174:80) tcp SIS_OPEN
 Session 83787EEC (10.99.99.3:51963)=>(75.101.142.23:80) tcp SIS_OPEN
 Session 837839EC (10.99.99.3:51719)=>(209.85.146.118:80) tcp SIS_OPEN
 Session 83780ECC (10.99.99.3:51965)=>(173.230.154.207:80) tcp SIS_OPEN
 Session 8378A44C (10.99.99.3:52081)=>(168.143.171.189:443) tcp SIS_OPEN
 Session 8378148C (10.99.99.3:52065)=>(217.89.107.16:80) tcp SIS_OPEN
Half-open Sessions 

 Session 8378E38C (10.56.87.52:389)=>(10.99.99.3:56697) udp SIS_OPENING
LAB-877w#sh ip ips sessions ?
 all IPS all available information
 configuration IPS configuration
 interfaces IPS interfaces
 name IPS name
 sessions IPS sessions
 signatures IPS signatures
 statistics IPS statistics 

LAB-877w#sh ip ips all
Configured SDF Locations:
 flash://sdmips.sdf
 flash://128MB.sdf
Builtin signatures are enabled but not loaded
Last successful SDF load time: 11:58:28 UTC Jan 30 2011
IPS fail closed is disabled
Fastpath ips is enabled
Quick run mode is enabled
Event notification through syslog is enabled
Event notification through SDEE is enabled
Total Active Signatures: 351
Total Inactive Signatures: 0
Signature 11207:0 disable
Signature 11208:0 disable
Signature 11209:0 disable
Signature 3325:0 disable
Signature 11200:0 disable
Signature 11201:0 disable
Signature 11202:0 disable
Signature 11222:0 disable
Signature 11224:0 disable
Signature 11225:0 disable
Signature 5050:0 disable
Signature 5085:0 disable
Signature 5322:0 disable
Signature 5322:1 disable
Signature 11210:0 disable
Signature 11211:0 disable
Signature 11212:0 disable
Signature 50000:0 disable
Signature 50000:1 disable
Signature 50000:2 disable
IPS Rule Configuration
 IPS name cli_ips_rule
Interface Configuration
 Interface Vlan1
 Inbound IPS rule is cli_ips_rule
 Outgoing IPS rule is not set
 Interface Vlan2
 Inbound IPS rule is cli_ips_rule
 Outgoing IPS rule is not set
Established Sessions 

 Session 83785F4C (10.99.99.3:51964)=>(72.21.211.174:80) tcp SIS_OPEN
 Session 8378C9AC (10.99.99.3:51971)=>(199.93.42.126:80) tcp SIS_OPEN
 Session 837853CC (10.99.99.3:51966)=>(74.125.77.121:80) tcp SIS_OPEN
 Session 8378DDCC (10.99.99.3:52075)=>(128.242.250.183:443) tcp SIS_OPEN
 Session 8378B86C (10.99.99.3:49556)=>(10.56.87.14:8194) tcp SIS_OPEN
 Session 8378902C (10.99.99.3:51968)=>(217.89.107.16:80) tcp SIS_OPEN
 Session 837850EC (10.99.99.3:51372)=>(10.56.87.73:1433) tcp SIS_OPEN
 Session 837811AC (10.99.99.3:51718)=>(4.26.237.126:80) tcp SIS_OPEN
 Session 8378708C (10.99.99.3:51721)=>(10.56.87.55:21295) tcp SIS_OPEN
 Session 8378EF0C (10.99.99.3:51969)=>(199.93.42.126:80) tcp SIS_OPEN
 Session 83783FAC (10.99.99.3:51967)=>(217.89.107.50:80) tcp SIS_OPEN
 Session 837822EC (10.99.99.3:51970)=>(217.89.107.49:80) tcp SIS_OPEN
 Session 83787EEC (10.99.99.3:51963)=>(75.101.142.23:80) tcp SIS_OPEN
 Session 837839EC (10.99.99.3:51719)=>(209.85.146.118:80) tcp SIS_OPEN
 Session 83780ECC (10.99.99.3:51965)=>(173.230.154.207:80) tcp SIS_OPEN
LAB-877w#

 

This Table lists the abbreviations used in this post

IPS Intrusion Prevention System
IDS Intrusion Detection System
NIPS Network based Intrusion Prevention System
NIDS Network based Intrusion Detection System
HIPS Host Based Intrusion Prevention System
HIDS Host based Intrusion Detection System
SDEE Security Device Event Exchange
SDM Security Device Manager
SDF Signature Definition file
VFR Virtual Fragment Reassembly
 
Tags: , , , ,
 Share on Facebook Share on Twitter Share on Reddit Share on LinkedIn
No Comments  comments 
formats

EIGRP – Advertised Distance & Reported Distance

Published on March 31, 2012 by in 2012

In this scenario I’m looking at the Advertised & Feasible distance for the network 10.1.25.0/24

 
 Share on Facebook Share on Twitter Share on Reddit Share on LinkedIn
No Comments  comments 
formats

LAB :: Testing PRE & CODE

Published on January 6, 2012 by in BGP

This post is to test that pre is showing router config in the way that I want it to.

 

This Section is “pre”

R18#sh run | sec router bgp
router bgp 20
no synchronization
bgp log-neighbor-changes
bgp confederation identifier 300
bgp confederation peers 10
network 18.18.18.0 mask 255.255.255.0
neighbor 10.17.18.17 remote-as 20
neighbor 10.17.18.17 next-hop-self
neighbor 10.18.19.19 remote-as 400
no auto-summary

 

This section is “code”

R18#sh run | sec router bgp
router bgp 20
no synchronization
bgp log-neighbor-changes
bgp confederation identifier 300
bgp confederation peers 10
network 18.18.18.0 mask 255.255.255.0
neighbor 10.17.18.17 remote-as 20
neighbor 10.17.18.17 next-hop-self
neighbor 10.18.19.19 remote-as 400
no auto-summary

 
 Share on Facebook Share on Twitter Share on Reddit Share on LinkedIn
No Comments  comments 
formats

“If Crocs Ate Old-Socs, Old-Crocs Expire”

Published on January 6, 2012 by in BGP, mnemonic

A mnemonic to help me remember the BGP finite state machine and a doodle to jazz it up.

“If Crocs Ate Old-Socs, Old-Crocs Expire”

I = idle

C = Connect

A = Active

OS = OpenSent

OC = OpenConnect

E = Established

http://en.wikipedia.org/wiki/Border_Gateway_Protocol#Finite-state_machine

 

BGP Peering state machine
Idle – Waiting to start the 3-way handshake.
Connect – Waiting to complete the 3-way handshake.
Active – 3-way handshake failed, try again.
Open Sent – 3-way handshake complete, OPEN message sent.
Open confirm – OPEN message received, parameters agreed upon.
Established - Peering complete.

R1#sh log | i went from
*Nov 8 10:06:32.205: BGP: 172.16.13.3 active went from Closing to Idle
*Nov 8 10:06:46.449: BGP: 172.16.13.3 passive went from Idle to Connect
*Nov 8 10:06:46.453: BGP: 172.16.13.3 passive went from Connect to OpenSent
*Nov 8 10:06:46.453: BGP: 172.16.13.3 passive went from OpenSent to OpenConfirm
*Nov 8 10:06:46.453: BGP: 172.16.13.3 passive went from OpenConfirm to Established
 
 Share on Facebook Share on Twitter Share on Reddit Share on LinkedIn
No Comments  comments 
formats

bgp-best-path-mnemonic

Published on January 5, 2012 by in 2012, BGP

I didn’t create this but I think its great, thank you Richard Bannister @ http://rbcciequest.wordpress.com

He created this very useful mnemonic for remembering the BGP best path Selection process.

 

“We Love Oranges AS Oranges Mean Pure Refreshment”

 

 

“We Love Oranges AS Oranges Mean Pure Refreshment”
W Weight (highest)
L Local Pref (highest)
O Originate (local)
A AS Path (shortest)
O Origin (igp > egp > incomplete)
M MED (lowest)
P Paths (external > internal)
R RID (lowest)


 

“We Love Oranges AS Oranges Mean Pure Refreshment”

 
Tags:
 Share on Facebook Share on Twitter Share on Reddit Share on LinkedIn
No Comments  comments 
formats

LAB :: Basic BGP configuration

Published on January 5, 2012 by in 2012

I have been building a virtualised BGP router lab in order to study for the Cisco CCIP BGP exam. I have created quite a large topology consisting of 20 routers. You can find the Topology buy clicking on the “BGP LAB Topology” page on the menu at the top page.

So far I have configured all of the interface IP addresses, the loopback 0 IP address, frame-relay in AS3 with OSPF as the IGP, BGP in all the AS’s, AS3 has two confederations 345 & 67 and AS300 has two confederations 10 & 20 and each router is advertising its loopback 0 address via BGP.

 
 Share on Facebook Share on Twitter Share on Reddit Share on LinkedIn
No Comments  comments 
© martinrenshaw.com