Archive for category Cisco
Cisco – tcp-small-servers and udp-small-servers
Posted by clamasters in Cisco, blog on February 19th, 2009
For some truly unknown reason, Cisco’s devices still have support for “small servers” or “simple services”. Examples of these include echo, chargen, daytime and discard. An attacker could possibly start a denial of service attack (DoS) against one or more network devices with those configured. In this case; echo and chargen are to blame by allowing an attacker to cause the chargen service to hit the echo services causing an endless loop of character generation and echo between the two hosts. To disable this, simply enter the following commands:
configure terminal
no service tcp-small-servers
no service udp-small-servers
These commands can be run on nearly all IOS based Cisco equipment.
Cisco Switching – switchport nonegotiate
Posted by clamasters in Cisco, blog on February 19th, 2009
Dynamic Trunking Protocol (DTP) is a standard feature of Cisco switches and allows two switches to dynamically configure interfaces interconnecting each other to be trunked ports. DTP has 5 modes; Auto (default), On, Off, desirable and nonegotiate. These 5 modes all have a purpose. I have layed out the groundwork below:
- auto – The default setting allows the port to willingly convert to trunking, however, the port will not trunk unless the neighbor is set to on or desirable. When two switches are connected together and set for auto, they will NOT trunk.
- on – This setting forces the port to be a trunk regardless of the neighbor’s settings.
- off – This setting forces the port to not trunk, even if the neighbor is set to on.
- desirable – This causes the port to attempt to become a trunk, however, the neighbor would have to be set to on, desirable or auto.
- nonegotiate – This setting, forces the port to be a trunk but disables DTP frames between the two switches. This is useful when you are working with non-Cisco equipment and just want to ensure that the ports won’t do anything you do not want them to….this is my preference.
To configure this on your switches, issue the following:
configure terminal
interface g1/0/49
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
Hopefully this was somewhat worthwhile. It is very basic so I apologize but this is the easiest way to give you the needed information without boring you to death 
Cisco Command Reference
Posted by clamasters in Cisco, blog on February 19th, 2009
I was working on a client’s network tonight and thought of about 10k topics to blog about. All the commands on Cisco routers and switches. The purpose of this would be to help remind me that the basics are not good enought and also expand your mind on what a command does, how to use it and possibly when to implement it. If at any point I’m completely off my rocker, you know what to do
Cisco PIX 515E upgrade to 7.0 Code
Posted by clamasters in Cisco on March 17th, 2008
Today I used the monitor mode version of the installation procedure to upgrade a Cisco PIX 515E that was 2 months from being out of a SMARTNet contract. Just in time. This is done by rebooting the firewall with the reload command or flipping the switch (whichever you prefer), and pressing ESC during the boot cycle when the prompt tells you to, then getting started with the string of commands that are required.
First lets set the interface.
interface inside
Then lets set the IP address
address 10.0.0.1
Next lets tell it where the TFTP Server is.
server 10.0.0.10
Now lets tell it the file name.
file pix707.bin
Finally, lets tell the firewall to upload the file.
tftp
The firewall will start to download, then install the code and it’ll reboot. When it comes up, the boot image is not saved to flash so we need to issue the following command.
copy tftp://10.0.0.10/pix707.bin flash:
Accept the following prompts and it’ll finally upload the image to flash. Issue a “write memory” and you are done. Now it’s time to upload the new ASDM image. You can do that with TFTP as well using the following commands.
copy tftp://10.0.0.10/asdm-506.bin flash:
Accept the prompts and it’ll upload the file to flash. Now we need to tell the configuration where that file is located with the following.
asdm location flash:/asdm-506.bin
Reboot and you should be able to access the firewall from the GUI interface using the 7.07 code and ASDM to match.
Packet Capture with Cisco PIX / ASA
Posted by clamasters in Cisco on March 11th, 2008
One of the guys I work with learned a cool trick and decided to pass it on to me. From a Cisco ASA / PIX firewall you can create a pcap file from the command line for use in Wireshark or just to debug from the console.
First we need to create an access list.
access-list testpcap permit tcp any any
Next we start the capture.
capture testpcapname access-list testpcap interface outside
Now that the capture is started you can view your capture with
show capture testpcapname
or you can download the current pcap file from the SDM with
http://ipoffirewall/testpcapname/pcap
To stop the capture issue
no capture testpcapname
and don’t forget to delete your access list unless you want to use it later. This example was very basic but you could get pretty granular with the access list rules to only pickup the data that you absolutely need to troubleshoot an issue or just for fun.