Securing RANCID CVSWEB

24/02/2013

Update the 000-default file with the following details below to add basic authentication.

<VirtualHost *:80>

ServerAdmin webmaster@localhost

DocumentRoot /var/www

<Directory />

Options FollowSymLinks

AllowOverride None

order deny,allow

</Directory>

<Directory /var/www/>

Options Indexes FollowSymLinks MultiViews

AllowOverride none

order allow,deny

allow from all

</Directory>

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/

        <Directory “/usr/lib/cgi-bin”>

                AuthType Basic

                AuthName “CVS REPO”

                AuthUserFile /etc/apache2/.htpasswd

                AllowOverride All

                Require valid-user

</Directory>

The command below will allow you to create a new user and it will lead you through adding a password for that user.

network@S-ABD-RANCID:$ sudo htpasswd -c .htpasswd myuser


Cisco ASA, IPSEC bypass options (bozo)

24/02/2013

To permit ANY packets that come from an IPsec tunnel without checking any ACLs such as the OUTIDE_ACCESS_IN The following example enables IPsec traffic through the ASA without checking ACLs:

hostname(config)# sysopt connection permit-vpn


VTP (never use it) you need to know it

24/02/2013

VLAN TRUNKING PROTOCOL is designed to ease administration  of a large number of switches. It manages addistions, deletions and renaming. You can only apply one VTP domain to a switch.

There are 3 versions of VTP and only two of those are actively used (V3 is CAT/OS). VTP is a method of synchronising the vlan databases of switches. The term domain is used to identify a cluster/group of switches. If the databases are to be shared then the domain name and any passwords set must match (not totally true, read below for more details).

VTP advertisements are based upon the revision number and are sent when a change is made or every 5 minutes. The advertisments are multicast frames.

A summary advertisment is sent out every 300 seconds and if a change occurs.

A subset advertisment after a configuration change. VLAN name, SAID value, type and MTU.

A request from client switch used to obtain up to date information.

Each change made to a vlan will increase the revision number. A switch will compare revision numbers when it receives an advertisement. A switch will overwrite its VTP database if the update from one of it’s peers is higher (potentially making an automatic change to the assigned vlan’s). The advertisement is forwarded onto any neighbours. If the switch receives a VTP advertisement with a lower revision it will reply with it’s advertisement to update it’s neighbour.

The roles are:

SERVER: This is the default and will allow the switch to create, delete and rename vlan’s.

CLIENT: Apparently clients cannot make changes. However, I have seen events where client switches have been able to pass on updates to server peers.

TRANSPARENT: Allows the creation, deletion and renaming vlan’s but all information remains local. This mode will forward VTP information to its peers.

The use of show vtp status identifies the version in use, the revision number and the number of vlans that are being passed around via VTP.


Q-in-Q VLAN tunnels

24/02/2013

Q-in-Q allows already tagged frames across a network by tunnelling them inside a single vlan. The process adds a second 802.1Q tag to each frame. As the packets traverse the network the network the infrastructure see’s the outside tag and forwards based on that vlan. Q-in-Q tunnels are usually implemented by service providers to encapsulate a customers multiple vlans into a single vlan.

Eg: as a simple example

Customer vlans 1,2,3,4,5
Service provider vlan 100

Customer switch trunk vlans 1-5 —-> (service provider dot1q-tunnel vlan 100) ——> vlans 1-5

This is enabled with:

switchport mode dot1q-tunnel

The tunnel interfaces should be setup at either end of the overall link.


VLAN trunks

24/02/2013

ISL: Cisco proprietary and encapsulates the original frame in a 26 byte header and a 4 byte trailer. The ISL vlan’s are 1-1001.

802.1Q: Open standard and inserts a field in the 802.1P header, just after the source mac-address. The 802.1Q vlan’s are 0-4094.

If a mixture of ISL and 802.1Q is in use then the matching vlan’s can map across up to the ISL limit.

Points to note include if a non trunking port receives and ISL encapsulated frame then the frame is dropped. This is because the header and trailer cause the frame to exceed the MTU and may be counted as an error.
If an 802.1Q frame is received on a non trunking port then the source and destination mac-addresses are checked and the frame is switched normally at Layer2.


Dynamic Trunking

24/02/2013

DTP sends out adverisments every 30 seconds and ports can become a trunk either by configuration or dynamically. A port can be in one of five modes:

ACCESS: A user port in a single clan.

TRUNK: A port has negotiated its a trunk with its peer.

NON-NEGOTIATE: The port is a trunk and does not negotiate with any peers.

DYNAMIC DESIRABLE: Dynamically negotiates with its peer and will become a trunk if the other end is set to trunk,dynamic desirable or dynamic auto.

DYNAMIC AUTO: Passively waits to negotiate DTP with its peer. The peer must be configured as a trunk or dynamic desirable.


Cisco LWAP conversion from AP to LWAP

14/02/2013

The process of upgrading/downgrading the AP/LAP’s can be covered as with most networking in many ways. This method is one of my favourites and allows you to copy the code off of an existing LWAP node.

To copy off of an LWAP node:

archive upload-sw tftp:///c1130-rcvk9w8-mx.DEFAULT

Download IOS onto the device:

archive download-sw /force-reload /overwrite tftp:///c1130-rcvk9w8-mx.DEFAULT