phanx

powered by Technology
RSS icon Email icon Bullet (black)

  • 创建在Cisco路由器上可以show run的只读用户

    Posted on 06月 2nd, 2007 phanx 1 comment
    ========phanx.com=========
    Author:  phanx
    Updated: 2005-11-01
    =========================
     
    某客户要求实施用户分级,有点特殊的就是需要分为特权用户和只读用户.
    特权用户可以查看,修改配置,只读用户只能查看,不能修改配置.
    开始使用cisco的权限分级 level 1 和 level 15 来作,
    然后给level 1 用户 授予 show run的权限
    privilege exec level 1 show running-config
    表面上看是达到了要求,但是. 当 level 1 用户使用show run 的时候
    命令可以被执行,但是显示出来得确实一个空得配置.
    Cisco有一篇文档描述了这个问题
    IOS Privilege Levels Cannot See Complete Running Configuration
    www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a00800949d5.shtml
     
    所以,为了解决这个问题,我们要从另外一个角度来做.
    要完成这个功能,我们需要通过CiscoACS来配合,而不仅仅是本地AAA认证.
    大概思路就是特权用户就和平常得特权用户一样, level 15的用户.
    而对于只读用户,我们也给level 15得权限,但是要禁止它执行configure命令.
    下面是具体的配置方法:
    在需要进行认证的路由器上做如下配置:
    aaa authentication login default group tacacs+ local none
    aaa authentication login no_tacacs local
    aaa authorization exec default group tacacs+ local
    aaa authorization commands 15 default group tacacs+ local
    aaa accounting commands 15 default start-stop group tacacs+
    aaa session-id common
    ip tacacs source-interface Loopback0
    tacacs-server host x.x.x.x
    tacacs-server directed-request
    tacacs-server key keytoacs
    建议再加入一个用户
    username admin privilege 15 password passwordforadmin
    以备ACS服务器无法访问时候用来进行本地认证
    需要在ACS上做一下配置:
    1. 添加 超级用户的 group
    在 Group Setup 中找到一个未用的组,例如 Group 8, 选 Edit Setting
     
    在TACACS+ Settings 中,选中Shell (exec) 和Privilege level 并将Privilege level 设为15
     
    Shell Command Authorization Set
    选 Per Group Command Authorization Unmatched Cisco IOS commands — Permit
       Unlisted arguments — Permit 
     
    然后选 Sumit ＋ Restart
    2．添加只读用户Group
    在Group Setup中选中一个未用的组，例如group 9 选 Edit Setting。
    其余操作同添加超级用户一致。
    最后一个Shell Command Authorization Set
     选 Per Group Command Authorization Unmatched Cisco IOS commands — Permit 
    然后勾上 Command 选项，输入 configure，Arguments里面填入
    deny terminal ,然后Unlisted arguments – Deny。
    点击Submit＋Restart
     
    然后添加用户，超级用户划入 group 8， 只读用户划入 group 9。
    就是在User Setup的Group to which the user is assigned中选取相应的group就行了。
     
    CiscoTechnology ,

  • Cisco PIX /ASA 防火墙密码恢复

    Posted on 06月 2nd, 2007 phanx No comments
    ========phanx.com=========
    Author:   phanx
    Updated: 2006-9-1
                 2007-6-1
    =========================
     
    PIX 的密码恢复和路由器/交换机稍有不同,需要用密码恢复文件来进行恢复.
    密码恢复文件有这些:
    np70.bin (7.0 release)
    np63.bin (6.3 release)
    np62.bin (6.2 release)
    np61.bin (6.1 release)
    np60.bin (6.0 release)
    np53.bin (5.3 release)
    np52.bin (5.2 release)
    np51.bin (5.1 release)
    np50.bin (5.0 release)
    np44.bin (4.4 release)
    nppix.bin (4.3 and earlier releases)
     
    PIX较老型号带有软驱,新一点的没有了.
    这里讲的是无软驱型号的恢复过程.
    启动的时候按  ESC 或者 BREAK ,进入 Rom Moniter状态.
    然后输入
    interface X    -  X代表端口号
    address x.x.x.x    – x.x.x.x 代表PIX地址
    server x.x.x.y  – x.x.x.y 代表TFTP Server地址
    file npXY.bin – XY代表版本号
    tftp
     
    CISCO SYSTEMS PIX FIREWALL
    Embedded BIOS Version 4.3.207 01/02/02 16:12:22.73
    Compiled by morlee
    32 MB RAM
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
     00  00  00   8086   7192  Host Bridge       
     00  07  00   8086   7110  ISA Bridge        
     00  07  01   8086   7111  IDE Controller    
     00  07  02   8086   7112  Serial Bus         9
     00  07  03   8086   7113  PCI Bridge        
     00  0D  00   8086   1209  Ethernet           11
     00  0E  00   8086   1209  Ethernet           10
    Cisco Secure PIX Firewall BIOS (4.2) #0: Mon Dec 31 08:34:35 PST 2001
    Platform PIX-506E
    System Flash=E28F640J3 @ 0xfff00000
    Use BREAK or ESC to interrupt flash boot.
    Use SPACE to begin flash boot immediately.
    Flash boot interrupted.                        
    0: i8255X @ PCI(bus:0 dev:14 irq:10)
    1: i8255X @ PCI(bus:0 dev:13 irq:11)
    Ethernet auto negotiation timed out.
    Ethernet port 1 could not be initialized.
    Use ? for help.
    monitor> ?
    ?                 this help message
    address   [addr]  set IP address of the PIX interface on which
                      the TFTP server resides
    file      [name]  set boot file name
    gateway   [addr]  set IP gateway
    help              this help message
    interface [num]   select TFTP interface
    ping      <addr>  send ICMP echo
    reload            halt and reload system
    server    [addr]  set server IP address
    tftp              TFTP download
    timeout           TFTP timeout
    trace             toggle packet tracing
    monitor> interface 0 
    0: i8255X @ PCI(bus:0 dev:14 irq:10)
    1: i8255X @ PCI(bus:0 dev:13 irq:11)
    ~两个端口 0 和 1
    Using 0: i82557 @ PCI(bus:0 dev:14 irq:10), MAC: 000d.bc7e.d97a
    monitor>address 1.1.1.2
    address 1.1.1.2
    monitor> file np62.bin
    file np62.bin
         ~~~~~~~~PIX 6.2 版本的
    monitor> ping 1.1.1.1
    Sending 5, 100-byte 0x9e5e ICMP Echoes to 1.1.1.1, timeout is 4 seconds:
    !!!!!
    Success rate is 100 percent (5/5)
    monitor> server 1.1.1.1
    server 1.1.1.1
    monitor> tftp
    tftp np62.bin@1.1.1.1……………………………………………………………………………………………………………………………….
    Received 73728 bytes
    Cisco Secure PIX Firewall password tool (3.0) #0: Wed Mar 27 11:02:16 PST 2002
    System Flash=E28F640J3 @ 0xfff00000
    BIOS Flash=am29f400b @ 0xd8000
    Do you wish to erase the passwords? [yn] y
    The following lines will be removed from the configuration:
            enable password mLbCjoY6Ql1vh0o4 encrypted
            passwd i/Y4R6kWHD6hjJ/v encrypted
    Do you want to remove the commands listed above from the configuration? [yn] y
    Passwords and aaa commands have been erased.
     
    Rebooting..
    CISCO SYSTEMS PIX FIREWALL
    Embedded BIOS Version 4.3.207 01/02/02 16:12:22.73
    Compiled by morlee
    32 MB RAM
    PCI Device Table.
    Bus Dev Func VendID DevID Class              Irq
     00  00  00   8086   7192  Host Bridge       
     00  07  00   8086   7110  ISA Bridge        
     00  07  01   8086   7111  IDE Controller    
     00  07  02   8086   7112  Serial Bus         9
     00  07  03   8086   7113  PCI Bridge        
     00  0D  00   8086   1209  Ethernet           11
     00  0E  00   8086   1209  Ethernet           10
    Cisco Secure PIX Firewall BIOS (4.2) #0: Mon Dec 31 08:34:35 PST 2001
    Platform PIX-506E
    System Flash=E28F640J3 @ 0xfff00000
    Use BREAK or ESC to interrupt flash boot.
    Use SPACE to begin flash boot immediately.
    Reading 1536512 bytes of image from flash.     
    ##################################################################################
    32MB RAM
    System Flash=E28F640J3 @ 0xfff00000
    BIOS Flash=am29f400b @ 0xd8000
    mcwa i82559 Ethernet at irq 11  MAC: 000d.bc7e.d97b
    mcwa i82559 Ethernet at irq 10  MAC: 000d.bc7e.d97a
      ———————————————————————–
                                   ||        ||
                                   ||        ||
                                  ||||      ||||
                              ..:||||||:..:||||||:..
                             c i s c o S y s t e m s
                            Private Internet eXchange
      ———————————————————————–
                            Cisco PIX Firewall
    Cisco PIX Firewall Version 6.2(2)
                               ~~~~~~ PIX 6.2
    Licensed Features:
    Failover:           Disabled
    VPN-DES:            Enabled
    VPN-3DES:           Disabled
    Maximum Interfaces: 2
    Cut-through Proxy:  Enabled
    Guards:             Enabled
    URL-filtering:      Enabled
    Inside Hosts:       Unlimited
    Throughput:         Limited
    IKE peers:          Unlimited
      ****************************** Warning *******************************
      Compliance with U.S. Export Laws and Regulations – Encryption.
     
      This product performs encryption and is regulated for export
      by the U.S. Government.
     
      This product is not authorized for use by persons located
      outside the United States and Canada that do not have prior
      approval from Cisco Systems, Inc. or the U.S. Government.
     
      This product may not be exported outside the U.S. and Canada
      either by physical or electronic means without PRIOR approval
      of Cisco Systems, Inc. or the U.S. Government.
     
      Persons outside the U.S. and Canada may not re-export, resell
      or transfer this product by either physical or electronic means
      without prior approval of Cisco Systems, Inc. or the U.S.
      Government.
      ******************************* Warning *******************************
    Copyright (c) 1996-2002 by Cisco Systems, Inc.
                    Restricted Rights Legend
    Use, duplication, or disclosure by the Government is
    subject to restrictions as set forth in subparagraph
    (c) of the Commercial Computer Software – Restricted
    Rights clause at FAR sec. 52.227-19 and subparagraph
    (c) (1) (ii) of the Rights in Technical Data and Computer
    Software clause at DFARS sec. 252.227-7013.
                    Cisco Systems, Inc.
                    170 West Tasman Drive
                    San Jose, California 95134-1706
    .
    Cryptochecksum(changed): f72dbc0b 3560939d 6544ff4a 70d7e598
    Type help or ‘?’ for a list of available commands.
    pixfirewall> en
    Password:
    pixfirewall#
     
    更详细的文档,请参考Cisco文档:
     

    Password Recovery and AAA Configuration Recovery Procedure for the PIX

    http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_password_recovery09186a008009478b.shtml

     

    而ASA的密码恢复过程就更加像路由器了.

    同样,启动后按ESC进入Rommon,输入 confreg命令.

    rommon #1> confreg

    然后更改: 

    Current Configuration Register: 0x00000011


    Configuration Summary:


      boot TFTP image, boot default image from Flash on netboot failure


    Do you wish to change this configuration? y/n [n]: y

    所有都按照默认回答,在问"disable system configuration?" 的时候,选择 y.
    然后重启:
    rommon #2> boot

    启动进入OS以后,密码为空.

    hostname> enable

    hostname# copy startup-config running-config
hostname# configure terminal
hostname(config)# password password
hostname(config)# enable password password
hostname(config)# username name password password
再把configuration register 改回来.
    hostname(config)# config-register value
然后存盘.
    hostname(config)# copy running-config startup-config

    请参考cisco文档:

    Performing Password Recovery for the ASA 5500 Series Adaptive Security Appliance http://www.cisco.com/en/US/docs/security/asa/asa71/configuration/guide/trouble.html#wp1058131

     

    CiscoTechnology , ,

  • RR环境下的iBGP等价负载均衡路径问题

    Posted on 05月 12th, 2007 phanx 5 comments

    ========phanx.com=========
    Author:   phanx
    Updated: 2007-5-12
    =========================

     
     
    这两天被某同事骚扰,协助解决一个RR环境下 iBGP 等价负载均衡的问题.
    今天查查文档,用DynaGen做了试验,明白了其中缘由.
     
    拓扑如图所示.
    R1和R3都为AS100里面的RR(路由反射体),分别属于cluster 0.0.0.1和0.0.0.3.
    R2和R4都是R1和R3的RR客户(Route-reflector-client).
    R1,R2,R3,R4之间均为相同类型和带宽的链路. R4下有一个100.0.0.0/24的网段.
     
    问题是,按照理解,R2到达R4的100.0.0.0/24应该存在两条等价路径. ( R2–> R1 –> R4 和 R2–> R3 –> R4 )
    但是,通过show ip bgp 100.0.0.0 和 show ip route 100.0.0.0 都只看到了一条路径.
     
    R2#sh ip bgp 100.0.0.0
    BGP routing table entry for 100.0.0.0/24, version 5
    Paths: (2 available, best #2, table Default-IP-Routing-Table)
    Multipath: iBGP
      Not advertised to any peer
      Local
        4.4.4.4 (metric 20) from 1.1.1.1 (1.1.1.1)
          Origin IGP, metric 0, localpref 100, valid, internal, best
          Originator: 4.4.4.4, Cluster list: 0.0.0.1
      Local
        4.4.4.4 (metric 20) from 3.3.3.3 (3.3.3.3)
          Origin IGP, metric 0, localpref 100, valid, internal
          Originator: 4.4.4.4, Cluster list: 0.0.0.3
     
    R2#sh ip route 100.0.0.0
    Routing entry for 100.0.0.0/24
      Known via "bgp 100", distance 200, metric 0, type internal
      Last update from 4.4.4.4 00:16:11 ago
      Routing Descriptor Blocks:
      * 4.4.4.4, from 1.1.1.1, 00:16:11 ago
          Route metric is 0, traffic share count is 1
          AS Hops 0
     
    如果大家了解BGP,就应该知道,BGP有一系列选择最佳路径的规则,而且默认只使用一条路径.
    在这个问题里面, R2上是配置了 bgp maximum-path ibgp 2的,所以只要两条路径的是等价的,
    那么就应该可行.
     
    那么为什么会只有一条呢?
     
    其实,我们都被误导了. 要明白这个问题,首先要理解RR.
    RR是route reflector 路由反射体,用来减少iBGP中iBGP Peer的连接数的.
    在iBGP中,RR只是负责将iBGP Peer通告的路由"反射"给其它的iBGP Peer.
    也就是说并不是RR接收iBGP Peer的通告后再通告给别的iBGP Peer,
    通告的源是iBGP Peer而不是RR.
     
    再来看看刚才的show ip bgp输出:
    R2#sh ip bgp 100.0.0.0
    BGP routing table entry for 100.0.0.0/24, version 5
    Paths: (2 available, best #2, table Default-IP-Routing-Table)
    Multipath: iBGP
      Not advertised to any peer
      Local
        4.4.4.4 (metric 20) from 1.1.1.1 (1.1.1.1)
          Origin IGP, metric 0, localpref 100, valid, internal, best
          Originator: 4.4.4.4, Cluster list: 0.0.0.1
      Local
        4.4.4.4 (metric 20) from 3.3.3.3 (3.3.3.3)
          Origin IGP, metric 0, localpref 100, valid, internal
          Originator: 4.4.4.4, Cluster list: 0.0.0.3
     
    这两个条目实际上反映的是同样一条路由,即要到达100.0.0.0/24, 下一条地址是4.4.4.4
    这从show ip route的输出也得到了验证.
    R2#sh ip route 100.0.0.0
    Routing entry for 100.0.0.0/24
      Known via "bgp 100", distance 200, metric 0, type internal
      Last update from 4.4.4.4 00:16:11 ago
      Routing Descriptor Blocks:
      * 4.4.4.4, from 1.1.1.1, 00:16:11 ago
          Route metric is 0, traffic share count is 1
          AS Hops 0
    那么到底到100.0.0.0/24有几条路呢?
     
    答案是:  两条.
    因为从R2到4.4.4.4的话不是直接可达,还需要进行路由的递归查找. 即查找到达4.4.4.4的下一条地址是哪里.
    那么,因为R2到R4存在两条同类型同带宽的链路,所以,就会有两条到达4.4.4.4的路径.
    R2#sh ip route 4.4.4.4
    Routing entry for 4.4.4.4/32
      Known via "isis", distance 115, metric 20, type level-2
      Redistributing via isis
      Last update from 10.0.0.17 on FastEthernet0/1, 00:02:03 ago
      Routing Descriptor Blocks:
        10.0.0.17, from 4.4.4.4, via FastEthernet0/1
          Route metric is 20, traffic share count is 1
      * 10.0.0.1, from 4.4.4.4, via FastEthernet0/0
          Route metric is 20, traffic share count is 1
     
    这样,到100.0.0.0/24同样也就得到了两条路径.
    实际上,这个负载均衡是通过IGP来实现的. 因为对于iBGP来说只能看到一条路径.
    在Cisco IOS实现中,在建立FIB的时候会自动对100.0.0.0/24做递归得到两条路径.
    R2#sh ip cef
    Prefix              Next Hop             Interface
    100.0.0.0/24   10.0.0.17            FastEthernet0/1
                        10.0.0.1             FastEthernet0/0
    R2#sh ip cef 100.0.0.0
    100.0.0.0/24, version 24, epoch 0, per-destination sharing
    0 packets, 0 bytes
      via 4.4.4.4, 0 dependencies, recursive
        next hop 10.0.0.1, FastEthernet0/0 via 4.4.4.4/32
        valid adjacency
      Recursive load sharing using 4.4.4.4/32.
     
    顺便再说一下.
     
    在这个问题中, 同事另外的问题就是为什么一定是1.1.1.1反射过来的路由成为最佳路径.
    那是因为在BGP Best Path Algorithm 中, 最后要比较通告的iBGP Peer的地址大小,
    小的优先.
     
    在这个RR的环境下,R2的Peer是R1和R3, 路由通告被RR反射过,上面就会携带RR的信息.
    也就是show ip bgp 100.0.0.0中的from 1.1.1.1 (1.1.1.1)和from 3.3.3.3 (3.3.3.3)
    括号外面的为建立iBGP Peer的地址, 括号里面为iBGP的router-id.
    这样一比,自然1.1.1.1小, 所以也就成为了best path.
     
    这个问题最后给我的启示就是,看问题不要被表面现象迷惑了. 要看到本质.
    CiscoTechnology , ,

  • 3750升级IOS后CPU利用率高,并且出现Traceback报错

    Posted on 01月 19th, 2007 phanx No comments
    去年记录的一个故障:
     
    ========phanx.com=========
    Author:   phanx
    Updated: 2006-5-10
    ========================= 
     
    将3750/3750G从12.1升级IOS到 12.2(25)SEE.
    升级完成后发现3750的CPU利用率在80％左右，较高。
    并发现大量的报告错误信息如下:
    *Mar  1 08:02:04.722: %PLATFORM_UCAST-3-ADJ:  Invalid OCE type 33 for fib x.x.x.x/32 Tbl:0
    -Traceback= 250D6C 9E1364 9F054C 9F2624 9E5470 9D437C 9D48A4 A566C8 A1D858 A31454 A20ACC A28360 A28470 A764D8 A77A4C AEBD80
    更换其它12.2系列IOS为后故障依旧.
    后经过配置比较发现故障设备有一句 ip cef accounting per-prefix,去掉后一切恢复正常.
    暂时在Cisco 没有查到相关的说明和文档.
    CiscoTechnology , , , , ,

  • WS-SUP720 引擎启动直接进入rommon状态的故障

    Posted on 01月 19th, 2007 phanx No comments

    以前记录的一个故障:

    ========phanx.com=========
    Author:   phanx
    Updated: 2005-11-17
    =========================

     
     
    WS-SUP720 引擎启动直接进入rommon状态的故障
     
    相关硬件:
    WS-SUP720-3A
    WS-SUP720-3B
    WS-SUP720-3BXL
     
    故障现象:
    config-register值为正常的 0×2102, IOS 也没有损坏。
    但是7609的SUP720-3B引擎启动后直接停留在rommon状态，不引导IOS。
    解决方法:
    升级 Supervisor Engine 720 的SP(Switch Processor) 的ROMMON Image(Bootstrap)到 8.4(2)
    升级方法:
    1. 检查当前 SP 的 Bootstrap (示例中为7609双引擎)
    Router-7609#sh rom-monitor slot 5 sp
    Region F1: INVALID
    Region F2: INVALID
    Currently running ROMMON from S (Gold) region
    Router-7609#sh rom-monitor slot 6 sp
    Region F1: INVALID
    Region F2: INVALID
    Currently running ROMMON from S (Gold) region
    2. 升级 SP 的 Bootstrap
    Router-7609#upgrade rom-monitor slot 5 sp file tftp://x.x.x.x/c6ksup3-rm2.srec.8.4.2
    Copying tftp://x.x.x.x/c6ksup3-rm2.srec.8.4.2 onto SP’s bootdisk…
    Loading c6ksup3-rm2.srec.8.4.2 from 10.178.190.117 (via FastEthernet8/1): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    [OK - 473563 bytes]
    Loading c6ksup3-rm2.srec.8.4.2 from 10.178.190.117 (via FastEthernet8/1): !
    Oct 19 19:40:05.789 CCT: SP: ROMMON image upgrade in progress
    Oct 19 19:40:05.789 CCT: SP: Erasing flash
    Oct 19 19:40:08.572 CCT: SP: Programming flash
    Oct 19 19:40:10.863 CCT: SP: Verifying new image
    Oct 19 19:40:10.971 CCT: SP: ROMMON image upgrade complete, Supervisor engine must be reloaded.
    Router-7609#upgrade rom-monitor slot  sp file tftp://x.x.x.x/c6ksup3-rm2.srec.8.4.2
    Copying tftp://x.x.x.x/c6ksup3-rm2.srec.8.4.2 onto SP’s bootdisk…
    Loading c6ksup3-rm2.srec.8.4.2 from 10.178.190.117 (via FastEthernet8/1): !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    [OK - 473563 bytes]
    Loading c6ksup3-rm2.srec.8.4.2 from 10.178.190.117 (via FastEthernet8/1): !
    *Oct 19 19:40:29.494 CCT: SP-STDBY: ROMMON image upgrade in progress
    *Oct 19 19:40:29.494 CCT: SP-STDBY: Erasing flash
    *Oct 19 19:40:32.082 CCT: SP-STDBY: Programming flash
    *Oct 19 19:40:34.006 CCT: SP-STDBY: Verifying new image
    *Oct 19 19:40:34.110 CCT: SP-STDBY: ROMMON image upgrade complete, Supervisor engine must be reloaded.
    3. 确认 SP 的 Bootstrap 和 register 值
    Router-7609#sh rom-monitor slot 5 sp
    Region F1: FIRST_RUN, preferred
    Region F2: INVALID
    Currently running ROMMON from S (Gold) region
    Router-7609#sh rom-monitor slot 6 sp
    Region F1: FIRST_RUN, preferred
    Region F2: INVALID
    Currently running ROMMON from S (Gold) region
    Router-7609#sh ver
    Configuration register is 0×2102
    4. 重启
    Router-7609#reload
    Proceed with reload? [confirm]y
    5. 重启后确认
    Router-7609#sh rom-monitor slot 5 sp
    Region F1: APPROVED, preferred
    Region F2: INVALID
    Currently running ROMMON from F1 region
    Router-7609#sh rom-monitor slot 6 sp
    Region F1: APPROVED, preferred
    Region F2: INVALID
    Currently running ROMMON from F1 region
    注意事项:
     
     在用upgrade命令升级Bootstrap后，需要使用reload命令重启。
     不能使用hw-module module x reset命令进行重启或者进行online insertion and removal (OIR)
     操作甚至断电。
     必须要reload后用 show rom-monitor slot x sp 命令确认Bootstrap 状态为APPROVED, preferred
    相关文档:
     

    CiscoTechnology ,

  • Cisco路由器和交换机的Port-Channel做法区别

    Posted on 01月 18th, 2007 phanx No comments
    ========phanx.com=========
    Author:   phanx
    Updated: 2007-1-18
    =========================
     
    路由器的Route Port以太口要做Port-Channel需要先在路由器上配置
     
    interface Port-ChannelX (X为1-64)
     
     
    然后才能到相应的端口上配置 channel-group X
     
     
    这和交换机Switch Port以太口先在相应的端口下配置 channel-group X mode on 后
    就会自动出现  interface Port-ChannelX 不同.
    CiscoTechnology , ,

  • 2960可以配置多个interface vlan并且都能UP

    Posted on 01月 18th, 2007 phanx No comments
     在Cisco早期的二层交换机比如： 2950系列的交换机山，如果配置了多个interface vlan，那么只能有一个处于up状态。
    在新的2960系列中，这个限制已经没有了。
    interface Vlan1
     no ip address
     no ip route-cache
     shutdown
    !
    interface Vlan100
     ip address 1.1.1.1.1 255.0.0.0
     no ip route-cache
    !
    interface Vlan200
     ip address 2.2.2.2 255.0.0.0
     no ip route-cache
     
    Switch# show ip int b
    Interface              IP-Address         OK? Method Status                Protocol
    Vlan1                      unassigned      YES unset  administratively down down   
    Vlan100                   1.1.1.1           YES manual up                    up   
    Vlan200                   2.2.2.2           YES manual up                    up  
    FastEthernet0/1        unassigned      YES unset  down                  down   
    FastEthernet0/2        unassigned      YES unset  down                  down   
    到底能配几个UP几个,没试.
    CiscoTechnology , , ,

  • 4500 引擎上的10/100 MGT 口只能在Rommon模式下使用

    Posted on 01月 18th, 2007 phanx No comments
    ========phanx.com=========
    Author:   phanx
    Updated: 2007-1-18
    =========================
     
    4500 引擎上的10/100 MGT 口只能在Rommon模式下使用.
     
     
    rommon 1 >unset boot
    rommon 2 > set interface fa1 1.1.1.1 255.0.0.0
    rommon 3 >boot tftp://1.1.1.2/cat4000-i5k91s-mz.122-25.EWA7.bin
     
    更详细的我也不写了.请参考Cisco的文档吧:
     
    CiscoTechnology , , , ,

  • 关于IP Source Guard的部署限制

    Posted on 01月 11th, 2007 phanx No comments
    ========phanx.com=========
    Author:   phanx
    Updated: 2007-1-11
    =========================
     
    最近做一个工程,客户正好要部署 DHCP Snooping + IP Source Guard来防止IP地址盗用.
    经过工程实施发现了一些问题.
     
    用户的接入交换机是 2960 ,只支持 DHCP Snooping,不支持 IP Source Guard.
    所以,需要在核心/汇聚交换机上去做.
     
    但是发现IOS版本的6500 也是只支持 DHCP Snooping,不支持 IP Source Guard,
    IP Source Guard 要在 CatOS 的 6500 才有.
     
    问起为什么低端的45,35都有,65反而没有, 我只能说 65 是定位在核心的高速交换,
    像 IP Source Guard 这种功能应该在接入上进行部署,而不是放到核心来做.
     
    最后只能在4500/3560上做. 但是对于接入交换机双线上连核心交换机的情况有点问题.
    一般双核心都会启用HSRP/VRRP这类冗余网关. DHCP Snooping 只能在Active网关上侦听
    并记录相应的条目, Backup网关上没有任何的记录. 因为IP Source Guard的Binding表
    是以 DHCP Snooping 的Binding表为基础形成的,这样, 一旦主用设备宕机,切换到
    备用设备上的时候,由于备用设备上没有任何的DHCP Snooping Binding记录,这将导致
    所有的用户都无法正常访问, 因为备用设备的 IP Source Guard 的Binding表中没有
    任何用户的Binding记录.
     
    还有, DHCP Snooping 的 Binding 表是需要保存的, 可以写到bootflash里面,或者是
    tftp服务器上面, tftp要好一些. 因为保存到bootflash里面的话, 会产生很多文件碎片.
    在配置Binding表保存到bootflash中的时候, 都会出现Warning提示.
     
    后记：
     
    关于IP Source Guard，另有一文简单介绍了一下 利用IP source guard 防止IP地址盗用
    BTW:发现网上转载这两篇挺多的 -_-!
    CiscoTechnology , , , ,

  • Cisco IOS 处理 VTP 报文的漏洞

    Posted on 12月 5th, 2006 phanx No comments
    以下引用自 NSFocus
    Cisco IOS在处理特制VTP报文时存在多个漏洞，具体如下：

    1 拒绝服务

    如果向Cisco IOS设备发送了VTP version 1摘要帧并将VTP版本字段设置为2的话，VTP处理进程就会陷入循环，最终由系统watchdog进程终止，导致设备重载。

    2 VTP修改版本整数回绕

    如果攻击者能够向Cisco IOS或CatOS设备发送VTP更新（摘要和sub）的话，就可以自己选择VTP信息的修改版本号。IOS会接受0x7FFFFFFF这个版本号。当运算符更改交换机VLAN配置时，IOS就会将版本号增加为0×80000000，然后由有符整数变量内部追踪这个版本号。因此，这个修改版本号会被处理为很大的负值。从这时起交换机无法同更改的VLAN配置通讯，因为所有其他交换机都会拒绝这个生成的更新，

    3 VLAN名称堆溢出

    如果攻击者能够向Cisco IOS设备发送VTP更新的话，类型2帧包含有每个VLAN的记录。VTP记录的一个字段中包含有VLAN的名称，另一个字段为这个名称的长度。如果更新的VLAN名称大于100字节且VLAN名称长度字段正确的话，就会导致堆溢出，在接收的交换机上执行任意代码。

     
     
     
    思科官方的公告：
     
     
    建议用VTP的改为transparent模式或者升级IOS吧。
    相关BUG信息：
  • CSCsd52629 ( registered customers only) , CSCsd34759 ( registered customers only) — VTP version field DoS
  • CSCse40078 ( registered customers only) , CSCse47765 ( registered customers only) — Integer Wrap in VTP revision
  • CSCsd34855 ( registered customers only) , CSCei54611 ( registered customers only) — Buffer Overflow in VTP VLAN name
  • CSCsg03449 ( registered customers only) — Etherswitch module VLAN Trunking Protocol Vulnerabilities
CiscoTechnology , ,
  • « Older Entries
    Newer Entries »
    • ©2000-2009 phanx.com. All rights reserved.