%%category%% Archives %%page%%

Archive for the 'ACL' Category

Difference between VLAN Access-map and ACL

Published

on July 10, 2008

in ACL, BCMSN, Certification, Cisco Systems, Concepts and Constructs and VACL

. 0 Comments

Looking over some things before I go write the BCMSN exam this is something I wanted to waffle on about again because the reason for both aren’t so clear to me and why to use what when.

So short and sweet an Access Control List (ACL) is something that comes from the CCNA course and is something one can use to manage and control traffic that passes through a switch (mind passes through and doesn’t originate on) either in an inbound or outbound direction. Cisco Catalyst Switches filter traffic through the use of a TCAM (mentioned on this post). The reason for VLAN Access Control List (VACL) is that only traffic that passes between VLANs can be filtered using ACLs.

So this means logicaly that traffic that stays in the same VLAN doesn’t necessarily have a direction (inbound or outbound) in relation to the interface and also isn’t crossing any interface boundries. There is also the fact that the packets may also be non-IP, non-IPX, or completely bridged. VACLs are mechanisms that can directly affect packets inside a VLAN. VACLs are configured using access-maps

BCMSN VLAN-ACL Lab 8

Published

Deon Botha

on June 23, 2008

in ACL, BCMSN, Certification, Cisco Systems, VACL and VLAN

. 0 Comments

LAB_2

Virtual Local Area Network (VLAN) Access Control Lists (ACL) (VACL or VLAN-ACL)

The CCNA taught ACLs standard, extended and named (standard and extended) the VACL is a standard or extended access list (no surprise) that is supported on Cisco IOS Software on Multilayer Switches (this is important) that can be mapped as the name suggests to a specific VLAN (take note).

This means that instead of an ACL filtering all traffic ingressing or egressing a particular port the ACL will filter all traffic ingressing and egressing a particular VLAN (cool huh).

The below config uses a named ACL in conjunction with the other particulars to make the VACL work. If you are rusty on the Access Lists the previous lab used an extended access list you can then also go on to try your hand at standard access lists on your own.

The aim of this lab is to block telnet, ftp, www and allow all other traffic to PC1 and PC2.

PC1 is in VLAN 10 with IP address 192.168.10.200 255.255.255.0 Default Gateway (DG) 192.168.10.1

PC2 is in VLAN 20 with IP Address 192.168.20.250 255.255.255.0 DG 192.168.10.50

Enter Privelaged Mode switch>enable Enter Global Configuration Mode switch#configure terminal Change the hostname of the switch switch(config)#hostname DSW1 Enable secret and password DSW1(config)#enable password cisco DSW1(config)#enable secret cisco Setup the console port password DSW1(config)#line con 0 DSW1(config-line)#password cisco DSW1(config-line)#login DSW1(config-line)#exit Setup the Virtual Teletype Terminal (VTY) Password DSW1(config)#line vty 0 4 DSW1(config-line)#password cisco DSW1(config-line)#login DSW1(config-line)#exit Setup the default VLAN DSW1(config)#interface vlan 1 DSW1(config-if)#ip address 192.168.1.1 255.255.255.0 DSW1(config-if)#no shut DSW1(config-if)#exit Setup VLAN 10 DSW1(config)#interface vlan 10 DSW1(config-if)#ip address 192.168.10.1 255.255.255.0 DSW1(config-if)#no shut DSW1(config-if)#exit Setup VLAN 20 DSW1(config)#interface vlan 20 DSW1(config-if)#ip address 192.168.20.1 255.255.255.0 DSW1(config-if)#no shut DSW1(config-if)#exit Setup Fastethernet Interfaces DSW1(config)#interface fastethernet 0/1 DSW1(config-if)#description DSW1 - ASW1 DSW1(config-if)#no shut DSW1(config-if)#exit DSW1(config)#interface fastethernet 0/2 DSW1(config-if)#description DSW1 - ASW1 DSW1(config-if)#no shut DSW1(config-if)#exit DSW1(config)#interface fastethernet 0/3 DSW1(config-if)#description DSW1 - ASW2 DSW1(config-if)#no shut DSW1(config-if)#exit DSW1(config)#interface fastethernet 0/4 DSW1(config-if)#description DSW1 - ASW2 DSW1(config-if)#no shut DSW1(config-if)#exit DSW1(config)#interface fastethernet 0/11 DSW1(config-if)#description DSW1 - DSW2 DSW1(config-if)#no shut DSW1(config-if)#exit DSW1(config)#interface fastethernet 0/12 DSW1(config-if)#description DSW1 - DSW2 DSW1(config-if)#no shut DSW1(config-if)#exit Enable QoS Globally DSW1(config)#mls qos Create Access Lists DSW1(config)#access-list 150 permit udp any any eq tftp DSW1(config)#access-list 150 permit tcp any any eq ftp DSW1(config)#access-list 150 permit tcp any any eq ftp-data DSW1(config)#access-list 151 permit udp any any eq echo DSW1(config)#access-list 151 permit udp any any eq echo-reply DSW1(config)#access-list 151 permit udp any any eq echo Create a class map DSW1(config)#class-map File-Transfer DSW1(config-cmap)#match access-group 150 DSW1(config-cmap)#exit DSW1(config)#class-map Echo DSW1(config-cmap)#match access-group 151 DSW1(config-cmap)#exit Create a policy map DSW1(config)#policy-map Precedence DSW1(config-pmap)#class file-transfer DSW1(config-pmap-c)#set ip precedence 5 DSW1(config-pmap-c)#exit DSW1(config-pmap)#class echo DSW1(config-pmap-c)#set ip precedence 1 DSW1(config-pmap-c)#exit DSW1(config-pmap)#exit Create a VLAN access map DSW1(config)#vlan access-map vlan_map_10 10 DSW1(config-access-map)#match ip address blocked_protocols DSW1(config-access-map)#action drop DSW1(config-access-map)#exit DSW1(config)#vlan access-map vlan_map_10 20 DSW1(config-access-map)#match ip address allowed_protocols DSW1(config-access-map)#action forward DSW1(config-access-map)#exit Create an Named Extended Access List DSW1(config)#ip access-list extended blocked_protocols DSW1(config-ext-ipacl)#permit tcp any any eq telnet DSW1(config-ext-ipacl)#permit tcp any any eq ftp DSW1(config-ext-ipacl)#permit tcp any any eq ftp-data DSW1(config-ext-ipacl)#permit tcp any any eq www DSW1(config-ext-ipacl)#exit DSW1(config)#ip access-list extended allowed_protocols DSW1(config-ext-ipacl)#permit ip any any DSW1(config-ext-ipacl)#exit Apply the VLAN ACL to Filter a VLAN DSW1(config)#vlan filter vlan_map_10 vlan-list 10 Associate VLANs with Fe 1 to 4 DSW1(config)#interface range fastethernet 0/1 - 4 DSW1(config-if-range)#speed 100 DSW1(config-if-range)#duplex auto DSW1(config-if-range)#switchport DSW1(config-if-range)#switchport trunk encapsulation dot1q DSW1(config-if-range)#switchport trunk native vlan 1 DSW1(config-if-range)#switchport trunk allowed vlan 1,20,10 DSW1(config-if-range)#switchport mode trunk Apply QoS Policy DSW1(config-if-range)#service-policy input precedence DSW1(config-if-range)#exit Associate VLANs with Fe 11 and 12 DSW1(config)#interface range fastethernet 0/11 - 12 DSW1(config-if-range)#speed 100 DSW1(config-if-range)#duplex auto DSW1(config-if-range)#switchport DSW1(config-if-range)#switchport trunk encapsulation dot1q DSW1(config-if-range)#switchport trunk native vlan 1 DSW1(config-if-range)#switchport trunk allowed vlan 1,20,10 DSW1(config-if-range)#switchport mode trunk DSW1(config-if-range)#exit Aministratively shutdown all ports not connected DSW1(config)#interface range fastethernet 0/5 - 10 DSW1(config-if-range)#shut DSW1(config-if-range)#exit Enable Spanning Tree Protocol on VLANs DSW1(config)#spanning-tree vlan 1 root primary DSW1(config)#spanning-tree vlan 10 root primary DSW1(config)#spanning-tree vlan 20 root secondary Enable Routing and a Protocol DSW1(config)#ip routing DSW1(config)#router eigrp 100 DSW1(config-router)#network 192.168.0.0 DSW1(config-router)#exit Exit Global Configuration Mode DSW1(config)#exit Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct DSW1#show interfaces status Check that you configured STP DSW1#show spanning-tree Check routing is correct DSW1#show ip route Check QoS is enabled DSW1#show mls qos Check Access Lists DSW1#show access-lists Check class maps DSW1#show class-map Check policy map DSW1#show policy-map Check that QoS is applied to the interfaces DSW1#show run | begin interface FastEthernet 0/1 Check VLAN Access-Map DSW1#show vlan access-map Confirm Named Access lists DSW1#show access-lists blocked_protocols DSW1#show access-lists allowed_protocols DSW1#show access-lists Confirm VLAN filter DSW1#show vlan filter Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)… oops copy start run DSW1#copy run start

Enter Privelaged Mode switch>enable Enter Global Configuration Mode switch#configure terminal Change the hostname of the switch switch(config)#hostname DSW2 Enable secret and password DSW2(config)#enable password cisco DSW2(config)#enable secret cisco Setup the console port password DSW2(config)#line con 0 DSW2(config-line)#password cisco DSW2(config-line)#login DSW2(config-line)#exit Setup the Virtual Teletype Terminal (VTY) Password DSW2(config)#line vty 0 4 DSW2(config-line)#password cisco DSW2(config-line)#login DSW2(config-line)#exit Setup the default VLAN DSW2(config)#interface vlan 1 DSW2(config-if)#ip address 192.168.1.50 255.255.255.0 DSW2(config-if)#no shut DSW2(config-if)#exit Setup VLAN 10 DSW2(config)#interface vlan 10 DSW2(config-if)#ip address 192.168.10.50 255.255.255.0 DSW2(config-if)#no shut DSW2(config-if)#exit Setup VLAN 20 DSW2(config)#interface vlan 20 DSW2(config-if)#ip address 192.168.20.50 255.255.255.0 DSW2(config-if)#no shut DSW2(config-if)#exit Setup Fastethernet Interfaces DSW2(config)#interface fastethernet 0/1 DSW2(config-if)#description DSW2 - ASW2 DSW2(config-if)#no shut DSW2(config-if)#exit DSW2(config)#interface fastethernet 0/2 DSW2(config-if)#description DSW2 - ASW2 DSW2(config-if)#no shut DSW2(config-if)#exit DSW2(config)#interface fastethernet 0/3 DSW2(config-if)#description DSW2 - ASW1 DSW2(config-if)#no shut DSW2(config-if)#exit DSW2(config)#interface fastethernet 0/4 DSW2(config-if)#description DSW2 - ASW1 DSW2(config-if)#no shut DSW2(config-if)#exit DSW2(config)#interface fastethernet 0/11 DSW2(config-if)#description DSW2 - DSW1 DSW2(config-if)#no shut DSW2(config-if)#exit DSW2(config)#interface fastethernet 0/12 DSW2(config-if)#description DSW2 - DSW1 DSW2(config-if)#no shut DSW2(config-if)#exit Enable QoS Globally DSW2(config)#mls qos Create Access Lists DSW2(config)#access-list 150 permit udp any any eq tftp DSW2(config)#access-list 150 permit tcp any any eq ftp DSW2(config)#access-list 150 permit tcp any any eq ftp-data DSW2(config)#access-list 151 permit udp any any eq echo DSW2(config)#access-list 151 permit udp any any eq echo-reply DSW2(config)#access-list 151 permit udp any any eq echo Create a class map DSW2(config)#class-map File-Transfer DSW2(config-cmap)#match access-group 150 DSW2(config-cmap)#exit DSW2(config)#class-map Echo DSW2(config-cmap)#match access-group 151 DSW2(config-cmap)#exit Create a policy map DSW2(config)#policy-map Precedence DSW2(config-pmap)#class file-transfer DSW2(config-pmap-c)#set ip precedence 5 DSW2(config-pmap-c)#exit DSW2(config-pmap)#class echo DSW2(config-pmap-c)#set ip precedence 1 DSW2(config-pmap-c)#exit DSW2(config-pmap)#exit Create a VLAN access map DSW2(config)#vlan access-map vlan_map_20 10 DSW2(config-access-map)#match ip address blocked_protocols DSW2(config-access-map)#action drop DSW2(config-access-map)#exit DSW2(config)#vlan access-map vlan_map_20 20 DSW2(config-access-map)#match ip address allowed_protocols DSW2(config-access-map)#action forward DSW2(config-access-map)#exit Create an Named Extended Access List DSW2(config)#ip access-list extended blocked_protocols DSW2(config-ext-ipacl)#permit tcp any any eq telnet DSW2(config-ext-ipacl)#permit tcp any any eq ftp DSW2(config-ext-ipacl)#permit tcp any any eq ftp-data DSW2(config-ext-ipacl)#permit tcp any any eq www DSW2(config-ext-ipacl)#exit DSW2(config)#ip access-list extended allowed_protocols DSW2(config-ext-ipacl)#permit ip any any DSW2(config-ext-ipacl)#exit Apply the VLAN ACL to Filter a VLAN DSW2(config)#vlan filter vlan_map_20 vlan-list 20 Associate VLANs with Fe 1 to 4 DSW2(config)#interface range fastethernet 0/1 - 4 DSW2(config-if-range)#speed 100 DSW2(config-if-range)#duplex auto DSW2(config-if-range)#switchport DSW2(config-if-range)#switchport trunk encapsulation dot1q DSW2(config-if-range)#switchport trunk native vlan 1 DSW2(config-if-range)#switchport trunk allowed vlan 1,20,10 DSW2(config-if-range)#switchport mode trunk Apply QoS Policy DSW2(config-if-range)#service-policy input precedence DSW2(config-if-range)#exit Associate VLANs with Fe 11 and 12 DSW2(config)#interface range fastethernet 0/11 - 12 DSW2(config-if-range)#speed 100 DSW2(config-if-range)#duplex auto DSW2(config-if-range)#switchport DSW2(config-if-range)#switchport trunk encapsulation dot1q DSW2(config-if-range)#switchport trunk native vlan 1 DSW2(config-if-range)#switchport trunk allowed vlan 1,20,10 DSW2(config-if-range)#switchport mode trunk DSW2(config-if-range)#exit Aministratively shutdown all ports not connected DSW2(config)#interface range fastethernet 0/5 - 10 DSW2(config-if-range)#shut DSW2(config-if-range)#exit Enable Spanning Tree Protocol on VLANs DSW2(config)#spanning-tree vlan 1 root secondary DSW2(config)#spanning-tree vlan 10 root secondary DSW2(config)#spanning-tree vlan 20 root primary Enable Routing and a Protocol DSW2(config)#ip routing DSW2(config)#router eigrp 100 DSW2(config-router)#network 192.168.0.0 DSW2(config-router)#exit Exit Global Configuration Mode DSW2(config)#exit Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct DSW2#show interfaces status Check that you configured STP DSW2#show spanning-tree Check routing is correct DSW2#show ip route Check QoS is enabled DSW2#show mls qos Check Access Lists DSW2#show access-lists Check class maps DSW2#show class-map Check policy map DSW2#show policy-map Check that QoS is applied to the interfaces DSW2#show run | begin interface FastEthernet 0/1 Check VLAN Access-Map DSW2#show vlan access-map Confirm Named Access lists DSW2#show access-lists blocked_protocols DSW2#show access-lists allowed_protocols DSW2#show access-lists Confirm VLAN filter DSW2#show vlan filter Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)… oops copy start run DSW2#copy run start

Enter Privelaged Mode switch>enable Enter Global Configuration Mode switch#configure terminal Change the hostname of the switch switch(config)#hostname ASW1 Enable secret and password ASW1(config)#enable password cisco ASW1(config)#enable secret cisco Setup the console port password ASW1(config)#line con 0 ASW1(config-line)#password cisco ASW1(config-line)#login ASW1(config-line)#exit Setup the Virtual Teletype Terminal (VTY) Password ASW1(config)#line vty 0 4 ASW1(config-line)#password cisco ASW1(config-line)#login ASW1(config-line)#exit Default Gateway ASW1(config-line)#ip default-gateway 192.168.1.1 Setup the default VLAN ASW1(config)#interface vlan 1 ASW1(config-if)#ip address 192.168.1.100 255.255.255.0 ASW1(config-if)#no shut ASW1(config-if)#exit Setup VLAN 10 ASW1(config)#interface vlan 10 ASW1(config-if)#ip address 192.168.10.100 255.255.255.0 ASW1(config-if)#no shut ASW1(config-if)#exit Setup VLAN 20 ASW1(config)#interface vlan 20 ASW1(config-if)#ip address 192.168.20.100 255.255.255.0 ASW1(config-if)#no shut ASW1(config-if)#exit Setup Fastethernet Interfaces ASW1(config)#interface fastethernet 0/1 ASW1(config-if)#description ASW1 - DSW1 ASW1(config-if)#no shut ASW1(config-if)#exit ASW1(config)#interface fastethernet 0/2 ASW1(config-if)#description ASW1 - DSW1 ASW1(config-if)#no shut ASW1(config-if)#exit ASW1(config)#interface fastethernet 0/3 ASW1(config-if)#description ASW1 - DSW2 ASW1(config-if)#no shut ASW1(config-if)#exit ASW1(config)#interface fastethernet 0/4 ASW1(config-if)#description ASW1 - DSW2 ASW1(config-if)#no shut ASW1(config-if)#exit Setup Fastethernet 0/12 for 10mbs half duplex as an access level end-point interface ASW1(config)#interface fastethernet 0/12 ASW1(config-if)#description ASW1 - PC1 ASW1(config-if)#speed 10 ASW1(config-if)#duplex half ASW1(config-if)#switchport Make the port as an access port ASW1(config-if)#switchport mode access Make the port an access port for VLAN 10 ASW1(config-if)#switchport access vlan 10 Enable PortFast on end-points ASW1(config-if)#spanning-tree portfast ASW1(config-if)#no shut ASW1(config-if)#exit Associate VLANs with Fe 1 to 4 ASW1(config)#interface range fastethernet 0/1 - 4 ASW1(config-if-range)#speed 100 ASW1(config-if-range)#duplex auto ASW1(config-if-range)#switchport ASW1(config-if-range)#switchport trunk encapsulation dot1q ASW1(config-if-range)#switchport trunk native vlan 1 ASW1(config-if-range)#switchport trunk allowed vlan 1,20,10 ASW1(config-if-range)#switchport mode trunk Configure UplinkFast ASW1(config-if-range)#spanning-tree uplinkfast ASW1(config-if-range)#exit Aministratively shutdown all ports not connected ASW1(config)#interface range fastethernet 0/5 - 11 ASW1(config-if-range)#shut ASW1(config-if-range)#exit Enable Spanning Tree Protocol on VLANs ASW1(config)#spanning-tree vlan 1 ASW1(config)#spanning-tree vlan 10 ASW1(config)#spanning-tree vlan 20 Exit Global Configuration Mode ASW1(config)#exit Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct ASW1#show interfaces status Check that you configured STP DSW1#show spanning-tree Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)… oops copy start run ASW1#copy run start

Enter Privelaged Mode switch>enable Enter Global Configuration Mode switch#configure terminal Change the hostname of the switch switch(config)#hostname ASW2 Enable secret and password ASW2(config)#enable password cisco ASW2(config)#enable secret cisco Setup the console port password ASW2(config)#line con 0 ASW2(config-line)#password cisco ASW2(config-line)#login ASW2(config-line)#exit Setup the Virtual Teletype Terminal (VTY) Password ASW2(config)#line vty 0 4 ASW2(config-line)#password cisco ASW2(config-line)#login ASW2(config-line)#exit Default Gateway ASW2(config-line)#ip default-gateway 192.168.1.50 Setup the default VLAN ASW2(config)#interface vlan 1 ASW2(config-if)#ip address 192.168.1.150 255.255.255.0 ASW2(config-if)#no shut ASW2(config-if)#exit Setup VLAN 10 ASW2(config)#interface vlan 10 ASW2(config-if)#ip address 192.168.10.150 255.255.255.0 ASW2(config-if)#no shut ASW2(config-if)#exit Setup VLAN 20 ASW2(config)#interface vlan 20 ASW2(config-if)#ip address 192.168.20.150 255.255.255.0 ASW2(config-if)#no shut ASW2(config-if)#exit Setup Fastethernet Interfaces ASW2(config)#interface fastethernet 0/1 ASW2(config-if)#description ASW2 - DSW2 ASW2(config-if)#no shut ASW2(config-if)#exit ASW2(config)#interface fastethernet 0/2 ASW2(config-if)#description ASW2 - DSW2 ASW2(config-if)#no shut ASW2(config-if)#exit ASW2(config)#interface fastethernet 0/3 ASW2(config-if)#description ASW2 - DSW1 ASW2(config-if)#no shut ASW2(config-if)#exit ASW2(config)#interface fastethernet 0/4 ASW2(config-if)#description ASW2 - DSW1 ASW2(config-if)#no shut ASW2(config-if)#exit Setup Fastethernet 0/12 for 10mbs half duplex as an access level end-point interface ASW2(config)#interface fastethernet 0/12 ASW2(config-if)#description ASW2 - PC2 ASW2(config-if)#speed 10 ASW2(config-if)#duplex half ASW2(config-if)#switchport Make the port as an access port ASW2(config-if)#switchport mode access Make the port an access port for VLAN 20 ASW2(config-if)#switchport access vlan 20 Enable PortFast on end-points ASW2(config-if)#spanning-tree portfast ASW2(config-if)#no shut ASW2(config-if)#exit Associate VLANs with Fe 1 to 4 ASW2(config)#interface range fastethernet 0/1 - 4 ASW2(config-if-range)#speed 100 ASW2(config-if-range)#duplex auto ASW2(config-if-range)#switchport ASW2(config-if-range)#switchport trunk encapsulation dot1q ASW2(config-if-range)#switchport trunk native vlan 1 ASW2(config-if-range)#switchport trunk allowed vlan 1,20,10 ASW2(config-if-range)#switchport mode trunk Configure UplinkFast ASW2(config-if-range)#spanning-tree uplinkfast ASW2(config-if-range)#exit Aministratively shutdown all ports not connected ASW2(config)#interface range fastethernet 0/5 - 10 ASW2(config-if-range)#shut ASW2(config-if-range)#exit Enable Spanning Tree Protocol on VLANs ASW2(config)#spanning-tree vlan 1 ASW2(config)#spanning-tree vlan 10 ASW2(config)#spanning-tree vlan 20 Exit Global Configuration Mode ASW2(config)#exit Check that you named the interfaces correctly, havent missed out on a connected interface and that the duplex and speed setting are correct ASW2#show interfaces status Check that you configured STP ASW2#show spanning-tree Copy the running configuration to the startup configuration. I got in the bad habbit to do this the other way around for a while (did it in an exam)… oops copy start run ASW2#copy run start

The end result of this will be if you attempt to for example telnet from one of the ASW switches to the PCs (1 or 2) you should get the following:

ASW1#telnet 192.168.10.200 Trying 192.168.10.200 ... % Connection timed out; remote host not responding

Still trying to sort out LAB time so will test this out and update as needed.

Notes and Notices:

This is a part of my personal BCMSN notes and research to assist myself in learning and understanding the concepts and theory for the BCMSN exam. I learn by making notes reading and writing things down and wish to file them where I can’t lose them. These notes are not to be seen, judged or mistaken for replacements to Cisco recognized and authorized training which I personally support and attend and suggest you undertake if you are going for the BCMSN Certification.

Switch Security Layer-2 Attacks – Four

Published

Deon Botha

on May 28, 2008

in ACL, BCMSN, CDP, Certification, Cisco Systems, Concepts and Constructs, SSH, Telnet and VTY

. 0 Comments

CDP

Cisco Discovery Protocol (CDP) is a useful and great protocol when you are sitting on the other side of the office/country/planet and don’t know what you are working with on a network but CDP has some holes for attackers to leverage that can cause problems.

CDP uses clear-text and unauthenticated to send information about network topology between network devices. An attacker can use a packet sniffer to get information about network infrastructure that we don’t really want them to have.

CDP isn’t needed on ports that no network management is done (this isn’t the case for Cisco IP Phones). You can also go ballistic and disable CDP totally thats up to you. To disable CDP use the following commands

CDP per-port

switch(config)#configure terminal switch(configp)#interface gigabitethernet 0/1 switch(config-if)#no cdp enable

CDP Globally

switch(config)#configure terminal switch(config)#no cdp run

Be careful with this, CDP is used in conjunction with or as support for other Cisco protocols

Telnet

Telnet has a few problems:

All usernames, passwords, and data sent over a public network (read: Internet) is sent in clear text and is thus vulnerable.
A user with an account on the system can gain elevated privelages.
A remote attacker could crash the Telnet service, preventing legitimate service rendering.
A remote attacker could find an enabled guest account that may be present anywhere in the trusted domain of the server.

iow Dont Telnet over the internet

SSH

SSH is a client and server protocol used to log in to another computer over a network. It provides strong authentication and secure communication over a public communication network. SSH may be “more” secure many vendors implementations of SSH is vulnerable.

switch(config)#configure terminal switch(config)#line vty 0-15 switch(config-line)#transport input ssh

VTY Access Control Lists (ACL)

One can associate ACLs to permit or deny access to a vty port to a switch.

The Number of VTYs differ make sure you get it right and configure an ACL on ALL the VTY connections and don’t leave one open

switch(config)#configure terminal switch(config)#access-list 12 permit 192.168.0.0 0.0.255.255 switch(config)#line vty 0 15 switch(config-line)#access-class 12 in

Notes and Notices:

Switch Security Layer-2 Attacks – Two

Published

Deon Botha

on May 27, 2008

in ACL, BCMSN, Certification, Cisco Systems, Concepts and Constructs, Switch Spoofing, Trunk, VACL, VLAN and VLAN Hopping

. 2 Comments

VLAN Hopping

VLAN Hopping is a network attack whereby an end-device sends packets to/or collects packets from a VLAN that should not be accessible to that end-device. This is done by tagging the invasive traffic with a specific VLAN ID (VID) or by negotiating a trunk link to send or receive traffic on penetrated VLANs. VLAN hopping can be done by switch spoofing or double tagging.

In a Switch spoofing attack the attacker configures an end-device to spoof itself as a switch (this can be a linux pc). The attack emulates Inter-Switch Link (ISL) or 802.1Q signaling along with Dynamic Trunk Protocol (DTP). This is signaling to attempt to establishing a trunk connection with the company switch.

Any switch port configured with DTP auto, upon receipt of a DTP packet generated by the attacking device, will become a trunk port and then accept traffic destined for any VLAN supported on any trunk on that link. The attacker can then send/collect packets from/to any VLAN.

Double Tagging is another method of VLAN Hopping, this is when a workstation generates frames for two 802.1Q headers, this causes the switch to forward the frames onto a VLAN that would normally be inaccessible to the attacker through legitimate means.

The first switch to encounter the double tagged 802.1Q frame strips the first header frame (native VLAN), and forwards the frame out a trunk link, the second switch then forwards the frame according to the other 802.1Q frame header. Should the tag not match the native VLAN of the attacker, the frame will go untagged and flooded to only the original frame.

Best Practices to Mitigate VLAN Hopping

Configure all unused ports as access ports so that trunking cannot be negotiated across those links.
Place all unused ports in the shutdown state and associate them with a VLAN designed for only unused ports, carrying no user data traffic (that means not the Native VLAN either).
When establishing a trunk link, purposefully configure arguments so that:
- The native VLAN will be different form any data VLANs
- Trunking is set up as “on” rather than as negotiated.
- The specific VLAN range will be carried on the trunk

Configuration
To Mitigate against VLAN hopping attacks the following is the config. First select a range of interfaces:
switch#configure terminal switch(config)#interface range gigabitethernet 0/1-48

Now configure the ports as access ports this in turn will turn off DTP

switch(config-if)#switchport mode access

Assign the ports to an unused VLAN (not the Native VLAN)

switch(config-if)#switchport access vlan vlan-id

NB the above commands will not work in VoIP (voice) networks. Cisco IP Phones use trunks (DTP).

VLAN Access Control Lists

There are three kinds of ACLs:

Router Access Control Lists (RACLs)supported in the TCAM hardware on Cisco Multi-layer switches (MLS). Can be applied to any router interface, such as a switch virtual interface (SVI) or Layer 3 routed port.
Port Access Control List (PACL)filters traffic at the port level. PACLs can be applied on a Layer-2 switch port, trunk port, or EtherChannel port.
Vlan Access Control Lists (VACLs)(a.k.a VLAN Access Maps) supported on software on Cisco MLS.

Cisco Catalyst switches support four ACL lookups per packet*:

ingress (1) and egress (2) security lookup
ingress (3) and egress (4) Quality of Service (QoS) look-up

This following section all went over my head or just about and I have no idea whether this works or not or is correct or not for more information.

There are cases where certain Access Control Entries (ACEs) must be combined in each ACLs due to limitations of TCAM hardware. The merge process is also responsible for other functions like expanding ACEs due to a lack of Layer 4 Operations Pointers (L4Op Pointers) or Logical Operational Units (LOUs).

Cisco catalyst Switches use two features to perform a merge

order independent algorithm merge
order dependant algorithm merge

Order Independent Merge (OIM) is based on Binary Decision Diagrams(BDD), ACLs are merged from a series of oder-dependant actions to a set of order-independent masks and patterns. The resulting ACE can be very large, and processor and memory intensive.

Order Dependant Merge (ODM) is not bit-based. The computation is much faster and is less processor intensive.

RACLs are supported in hardware through IP standard and IP extended ACSs, with permit and deny actions. ACL processing is an intrinsic part of the packet forwarding process. ACL entries are programmed in hardware. Lookups occur in the pipeline, whether ACLs are configured or not. With RACLs access list statistics and logging are not supported.

*You can get some switches with two security lookups and 1 QoS lookup in each direction (6 total).

Configuring VACLs

VACLs apply to all traffic on a VLAN. VACLs use standard and extended Cisco IOS IP and IPX ACLs, and MAC Layer-named ACLs and VLAN access-maps.

VACLs follow route-map conventions, in which map sequences are check in order (top-down).

Each VLAN access map can consist of one or more map sequence, each sequence with a match clause and an action clause. The match clause specifices IP, IPX, or MAC ACLs for traffic filtering and the action clause specifies the action to be taked when a match occurs. When a flow matches a permit ACL entry, the assciated action is taken and the flow is not checked against the remaining sequences. When a flow matches a deny ACL entry, it will be checked against the next ACL in the same sequence or the next sequence. If aflow does not match any ACL entry and at least on ACL is configured for that packet, the packet is denied.

Three VACL actions are permitted:

Permit (with capture, Catalyst 6500 only)
Redirect (Catalyst 6500 only)
Deny (with logging, Catalyst 6500 only)

Two features are supported on Catalyst 6500 only:

VACL Capturewhere Forwarded packets are captured on the capture port. The capture option is only permit ACEs. The capture port can be an IDS port or an Ethernet port. The capture port must be an egress VLAN for layer-3 switched traffic.

VACL Redirect where matching packets are redirected to specific ports. You can configure up to five redirect ports. Redirect ports must be in a VLAN where a VACL is applied.

Define a VLAN Access MAP

switch#configure terminal switch(config)#vlan access-map map-name seq# insert to/delete from

Configure the match clause in a VLAN access map sequence

switch(config-access-map)#match options

Configure actions

switch(config-access-map)#action options

Apply the VACL to VLANs

switch(config)#vlan filter map-name vlan-list list

Verify configuration

switch(config)#show vlan access-map map-name

Source for this Config document Section

Private VLANs

Internet Service Providers (ISP) often have devices from multiple clients, in addition to their own servers resident on a single demilitarized zone(DMZ) segment of VLAN. Cisco Catalyst 6500/4500 switches Private Virtual Local Area Networks (PVLAN) to keep some switch ports shared and some switch ports isolated, even if the ports exist in the same VLAN. The 2950 and 3550 support “protected ports”, which are functionally the same on a per-switch basis.

Traditionally ISPs used one VLAN per customer, with each VLAN having its own subnet. A layer 3 device the provides interconnectivity between VLANs and Internet destinations. Problems with this method:

Supporting a VLAN per customer may require a high number of interfaces on ISP network devices.
Spanning Tree becomes more complicated with many VLAN iterations.
Network address space must be divided into many subnets, which wastes space and increases management complexity.
Multiple ACL applications are required to maintain security on multiple VLANs, resulting in increased management complexity.

PVLANs provide Layer-2 isolation between ports within the same VLAN, thereby eliminating the need for VLAN and IP subnet per customer.

A Port in a PVLAN can be one of three types:

Isolated: port has complete Layer-2 separation from other ports within the same PVLAN, except for promiscuous ports; blocks all traffic to isolated ports except from promiscuous ports. Traffic received from an isolated port is forwarded only to promiscuous ports.
Promiscuous: ports can communicate with all ports within the PVLAN. The default Gateway (DG) is probably be hosted as a promiscuous port.
Community: ports communicate among themselves and their promiscuous ports. These interfaces are isolated at Layer-2 from all other interfaces in other communities, or in isolated ports within their PVLAN.

Trunks carry all VLAN traffic so isolated, promiscuous and community PVLAN traffic may enter and leave a switch through trunks

PVLAN ports are associated with a set of supporting VLANs that are used to create the PVLAN structure.

As a Primary VLAN: carrying traffic from promiscuous ports to isolated, community and other promiscuous ports in the same primary VLAN.
As an Isolated VLAN: carrying traffic from isolated ports to a promiscuous port.
As a Community VLAN: carrying traffic between secondary VLANs. You can extend PVLANs across multiple devices by trunking primary, isolated, and community VLANs to other devices that support PVLANs.

A promiscuous port can service only one primary VLAN. A promiscuous port can service one isolated VLAN or many community VLANs.

Configuring

Step 1: Set VTP Mode to Transparent

switch#configure terminal switch(config)#vtp mode transparent

You may also want to check VTP version, password and domain while you are at VTP configuration

Step 2: Create the secondary VLANs (Isolated and community VLANs are secondary VLANs)

switch#configure terminal switch(config)#vlan 102 switch(config-vlan)#private-vlan isolated switch(config-vlan)#end switch#show vlan private-vlan type

Step 3: Create the primary VLAN

switch#configure terminal switch(config)#vlan 100 switch(config-vlan)#private-vlan primary switch(config-vlan)#end switch#show vlan private-vlan type

Step 4: Associate the secondary VLAN with the primary VLAN. Only one isolated VLAN can be mapped to a primary VLAN, but more than one community VLAN can be mapped to a primary VLAN

switch#configure terminal switch(config)#vlan 100 switch(config-vlan)#private-vlan association add 102 switch(config-vlan)#end switch#show vlan private-vlan type

When associating secondary VLANs with primary VLANs use these best practices:

Make sure that the VLAN IDs contain only one isolated VLAN ID (VID)
Use the remove keyword with the secondary VID to clear association; there can only be one association.
Use the no keyword to clear all association from the primary VLAN.
Do not allow the command to take effect until you exit VLAN configuration submode.

Step 5: Configure an interface as an isolated or community port.

switch#configure terminal switch(config)#interface gigabitethernet 0/1 switch(config-if)#switchport mode private-vlan host switch(config-if)#end switch#show interfaces gigabitethernet 0/1 switchport

Step 6: Associate the isolated port or community port with the primary/secondary VLAN pair

switch#configure terminal switch(config)#interface gigabitethernet 0/1 switch(config-if)#switchport private-vlan mapping 100 102 switch(config-if)#end switch#show interfaces gigabitethernet 0/1 switchport

Step 7: Configure an interface as a promiscuous port

switch#configure terminal switch(config)#interface gigabitethernet 0/1 switch(config-if)#switchport mode private-vlan promiscuous switch(config-if)#end switch#show interfaces gigabitethernet 0/1 switchport

Step 8: Map the promiscuous port to the primary/secondary VLAN pair

switch#configure terminal switch(config)#interface gigabitethernet 0/1 switch(config-if)#switchport private-vlan host-association mapping 100 102 switch(config-if)#end switch#show interfaces gigabitethernet 0/1 switchport

Step 9: Permit Routing of Secondary VLAN Ingress Traffic

switch#configure terminal switch(config)#interface vlan 100 switch(config-if)#private-vlan mapping add 102 switch(config-if)#end switch#show interfaces private-vlan mapping

The sources for this config section include this Cisco 4500 document and this document. Finally CCIE Blog gave me a some insight and hint as to WTF the difference between the host and promiscious ports on the interface config was.

Definition

Logical Operation Unit (LOU) are hardware registers used to store {operator, operand} tuplesfor Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) port numbers specified in an IP extended ACL, VACL, or QoS ACL. These tuples are called Layer 4 Operations (L4Op).

Source

Notes and Notices:

References I want to rememeber:

Hucaby, D. (2007). CCNP Self-Study: CCNP BCMSN Official Exam Certification Guide, Fourth Ed, VLAN Access Lists (page. 413-414). Indianapolis: Cisco Press.

Network Ninja

Archive for the 'ACL' Category

Difference between VLAN Access-map and ACL

BCMSN VLAN-ACL Lab 8

Switch Security Layer-2 Attacks – Four

Switch Security Layer-2 Attacks – Two

Search

About

Latest

Archives

Categories