Category Archives: Security – CCNA / CCNP Security

Syslog on ASA

Syslog Packet: The syslog packet size is limited to 1024 bytes and carries the following information:   Facility Severity Hostname Timestamp Message — Syslog Port numbers: When sending messages using UDP the destination port is usually 514 When sending messages using TCP the destination port is usually 1468 — Syslog Message Format: Message This isContinue reading “Syslog on ASA”

Cisco Labs

CCP Configuration: http://www.omnisecu.com/ccna-security/how-to-install-ccp-and-how-to-configure-cisco-router-for-ccp.php ASA ASDM basic config: http://www.net-gyver.com/?p=1419 Cisco 861/871 basic router configuration:  http://ciscorouterswitch.over-blog.com/article-cisco-871-interfaces-and-basic-configuration-80487118.html Cisco IOS DHCP Configuration: http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/812-cisco-router-dhcp-config.html IOS Zone based Firewall configuration:  http://packetlife.net/blog/2012/jan/30/ios-zone-based-firewall/ IOS Site-to-Site IPSec VPN Configuration:  http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/867-cisco-router-site-to-site-ipsec-vpn.html ASA Site-to-Site IPSec VPN:  http://packetlife.net/blog/2011/jul/11/lan-lan-vpn-asa-5505/ Cisco ASA Site to Site VPN ‘Using ASDM’ Cisco VPN Client Configuration – Setup for IOS Router:  http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/809-cisco-router-vpn-client.html HowContinue reading “Cisco Labs”

How Does NAT-T (NAT Traversal) work with IPSec?

ESP encrypts all critical information, encapsulating the entire inner TCP/UDP datagram within an ESP header. ESP is an IP protocol in the same sense that TCP and UDP are IP protocols (OSI Network Layer 3), but it does not have any port information like TCP/UDP (OSI Transport Layer 4). This is a difference from ISAKMPContinue reading “How Does NAT-T (NAT Traversal) work with IPSec?”

Data-plane attacks and Mitigation Techniques

CAM Table OverFlow Attack (DoS attack)(macof –i eth0): Port-Security DHCP Starvation Attack (DoS attack): Port-Security and Rate-limiting requests. DHCP Spoofing/Rogue DHCP Attack (Mitm attack): DHCP Snooping VLAN Hopping attack (negotiate trunk using DTP)(yersinia -G): set all the ports not connected to switches to no-negotiate and access ports, as by default they are set to negotiateContinue reading “Data-plane attacks and Mitigation Techniques”