Selam,

İki hafta boyunca maalesef neredeyse hiç ASA ile ilgilenemedim. Neredeyse unutmaya bile başladım denilebilir. Ancak bu hızda gidersem hiç bir zaman istediğim sertifikaları alamayacağımdan biraz hızlanmaya karar verdim. Bu geceleride dogru durust uyumamak anlamına geliyor ama. Bunlara rağmen videoları yapmaya devam etmek istiyorum. Cunku bana konuları anlamakta ve sonrasında hatırlamakta cok yardımcı oluyorlar. Aşağıda izleyeceğiniz video yine MPF ile ilgili. Ancak bu sefer MPF QoS yapmak için kullanılıyor.

 

 Bu arada başlangıç konfigürasyonlarını vermeye gerek duymuyorum. Çünkü üzerinde daha önceki videodan farklı bir başlangıç konfigürasyonu yok. ASA1 üzerinde gerekli NAT lar yapılmış ve access-listler ayarlanmış. ASA3 ise sadece içerideki client ın dış network e çıkması için konfigüre edilmiş durumda.

Hepinize iyi çalışmalar ve zaman ayırarak izlediğiniz için teşekkürler.

ASA Modular Policy Framework Kullanarak TCP Ayarlarını Düzenlemek

Selam

Bu video Service Policy'lerin TCP Bağlantı ayarlarınını yapmak için nasıl kullanılacağı ile ilgili. Video nun bazı yerlerinde biraz saçmalamışım. Örneğin sonunda TCP sequence number demem gerekirken TCP synchronization number demişim. Bir yerde paket veya prob demem gerekirken, flag demişim. Lütfen dinlerken bu hatalarımı mazur görün. Gecenin bir yarısında video yapmaya çalışınca böyle hatalar olabiliyor.  Ancak genel olarak baktığınızda konfigürasyonlar doğru ve çalışıyorlar. Buna rağmen eğer konu anlatımında veya konfigürasyonlarda önemli bir hata görürseniz lütfen paylaşın ki hem ben hatamı dezelteyim, hem de eğer başka birisi daha bu videoyu izleyecek olursa yanlış bilgiler edinmesin.

Başlangıç konfigürasyonları neredeyse bir önceki videodaki konfigürasyonlarla aynı. Ancak yine de göz gezdirmek isterseniz aşağıda başlangıç konfigürasyonlarını bulabilirsiniz.

=================================== ASA-1 =================================== ASA-1# sh run : Saved : ASA Version 8.4(2) ! hostname ASA-1 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface GigabitEthernet0 description *** INSIDE_NETWORK nameif inside security-level 100 ip address 10.100.1.1 255.255.255.0 ! interface GigabitEthernet1 description *** DMZ_NETWORK *** nameif dmz security-level 50 ip address 172.16.1.1 255.255.255.0 ! interface GigabitEthernet2 nameif outside security-level 0 ip address 22.22.22.33 255.255.255.252 ! interface GigabitEthernet3 shutdown no nameif no security-level no ip address ! interface GigabitEthernet4 shutdown no nameif no security-level no ip address ! interface GigabitEthernet5 shutdown no nameif no security-level no ip address ! ftp mode passive object network WWW_PRIVATE host 172.16.1.32 object network WWW_PUBLIC host 22.22.22.1 object network FTP_PRIVATE host 172.16.1.33 object network FTP_PUBLIC host 22.22.22.2 object network INSIDE_FTP_PRIVATE host 10.100.1.111 object network INSIDE_FTP_PUBLIC host 22.22.22.23 object network DNS_PRIVATE host 172.16.1.200 object network DNS_PUBLIC host 22.22.22.3 access-list outside_access extended permit tcp any object INSIDE_FTP_PRIVATE eq ftp access-list outside_access extended permit tcp any object WWW_PRIVATE eq www access-list outside_access extended permit tcp any object FTP_PRIVATE eq ftp access-list outside_access extended permit icmp any any time-exceeded 0 access-list outside_access extended permit icmp any any unreachable 3 access-list outside_access extended permit tcp any object DNS_PRIVATE eq telnet access-list outside_access extended permit tcp any object WWW_PRIVATE eq telnet ! tcp-map BGP_MD5_OPTION_19 tcp-options range 19 19 allow ! pager lines 24 logging console debugging mtu inside 1500 mtu dmz 1500 mtu outside 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-647.bin no asdm history enable arp timeout 14400 ! object network WWW_PRIVATE nat (dmz,outside) static WWW_PUBLIC object network FTP_PRIVATE nat (dmz,outside) static FTP_PUBLIC object network INSIDE_FTP_PRIVATE nat (inside,outside) static INSIDE_FTP_PUBLIC object network DNS_PRIVATE nat (dmz,outside) static DNS_PUBLIC access-group outside_access in interface outside ! router ospf 10 router-id 111.111.111.111 network 10.100.1.1 255.255.255.255 area 0 network 172.16.1.1 255.255.255.255 area 0 log-adj-changes default-information originate ! route outside 0.0.0.0 0.0.0.0 22.22.22.34 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL http server enable http 10.100.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart telnet 10.100.1.0 255.255.255.0 inside telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect ftp inspect icmp ! service-policy global_policy global prompt hostname context no call-home reporting anonymous crashinfo save disable Cryptochecksum:c75282a25b34e3142d634bc1125ed898 : end ============================================== ASA3 ============================================== ASA-3# sh run : Saved : ASA Version 8.4(2) ! hostname ASA-3 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface GigabitEthernet0 nameif inside security-level 100 ip address 10.100.1.1 255.255.255.0 ! interface GigabitEthernet1 nameif outside security-level 0 ip address 41.21.12.2 255.255.255.252 ! interface GigabitEthernet2 nameif outside2 security-level 99 ip address 41.21.13.2 255.255.255.252 ! interface GigabitEthernet3 shutdown no nameif no security-level no ip address ! interface GigabitEthernet4 shutdown no nameif no security-level no ip address ! interface GigabitEthernet5 shutdown no nameif no security-level no ip address ! ftp mode passive same-security-traffic permit intra-interface object network INSIDE_NETWORK subnet 10.100.1.0 255.255.255.0 object network INSIDE_CLIENT host 10.100.1.111 object network OUTSIDE_2 subnet 41.21.13.0 255.255.255.252 object network OUTSIDE subnet 41.21.12.0 255.255.255.252 pager lines 24 logging console debugging mtu inside 1500 mtu outside 1500 mtu outside2 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-647.bin no asdm history enable arp timeout 14400 nat (outside2,outside) source static OUTSIDE_2 OUTSIDE_2 destination static OUTSIDE OUTSIDE ! object network INSIDE_NETWORK nat (inside,outside) dynamic interface object network OUTSIDE_2 nat (outside2,outside) dynamic interface ! router ospf 10 router-id 33.33.33.33 network 41.21.13.2 255.255.255.255 area 0 log-adj-changes ! route outside 0.0.0.0 0.0.0.0 41.21.12.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL http server enable http 10.100.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart telnet 10.100.1.0 255.255.255.0 inside telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect icmp inspect ftp ! service-policy global_policy global prompt hostname context no call-home reporting anonymous crashinfo save disable Cryptochecksum:4ff769cbb03b5a1b140ccdac5a437a64 : end ======================================= R7 ======================================= INTERNAL_DNS#sh run Building configuration... Current configuration : 2940 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname INTERNAL_DNS ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! no ip domain lookup ip domain name lab.local ip host levent.com 172.16.1.32 ip host company-B.com 84.1.1.1 ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address duplex auto speed auto ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet1/0 ip address 172.16.1.200 255.255.255.0 duplex auto speed auto ! router ospf 10 router-id 7.7.7.7 log-adjacency-changes network 172.16.1.200 0.0.0.0 area 0 ! ip forward-protocol nd ! ! ip http server ip http authentication local ip http secure-server ip dns server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 exec-timeout 0 0 logging synchronous login local transport input telnet ssh ! ! end ======================================= R1 ======================================= R1#sh run Building configuration... Current configuration : 2894 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R1 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface Serial0/0 ip address 81.1.1.1 255.255.255.252 clock rate 2000000 ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet1/0 ip address 22.22.22.34 255.255.255.252 duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Serial0/0 ip route 22.22.22.0 255.255.255.224 FastEthernet1/0 ! ! ip http server ip http authentication local ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end =================================== ML-SW1 =================================== ML_SW1#sh run Building configuration... Current configuration : 3957 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname ML_SW1 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 no ip routing no ip cef ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address no ip route-cache shutdown duplex auto speed auto ! interface FastEthernet0/1 no ip address no ip route-cache shutdown duplex auto speed auto ! interface FastEthernet1/0 description ASA_1-Gig0-IN switchport access vlan 100 spanning-tree portfast ! interface FastEthernet1/1 description ASA_1-Gig1-DMZ switchport access vlan 200 spanning-tree portfast ! interface FastEthernet1/2 description ASA_1-Gig2-OUT switchport access vlan 300 spanning-tree portfast ! interface FastEthernet1/3 ! interface FastEthernet1/4 ! interface FastEthernet1/5 description SW1_DMZ switchport access vlan 200 ! interface FastEthernet1/6 description SW2_IN switchport access vlan 100 ! interface FastEthernet1/7 description R1_Perimeter_Fa1/0 switchport access vlan 300 spanning-tree portfast ! interface FastEthernet1/8 ! interface FastEthernet1/9 ! interface FastEthernet1/10 description ASA_2-Gig0-IN switchport access vlan 100 spanning-tree portfast ! interface FastEthernet1/11 description ASA_2-Gig1-DMZ switchport access vlan 200 spanning-tree portfast ! interface FastEthernet1/12 description ASA_2-Gig2-OUT switchport access vlan 300 spanning-tree portfast ! interface FastEthernet1/13 ! interface FastEthernet1/14 ! interface FastEthernet1/15 ! interface Vlan1 no ip address no ip route-cache ! interface Vlan100 ip address 10.100.1.253 255.255.255.0 ! ip default-gateway 10.100.1.1 ip forward-protocol nd ! ! ip http server ip http authentication local ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ============================= R6 ============================= R6#sh run Building configuration... Current configuration : 3034 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R6 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! interface FastEthernet0/0 ip address 10.100.2.1 255.255.255.0 ip nat inside ip virtual-reassembly duplex auto speed auto ! interface Serial0/0 ip address 86.1.1.1 255.255.255.252 ip nat outside ip virtual-reassembly clock rate 2000000 ! interface FastEthernet0/1 ip address 16.1.1.1 255.255.255.0 duplex auto speed auto ! interface FastEthernet1/0 no ip address shutdown duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Serial0/0 ! ! ip http server ip http authentication local ip http secure-server ip nat inside source list NAT interface Serial0/0 overload ! ip access-list extended NAT permit ip 10.100.2.0 0.0.0.255 any ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ================================== R8 ================================== R8#sh run Building configuration... Current configuration : 3295 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R8 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! ! ! no ip domain lookup ip domain name lab.local ip host company-B.com 84.1.1.1 ip host levent.com 22.22.22.1 ip host ftp.levent.com 22.22.22.2 ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface Loopback0 ip address 8.8.8.8 255.255.255.255 ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface Serial0/0 ip address 81.1.1.2 255.255.255.252 clock rate 2000000 ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface Serial0/1 ip address 86.1.1.2 255.255.255.252 clock rate 2000000 ! interface Serial0/2 ip address 85.1.1.2 255.255.255.252 clock rate 2000000 ! interface Serial0/3 ip address 84.1.1.2 255.255.255.252 clock rate 2000000 ! ip forward-protocol nd ip route 16.1.1.0 255.255.255.0 86.1.1.1 ip route 22.22.22.0 255.255.255.192 Serial0/0 ip route 41.21.12.0 255.255.255.252 Serial0/3 ip route 41.21.13.0 255.255.255.0 Serial0/3 ! ! ip http server ip http authentication local ip http secure-server ip dns server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ================================= R4 ================================= R4#sh run Building configuration... Current configuration : 2902 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R4 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address duplex auto speed auto ! interface Serial0/0 ip address 84.1.1.1 255.255.255.252 ip virtual-reassembly clock rate 2000000 ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet1/0 ip address 41.21.12.1 255.255.255.0 duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Serial0/0 ip route 41.21.13.0 255.255.255.0 FastEthernet1/0 ! ! ip http server ip http authentication local ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ======================================= R11 ======================================= R11#sh run Building configuration... Current configuration : 1138 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R11 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet1/0 ip address 41.21.13.1 255.255.255.252 duplex auto speed auto ! router ospf 10 log-adjacency-changes network 41.21.13.1 0.0.0.0 area 0 ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 41.21.13.2 ! ! no ip http server no ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 exec-timeout 0 0 logging synchronous login local ! ! end ===========================================

Umarım faydalı olabilmişimdir. Herkese iyi çalışmalar.

CISCO CATALYST Switch ile 3.Parti SFP'leri Kullanmak

Merhaba,

Geçenlerde arkadaşımın aldığı ikinci el bir 3750 switch'i denemek için cisco olmayan SFP ler kullanmak istedik. Switch'in konsoluna bağlandık ve SFP modülü yerleştirdik. Modül yerine oturduğu gibi aşağıdakine benzer bir hata ile karşılaştık.

%PHY-4-UNSUPPORTED_TRANSCEIVER: Unsupported transceiver found in Gi0/1

%GBIC_SECURITY_CRYPT-4-VN_DATA_CRC_ERROR: GBIC in port 65538 has bad crc

Hemen arkasından port err-disable konumuna düştü.

CONFIGURE REPLACE Komutunu Kullanmak

Merhaba,

Bildiğiniz gibi cisco cihazlar üzerinde bir yaptığımız bir konfigürasyonu kaydetmek için her ya "write memory" ya da "copy running-config startup-config" komutlarını kullanırız. Bu komutun yaptığı işlem kayıtlı olan startup konfigürasyonunu silmek, çalışan konfigürasyonun bir kopyasını alıp startup konfigürasyonu yapmaktır. Ancak bu komutun tersi bu şekilde çalışmaz. Eğer "copy start run" yaparsanız startup konfigürasyon ile running konfigürasyonu birleştirecektir. Eğer üretimde kullanılan bir cihazda running konfigürasyonu değiştirirseniz ve yaptığınız bazı değişikliklerin yanlış olduğuna karar verip tekrar eski konfigürasyona dönmek için copy start run" komutunu kullanırsanız, sonuç hayal kırıklığı olabilir. Bunu bir örnek ile açıklayalım.

ASA Modular Policy Framework L3/L4 Konfigurasyonu

Merhaba,

İzleyeceğiniz video da, Service Policy'nin çok basit anlamda MPF kullanılarak nasıl konfigüre edildiğini ve mantığını, icmp traceroute ve ftp gibi protocoller kullanılarak anlatmaya çalıştım. Bu video içerisindeki örnekler service policy'nin sadece L3/L4 inspection için nasıl kullanıldığı ile ilgili örneklerdir.

Aşağıda kullanılan cihazların başlangıç konfigürasyonlarını bulabilirsiniz. Her ne kadar başlangıç konfigürasyonları içinde interface konfigürasyonları ve static route'lar dışında bir konfigürasyon olmasa bile başlangıç konfigleri bazen gerekli olabiliyor.

============================================================ R10 ============================================================ R10#sh run Building configuration... Current configuration : 896 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R10 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated username cisco privilege 15 password 0 cisco ! ! archive log config hidekeys ! ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface FastEthernet0/1 ip address 16.1.1.2 255.255.255.0 duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 FastEthernet0/1 ! ! no ip http server no ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local ! ! end ================================================================= ASA-1 ================================================================= ASA-1# sh run : Saved : ASA Version 8.4(2) ! hostname ASA-1 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface GigabitEthernet0 description *** INSIDE_NETWORK nameif inside security-level 100 ip address 10.100.1.1 255.255.255.0 ! interface GigabitEthernet1 description *** DMZ_NETWORK *** nameif dmz security-level 50 ip address 172.16.1.1 255.255.255.0 ! interface GigabitEthernet2 nameif outside security-level 0 ip address 22.22.22.33 255.255.255.252 ! interface GigabitEthernet3 shutdown no nameif no security-level no ip address ! interface GigabitEthernet4 shutdown no nameif no security-level no ip address ! interface GigabitEthernet5 shutdown no nameif no security-level no ip address ! ftp mode passive object network WWW_PRIVATE host 172.16.1.32 object network WWW_PUBLIC host 22.22.22.1 object network FTP_PRIVATE host 172.16.1.33 object network FTP_PUBLIC host 22.22.22.2 object network INSIDE_FTP_PRIVATE host 10.100.1.111 object network INSIDE_FTP_PUBLIC host 22.22.22.23 object network DNS_PRIVATE host 172.16.1.200 object network DNS_PUBLIC host 22.22.22.3 access-list outside_access extended permit tcp any object INSIDE_FTP_PRIVATE eq ftp access-list outside_access extended permit tcp any object WWW_PRIVATE eq www access-list outside_access extended permit tcp any object FTP_PRIVATE eq ftp pager lines 24 logging console debugging mtu inside 1500 mtu dmz 1500 mtu outside 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-647.bin no asdm history enable arp timeout 14400 ! object network WWW_PRIVATE nat (dmz,outside) static WWW_PUBLIC object network FTP_PRIVATE nat (dmz,outside) static FTP_PUBLIC object network INSIDE_FTP_PRIVATE nat (inside,outside) static INSIDE_FTP_PUBLIC object network DNS_PRIVATE nat (dmz,outside) static DNS_PUBLIC access-group outside_access in interface outside ! router ospf 10 router-id 111.111.111.111 network 10.100.1.1 255.255.255.255 area 0 network 172.16.1.1 255.255.255.255 area 0 log-adj-changes default-information originate ! route outside 0.0.0.0 0.0.0.0 22.22.22.34 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL http server enable http 10.100.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart telnet 10.100.1.0 255.255.255.0 inside telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect ftp ! service-policy global_policy global prompt hostname context no call-home reporting anonymous crashinfo save disable Cryptochecksum:dfca605ecef317ead3e6456aead8181b : end ================================================================= R6 ================================================================= R6#sh run Building configuration... Current configuration : 3034 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R6 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! interface FastEthernet0/0 ip address 10.100.2.1 255.255.255.0 ip nat inside ip virtual-reassembly duplex auto speed auto ! interface Serial0/0 ip address 86.1.1.1 255.255.255.252 ip nat outside ip virtual-reassembly clock rate 2000000 ! interface FastEthernet0/1 ip address 16.1.1.1 255.255.255.0 duplex auto speed auto ! interface FastEthernet1/0 no ip address shutdown duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Serial0/0 ! ! ip http server ip http authentication local ip http secure-server ip nat inside source list NAT interface Serial0/0 overload ! ip access-list extended NAT permit ip 10.100.2.0 0.0.0.255 any ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ============================================================= R8 ============================================================= R8#sh run Building configuration... Current configuration : 3251 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R8 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! no ip domain lookup ip domain name lab.local ip host company-B.com 84.1.1.1 ip host levent.com 22.22.22.1 ip host ftp.levent.com 22.22.22.2 ! multilink bundle-name authenticated ! ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface Loopback0 ip address 8.8.8.8 255.255.255.255 ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface Serial0/0 ip address 81.1.1.2 255.255.255.252 clock rate 2000000 ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface Serial0/1 ip address 86.1.1.2 255.255.255.252 clock rate 2000000 ! interface Serial0/2 ip address 85.1.1.2 255.255.255.252 clock rate 2000000 ! interface Serial0/3 ip address 84.1.1.2 255.255.255.252 clock rate 2000000 ! ip forward-protocol nd ip route 16.1.1.0 255.255.255.0 86.1.1.1 ip route 22.22.22.0 255.255.255.192 Serial0/0 ip route 41.21.12.0 255.255.255.252 Serial0/3 ! ! ip http server ip http authentication local ip http secure-server ip dns server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ========================================================= R1 ========================================================= R1#sh run Building configuration... Current configuration : 2894 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R1 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address shutdown duplex auto speed auto ! interface Serial0/0 ip address 81.1.1.1 255.255.255.252 clock rate 2000000 ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet1/0 ip address 22.22.22.34 255.255.255.252 duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Serial0/0 ip route 22.22.22.0 255.255.255.224 FastEthernet1/0 ! ! ip http server ip http authentication local ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ======================================================= ML-SW1 ======================================================= ML_SW1#sh run Building configuration... Current configuration : 3957 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname ML_SW1 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 no ip routing no ip cef ! ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address no ip route-cache shutdown duplex auto speed auto ! interface FastEthernet0/1 no ip address no ip route-cache shutdown duplex auto speed auto ! interface FastEthernet1/0 description ASA_1-Gig0-IN switchport access vlan 100 spanning-tree portfast ! interface FastEthernet1/1 description ASA_1-Gig1-DMZ switchport access vlan 200 spanning-tree portfast ! interface FastEthernet1/2 description ASA_1-Gig2-OUT switchport access vlan 300 spanning-tree portfast ! interface FastEthernet1/3 ! interface FastEthernet1/4 ! interface FastEthernet1/5 description SW1_DMZ switchport access vlan 200 ! interface FastEthernet1/6 description SW2_IN switchport access vlan 100 ! interface FastEthernet1/7 description R1_Perimeter_Fa1/0 switchport access vlan 300 spanning-tree portfast ! interface FastEthernet1/8 ! interface FastEthernet1/9 ! interface FastEthernet1/10 description ASA_2-Gig0-IN switchport access vlan 100 spanning-tree portfast ! interface FastEthernet1/11 description ASA_2-Gig1-DMZ switchport access vlan 200 spanning-tree portfast ! interface FastEthernet1/12 description ASA_2-Gig2-OUT switchport access vlan 300 spanning-tree portfast ! interface FastEthernet1/13 ! interface FastEthernet1/14 ! interface FastEthernet1/15 ! interface Vlan1 no ip address no ip route-cache ! interface Vlan100 ip address 10.100.1.253 255.255.255.0 ! ip default-gateway 10.100.1.1 ip forward-protocol nd ! ! ip http server ip http authentication local ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ML_SW1# ML_SW1#sh interface statu Port Name Status Vlan Duplex Speed Type Fa1/0 ASA_1-Gig0-IN connected 100 a-full a-100 10/100BaseTX Fa1/1 ASA_1-Gig1-DMZ connected 200 a-full a-100 10/100BaseTX Fa1/2 ASA_1-Gig2-OUT connected 300 a-full a-100 10/100BaseTX Fa1/3 notconnect 1 auto auto 10/100BaseTX Fa1/4 notconnect 1 auto auto 10/100BaseTX Fa1/5 SW1_DMZ connected 200 a-full a-100 10/100BaseTX Fa1/6 SW2_IN connected 100 a-full a-100 10/100BaseTX Fa1/7 R1_Perimeter_Fa1/0 connected 300 a-full a-100 10/100BaseTX Fa1/8 notconnect 1 auto auto 10/100BaseTX Fa1/9 notconnect 1 auto auto 10/100BaseTX Fa1/10 ASA_2-Gig0-IN connected 100 a-full a-100 10/100BaseTX Fa1/11 ASA_2-Gig1-DMZ connected 200 a-full a-100 10/100BaseTX Fa1/12 ASA_2-Gig2-OUT connected 300 a-full a-100 10/100BaseTX Fa1/13 notconnect 1 auto auto 10/100BaseTX Fa1/14 notconnect 1 auto auto 10/100BaseTX Fa1/15 notconnect 1 auto auto 10/100BaseTX ================================================= R7 ================================================= INTERNAL_DNS#sh run Building configuration... Current configuration : 2922 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname INTERNAL_DNS ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! ! no ip domain lookup ip domain name lab.local ip host levent.com 172.16.1.32 ip host company-B.com 84.1.1.1 ! multilink bundle-name authenticated ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address duplex auto speed auto ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet1/0 ip address 172.16.1.200 255.255.255.0 duplex auto speed auto ! router ospf 10 router-id 7.7.7.7 log-adjacency-changes network 172.16.1.200 0.0.0.0 area 0 ! ip forward-protocol nd ! ! ip http server ip http authentication local ip http secure-server ip dns server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end ========================================================= ASA-3 ========================================================= ASA-3(config)# sh run : Saved : ASA Version 8.4(2) ! hostname ASA-3 enable password 8Ry2YjIyt7RRXU24 encrypted passwd 2KFQnbNIdI.2KYOU encrypted names ! interface GigabitEthernet0 nameif inside security-level 100 ip address 10.100.1.1 255.255.255.0 ! interface GigabitEthernet1 nameif outside security-level 0 ip address 41.21.12.2 255.255.255.252 ! interface GigabitEthernet2 shutdown no nameif no security-level no ip address ! interface GigabitEthernet3 shutdown no nameif no security-level no ip address ! interface GigabitEthernet4 shutdown no nameif no security-level no ip address ! interface GigabitEthernet5 shutdown no nameif no security-level no ip address ! ftp mode passive object network INSIDE_NETWORK subnet 10.100.1.0 255.255.255.0 pager lines 24 logging console debugging mtu inside 1500 mtu outside 1500 no failover icmp unreachable rate-limit 1 burst-size 1 asdm image disk0:/asdm-647.bin no asdm history enable arp timeout 14400 ! object network INSIDE_NETWORK nat (inside,outside) dynamic interface route outside 0.0.0.0 0.0.0.0 41.21.12.1 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 dynamic-access-policy-record DfltAccessPolicy user-identity default-domain LOCAL http server enable http 10.100.1.0 255.255.255.0 inside no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart telnet 10.100.1.0 255.255.255.0 inside telnet timeout 5 ssh timeout 5 console timeout 0 threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15 ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect icmp inspect ftp policy-map type inspect ftp benim parameters ! service-policy global_policy global prompt hostname context no call-home reporting anonymous crashinfo save disable Cryptochecksum:9f9398ce2a97aa56a5266643bb743c3f : end ============================================================== R4 ============================================================== R4#sh run Building configuration... Current configuration : 2852 bytes ! version 12.4 service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname R4 ! boot-start-marker boot-end-marker ! ! no aaa new-model memory-size iomem 5 ip cef ! no ip domain lookup ip domain name lab.local ! multilink bundle-name authenticated ! ! ! username cisco privilege 15 password 0 cisco archive log config hidekeys ! ! ip ssh version 2 ! ! interface FastEthernet0/0 no ip address duplex auto speed auto ! interface Serial0/0 ip address 84.1.1.1 255.255.255.252 ip virtual-reassembly clock rate 2000000 ! interface FastEthernet0/1 no ip address shutdown duplex auto speed auto ! interface FastEthernet1/0 ip address 41.21.12.1 255.255.255.0 duplex auto speed auto ! ip forward-protocol nd ip route 0.0.0.0 0.0.0.0 Serial0/0 ! ! ip http server ip http authentication local ip http secure-server ! ! control-plane ! ! line con 0 exec-timeout 0 0 privilege level 15 logging synchronous line aux 0 exec-timeout 0 0 privilege level 15 logging synchronous line vty 0 4 logging synchronous login local transport input telnet ssh ! ! end

Herkese iyi çalışmalar.

877 Router Bridge Mode

Merhaba Cisco 877 router'ı bridge modda kullanmak için gereken konfigürasyonu aşağıda bulabilirsiniz. Aslında tek yapılacak olan bir adet bridge grup oluşturmak ve iki interface i bu bridge group'a atamak.

version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
!
!
dot11 syslog
no ip routing
no ip cef
!
!
archive
log config
hidekeys
!
interface ATM0
no ip address
no ip route-cache
no atm ilmi-keepalive
dsl operating-mode auto
!
interface ATM0.1 point-to-point
no ip route-cache
atm route-bridged ip
pvc 8/35
encapsulation aal5snap
!
bridge-group 1
!
interface FastEthernet0
switchport access vlan 1
!
interface FastEthernet1
shutdown
!
interface FastEthernet2
shutdown
!
interface FastEthernet3
shutdown
!
interface Vlan1
no ip address
no ip route-cache
bridge-group 1
!
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
control-plane
!
bridge 1 protocol ieee
!
line con 0
no modem enable
line aux 0
line vty 0 4
!
scheduler max-task-time 5000
end

ASA MPF Konu Anlatımı

Merhaba

Aşağıdaki videoda CCNP Security Firewall sınavının en önemli konularından bir tanesi olan MPF hakkında bilgiler bulabilirsiniz. Şu an itibari ile sadece konu anlatımı var ancak yakın bir zamanda L3/L4 Inspection, L7 inspection, TCP normalization ve yapabilirsem QoS (policing) ile ilgili örnekler yapmaya çalışacağım.

Hepinize iyi çalışmalar,

ASA NAT Konu Anlatımı ve Konfigürasyon Örnekleri

Bu videoları hazırlamak zevkli olmasına rağmen biraz uğraştırıcı oldu. Bunun nedeni FIREWALL sınavında NAT konusu hem 8.2 ve öncesi NAT'ı, hem de 8.3 ve sonrası NAT'ı kapsıyor. Ayrıca çok fazla konfigürasyon örneği var. Bunun yanında son videoda bonus olarak overlapped networklerin birbirleri ile nasıl konuşacağına dair bir kısım var. Bu normalde sadece bir iki satır olarak kitapta işleniyor. Çünkü konunun tamamı NAT ile ilişkili değil. Ama NAT kısmını gösterebilmek için ben biraz daha fazlasını açıklamak zorunda kaldım sanırım. Umarım videolar sizin için yararlı olur.

hepinize iyi çalışmalar.

ASA Firewall Mode Konu Anlatımı ve Konfigürasyon Örneği

Selam

Umarım hem anlatımı hem de örnek yeterince açıklayıcı ve öğretici olmuştur.

iyi çalışmalar.

ASA Multiple Context Konu Anlatımı ve Konfigürasyon Örneği

İlk video da multiple Context ile ilgili konu anlatımı bulabilirsiniz.

ikinci video ise konu anlatımı sırasında öğrenilenlerin GNS kullanılarak uygulamasına ilişkindir.

Hepinize iyi çalışmalar.

ASA üzerinde DHCP ve DHCPRelay

Lafı çok uzatmadan videoları teker teker ekleyeceğim. Zaten videolar içerisinde gerekli olan tüm açıklamaları bulabilirsiniz.

ASA üzerinde DEFAULT ROUTE ve OSPF Konfigürasyonları

Merhaba,

İlk post'umda belirtiğim gibi CCNP Security sınavlarına hazırlanıyorum. Bu sınavlardan birisi olan FIREWALL sınavı için yani 642-618 numaralı sınav için 5-6 videoyu bu blog'u daha hazırlamadan önce kaydetmiştim. Bundan dolayı başlangıç konfigürasyonları ve video içerisinde yaptığım konfigürasyonları yazılı olarak post'lara ekleyemeceğim. Ancak bu tarihten sonra hazırladığım her video için bu konfigleri post içerisinde bulabileceksiniz. Hepinize iyi çalışmalar.

Cisco 800 Serisi Router üzerinde VDSL konfigürasyonu

Selam,

Bu post'ta paylaşmak istediğim  cisco 800 serisi router üzerinde VDSL konfigürasyonunun nasıl yapıldığı. Aslında ADSL den farklı olarak tek yapmamız gereken ATM interface'i yerine ethernet interface'ini konfigüre etmek.

İlk olarak ethernet interface'ini enable ediyoruz.

interface Ethernet0
no ip address
no shutdown

Daha sonra bir subinterface oluşturmamız gerekiyor. Burada önemli olan subinterface oluştururken hangi VLAN tag'ını kullanmanız gerektiği. Bildiğim kadarı ile TÜRKİYE için 35. Subinterface altında iken  bu interface'i daha sonra oluşturacağımız dialer interface'ine bağlamayı da unutmuyoruz.

interface Ethernet0.35
encapsulation dot1Q 35
pppoe-client dial-pool-number 1