Configure Cisco IOS SSL vpn

Example for simple network configuration
one router with WAN/LAN interfaces and loopback interface:
- FastEthernet0/0  - WAN interface
- FastEthernet0/1  - LAN interface
- Loopback0 - internal router interface
SSL VPN access to networks:
- 2.2.2.0/24
- 4.4.4.0/24

configure router
interface Loopback0
ip address 4.4.4.1 255.255.255.0
!
interface FastEthernet0/0
description WAN interface
ip address 1.1.1.100 255.255.255.0
duplex auto
speed auto
no shut
!
interface FastEthernet0/1
description LAN interface
ip address 2.2.2.1 255.255.255.0
duplex full
speed 100
no shut
!
username cisco password cisco

configure SSL VPN
ip local pool SSLVPN1_POOL 3.3.3.10 3.3.3.20
!
access-list 2 permit c 0.0.0.255
access-list 2 permit 4.4.4.0 0.0.0.255
!
webvpn gateway SSLVPN
ip interface FastEthernet0/0 port 443
http-redirect port 80
ssl encryption 3des-sha1
ssl trustpoint TP-self-signed-4279256517
logging enable
inservice
!
webvpn install svc disk0:/webvpn/anyconnect-win-2.5.0217-k9.pkg sequence 1
!
webvpn context SSLVPN
!
policy group SSLVPN1
  functions svc-enabled
  svc address-pool "SSLVPN1_POOL" netmask 255.255.255.0
  svc keep-client-installed
  svc split include acl 2
  svc dns-server primary 10.10.10.1
  svc dns-server secondary 10.10.10.2
!
ssl authenticate verify all
default-group-policy SSLVPN1
gateway SSLVPN
max-users 10
logging enable
inservice

disable loggin
no  logging enable

access to VPN
http://1.1.1.100

Configure Redundant interface on ASA 5510 and above

Example  ASA redundant interface for Inside and DMZ interfaces. You need configure trunk  ports on switch.
Doesn’t support on ASA 5505. For ASA 5505 need use STP.

# interface Ethernet0/1
# no nameif
# no security-level
# no ip address

# interface Ethernet0/2
# no nameif
# no security-level
# no ip address

# interface Redundant1
# member-interface Ethernet0/1
# member-interface Ethernet0/2
# no nameif
# no security-level
# no ip address

# interface Redundant1.100
# vlan 100
# nameif Inside
# security-level 100
# ip address 10.10.100.1 255.255.255.0

# interface Redundant1.50
# vlan 50
# nameif DMZ
# security-level 50
# ip address 10.10.50.1 255.255.255.0

Rename or move nameif Inside, Outside on Cisco ASA

# copy running-config flash:/running-config.backup
# copy running-config tftp:

edit running-config on your PC with text editor compatible with unix text files

# copy tftp:  flash:/running-config.new
# copy flash:/running-config.new  startup-config
# reload

if you need return to old configuration

# copy flash:/running-config.backup  startup-config
# reload

P.S. was tested with ASA 8.3, works perfect

Enable SSH access on IOS without AAA

# conf t
# hostname Router
# ip domain-name ciscotest.com
# crypto key generate rsa
# username cisco privilege 15 secret cisco
# ip ssh version 2
# ip ssh time-out 120
# ip ssh authetication-retries 3
# line vty 0 15
# login local
# transport input ssh

Enable SNMP on Cisco ASA

 # conf t
 # snmp-server community public
 # snmp-server location Rack22
 # snmp-server contact IT support
 # snmp-server host Management 10.10.10.100 community public version 2c

Enable SSH on Cisco ASA

# conf t
# domain-name cisco.com
# crypto key generate rsa
# ssh 0.0.0.0 0.0.0.0 inside
# username cisco password cisco
# enable password cisco
# aaa authentication ssh console LOCAL

Dell server and two cisco switches

Connect Dell server with two Gbps NIC to two Cisco switches 4948. Cisco switches are connected with trunk.

 

1. On Dell server configure Virtual Adapter, add NIC's and type set to Smart Load Balancing.

2. On Cisco switches add server vlan to trunk bettween switches.

3. Configure server ports on two switches.

interface GigabitEthernet1/7

 description Dell server

 switchport access vlan 111

 logging event link-status

 load-interval 30

 spanning-tree portfast

Cisco ASA 5505 Failover

ASA 5505 with Security Plus license support LAN-Based failover (Active/Standby)

you need

- two  ASA 5505 with Security Plus license

- one crossover cable

 

In our configuration we use

- ethernet 0/5 for failover link

- ethernet 0/1 for internal lan

- ethernet 0/3 for outside internet

 

configure primary ASA

 

ciscoasa# conf t

ciscoasa(config)# hostname ASA5505-1

ASA5505-1(config)# interface vlan 221

ASA5505-1(config-if)# description LAN Failover

ASA5505-1(config-if)# no shutdown 

 

ASA5505-1(config)# failover 

ASA5505-1(config)# failover lan unit primary 

ASA5505-1(config)# failover lan interface failover Vlan221

ASA5505-1(config)# failover interface ip failover 10.221.10.1 255.255.255.0 standby 10.221.10.2

 

SA5505-1(config)# int Vlan 80

ASA5505-1(config-if)# ip address 10.80.10.1 255.255.255.0 standby 10.80.10.2

ASA5505-1(config-if)# nameif TDMZ

ASA5505-1(config-if)# no shutdown 

 

ASA5505-1(config)# int vlan 99

ASA5505-1(config-if)# ip address 10.10.20.253 255.255.255.0 standby 10.10.20.254

ASA5505-1(config-if)# nameif Outside

ASA5505-1(config-if)# security-level 100

ASA5505-1(config-if)# no shutdown 

 

ASA5505-1(config)# interface ethernet 0/3

ASA5505-1(config-if)# switchport access vlan 99

ASA5505-1(config-if)# description Outside

ASA5505-1(config-if)# no shutdown 

 

ASA5505-1(config-if)# interface ethernet 0/1   

ASA5505-1(config-if)# description TDMZ      

ASA5505-1(config-if)# switchport access vlan 80

ASA5505-1(config-if)# no shutdown 

 

ASA5505-1(config-if)# interface ethernet 0/5   

ASA5505-1(config-if)# description Failover     

ASA5505-1(config-if)# switchport access vlan 221

ASA5505-1(config-if)# no shutdown 

ASA5505-1# write memory

 

 

configure secoundary ASA

 

ciscoasa(config)# hostname ASA5505-2

ASA5505-2(config)# int vlan 221

ASA5505-2(config-if)# description LAN Failover

ASA5505-2(config-if)# no shutdown 

 

ASA5505-2(config-if)# failover 

ASA5505-2(config)# failover lan unit secondary 

ASA5505-2(config)# failover lan interface failover Vlan221

ASA5505-2(config)# failover interface ip failover 10.221.10.1 255.255.255.0 standby 10.221.10.2

 

ASA5505-2(config)# interface ethernet 0/5

ASA5505-2(config-if)# description Failover

ASA5505-2(config-if)# switchport access vlan 221

ASA5505-2(config-if)# no shutdown 

ASA5505-2(config-if)# write memory

 

 

after failover up secondary ASA get config from primary and rename hostname to ASA5505-1

check failover 

 

ASA5505-1# show failover

Failover On

Failover unit Primary

Failover LAN Interface: failover Vlan221 (up)

Unit Poll frequency 1 seconds, holdtime 15 seconds

Interface Poll frequency 5 seconds, holdtime 25 seconds

Interface Policy 1

Monitored Interfaces 3 of 23 maximum

Version: Ours 8.4(3), Mate 8.4(3)

Last Failover at: 18:52:25 UTC Jan 24 2012

        This host: Primary - Active

                Active time: 1022 (sec)

                slot 0: ASA5505 hw/sw rev (1.0/8.4(3)) status (Up Sys)

                  Interface TDMZ (10.80.10.1): Normal (Monitored)

                  Interface Outside (10.10.20.253): Normal (Monitored)

                slot 1: empty

        Other host: Secondary - Standby Ready

                Active time: 0 (sec)

                slot 0: ASA5505 hw/sw rev (1.0/8.4(3)) status (Up Sys)

                  Interface TDMZ (10.80.10.2): Normal (Monitored)

                  Interface Outside (10.10.20.254): Normal (Monitored)

                slot 1: empty

Port security on a trunk port

interface FastEthernet0/1

 switchport trunk native vlan 20

 switchport mode trunk

 switchport port-security maximum 2

 switchport port-security

 switchport port-security violation restrict

 switchport port-security mac-address sticky

 switchport port-security maximum 1 vlan 20,30

VRF-Lite guest VLAN for Wireless

ip vrf GUEST_WIFI

 description Guest vlan

interface Vlan66

 description Guest WiFi

 ip vrf forwarding GUEST_WIFI

 ip address 10.10.10.250 255.255.255.0

 ip nat inside

 ip virtual-reassembly

ip access-list extended nonat0_GUEST_WIFI

 deny   ip 10.10.10.0 0.0.0.255 10.10.10.0 0.0.0.255

 permit ip 10.10.10.0 0.0.0.255 any

ip nat inside source list nonat0_GUEST_WIFI interface FastEthernet1 vrf GUEST_WIFI overload

ip route vrf GUEST_WIFI 0.0.0.0 0.0.0.0 FastEthernet1 192.168.0.1 global

ip dhcp pool GUEST_WIFI

   vrf GUEST_WIFI

   network 10.10.10.0 255.255.255.0

   default-router 10.10.10.250 

   dns-server 8.8.8.8  

   domain-name guest

   lease 2

OSPF redistribute static routers

access-list 10 permit 10.10.10.10

access-list 10 permit 10.10.20.0 0.0.0.255

route-map STATIC-OSPF permit 10

 match ip address 10

router ospf 100

 redistribute static metric 100 subnets route-map STATIC-OSPF

delay for wireless client for deploy GPO MSI software

Add this key for boot delay 60 sec for wireless client for deploy GPO and install MSI software.

Usualy 60 sec is enough but you can increase it if need. I use GPO for set this key. 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"GpNetworkStartTimeoutPolicyValue"=dword:0000003c

Cisco IOS archive

Cisco has simple method for backup config

mkdir flash:/archive

 

conf t

archive

 log config

  logging enable

  hidekeys

 path flash:archive/config

 write-memory

 

 

you can use other options like path tftp,scp... etc

also notify syslog contenttype plaintext if you want write to log

for check archive:

 

 

show archive log config all

show archive config differences flash:archive/config-1 system:running-config

 

Software upgrade Cisco Wireless LAN Controller

1. check your controller software version.

(Cisco Controller) >show sysinfo

Manufacturer's Name.............................. Cisco Systems Inc.

Product Name..................................... Cisco Controller

Product Version.................................. 6.0.199.4

2. check  release notes for new software version and check upgrade patch table. 

3. download new image from cisco site and copy it to tftp server.

4. login to controller

(Cisco Controller) >transfer download mode tftp

(Cisco Controller) >transfer download serverip 172.16.15.70

(Cisco Controller) >transfer download path .

(Cisco Controller) >transfer download filename AIR-WLC2100-K9-7-0-116-0.aes

(Cisco Controller) >transfer download start

Mode............................................. TFTP

Data Type........................................ Code

TFTP Server IP................................... 172.22.22.10

TFTP Packet Timeout.............................. 6

TFTP Max Retries................................. 10

TFTP Path........................................ ./

TFTP Filename.................................... AIR-WLC2100-K9-7-0-116-0.aes

This may take some time.

Are you sure you want to start? (y/N) y

TFTP Code transfer starting.

TFTP receive complete... extracting components.

/mnt/application

Writing new RTOS to flash disk.

Writing new Code to flash disk.

Executing install_code script.

Writing new APIB to flash disk.

Executing install_apib script.

TFTP File transfer is successful.

  Reboot the controller for update to complete.

  Optionally, pre-download the image to APs before rebooting to reduce network downtime.

(Cisco Controller) >reset system

The system has unsaved changes.

Would you like to save them now? (y/N) y

Configuration Saved!

System will now restart!

Enable ASDM for Cisco ASA

ciscoasa# conf t

ciscoasa(config)#asdm image disk0:/asdm-645-106.bin

ciscoasa(config)#http server enable

ciscoasa(config)#http 172.16.1.0 255.255.255.0 inside

upgrade ROM and IOS for cisco 4900 switches

for ROM upgrade:

1. download last rom from cisco site.

2. copy rom file to switch bootflash:

3. turn on switch and enter control-C to go to rommon

4. enter rommon 1 >boot bootflash:cat4500-ios-promupgrade-122_31r_SGA7(or your rom)

5. switch will restarted after upgraide

6. run show version  | i ROM

 

 

for IOS upgrade:

1. download last ios

2. copy ios to switch bootflash:

3. enter show running-config | i boot system

4. go to config mode 

5. enter no boot system flash bootflash:cat4500-entservicesk9-mz.122-13.SG1.bin(your ios)

6. enter boot system flash bootflash:cat4500-entservicesk9-mz.122-54.SG.bin

7. save config and reboot switch

8. check ios version after reboot show version | i bootflash 

MS Outlook autocomplete cache file

MS Outlook autocomplete cache file 

path for file:

Windows XP

C:\Documents and Settings\username\Application Data\Microsoft\Outlook\outlook.NK2

Windows 7

C:\Users\username\AppData\Roaming\Microsoft\Outlook\outlook.NK2

Maximim emails key

H_KEY_CURRENT_USER\Software\microsoft\Office\10.0\outlook\

DWORD MaxNicknames default it is 1000

Cisco switch port security

 Example:

int Fa0/1 

switchport mode access

!- maximum MAC address on port

 switchport port-security maximum 2

 switchport port-security

!- restrict MAC, logging  but don't shutdown port

 switchport port-security violation restrict

 switchport port-security mac-address sticky

 !- allowed MAC addresses

 switchport port-security mac-address sticky 702a.0371.96a6

 switchport port-security mac-address sticky 78d6.f355.eb4d

Show port security settings:

show port-security int Fa 0/1

Cisco DHCP Snooping

just config, it's pretty easy

!enable DHCP snooping for vlan 1

ip dhcp snooping

ip dhcp snooping vlan 1

!enable DHCP option 82

ip dhcp snooping information option

!set trust port for DHCP server

int Gi0/2

ip dhcp snooping trust

!set limit per second

int range Fa0/1 - 24

ip dhcp snooping limit rate 20

!set trust trunk port:

ip dhcp snooping trust

show settings:

show ip dhcp snooping

show ip dhcp snooping binding

Remote change power settings

you can use it if need change power settings for remote computer

get info about remote power pc settings:

PsExec.exe \\rcomputer  powercfg -query

 

disable sleep timeout:

PsExec.exe \\rcomputer  powercfg -change -standby-timeout-ac 0

 

other interesting options:

 

powercfg -change -monitor-timeout-ac 0

powercfg -change -monitor-timeout-dc 0

powercfg -change -disk-timeout-ac 0

powercfg -change -disk-timeout-dc 0

powercfg -change -standby-timeout-ac 0

powercfg -change -standby-timeout-dc 0

powercfg -change -hibernate-timeout-ac 0

powercfg -change -hibernate-timeout-dc 0