Changing UCM to mixed mode without the need of a token

I have just done it in my lab, running 10.5.2.10000-5.  You can simply change it by issuing the command:

utils cli set-cluster mixed mode

Restart the TFTP and CallManager services, you are good to go!

Detail post here:
http://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/118893-technote-cucm-00.html

ISE Web Admin Password Expired

I haven't touched my ISE 1.3 lab setup for some time.  When I tried to log in again I saw this - "Password is expired.  Please reset your admin password."

This is a good security policy for production customer environment, annoying in lab environment.  First let's reset the password, it has to be done via CLI:

If you want to disable this default 45-day admin password expiration policy, you can go back to UI, Administration > Admin Access > Authentication > Password Policy > Password Lifetime, uncheck the first checkbox.

ISE 1.3 + vWLC 7.6 - Basic 802.1x Configuration for Wireless Devices

I have setup ISE 1.3 + vWLC 7.6 in my lab virtually on my UCS server.  Good thing is now ISE 1.3 comes with a OVA, which you can deploy and use immediately without lengthy installation.  It still needs to go through a wizard and need some time to initialize the database, but comparatively easier than pervious release.  vWLC also comes with a evaluation license that you can test things out after you accept the EULA.  Here is a step-by-step guide to configure basic 802.1x authentication for wireless devices using ISE local DB.

1.  Add ISE as Authentication Server, 192.168.24.71 is my ISE IP address.

2. Add ISE as Accounting Server

3. Add a WLAN, the SSID of my testing WLAN is DW-BYOD

Remember to enable AAA Override, choose Radius NAC under NAC state and check DHCP Profiling (this is just used to feed info to my ISE for device profiling).  In my lab I am using FlexConnect local switching therefore you can see I have checked that checkbox.

4.  Create Users on ISE, now I am going to use the ISE local database.

Done!  You should now able to access your SSID using the user credentials that you have created in ISE local database.  

The next post we will go a step further, to configure BYOD with EAP-TLS and self on-boarding capability.

Cisco Identity Services Engine - Default web login username and password

My environment:  Cisco ISE 1.0.3.377

I have just installed ISE in my lab environment to test things out and the installation is pretty straight forward.  Mount the iso in the VMWare ESXi datastore and run it for around 45 mins.  A post-installation wizard for information like IP address, hostname, etc.  A default admin user is created during the wizard, however it is NOT the same as the web admin username and password.  To access ISE:

https:///admin

The default web admin username and password is admin/cisco.  You are prompted to change it after your first successful logon.

Haven't started configure anything yet, will post anything that found interesting.  :)

Basic Gatekeeper Security using zone subnet command

By default any gateway can register with gatekeeper, and you can specify the subnet or hosts which are allowed to register to gatekeeper
gatekeeper
no zone subnet PANDA-GK default enable
zone subnet PANDA-GK 192.168.20.0/24 enable

Protecting from ARP attack – Dynamic ARP Inspection (DAI)

My environment: Cisco Catalyst 3560E
IOS: c3560e-universal-mz.122-35.SE5.bin

Before a PC can talk to another PC, it must do an ARP request to map the IP address to a MAC address.

For example:

Client A (ARP Request Broadcast): Who is 192.168.10.12?

Client B (ARP Reply): I am 192.168.10.12, mac address B

A client can send out unsolicited reply (gratuitous ARP) according to the ARP RFC.  That means anyone can claim to be the owner of any IP-MAC address pair.  ARP attack is using this to poison the ARP cache on switch and redirect the traffic.

Dynamic ARP inspection is a security feature to protect from ARP attack based on DHCP snooping binding database. 

! Global Command
ip arp inspection vlan 168,201

! Interface that you want to trust
ip arp inspection trust

! Default untrust
no ip arp inspection trust

For those host with static IP address (not get address from DHCP server), their information will not be stored in the DHCP binding table therefore you will get reject message on the console.

Jun  5 12:31:40.734 HKT: %SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Req) on Gi0/4, vlan 201.([000c.29f2.6a88/192.168.10.221/0000.0000.0000/192.168.10.254/12:31:39 HKT Fri Jun 5 2009])

In that case you’ll need to create an ARP access-list to allow static address hosts:

! Define ARP ACL
pandaeatsbamboo-sw01(config)#arp access-list allow-arp
pandaeatsbamboo-sw01(config-arp-nacl)#permit ip host 192.168.10.221 mac any

! Apply ARP ACL to DAI
pandaeatsbamboo-sw01(config)#ip arp inspection filter allow-arp vlan 201

Protecting from Rogue DHCP server attacks – DHCP Snooping

My environment: Cisco Catalyst 3560E
IOS: c3560e-universal-mz.122-35.SE5.bin

One of the common DHCP server attack is rogue dhcp server attack, the potential problem is the attacker will become the hosts’ default gateway or DNS server.  DHCP snooping can prevent it from happening by untrusting the switchport that are not connecting to the DHCP server.

! Global Command

! which vlan you would like to snoop
ip dhcp snooping vlan 168,201

! this is important otherwise this feature is not enabled
ip dhcp snooping

! Switchport configuration for DHCP server
int gi0/4
ip dhcp snooping trust 

! User-facing switchport configuration, default untrust
int gi0/5
no ip dhcp snooping trust 

To showing the DHCP snooping binding:

pandaeatsbamboo-sw01#sh ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:16:C8:FF:C4:6D   192.168.10.102   80179       dhcp-snooping   201   GigabitEthernet0/6
00:17:E0:1C:AB:1A   192.168.10.104   79680       dhcp-snooping   201   GigabitEthernet0/8
Total number of bindings: 2

DHCP Snooping table can be written to flash or external storage.  Very importantly if you want to get the DHCP snooping database agent working, you MUST synchronize your switch with NTP, you can verify it with the command “sh ntp status”, make sure the clock is synchronized.

ip dhcp snooping database tftp://192.168.10.2/snoop.db

 

Then you can show ip dhcp snooping database to verify:

pandaeatsbamboo-sw01#sh ip dhcp snooping database
Agent URL : tftp://192.168.10.2/snoop.db
Write delay Timer : 15 seconds
Abort Timer : 300 seconds

Agent Running : No
Delay Timer Expiry : Not Running
Abort Timer Expiry : Not Running

Last Succeded Time : 10:29:01 HKT Fri Jun 5 2009
Last Failed Time : 18:35:29 HKT Wed Jun 3 2009
Last Failed Reason : Unable to access URL.

Total Attempts       :     1206   Startup Failures :        0
Successful Transfers :     1205   Failed Transfers :        1
Successful Reads     :        2   Failed Reads     :        0
Successful Writes    :     1203   Failed Writes    :        1
Media Failures       :        0

Configuring Basic Authentication on Apache

Although there are many different authentication methods available for web services, basic authentication is still the simplest and most common authentication method used. This post is target to give you a quick example on how to configure basic authentication on apache.

Create a password file

htpasswd is the command to create a password file, example:
htpasswd -c passwd panda
New password: mypassword
Re-type new password: mypassword
Adding password for user panda

The -c flag is used only when you are creating the file. You can omit the -c flag if you want to add more users to an already created password file.

You should store the file in a secure location. And you should set permissions on the file so that only the webserver can read the file and only root can write to it:

chown root.nogroup /etc/httpd/secret/passwd
chmod 640 /etc/httpd/secret/passwd

Configure httpd.conf


For more information, please refer to official apache doc:
http://httpd.apache.org/docs/2.3/howto/auth.html

OpenSSL Cheatsheet

A. Generate your own CA

openssl req –x509 –days 1460 –newkey rsa:2048 –keyout ca-key.pem –out ca-crt.pem


Show Certificate Properties

openssl –x509 –in crt.pem –noout –text


Change Certificate to binary DER format

openssl –x509 –in ca-crt.pem –outform DER –out ca-crt.der


B. Generate a host certificate


Make the private key and CSR

openssl req –newkey rsa:1024 –keyout host-key.pem –out host-csr.pem


Sign the CSR by CA

If you have want to sign by the root CA specified in openssl.cnf,

openssl ca –in host-csr.pem –days 365 –out host-crt.pem –notext



Otherwise,

openssl x509 -req -days 365 -in host-csr.pem -CA ca-crt.pem -CAkey ca-key.pem -CAcreateserial -out host-crt.pem


Export the certificate and the private key to PKCS#12 format

openssl pkcs12 –export –inkey host-key.pem \

-in host-crt.pem –name “panda” \

-certfile ca-crt.pem –caname “Panda CA” \

-out host-crt.p12


C. Another way to make the host certificate

1. openssl genrsa –des3 –out new-key.pem 1024
2. openssl req –new –days 3650 –key new-key.pem –out new-csr.pem
3. openssl ca –in new-csr.pem –keyfile ./demoCA/private/ca-key.pem –cert ./demoCA/ca-crt.pem –out new-crt.pem


D. Extract keys and cert from PKCS#12

openssl pkcs12 –in my-crt.p12 –clcerts –nokeys –out usr-crt.pem

openssl pkcs12 –in my-crt.p12 –nocerts –out usr-key.pem


E. Print out certificate hash value

openssl x509 -hash -noout –in ca-crt.pem

Implementing Port Security

Port Security is used when you want to secure fixed host ports from being used by other device.

For all static devices like servers, printers etc, you can lock it down by using port security, and when somebody attempts to use the link connect another device into the network.

SW1(config-if)# switchport port-security mac-address 0011.2233.4455

Only device with MAC address 0011.2233.4455 is allowed to access that switch port.

Besides, you can limit the number of devices that can be seen on a given switch port. It is useful in protecting the switch from a MAC flooding attack. A MAC flooding attack works by sending random MAC addresses into the switch in an attempt to fill the L2 forwarding table. Address learning will stop until space is freed up in the table and the switch will have to flood all the traffic destined to the yet-to-learnt MAC addresses. Hackers could then exploit this extra flooding and use a sniffer to collect all the data flooded in his VLAN.

SW2(config-if)# switchport port-security maximum 10

It limits the given port from learning more than 10 MAC addresses.