A Simple Frame to Showcase Cyber Security Hierarchies

 

HTH...

A Tech Artist 🎨

Important Considerations To Get Your Zero Trust/MicroSegmentation Project Right ... A Network Artist's Perspective

Recently came across an interesting blog talking about When & How " Zero Trust " idea surfaced almost a decade ago and some really good approach author has put together when it comes to approach a Zero Trust project.

While the approach seems to be good for most part, I found few small gaps and some additional consideration those needs to well thought through in order to get it right in real world.

So here is quick summary - Feel free to add and correct. Again it's my personal perspective and nothing against the original blog author. 


1. By implementing Zero Trust, you just increased the Network Complexity in significant manner (I'll save P vs. NP analysis for later :)  ) and more importantly Operational Complexity. So Author sort of didn't touch on those important topics I guess. You don't want to end up increasing MTTR and MTTI.


2. It would require a big Cultural Change in the organization to be successful. Similar to NetDevOPS and other fancy stuff.



3. The point 2 and 3 seems to be going opposite to each other. You want every communication to be encrypted/Secure and you want to inspect every thing too. Probably no easy way to do that in real life.



4. Every encrypted communication will add into performance degradation probably. Even considering CPU and Memory are not issues any longer. You run into other fancy issues such as MTU, MSS. Having multiple hops involved for encryption/decryption for Inspection would add significant delay, Expose it to man in middle attack and breaks end to end communication flow. And never underestimate the madness things like NAT can add into this.



5. Convergence becomes a challenge. (Networking Convergence is not = Application Convergence)



6. How this model map to Overlay Networking is interesting area to get head around and think through. (Stitching those policies across Campus, WAN and DCs needs to considered too as most vendor solutions in these spaces are pretty much black boxes)



7. Is your NMS ready to Monitor such Network and Network Constructs ?



8. How do you map this model to Telco Services and SLAs will be worth taking a look



9. For application dependency mappings you need to invest into APMs. A pretty big investment usually I guess and takes good amount of time to not only deploy it but getting it right.



10. My Fav One - Are you solving the right problem to begin with. It's not only about doing right things but more importantly doing things right. :)

11. Impact on Customer Experience. Most organisations don't even want you to touch that area in case there is any impact....even if it's little.



It goes back to basic principle of Computer Science around State, Surface & Optimization. The Author seems to be more focussed on only single dimension of Surface (Though Surface itself has many micro areas to touch upon)



Maybe good time to look at OODA loop for Cyber Security ?



What would the governance model , business case to get funds will look like and how you would measure the success of such project ?


And never underestimate RFC 1925 rule 8 :)

HTH...
Deepak Arora
Evil CCIE

IPexpert's Protocol Operations and Troubleshooting Series

In last couple of months, one of the most popular CCIE R&S training vendor in market - IP EXPERT released couple of books covering R&S blueprint technologies. Which I personally feel is a big effort. Since writing books not only takes time but also those should be user friendly as well. Otherwise there are always choices in terms of books. The best part about IPX books is that they not explain you technology in a very simple manner but also focus on configuration examples to make sure you really understand the concepts and also focus heavily on troubleshooting. Troubleshooting is I guess the part which most book vendors fail to cover or help you as reader to build step by step logical approach.


So far they have released four books under this series and I wish they will keep doing it for rest of important R&S technology domains.


http://www.ipexpert.com/Cisco/Troubleshooting-Series


HTH...
Deepak Arora
Evil CCIE

JNCIS FWV Study Guide - Free

While reading through some article at packetlife.net, I found this free JNCIS FWV study guide/notes from Gavrilo. Looks like some decent cliff notes. Planning to take JNCIS-FWV by June end.


Here is the download URL:


http://packetlife.net/forums/thread/863/


HTH...
Deepak Arora
Evil CCIE

Basic ASA Configuration - NAT,PAT & ACL (Coming Soon)

How Well Do You Understand Traceroute

http://ccie20728.wordpress.com/2008/12/01/ciscos-traceroute-implementation/

 http://blog.ine.com/2007/12/28/understanding-traceroute/

http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_tech_note09186a00800a6057.shtml

http://www.cisco.com/en/US/tech/tk364/technologies_tech_note09186a00801ae32a.shtml

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080093f22.shtml

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml

BTW... Traceroute is a application not an protocol in itself :-)

HTH...

Deepak Arora

Evil CCIE

Free INE CCNP Workbook

Just got this URL today at IEOC.COM where Brian McGahan has provided download URL to INE CCNP Workbook. Though it was written for CCNP Ver 5. But contents are still relavant for current Route and Switch exams.

http://www.ine.com/downloads/ine.ccnp.lab.workbook.1.01.zip 

HTH...
Deepak Arora

MPLS VPN Troubleshooting - Bob Calling For Help !!!

Finally after a long gap I am back with my tutorials and labs for learning and fun. Few weeks back I posted MPLS VPN Lab topology, So before explaining it step by step I thought to bring it as challenge for people who already know MPLS from R&S lab prospective and are looking for some troubleshooting stuff on it. So I am going to bring today a MPLS VPN TS challenge for them.

So our old friend BOB was sitting free on monday after noon and then he received an email containing the following topology and two fault tickets.

The topology has got two different MPLS VPNs. One is VPN blue and another is VPN red. VPN blue site 1 should be able to reach VPN blue site 2 and vice versa and same case with VPN RED. But both VPNs shouldn't be able to talk to each other.


Below is the link to download initials for lab along with GNS topology and IOS version details to run it. See if you can help BOB with this problem.


BTW.... Avoid removing configurations completely. Also being a excellent engineer, don't use "sh run" to show your skills.


http://hotfile.com/dl/123139611/4ae9ec6/MPLS_VPN_LAB_final_config.rar.html

HTH...
Deepak Arora

Some Basic Networking Videos In Free - From CCIE Keith Barker

BGP basic configuration > https://learningnetwork.cisco.com/docs/DOC-9011 

Private Vlans > https://learningnetwork.cisco.com/docs/DOC-9653#cf

SVI vs VLAN > https://learningnetwork.cisco.com/docs/DOC-7501

L2 vs L3 > https://learningnetwork.cisco.com/docs/DOC-7494

&

Many More : http://www.youtube.com/user/Keith6783#p/u 

HTH...
Deepak Arora

Binary Maths - How To Solve Tricky ACL & Summarization Tasks (IP Expert V Lecture)

Enjoy...

https://admin.acrobat.com/_a748906506/p12841892/?launcher=false&fcsContent=true&pbMode=normal

HTH...

Deepak Arora

Limited CLI Access - Role Based CLI

Few Days back I have been asked by one of our customer for which I implemented Cisco Router Based PPPoE Server - "Hey we need to give some command access to few of our Engineers, but they shouldn't be able to use other commands available under same config prompt".

Okay...I thought it will be simple before he told me one more thing... " We can't buy AAA Server for this Job" :-(

Hmmm... It's quite simple to do with a AAA Server like Cisco ACS. But how about doing this without that.

It reminded me other two ways which I know but I never implemented those before. The one was setting up "Privilege Levels" and other which I learned during my CCNA Security Preparation was " Role Based CLI".

So I choose the Second Way. Because there is a little problem with setting up Privilege levels. In case of Privilege levels the user will have access to all the command available under privilege level Less than the current one. 

On the other hand in case of Role based CLI the user will have access to the commands only which were configured under the VIEW.

Although I see there is a third option which is not so flexible called "MENU"

So here is the list of command that I was given. All the Guest Admins should have access to these commands only.

"show users"
"show pppoe sessions"
"clear pppoe rmac"

and here is the quick config that I did for this. The view created here is named as "FIVE"

Cisco_NAS(config)#username radiusadmin secret radiusadmin

Cisco_NAS(config)#parser view five
Cisco_NAS(config-view)#secret guestadmin
Cisco_NAS(config-view)#command exec include show users
Cisco_NAS(config-view)#command exec include show pppoe session
Cisco_NAS(config-view)#command exec include clear pppoe rmac 
Cisco_NAS(config-view)#exit

and that's it. Next time the guest admin wants to login have to enter username "radiusadmin" and password as "radiusadmin". After that instead of typing "enable" they have to type "enable view five" and then have to provide password for authentication as "guestadmin".


They won't have access to any other commands except the 3 commands that I mentioned in my config.

Thanks!

Deepak Arora

Difference between CBAC & ZBF

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5708/ps5710/ps1018/prod_white_paper0900aecd806f31f9.pdf

Filtering ALL Even Subnets With Single ACL....Solution

So finally...the moment has arrived when I am gonna reveal this gotcha of my ACL filtering post. Today I am just gonna post the solution of my previous post...although you can see the solution but I am still giving you some more time to figure out why it's the correct solution. So many CCNPs, CCNAs went though this post and were not able to figure out the correct solution. So for them I'll soon reveal the dilemma of calculating ACL Wildcard Masks...

So Stay tuned and Enjoy the solution...happy studying :)

Best Regards,
Deepak Arora
CCIE#XXXXX...Oops that number is still missing :)

---------------------------
R1#sh run
Building configuration...

Current configuration : 943 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R1
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
!
!
ip cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback1
 ip address 10.0.0.1 255.255.255.0
!
interface Serial0/0
 ip address 1.1.1.1 255.255.255.252
 ip access-group 101 in
 no ip unreachables
 serial restart-delay 0
!
interface Serial0/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial0/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial0/3
 no ip address
 shutdown
 serial restart-delay 0
!
router eigrp 100
 network 0.0.0.0
 no auto-summary
!
ip http server
ip forward-protocol nd
!
!
!
access-list 101 deny   ip 192.168.0.0 0.0.6.255 any log-input
access-list 101 permit ip any any log-input
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
!
!
end

R1#
R1#
R1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     1.0.0.0/30 is subnetted, 1 subnets
C       1.1.1.0 is directly connected, Serial0/0
D    192.168.4.0/24 [90/2297856] via 1.1.1.2, 00:22:38, Serial0/0
D    192.168.5.0/24 [90/2297856] via 1.1.1.2, 00:22:21, Serial0/0
     10.0.0.0/24 is subnetted, 1 subnets
C       10.0.0.0 is directly connected, Loopback1
D    192.168.6.0/24 [90/2297856] via 1.1.1.2, 00:22:08, Serial0/0
D    192.168.7.0/24 [90/2297856] via 1.1.1.2, 00:19:10, Serial0/0
D    192.168.0.0/24 [90/2297856] via 1.1.1.2, 00:23:26, Serial0/0
D    192.168.1.0/24 [90/2297856] via 1.1.1.2, 00:23:13, Serial0/0
D    192.168.2.0/24 [90/2297856] via 1.1.1.2, 00:23:00, Serial0/0
D    192.168.3.0/24 [90/2297856] via 1.1.1.2, 00:22:48, Serial0/0
R1#
------------------------------------------------------------------
R2#sh run
Building configuration...

Current configuration : 1216 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname R2
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 5
!
!
ip cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
 ip address 192.168.0.1 255.255.255.0
!
interface Loopback1
 ip address 192.168.1.1 255.255.255.0
!
interface Loopback2
 ip address 192.168.2.1 255.255.255.0
!
interface Loopback3
 ip address 192.168.3.1 255.255.255.0
!
interface Loopback4
 ip address 192.168.4.1 255.255.255.0
!
interface Loopback5
 ip address 192.168.5.1 255.255.255.0
!
interface Loopback6
 ip address 192.168.6.1 255.255.255.0
!
interface Serial0/0
 ip address 1.1.1.2 255.255.255.252
 serial restart-delay 0
!
interface Serial0/1
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial0/2
 no ip address
 shutdown
 serial restart-delay 0
!
interface Serial0/3
 no ip address
 shutdown
 serial restart-delay 0
!
router eigrp 100
 network 0.0.0.0
 no auto-summary
!
ip http server
ip forward-protocol nd
!
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
line con 0
line aux 0
line vty 0 4
!
!
end

R2#
R2#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     1.0.0.0/30 is subnetted, 1 subnets
C       1.1.1.0 is directly connected, Serial0/0
C    192.168.4.0/24 is directly connected, Loopback4
C    192.168.5.0/24 is directly connected, Loopback5
     10.0.0.0/24 is subnetted, 1 subnets
D       10.0.0.0 [90/2297856] via 1.1.1.1, 00:26:49, Serial0/0
C    192.168.6.0/24 is directly connected, Loopback6
C    192.168.7.0/24 is directly connected, Loopback7
C    192.168.0.0/24 is directly connected, Loopback0
C    192.168.1.0/24 is directly connected, Loopback1
C    192.168.2.0/24 is directly connected, Loopback2
C    192.168.3.0/24 is directly connected, Loopback3
R2#
R2#ping 10.0.0.1 sou loop0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.0.1
.....
Success rate is 0 percent (0/5)
R2#
R2#ping 10.0.0.1 sou loop1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/36/80 ms
R2#
-------------------------------------------------------------------
R3# Hmmm ...I used loopback 1 on R1 to emulate it's Ethernet Segment :), Also on R2 I configured Loopback 8 to make sure rest of Even subnets can reach to R1

One more thing...I disabled IP Unreachable on S0/0 of R1 so that even if ping fails sent by R2, you won't see Unreachable message which normally appears as U.U.U.... and so on. Because this feature allows evil minds to find out that ACL is blocking the traffic. But what if they don't see U messages...hmmm ....they don't know than what's blocking the ping on the other side :)



R2(config)#do sh run int lo8
Building configuration...

Current configuration : 65 bytes
!
interface Loopback8
 ip address 192.168.8.1 255.255.255.0
end

R2(config)#do ping 10.0.0.1 sou lo8

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.8.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/28/64 ms








-------------------------------------------------------------------

How Many Types of ACLs are there in Cisco's Big IOS Security World....Continued

I thought to add some more IOS Security features in my previous list...might not be an exact ACL feature but in some way sometimes relies heavily on ACL.

1. ACL using Group-Objects...YES...now can use group objects to minimize number of ACLs like we do in ASA :-) isn't that cool enough...those old days are gone now. Thanks to some great programmers sitting out there in Cisco.

ACL group object feature came I guess in IOS 12.4(20T). It allows you to configure two types of group object.

* Network Objects
* Service Objects

And guess what...one more surprise with this feature is now we can use / notation with our IP addresses in Network Objects Group like 1.1.1.1/1...isn't that cool

Anyways...I'll demonstrate this feature in my next post and till the time I'll try to find out IOS for it.

2.) TCP Intercept - Another Cool IOS security feature

3.) URPF - Sometimes it also has to rely on ACLs...depending upon it's configuration mode

4.) NBAR - Cool QOS based Security Feature

5.) CAR -Of Course it not four wheeler CAR but CAR is acronym for Committed Access Rate and can be used as a security feature.

6.) IOS based IPS

7.) 802.1x

8.) CoPP - Control Plane Policing

9.) Setting up privilege level / Menu based Access For Users

10.) Setting Up Connection Limits - Defining Max number of TCP/UDP/ICMP packets from Single host
under defined time value, Max number of Half TCP sessions from
anyone under defined time value

I am sure there would be some other features as well along with some protocol specific features like RTBHF and Sink hole filtering...Those are more or less CCIE Security Topics anyways :-)

Happy Studying & Stay Tuned....

Best Regards,
Deepak Arora
CCIE#XXXXX...Oops that number is still missing

How Many Types of ACLs are there in Cisco's Big IOS Security World

Few days back I asked a question to a very confident CCNA Security guy...actually he just came to me before taking CCNA Security exam and asked me...hey,why don't you ask me something related to Security as I am feeling pretty confident that I know lots of security stuff now.

Hmmm...I said Okey and just asked him the following question :-)

How many ACLs and Firewall features we have in IOS related to Router Security ?

He said... Standard ACL, Extended ACL, Named ACL, Reflexive ACL, CBAC & Zone Based Firewall.

Hmmm...his list looks interesting but still not complete...maybe it was not a true CCNA Security Question as I never take a look at it's curriculum...Anyways...Following is my list and see if I missed something...Feel free to drop an email to me if you have something to add in this list.

1. Standard ACL
2. Extended ACL
3. Named ACL
4. TCP Established ACL / Reflexive ACL
5. Turbo ACL
6. CBAC
7. Zone Based Firewall
8. Time Based ACL
9. Dynamic ACL / Lock & Key ACL
10. Flexibal Packet Matching ACL
11. ACL to to prevent fragmented IP packets from reaching you application ports

Holy Cow...Did you ever think about that :-(

I must say even I still need to dig myself about which one takes precedence over other when multiple types are configured together

Some more ACL stuff in coming days along with solution of my last ACL Post...

Happy Studying...

Best Regards,
Deepak Arora
CCIE# XXXXX...Oops that number is still missing :-)

Filtering ALL Even Subnets With Single ACL

These days I am quite busy with my job schedule which is keeping me away from studies & blog.

Anyways... today lets play around some ACLs. I know many people who think that they know ACL stuff very well. But actually that's not the case. Specially if they were been given task like I show up in Diagram here. The challenge here is following:

R2 has got plenty of networks to advertise using EIGRP to R1. Administrator f R1 wants that only Odd Network Subnets like 192.168.1.0/24...3.0/24 etc of R2 should be able to reach LAN segment of R1 and all Even subnets should not be able to do that. And for that you are only allowed to use single ACL entry....but also don't use Group Objects ( If you know really what they are :-) )

So good luck to all of you * R1 Admins :-) * I will post the solution and some more ACL details soon.

Happy Studying...

Regards,
Deepak Arora

Fixing ASDM Error - Unconnected Sockets Not Implemented

Yesterday when I tried to access my ASA 5520 box using ASDM, I got an error " Unconnected Sockets Not Implemented". Initially I thought It could be because of some ASDM access permission configured on ASA. But everything was fine with the configuration. I spent quite some time but didn't find any clue about how to fix this issue and what could be the possible cause.

Finally I downgraded my Java version because I knew that ASDM uses JRE and recently I upgraded my JRE. So after making downgrade I was able to access the ASDM. It seems like some JRE versions are not compatible with Latest ASDM version 6.x

Regards,
Deepak Arora

Worm Mitigation Technical Details

http://www.cisco.com/web/about/security/intelligence/worm-mitigation-whitepaper.html

Thanks!
Deepak Arora

Configuring Cisco IOS ZBF using Cisco Configuration Professional

http://www.cisco.com/cdc_content_elements/flash/ios/ios_zbf/index.html

IPSEC Basics

The IPsec standard provides a method to manage authentication and data
protection between multiple crypto peers engaging in secure data transfer.
IPsec includes the Internet Security Association and Key Management Protocol
(ISAKMP)/Oakley and two IPsec IP protocols: Encapsulating Security Protocol
(ESP) and Authentication Header (AH).

IPsec uses symmetrical encryption algorithms for data protection. Symmetrical
encryption algorithms are more efficient and easier to implement in hardware.
These algorithms need a secure method of key exchange to ensure data protection.
Internet Key Exchange (IKE) ISAKMP/Oakley protocols provide this capability.

This solution requires a standards-based way to secure data from eavesdropping
and modification. IPsec provides such a method. IPsec provides a choice of
transform sets so that a user can choose the strength of their data protection.
IPsec also has several Hashed Message Authentication Codes (HMAC) from
which to choose, each giving different levels of protection for attacks such as
man-in-the-middle, packet replay (anti-replay), and data integrity attacks.

Best Regards,
Deepak Arora