Displaying Interface descriptions in SNMP traps using SNMPTT's PREXEC funtion

I collect snmp traps via snmptrapd which then hands them off to snmptt. Upon receipt of an interface down/up trap (.1.3.6.1.6.3.1.1.5.3, for example) snmptt then runs a quick snmpget request (unfortunately using SNMPv1 at the moment) to the reporting host to pull the description for the given interface like so:

EVENT ciscoConfigManEventDN .1.3.6.1.6.3.1.1.5.3 "Status Events" Normal
# use snmpget to fetch the interface description and save it as $p1, to be used it the FORMAT line.
PREEXEC /usr/bin/snmpget -v 1 -t 2 -Ovq -c snmptt $aA ifAlias.$1
FORMAT Link DOWN $2 - $p1
# OPTIONAL: do not process this event for VI interfaces (like PPPoE interfaces)
MATCH $2:!(Virtual-Access)
MATCH $2:!(Multilink)
MATCH MODE=and
#
EXEC /root/bin/sendemail.sh high traps@mydomain.com "ALERT-$s-$R-$Fz" "Agent $A at $aA reports $Fz$FnTrap $e:$D$Fn"

Note that I've created a special SNMP VIEW and community one our routers which allow access only to the ifAlias.* OID tree like so:

snmp-server view snmptt ifXEntry.* included
! note that ACL99 includes my snmp NMS only!
snmp-server community snmptt view snmptt RO 99

Site to Site VPN Worksheet

Periodically I find myself working with another party to establish a LAN to LAN, or Site to Site, IPSEC VPN tunnel and there are various parameters which must be agreed upon.  I have found that exchanging a VPN worksheet ahead of time helps both parties think through the process better and speeds up the VPN configuration.  This is preferable under all scenarios, but especially when one or more parties are paying by the hour to have someone configure it for them.  Feel free to download, alter and use it as you see fit:

https://docs.google.com/leaf?id=0Bw0IToZ5AnXTMjAzMzJiYmEtOWRjOC00OTY0LTg4ZjUtYzk4ZTk4MjViNTEx&hl=en_US&authkey=CMbmnecO

Cisco ASA Remote Access VPN for IPSEC client

Here's a basic template for Remote Access VPN using the Cisco IPSEC VPN client. It includes a pool for address assignment, and an ACL to provide remote clients access to a few RDP servers. This also features PPPoE dialer for the WAN interface.

interface Vlan1
 description LAN
 nameif inside
 security-level 100
 ip address 10.0.0.1 255.255.255.0
!
interface Vlan2
 description OUTSIDE
 nameif outside
 security-level 0
 ip address pppoe setroute
!
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
!
object-group network remoteVPNGroup
 network-object 172.16.0.0 255.255.255.0
object-group network insideNetworks
 network-object 10.0.0.0 255.255.255.0
object-group network RDP-Servers
 network-object host 10.0.0.6
 network-object host 10.0.0.14
 !
access-list inside_nat0_outbound extended permit ip object-group RDP-Servers object-group remoteVPNGroup
!
ip local pool RAGenPool 172.16.0.2-172.16.0.30 mask 255.255.255.0
!
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 10.0.0.0 255.255.255.0
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map outside_dyn_map 20 set pfs
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set reverse-route
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
!
crypto isakmp policy n
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 43200
!
group-policy RAGeneral internal
group-policy RAGeneral attributes
 vpn-tunnel-protocol IPSec
 group-lock value RAGeneral
 split-tunnel-policy tunnelall
 address-pools value RAGenPool
 !
username testuser password ************** encrypted
username testuser attributes
 vpn-group-policy RAGeneral
 group-lock value RAGeneral
username superadmin password ********** encrypted privilege 15
!
tunnel-group RAGeneral type ipsec-ra
tunnel-group RAGeneral general-attributes
 address-pool RAGenPool
 default-group-policy RAGeneral
tunnel-group RAGeneral ipsec-attributes
 pre-shared-key * 

!

vpdn group PPPOE-WAN request dialout pppoe
vpdn group PPPOE-WAN localname my_ppp_username
vpdn group PPPOE-WAN ppp authentication pap
vpdn username my_ppp_username password *********
 

Cisco ASA 7.2 PPPoE Lan-to-LAN IPSEC with conditional NAT Template

This is a pretty standard config, except for the conditional NAT.  So in this case, only certain local IP addresses (host in network-object LocalHostsToNATtoVendor01) will match the VPN tunnel, and will be NATted before hitting the tunnel.

!ASA Version 7.2(4)
!
enable password ********** encrypted
passwd ********** encrypted
names
!
interface Vlan1
description LAN
nameif inside
security-level 100
ip address 10.10.10.1 255.255.255.0
!
interface Vlan2
description OUTSIDE
nameif outside
security-level 0
pppoe client vpdn group MyPPPUserName
ip address pppoe setroute
!
interface Ethernet0/0
switchport access vlan 2
!

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
!
object-group network RemoteVendor01
network-object 192.168.64.0 255.255.248.0
! 
object-group network LocalHostsToNATtoVendor01
network-object host 10.10.10.150
network-object host 10.10.10.151
network-object host 10.10.10.152
network-object host 10.10.10.153
network-object host 10.10.10.154
network-object host 10.10.10.155
network-object host 10.10.10.156
network-object host 10.10.10.157
! 
access-list outside_1_cryptomap extended permit ip 172.16.6.24 255.255.255.248 192.168.64.0 255.255.248.0
access-list inside_nat0_outbound extended permit ip 172.16.6.24 255.255.255.248 192.168.64.0 255.255.248.0
! 
access-list LocalHostsToNATtoVendor01 remark conditional NAT
access-list LocalHostsToNATtoVendor01 extended permit ip object-group LocalHostsToNATtoVendor01 object-group RemoteVendor01
!
!define two NAT pools, one pool of IPs, the other the outside interface address
global (outside) 1 172.16.6.24-172.16.6.31
global (outside) 2 interface
!don't nat some hosts
nat (inside) 0 access-list inside_nat0_outbound
!do NAT this ACL
nat (inside) 1 access-list LocalHostsToNATtoVendor01
nat (inside) 2 10.10.10.0 255.255.255.0
!
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer 192.152.45.12
crypto map outside_map 1 set transform-set ESP-AES-192-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes-192
hash sha
group 5
lifetime 28800
!
vpdn group MyPPPUserName request dialout pppoe
vpdn group MyPPPUserName localname MyPPPUserName
vpdn group MyPPPUserName ppp authentication pap
vpdn username MyPPPUserName password *********
!
tunnel-group 192.152.45.12 type ipsec-l2l
tunnel-group 192.152.45.12 ipsec-attributes
pre-shared-key *
!
! here's an interesting feature
smtp-server 10.45.26.2
prompt hostname context

Quick and easy LAN-to-LAN VPN for Cisco ASA

The Scenario:
You want your workstation at H.Q. at your.local.subnet.15 to be able to Remote Desktop (TCP3389) to you server at your.remote.subnet.34. Your remote branch has a WAN IP address of your.remote.wan.29:

!
! Define "interesting" traffic to determine which traffic gets encrypted.
! In this case it's any packet from the local box with a destination address of the remote server, TCP port 3389 and ICMP traffic.
! Note that THIS ACL must be exacly the same, with source and destination addresses reversed, on the IPSEC peer at the other end.
! If you don't control both peers then it may be advisable to use simple host-based ACLs and leave off the ports.
! Naturally, this is less secure that specifying the ports here.  You can always add an additional ACL (which doesn't have to match at the far end)
! on the tunnel-group with the "vpn-group-policy" option.
!
access-list outside_60_cryptomap extended permit tcp host your.local.subnet.15 host your.remote.subnet.34 eq 3389
access-list outside_60_cryptomap extended permit icmp host your.local.subnet.15 host your.remote.subnet.34
!
! Define IKE Phase I Parameters
! IKE Phase I authenticates IPSec peers and negotiates IKE SAs during this phase.
! This sets up a secure channel for negotiating IPSec SAs in phase 2.
!
crypto isakmp policy 20
authentication pre-share
encryption aes-256
hash md5
group 5
lifetime 14400
!
! Define IKE Phase II IPSEC transformations
! IKE Phase II negotiates IPSec SA parameters and sets up matching IPSec SAs in the peers.
!
crypto ipsec transform-set esp-aes-md5 esp-aes-256 esp-md5-hmac
!
!
! NAT considerations
! You may want to disable NAT across the IPSEC tunnel.  In a SMB environment, there is probably no need or desire to source NAT.
! So, add and additional line to your existing nat exception ACL or create one.  Here, we add a line to the existing inside_nat0_outbound ACL.
! This bit is a bet beyond the scope of this article
access-list inside_nat0_outbound extended permit ip host your.local.subnet.15 host your.remote.subnet.34
!
! Define the IPSEC peer and its IKE Phase II.  PFS is optional
crypto map outside_map 60 match address outside_60_cryptomap
crypto map outside_map 60 set peer your.remote.wan.29
crypto map outside_map 60 set transform-set esp-aes-md5
! optionally enable Perfect Forwarding Secrecy.  Disabled by default.  It's more secure, but requires more processor.
crypto map outside_map 60 set pfs group5
! optionally enable aggressive mode (off by default and not encouraged).  Aggressive mode is faster to setup but less secure.
crypto map outside_map 60 set phase1-mode aggressive
!

! Define the tunnel-group peer address and Pre-Shared Key.  This is also where you configure address-pool, deafult-group-policy
tunnel-group your.remote.wan.29 type ipsec-l2l
tunnel-group your.remote.wan.29 ipsec-attributes
pre-shared-key #your.complex.key.here#
!
! Attach it to the outside interface.  Note that you'll use your outside intefaces "ifname" and it IS case sensitive.
! If you already have IPSEC running then this is already done.
crypto map outside_map interface Outside
crypto isakmp enable Outside
!

limiting access for Remote Access IPSec clients on a Cisco ASA

So you have a Cisco ASA and you want to limit a particular user's access.  It's a common scenario and one that's pretty simple to deal with.  This works for 7.2(3) and I believe the commands are the same for 8.x

!! Create the user normally
username BobDobbs password *****

!! Assign the user a static IP.  I use one that is in the same network as the Group's ip pool, but not in the pool.
!! For example if the pool is 192.168.4.2/24 - 192.168.4.60/24, I'd assign this user 192.168.4.61.
username BobDobbs attributes
 vpn-group-policy RA-Client-Policy
 vpn-framed-ip-address x.x.x.x 255.255.255.0

!! Create an ACL which permits the new user's address to do what you want, block them from doing anything else, then allow everyone else (or whatever you deem appropriate)
access-list RA-Client-ACL-01 extended permit ip host x.x.x.x host y.y.y.y
access-list RA-Client-ACL-01 extended deny ip host x.x.x.x any
access-list RA-Client-ACL-01 extended permit ip any any


!! Finally, apply that ACL to the group-policy
group-policy RA-Client-Policy attributes
  vpn-filter value RA-Client-ACL-01
end

EIGRP and poison reverse

Today, Stretch posted an interested EIGRP update scenario.  I found myself confused, though, at Step 4 where it says "R3 has a learned of a new path to 0.0.0.0/0 from the reply sent by R2. First, it sends a poison reverse update to R2 for this route."  Why would a router send a poison-reverse update for a route to a neighbor whom originated the route?  Cisco sheds more light

Thanks Stretch.

dynamic backup routes using Cisco's Enhanced Object Tracking

     In this example, routerA has two ethernet interfaces which both connect to service providers. Using traditional static routes with different metrics would only remove the primary route if the interface itself were to go down (i.e. "line is down,protocol is down"). If the S.P. on the primary link had a routing issue or some other problem (janitor tripped over a power cable 200 miles away), routerA needs to update its routing table even though its interface is still up. Enter starge left Cisco's object tracking.

     RouterA has a primary ethernet interface at Fa1/0/1 and a backup at Fa1/0/2. We create a policy map to force pings to a certain address (something close to your critical destinations, or the the Internet at large if there's no specific traffic you want to track) to use the primary interface (no, I don't understand why it's routed to Null 0) and when that fails, it removes the default route. The secondary floating route then takes over.

!!begin sample config
hostname routerA
ip subnet-zero
ip routing
!
ip sla 1
icmp-echo 4.2.2.2
request-data-size 1400
timeout 2000
threshold 2000
frequency 3
ip sla schedule 1 life forever start-time now
!
interface FastEthernet1/0/1
description Primary Link - .1 is the default gateway for this subnet
ip address 172.16.0.2 255.255.255.0
!
interface FastEthernet1/0/2
description Backup Link - 10.0.0.1 is the gateway for this subnet
ip address 10.0.0.2 255.255.255.0
!
ip local policy route-map MY-LOCAL-POLICY
!
access-list 101 permit icmp any host 4.2.2.2
route-map MY-LOCAL-POLICY permit 10
match ip address 101
set interface Null0
set ip next-hop 172.16.0.1
!
ip route 0.0.0.0 0.0.0.0 172.16.0.1 track 100
ip route 0.0.0.0 0.0.0.0 10.0.0.1 254
!
track 100 rtr 1 reachability
!
!! end sample config

Details on Cisco's Enhanced Object Tracking feature can be found at http://www.cisco.com/en/US/docs/ios/12_3/12_3x/12_3xe/feature/guide/dbackupx.html#wp1071672 .

Find the IfIndex ID of a given interface

When you're using SNMP to poll a router for stats on a given interface sometimes you need to know the SNMP IfIndex ID of a given interface. It's easy (example from a 7206 running 12.4(9)T2):

router-1#show snmp mib ifmib ifindex atm1/0.1080       
Interface = ATM1/0.1080, Ifindex = 190

router-1#show snmp mib ifmib ifindex detail atm1/0.1080
Description                     ifIndex  Active  Persistent 
---------------------------------------------------------------

ATM1/0.1080-aal5 layer           190    yes      enabled   

Cisco ASA 5505 licensing caveats

While the Cisco ASA firewall appliance is a nice piece of work, it is a bit like a British sports car: it's great when it's working and not so great when it's not. In addition to the usual code-based caveats to watch out for there are also a few licensing issues to be aware of on the ASA5505. The output of the "show ver" command will quickly display the limitations of your ASA:

Licensed features for this platform:
Maximum Physical Interfaces : 8        
VLANs                       : 3, DMZ Restricted
Inside Hosts                : 10       
Failover                    : Disabled
VPN-DES                     : Enabled  
VPN-3DES-AES                : Enabled  
VPN Peers                   : 10       
WebVPN Peers                : 2        
Dual ISPs                   : Disabled 
VLAN Trunk Ports            : 0        

This platform has a Base license.

Here is an example of the Security Plus License feature set:

Licensed features for this platform:
Maximum Physical Interfaces : 8        
VLANs                       : 20, DMZ Unrestricted
Inside Hosts                : Unlimited
Failover                    : Active/Standby
VPN-DES                     : Enabled  
VPN-3DES-AES                : Enabled  
VPN Peers                   : 25       
WebVPN Peers                : 2        
Dual ISPs                   : Enabled  
VLAN Trunk Ports            : 8        

This platform has an ASA 5505 Security Plus license.

A brief explanation of the items highlighted in red:

1. Only 10 hosts from the DMZ and LAN combined may communicated with the Outside interface at any one time.  
2. Only 2 fully-functional VLANs (inside and outside usually) are permitted.  The 3rd VLAN, typically a DMZ can only be activated with the "no forward vlan n" command which prevents it from initiating connections to one of the other VLANs, usually the inside. 
   
   
   
   
   interface Vlan3
    description DMZ
    no forward interface Vlan1
    nameif dmz
    security-level 50
    ip address
   
   
   
     Fortunately, it still permits replies from connections initiated from the inside to the DMZ.  ***Use caution here and think it through***  This means that:
   
   • You cannot host your DNS server (frequently also your Windows Domain Controller) on your inside vlan.  
   • Your backup strategy may fail.  If your backup server is on the inside vlan, you won't be able to SSH (and by extension SCP, RSYNC, etc.) to it.  You can still SSH from the inside to the DMZ of course...
   •  An SMTP server on the DMZ cannot initiate LDAP queries (or other methods of recipient verification) to an inside host.
   
   
   

    It would appear that only the 5505 (e.g. not the 5510, nor the 5520 etc.) offers this DMZ limitation. See Cisco's Comparison Chart for more details.  So before you think you've just gotten a great deal on a refurbished firewall from Brian at Network Liquidators (hint hint), make sure you've asked yourself, and your vendor, the right questions.

PE-CE BGP dual-homed with backup

This document details the configurations necessary to connect an MPLS customer to an MPLS Service Provider via two separate link terminating on two separate PE Routers. In this case the customer has a 10mpbs Ethernet circuit, which is to be used as the primary link, and an ADSL line which is to be used when the Ethernet circuit is not functioning.

This configuration uses standard, default BGP timers and therefore the failover takes approximately 180 seconds. It will revert back to the primary significantly faster once connectivity has been re-established.


!!PE-01 - Ethernet PE
!
!!Enter the PE's BGP configuration
router bgp
!! Enter the customer's PE-CE BGP configuration 
 address-family ipv4 vrf CustomerVRF
 no synchronization
 !! use this to send a default route to all other PE routers in this VRF, not the cusotmer's PE routers.
 default-information originate
 !! replace this with the customer's BGP AS.  Must be >=65000
 neighbor 192.168.2.2 remote-as 65nnn 
 neighbor 192.168.2.2 update-source GigabitEthernet0/1
 !! Always set a password
 neighbor 192.168.2.2 password  
 neighbor 192.168.2.2 next-hop-self
 !! (optional) send a default route
 neighbor 192.168.2.2 default-originate
 !! Always limit the number of routes accepted
 neighbor 192.168.2.2 maximum-prefix 250 80
 !! don't use classful summaries
 no auto-summary 
 neighbor 192.168.2.2 activate
 exit-address-family


!PE-02 - ADSL RAS PE
!
route-map CustomerVRFSetLocalIn permit 10
 set local-preference 50
!
route-map CustomerVRFSetLocalIn permit 20
!
!!Enter the PE's BGP configuration
router bgp
!! Enter the customer's PE-CE BGP configuration
 address-family ipv4 vrf CustomerVRF    
 no synchronization
 !! (optional) send a default route
 default-information originate
 !! replace this with the customer's BGP AS.  Must be >=65000  
 neighbor 192.168.1.2 remote-as 65nnn
 !! Change this to whatever the PE's connected interface on their VRF is 
 neighbor 192.168.1.2 update-source Loopbackn
 !! Always set a password
 neighbor 192.168.1.2 password   
 neighbor 192.168.1.2 next-hop-self
 !! (optional) send a default route
 neighbor 192.168.1.2 default-originate 
 !! set route map which will lower the LocalPref (and thereby the chances of being entered into the Provider's LFIB table).  When the preferred route is
 !! removed from BGP as a result of the neighbor going down on the primary link, this route will be entered into the LFIB on next BGP Scan.
 neighbor 192.168.1.2 route-map setlocalin in 
 !! Always limit the number of routes accepted
 neighbor 192.168.1.2 maximum-prefix 250 80 
 !! don't use classful summaries
 no auto-summary 
 neighbor 192.168.1.2 activate
 exit-address-family


!!CPE
!
route-map setlocalin permit 10
 set local-preference 50
!
route-map setlocalin permit 20
!
router bgp 65004
 no synchronization
 bgp log-neighbor-changes
 neighbor 192.168.1.1 remote-as
 !! Always set a password
 neighbor 192.168.2.1 password  
 neighbor 192.168.1.1 remote-as
 !! Always set a password
 neighbor 192.168.2.1 password  
 neighbor 192.168.1.1 route-map setlocalin in
 no auto-summary