RE: ip directed broadcast
Hi, The removal of directed-brooadcasts is one of the security messures that is being taken place on the router. The IP directed broadcast is a datagram which is sent to the broadcast address of a subnet to which the sending machine is not directly attached. The directed broadcast is routed through the network as a unicast packet until it arrives at the target subnet, where it is converted into a link-layer broadcast. The directed-broadcasts arp being used in the extremely common and popular "smurf" denial of service attack, and can also be used in related attacks. I hope it helps Gil -Original Message- From: Howard C. Berkowitz [mailto:[EMAIL PROTECTED]] Sent: ??? ??? 05 ?? 2001 06:13 To: [EMAIL PROTECTED] Subject: Re: ip directed broadcast >hi all > >anyone knows why no ip directed broadcast is always >set for any interfaces? > > >regards, > >suaveguru RFC 2644 Changing the Default for Directed Broadcasts in Routers. D. Senie. August 1999. (Format: TXT=6820 bytes) (Updates RFC1812) (Also BCP0034) (Status: BEST CURRENT PRACTICE) _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: telnet access to pix
Hi, The PIX firewall doesn't support telnet through the outside interface, the exception to that is if the telnet session is through a secured connection via VPN & needless to say that you need to configure the telnet server to accept specific IP's. # In the future OS versions, as far as I know, it will be possible, it is on Cisco's road map. Gil -Original Message- From: Frank Kim [mailto:[EMAIL PROTECTED]] Sent: ??? 09 ?? 2001 22:42 To: [EMAIL PROTECTED] Subject: telnet access to pix Hey guys, I got eth0= security0 and eth1=security100. I'm able to telnet from the inside network. Is there any way for me to telnet from the outside? Pix has disabled this by default. -Frank _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
PIX SSH
Hi all, A couple of weeks ago I have red on this mailing list that remote connection to the PIX firewall is possible not only through IPSEC tunnels but also by using SSH. If so I will appreciate it if someone will send me a brief explanation about how it is done and a configuration example. The Cisco's site surprisingly didn't give a satisfying explanation. Thank you in advance Gil _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: Access list to deny IPSEC on C1600
Hi, The IPSEC protocol uses UDP port 500. Gil -Original Message- From: Damien Kelly [mailto:[EMAIL PROTECTED]] Sent: ??? ??? 12 ??? 2001 12:33 To: '[EMAIL PROTECTED]' Subject: Access list to deny IPSEC on C1600 Hi All One of our office is on ISDN dialup and has a firewall behind it on the LAN, we have an issue with the line connecting to the ISP every min, 24 x 7, as you can imagine the ISDN bill is huge. We have determined the VPN link is cauing the dialup's. The Cisco is a 1603, I want to create an accesslist, But don't know how to define protocol 50 ( IPSEC ), as it isn't really TCP or UDP Can I set an access list as follows Access-list 101 deny IP any any eq 50 Or do I need to replace the IP with a different definition Any Suggestions ( If I can get the IPSec definition, I may create a timebased accesslist, so as not to defeat the purpose of the VPN. ) Thanks Damien Kelly ** The information contained in this message is confidential and is intended for the addressee(s) only. If you have received this message in error or there are any problems please notify the originator immediately. The unauthorised use, disclosure, copying or alteration of this message is strictly forbidden. This message and any attachments have been scanned for viruses. Orbiscom Ltd. will not be liable for direct, special, indirect or consequential damages arising from alteration of the contents of this message by a third party or as a result of any virus being passed on. www.Orbiscom.com ** _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: a real bgp question
Hi, I can really relate to that problem, I faced it about a year and a half ago while a client of mine wanted to divide the traffic in to categories, European traffic and U.S traffic and all the reset doesn't really matter to him. The way I though of was involved in a lot of dirty work, I used the ARIN database to find all the European and the U.S AS's, after I had the two lists I started building appropriate regular expressions to all of the statements. After having finishing writing all the regular expressions you need to attach them to a route-map which will specify the properties of the regular expressions, by using the local-preference attribute for setting it's a path and for it transitive property in the IBGP peering. In the end after finishing all those tasks and you want to try and fixing the returning traffic, set another route-map that it's purpose is to prepend additional AS's to your networks advertisement. O.K good lack and I hope I have helped you. Gil -Original Message- From: Dean [mailto:[EMAIL PROTECTED]] Sent: ??? 16 ??? 2001 17:40 To: [EMAIL PROTECTED] Subject: a real bgp question Dear group, I come across a real bgp question in my work,that is: I want to load balance and backup between my 2 ISPs,they also have their own AS numbers and have a direct connection between them as well,I use 2 edge router running iBGP with eachother and eBGP with my 2 ISPs.The question is : .if I want to make the traffic for ISP1's AS pass through one connection and the other traffic for Internet through ISP2,how to config my edge router in my one AS? .if I have 2 ASs,what about the story? Avobe 2 conditions,does it need some config in my ISPs BGP neighboors? I am appreciated if you can give me some idea. TIA Dean _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Security terminology
Hi, Does any body know what the term "Security forensic" refers to ? Thank you in advance Gil _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: Wierd PIX issue - Long
Hi, Try disabling the fix option for the SMTP, as far as I remember there is a bug regarding fixup protocols in the 5.3(1) PIX version. Gil -Original Message- From: Eric McMasters [mailto:[EMAIL PROTECTED]] Sent: ??? ? 22 ??? 2001 03:59 To: [EMAIL PROTECTED] Subject: Wierd PIX issue - Long I have PIX 515 w/5.3(1) IOS running and I ran into a problem with SMTP connectivity between two Exchange servers. I have the FW opened up to allow SMTP between Server 1 and Server 2 and everything seemed okay. Now here is the freaky problem. Server 1 receives inbound email just fine, but its outbound email to Server 2 will sit in the queue for a random amount of time before being sent. I hooked up a Sniffer between Server 1 and the FW and the majority of the traffic between the two servers showed "No Response". When I decoded the traffic it looked like Server 1 was sending a reset (RSET) to Server 2 and that is what was causing the problem. After some research on CCO I found an incompatibility with older PIX IOS versions and the "Mailguard" feature. It seems that the Mailguard feature didn't support "ESMTP", which these Exchange servers are using. I thought I had found the problem until I did a little bit more digging and found that this was fixed in IOS 5.2(2) and later with the new support of RFC 1869 for SMTP Service Extensions. So this shouldn't be an issue. The thing that is throwing me off is that A.) Inbound email to Server 1 has no problem. B.) The server admin setup a test servers and both inbound and outbound traffic worked fine through the PIX. C.) Server 2 isn't having any problems getting through the FW. Now here is the kicker...D.) When I disabled "Mailguard" everything is said to be working normally!! I might be paranoid, but I'm starting to think the Exchange guys made some changes on Server 1 and are trying to lead me to believe that it was my FW, but I'm having a hard time dealing with that. The whole denial thing of nothing ever going wrong with Cisco :-|, and the fact that I wasn't involved in the final stage of the troubleshooting. I don't trust many people. Anywayif anyone has ever run into this problem or something similar I would like to hear your story. TIA for all and any responses to my incoherent pleas for mercy! Eric _ Get your FREE download of MSN Explorer at http://explorer.msn.com _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Cisco VPN client
Hi, I was wondering in what fashion the softnet/soft-pk software works, capi,pkcsii, etc. Thank you in advance Gil Shulman _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
PIX virtual telnet
Hi, I have a Cisco PIX firewall with OS version 5.3.1. I am trying to implement the virtual telnet feature for authentication, from some reason when I am trying to attach an access-list to the aaa authentication statement it gives me the following error massage "do not support hybrid configuration". If someone have any idea what the man in the machine wants from me or have any suggestions how to overcome that problem I will appreciate his or her help. Thank you in advance Gil _ FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
7100 VPN Router [7:1213]
Hi everyone, Does anyone know if I can perform differant types of QoS to a VPN with respect to a LDAP server? Thank you in advance Gil Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=1213&t=1213 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: Pix 6.0 debut? Anyone know when? Thanks [7:1780]
Hi The PIX 6.0 version is suppose to be released on May 11th. Enjoy -Original Message- From: Dropped Packet [mailto:[EMAIL PROTECTED]] Sent: Tuesday, April 24, 2001 11:40 PM To: [EMAIL PROTECTED] Subject: Pix 6.0 debut? Anyone know when? Thanks [7:1780] _ Get your FREE download of MSN Explorer at http://explorer.msn.com FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED] Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=2714&t=1780 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
PIX authentication and authorization [7:3832]
Hi all, I am trying to configure my PIX to perform user authentication against a Steel-Belted Radius server. My final goal is not cut-through proxy, but user authentication. I want to configure different types of users with different authorizations to different services (not only ftp, telnet , http, smtp) like ICMP, SSH and etc, like users profiles, by performing some type of authentication action. (For the people of knows the Checkpoint Firewall-1 something like Client Authentication) Any help will be appreciated Thank you in advance Gil Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=3832&t=3832 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: any one want talk about alteon?? [7:9720]
What version? -Original Message- From: amanda [mailto:[EMAIL PROTECTED]] Sent: Monday, June 25, 2001 5:43 AM To: [EMAIL PROTECTED] Subject: any one want talk about alteon?? [7:9720] where can i found the operating manual of WebOs Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=9766&t=9720 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Traffic diversion [7:35018]
Hi all, Does any body know how can I divert all traffic transparently from an ATM interface to an Ethernet interface in order to examine all IP traffic ? Thank you in advance Gil ** The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to any one or make copies. ** eSafe scanned this email for viruses, vandals and malicious content ** ** Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=35018&t=35018 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
VPN Client [7:14129]
Hi all, I am trying for find out about the VPN client ver.1.1specs. I need to know if the client supports the PKCS and the CAPI protocols for tokens interoperability. Thank you in advance Gil ** The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to any one or make copies. ** eSafe scanned this email for viruses, vandals and malicious content ** ** Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=14129&t=14129 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
RE: PIX and Lock and Key Dynamic Access-Lists [7:14937]
Hi, For services like Telnet and FTP you can use the PIX's, "Cut-Through proxy" function, but if you want a mechanism that can authenticate all services, as far as I know you cannot do it. Gil -Original Message- From: Bruce Williams [mailto:[EMAIL PROTECTED]] Sent: Sunday, August 05, 2001 10:37 AM To: [EMAIL PROTECTED] Subject: PIX and Lock and Key Dynamic Access-Lists [7:14937] I want to know if it is possible to create Lock and Key Dynamic Access-List on a PIX 520 Firewall. This is the problem I am trying to solve. We have a R&D network that has confidential information which we need to keep isolated from all of the users on our corporate network except for a few authorized users. We have a PIX 520 between the two networks. A few authorized users will need to be able to Telnet and FTP from the corporate network to this restricted network. These authorized users do not have static addresses so I cant filter them by IP address I need to be able to authenticate them by username and password. I would like to configure a Lock and Key Dynamic Access-list so that authorized users can log in to the PIX with their username and password and then the Dynamic Access-List opens up the firewall for them. I know Lock and Key (Dynamic Access-Lists) can be configured on routers, but can they be configured on the PIX? Bruce Williams 215-275-2723 [EMAIL PROTECTED] ** The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to any one or make copies. ** eSafe scanned this email for viruses, vandals and malicious content ** ** Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=14938&t=14937 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Firewalls [7:16951]
Hi all, I know that this is a little off the scope of the group but please hummer me if you can. I wanted to know if anyone has any experience with the a RapidStream Firewalls ? Any inputs will be appreciated. Gil ** The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to any one or make copies. ** eSafe scanned this email for viruses, vandals and malicious content ** ** Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=16951&t=16951 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
ATM Sniffers [7:32624]
Hi all, I was wondering if anybody has a good experience with some kind of ATM sniffer for STM-1 or ATM over E1. Recently I tried working with the prismalight and I got less then satisfying results. Any inputs will be appreciated. Gil ** The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to any one or make copies. ** eSafe scanned this email for viruses, vandals and malicious content ** ** Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=32624&t=32624 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
flash problem [7:20113]
Hi all, I am having some trouble with the installation of a new flash card. For some reason it marks the flash as "Device not programmable", the write protected switch is o.k. I tried to repartition the flash with no luck. I am adding information from the Router, this is the third flash that I am replacing ( Is it possible that bootstrap version is not up to date enough ? ). Cisco Internetwork Operating System Software IOS (tm) 1600 Software (C1600-BOOT-R), Version 11.1(10)AA, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) Copyright (c) 1986-1997 by cisco Systems, Inc. Compiled Tue 18-Mar-97 14:01 by ccai Image text-base: 0x04018060, data-base: 0x02005000 ROM: System Bootstrap, Version 11.1(10)AA, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1) Router uptime is 2 minutes System restarted by power-on System image file is "eprom:c1600-boot-r.111-10.AA", booted via ROM cisco 1601 (68360) processor (revision C) with 3584K/512K bytes of memory. Processor board ID 06037967 X.25 software, Version 2.0, NET2, BFE and GOSIP compliant. 1 Ethernet/IEEE 802.3 interface. 1 Serial(sync/async) network interface. System/IO memory with parity enabled (On Board Memory disabled) 8K bytes of non-volatile configuration memory. 8192K bytes of PCMCIA flash (Device not programmable) Configuration register is 0x2102 PCMCIA flash directory: No files in PCMCIA flash [0 bytes used, 8388608 available, 8388608 total] 8192K bytes of PCMCIA flash (Device not programmable) ChipBankCode Size Name 1 1 4096KBUnknown Chip 2 1 4096KBUnknown Chip Help will be appreciated. Gil ** The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to any one or make copies. ** eSafe scanned this email for viruses, vandals and malicious content ** ** Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=20113&t=20113 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
PIX & Destination Nat [7:48754]
Hi all, I am trying to perform a Nat on the destination IP address. I have a PIX holding the 6.2 OS Version. I know Destination Natting can be achieved by using the alias command but I have to configure an alias which will translate two different D. IP addresses to a single one. Help on the I can do it (if at all) will be appreciated. Cheers, Gil ** The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to any one or make copies. ** eSafe scanned this email for viruses, vandals and malicious content ** ** Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=48754&t=48754 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
OSPF Advertisments [7:49659]
Hi all, Does know how and if I can advertise via OSPF an HSRP IP address as a defualt gateway. Thank you in advance, Gil ** The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to any one or make copies. ** eSafe scanned this email for viruses, vandals and malicious content ** ** Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=49659&t=49659 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
HSRP & OSPF [7:50626]
Hi all, I know that I asked this question in the past, but I still have some problem with this issue. What I am trying to do is as follows: Site A| Site B __802.1q _ |_ | _ _|_ | SW-L3 |--| SW - L2 | | | SW - L3 |-| SW - L2| ||--|_| | ||-|_| // | // // | / / // | Vlan2//Vlan3 / Vlan3 / / / Vlan 2 // / / / / / / _/__/ /__/ | || | |Host A | | Host B | |__| |___| The L-3 at site A and B holds two HSRP IP addresses for each Vlan, Vlan 2 & Vlan 3. Host A & B don't hold a static default gateway configuration, they are running an OSPF process and should learn their default gateway IP address via OSPF advertisements. The question is, how can I advertise an HSRP IP address via OSPF routing protocol. I have been trying to achieve it by using the "default-information originate always" but the default gateway which the hosts gets is the real IP address of the interface. Help will be most appreciated. Cheers, Gil ** The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to any one or make copies. ** eSafe scanned this email for viruses, vandals and malicious content ** ** Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=50626&t=50626 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
Ospf GW distribution [7:52208]
Hi all, I was wondering if someone can send me a configuration example for a scenario in which a L3 switch disributes several defualt gateways with differant metrics. Cheers, Gil ** The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to any one or make copies. ** eSafe scanned this email for viruses, vandals and malicious content ** ** Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=52208&t=52208 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
OSPF "default-information original always" [7:52721]
Hi all, I have been wondering whether someone can help me understand, how to control which default-gateway will the OSPF mechanism will advertise first, in a scenario which I have four. Thank you in advance for any help, Gil ** The contents of this email and any attachments are confidential. It is intended for the named recipient(s) only. If you have received this email in error please notify the system manager or the sender immediately and do not disclose the contents to any one or make copies. ** eSafe scanned this email for viruses, vandals and malicious content ** ** Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=52721&t=52721 -- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
