Simple Tutorial on Configuring SSH and SCP on a Cisco Router or Cisco Switch

Many beginners may be not very clear at what is SSH and what is SCP. Now we'll explain their concepts, their connections and how to configure SSH and SCP on a Cisco Router or Cisco Switch detailedly. We are all aware of the traditional way of transferring IOS files from and to Cisco Catalyst Switches, Cisco Routers and Cisco PIX/ASA firewall devices using TFPT, FTP and lately https. However there is also one more way to copy the IOS files, which is known as Secure Copy (SCP). The Secure Copy (SCP) is a secure and authenticated method of copying a configuration file or transferring an Image files to Cisco Catalyst Switches, Cisco Routers and Cisco PIX/ASA firewall devices. The Secure Copy (SCP) works on SSH protocol on port 22 which is like an encrypted tunnel. This tool is very useful especially to transfer files for upgrades or to perform safe backups.

To make things more clear, Cisco Systems introduced the Secure Copy (SCP) feature in the following IOS releases

Release	Modification
12.2(2)T	This feature was introduced.
12.0(21)S	This feature was integrated into Cisco IOS 12.0(21)S.
12.2(25)S	This feature was integrated into Cisco IOS 12.2(25)S.

Now, let's share the details step by step:
1. In order to configure Secure Copy (SCP) in a Cisco Router make sure the SSH is enabled and its working.
Let's enable the SSH and AAA features in the Cisco Device:
ITKE-AS1(config)#ip domain-name itke.com
ITKE-AS1(config)#crypto key generate rsa general-keys modulus 512
The name for the keys will be: ITKE-AS1.itke.com

% The key modulus size is 512 bits
% Generating 512 bit RSA keys, keys will be non-exportable…[OK]

ITKE-AS1(config)#
ITKE-AS1(config)#aaa new-model
ITKE-AS1(config)#aaa authentication login default local
ITKE-AS1(config)#aaa authentication exec default local

2. In order to use the SCP feature to manage configuration we must have at least once user account with enough privilege to access it. Log in to the Cisco router when prompted for your user name and password.
ITKE-AS1(config)#
ITKE-AS1(config)#username itke privilege 15 password secret itkeleads



3. Type the following text into the command line and replace "retries" with the number of times you want to allow users to try to connect after typing the wrong username and password:
ip ssh retries

4. Now you are ready to enable the SCP server on:
ITKE-AS1(config)#ip scp server enable
Type "configure terminal" to configure the settings for the SCP connection.

5. Type "aaa authentication login" and press "Enter." And then, type the username you want to use for SCP access. Lastly, type "ip scp server enable" to enable the SCP protocol.
With these five simple steps, you'll make things done!

The material is originally from: http://itknowledgeexchange.techtarget.com/network-technologies/how-to-configure-secure-copy-scp-in-cisco-devices/

How to Configure Frame-relay switch In the Free CCNA Labs Topology?

Cisco switches makes the LAN more competent by creating multiple collision domains. Each switch port is a split collision domain. With only one device connected per port, collisions are not probable and communications are more efficient.
Configuring a frame-relay switch isn’t something you’ll have to do in order to earn the Cisco CCNA certification, but we will need one in order to complete the lab exercises that use frame-relay.

In the Free CCNA Labs Topology, we’ll only be using five frame-relay connections (one to each router), each of which operates at 128 kbps.

If you’re have a home Cisco lab, you can configure a real router as a frame-relay switch or a virtual router running under Cisco IOU or Dynamips/GNS3. There is no difference in configuration (other than perhaps the correct interface names). What is key, however, is that we get the interface to DLCI mappings correct or we’ll run into some interesting issues when we begin to configure frame-relay connections.

NOTE: If you’re just getting started in Cisco and none of this makes sense to you yet, don’t worry. We’ll take about frame-relay in great detail later and you’ll become very familiar with it. If you work through the labs in order (or you’re enrolled in Cisco Academy), you won’t need a frame-relay switch until towards the end.

The interface to DLCI mappings for the frame-relay switch are listed on the Free CCNA Labs topology page.
With these mappings lined out, we can begin configuring our frame-relay switch to properly direct the frames out the correct interfaces. Assuming that you’re using following along with the topology, the frame-relay switch configuration should look like this:

interface s0/0
 description CONNECTED TO CHICAGO S1/0
 encapsulation frame-relay
 clock rate 128000
 frame-relay intf-type dce
 frame-relay route 401 interface s1/3 104
 frame-relay route 402 interface s0/2 204
 frame-relay route 403 interface s0/3 304
 frame-relay route 405 interface s0/1 504

interface s0/1
 description CONNECTED TO NEWYORK S1/0
 encapsulation frame-relay
 clock rate 128000
 frame-relay intf-type dce
 frame-relay route 501 int s1/3 105
 frame-relay route 502 int s0/2 205
 frame-relay route 503 int s0/3 305
 frame-relay route 504 int s0/0 405

interface s0/2
 description CONNECTED TO DALLAS S1/0
 encapsulation frame-relay
 clock rate 128000
 frame-relay intf-type dce
 frame-relay route 201 int s1/3 102
 frame-relay route 203 int s0/3 302
 frame-relay route 204 int s0/0 402
 frame-relay route 205 int s0/1 502

interface s0/3
 description CONNECTED TO MIAMI S1/0
 encapsulation frame-relay
 clock rate 128000
 frame-relay intf-type dce
 frame-relay route 301 int s1/3 103
 frame-relay route 302 int s0/2 203
 frame-relay route 304 int s0/0 403
 frame-relay route 305 int s0/1 503

interface s1/3
 description CONNECTED TO PHOENIX S1/0
 encapsulation frame-relay
 clock rate 128000
 frame-relay intf-type dce
 frame-relay route 102 int s0/2 201
 frame-relay route 103 int s1/0 301
 frame-relay route 104 int s0/0 401
 frame-relay route 105 int s0/1 501

If you follow my topology and use the above configuration, you should have full-mesh connectivity between all routers via frame-relay virtual circuits.
This material originally from: http://freeccnalabs.com/resources/frame-relay-switch-configuration/

What Can You Do When Firewall Threat Your Internet Security?

What a firewall is and what it does are widely known to technophiles and technophobes alike. The purpose of a firewall has been burned into the head of just about every person who uses the Internet, and the thought of functioning without protection from the bad people is sheer lunacy.

However, nearly all firewalls are unidirectional. They may protect you from nefarious pokes and prods from the nether regions of the Internet, but they'll happily ship out any data you send from the inside. Only at the higher levels of enterprise IT do you see active filters for data leaving the network.

Of course，I'm not talking about facilities that prevent access to certain websites based on content or filters that block peer-to-peer applications. I'm talking about devices that actively block or issue alerts when anomalous data is passed through the firewall from internal hosts. For instance, it's unlikely that anyone working in engineering and design firms in Peru would send lots of data to Chinese sites. If a filter or network traffic monitor spotted this unusual activity, it's possible those firms wouldn't have lost tens of thousands of blueprints to an unknown Chinese organization. But their firewalls blithely allowed sensitive information to escape.

We're in a place now, technologically, that's fueling an uprising of internal threats -- not just from viruses and whatnot, but espionage. There's been some recent concern that computer hardware produced in foreign countries may contain Trojans burned into the chips, allowing anything from remote control of sensitive devices to keylogging or providing a wider backdoor into the network.

Make what you will of this claim, but don't think for a minute it's not possible. The fact these allegations are in dispute does not detract from the certainty that what they describe is technologically feasible. The only way to fight this kind of deep intrusion is by carefully inspecting what leaves the network. I bet the vast majority of the corporate infrastructures in place today have little to no visibility of this kind, and the people using them may not even realize the threat.

But how does one gain control over outbound traffic? Locking down the inside of your firewall at Layer 4 does next to nothing to prevent data leaks, even if you explicitly block IP ranges belonging to foreign countries or competitors. Creating and maintaining such a blacklist is a fool's errand, as it's trivial for a data collector for a German-based bad actor to work from within the United States, running on a cheap VPS somewhere near Los Angeles. As the United Kingdom has discovered, IP blacklists are essentially useless.

The only way to truly get a handle on this is by using deep packet inspection and peering into every packet as it heads out of the network. Devices such as NIKSUN's NetDetector do exactly this, and they can be configured to send out notifications when passing traffic matches certain patterns, contains certain files, or even show up with specific text strings. Naturally, the use of heavy encryption can evade some of these triggers, but if suddenly there's a flurry of encrypted traffic heading to an unknown IP address in Guam, it might bear closer inspection. You can immediately identify the internal source since you have the packet stream in its entirety.

This material is original from:

http://www.infoworld.com/d/data-center/the-firewall-threat-you-dont-know-196161

Steps and Reasons of setting passwords on Cisco Routers

Nowadays, Internet security is more and more important with more and more challenges. As a must of Internet, routers and switches play a vital role. Talking with regards to CISCO router, not having a code for it means serious risk to your comfort. Without protection account details, getting private details becomes as easy as it is when you informal look at the Online and out of nowhere lose your entire details and system facilities. If you do not have protection account details for CISCO routers, it may allow anyone to make configurations changes they want, as well as let them closing you out of your own system.

In just two minutes you can set protection account details for your Cisco routers, which guarantees a more protected router and system facilities. Along with a Cisco router, you decline need an Ethernet wire or system wire.

You first need to hook up the CISCO router with a system or an Ethernet wire. In case of system wire, hook up it to the system slot of your notebook or computer. You then have to web link it to the system slot on the CISCO router that flows Console, (CISCO 2600 Sequence Electrical circuitry and Setup) in red composing.

An Ethernet wire needs to be linked with the pc’s Local Place Network (LAN) slot, which is usually on the side of a notebook or behind a pc. It then needs to be linked with the Ethernet slot marked; ETHERNET 0/0; (CISCO 2600 Sequence Electrical circuitry and Setup) on the CISCO router.

Moving to phase second, you are required to use the system slot to accessibility the CISCO router via the Super Terminal system. This system comes preinstalled with the Windows based pc. From the Begin selection, choose ”All Programs” ---“Accessories”--- “Communications”; and simply select the quick way to Super Terminal.

The following slot configurations need to be used when encouraged by Super Terminal:

BITS per second: 9600

Data bits: 8

Parity: None

Stop bits: 1

Circulation control: None

As a substitute, you can open a control immediate screen by choosing from the Begin selection. Type “cmd” in the space offered and media ”Enter”. In the control immediate, get into the control “telnet”; followed by the IP deal with of the router. An example of the control range is: C: telnet 123.156.204.12.

Command usage

-Prior to any changes, get into the blessed function of the router and use the following control. You also need to make sure that the “Router>” is the standard router immediate for a CISCO router.

-Once you get into the allow control, it will change your CISCO router immediate to:

Router#

In order to get into the configurations function of the CISCO router, the following control needs to be used:

Router#config

 Once you efficiently get into the configurations function, the following concept will be received:

“Enter configurations orders, one per range. End with CNTL/Z.”

After you get into the configurations function of the CISCO router, the following immediate will be visible:

Router (config)#

Password Setting

Now you need to set the allow code by using the control “enable password ”;. For example, for the code “Change me2”, the control will be as follows:

Router(config)#enable code Changeme2

It is essential that you use a powerful code platform when establishing the allow code. The allow code is an exclusive terminal code that defends entry to the router over a system interface. This code is noticeable in the router configurations and is not saved secured on the CISCO router.

We now come to the last phase of establishing the code. You need to set the allow key code with the “enable secret” control.

For example, for “Newpswd4” as the code, the control will be:

Router(config)#enable key Newpswd4

While creating code configurations, it is recommended that you use a different protection account details for “enable secret” and ”enable password”. The allowed key code is more protected and secured than the allow code. One can also not view the allowed key code in the CISCO router configurations.

Solutions of avoiding Cisco Connect Cloud

Recently, a sensation paid attention by the world especially by the Cisco Router customers may annoy some users too. That is Cisco just rolled out across their router line, forcing users to register with Cisco's cloud service or end up with a bricked device, which make the customers upset a lot. And what's that mean? The service basically replicates all the features router administrators already have, but moves them from your home network to Cisco’s cloud. The supposed benefit is that you can manage your router even when you’re not at home. Regardless of the necessity, I do believe that some customers may want to avoid the needless security risk (albeit a small one). In exchange for the convenience of Connect Cloud, you have to agree to some pretty onerous terms. In short, Cisco would really hate it if you use the Web to view porn or download copyrighted files without paying for them.

Fortunately, there are many users who are good at theory and application have found out the solutions so that you can make full use of all the old functions with rolling back your firmware, and ditching Connect Cloud.
In fact, the Cisco Knowledge Base provides instructions on how to roll the router’s firmware back to avoid using the cloud service at all. Now let’s share the detailed steps one by one.
The first step is downloading the earlier version of the firmware. Next, you disconnect the Ethernet cable from the router’s Internet port. That’s because if your computer is online, navigating to 192.168.1.1 takes you to the Connect Cloud signup page. Severing the Internet connection brings you to a different page that provides administration access with your router’s password.
At this point, you can use the previously downloaded file to roll the router’s firmware back to the prior version. The router reboots, and once you plug the Ethernet cable back in your online, and going to 192.168.1.1 gives you the traditional Web interface—no cloud service account required.
The final step is to uncheck the automatic upgrade option. Now your router won’t automatically receive firmware updates. You could try the third-party firmware DD-WRT, but it seems to be supported on the Linksys EA2700 but not the other two models affected by the recent update.
Not receiving firmware updates isn’t ideal, of course. There is one way around this without signing up for the cloud service, though. Even with the latest firmware, you can manage your router without a Connect Cloud account by using the software that comes with a Cisco router. However, this software only includes the most basic options—for anything advanced, it redirects you to 192.168.1.1, which in turn redirects you to the Cisco Connect Cloud if you haven’t rolled back your firmware.
There’s also a phone app called Cisco Connect Express that works on your home network without a cloud account. That app is still available for now, but Cisco is pushing a new phone app that requires the cloud account.
Certainly, that Cisco blog post said the company is developing an updated version of the opt-out process for automatic updates to make it clearer that customers have more options than simply creating a Connect Cloud account. Maybe we all are waiting for the action of Cisco, yes?

No Permanent Peace Nor Warfare---Cisco locks users out of their routers

No Permanent Peace Nor Warfare---Cisco locks users out of their routers

Generally, when you buy a new device you plan on using it however you want, hopefully with the occasional update to keep everything running smoothly. Every once in a while, though, an update comes along that makes you scream in terror, like the one Cisco just rolled out across their router line, forcing users to register with Cisco's cloud service or end up with a bricked device.

Why in the world would you need to tie your router into some sort of cloud service? So that Cisco can monitor everything you do and sell your information, of course! Alright, alright: on the bright side, you do get anytime, anywhere” access to your router, and access to 'new apps' to enrich your 'connected lifestyle.' We never asked for apps on our router in the first place, but that's beside the point.

 

Initially, Cisco updated their privacy policy to give them the right to keep track of things like how much traffic goes through your router and which websites you're looking at:

“When you use the Service, we may keep track of certain information related to your use of the Service, including but not limited to the status and health of your network and networked products; which apps relating to the Service you are using; which features you are using within the Service infrastructure; network traffic (e.g., megabytes per hour); internet history; how frequently you encounter errors on the Service system and other related information (“Other Information”).”

Since then, they decided to yank that little addition (although they still have the right to change it back without notice), and thanks to user outcry, they've also provided some instructions to revert back to the old firmware and avoid these problems. Unfortunately, the vast majority of users will never even know about the update, or even what firmware is, let alone how to revert to an older version of it.

Aside from the obvious privacy issues, the real problem here is that they're trying to take your porno and warez away from you. The terms of service of Cisco's Cloud Connect service contains some really interesting clauses:

“You agree not to use or permit the use of the Service: (i) to invade another's privacy; (ii) for obscene, pornographic, or offensive purposes; (iii) to infringe another's rights, including but not limited to any intellectual property rights; (iv) to upload, email or otherwise transmit or make available any unsolicited or unauthorized advertising, promotional materials, spam, junk mail or any other form of solicitation; (v) to transmit or otherwise make available any code or virus, or perform any activity, that could harm or interfere with any device, software, network or service (including this Service); or (vi) to violate, or encourage any conduct that would violate any applicable law or regulation or give rise to civil or criminal liability.  ”

As a result of that, Cisco reserves the right, 'without limitation,' to transform your router into a useless brick if they decide you're uploading a little too much porn on their cloud service, or if they catch you uploading that CD you just ripped. That could raise another red flag for people who still value their privacy, since enforcing those rules would probably mean keeping tabs on what each file that passes through the service is. With any luck, though, it's just an attempt to keep Cisco Cloud Connect from becoming the next Mega upload.

Like a famous motto says, to err is human, maybe Cisco also just need some time…

Basic Steps of Configurating the Cisco ASA 5505 Firewall

The Cisco ASA 5505 Firewall is the smallest model in the new 5500 Cisco series of hardware appliances. Although this model is suitable for small businesses, branch offices or even home use, its firewall security capabilities are the same as the biggest models (5510, 5520, 5540 etc). The Adaptive Security technology of the ASA firewalls offers solid and reliable firewall protection, advanced application aware security, denial of service attack protection and much more. Moreover, the performance of the ASA 5505 appliance supports 150Mbps firewall throughput and 4000 firewall connections per second, which is more than enough for small networks.

Here, let's share the basic configuration steps needed to setup a Cisco 5505 ASA firewall for connecting a small network to the Internet. We assume that our ISP has assigned us a static public IP address (e.g 200.200.200.1 as an example) and that our internal network range is 192.168.1.0/24. We will use Port Address Translation (PAT) to translate our internal IP addresses to the public address of the outside interface. The difference of the 5505 model from the bigger ASA models is that it has an 8-port 10/100 switch which acts as Layer 2 only. That is, you can not configure the physical ports as Layer 3 ports, rather you have to create interface Vlans and assign the Layer 2 interfaces in each VLAN. By default, interface Ethernet0/0 is assigned to VLAN 2 and it's the outside interface (the one which connects to the Internet), and the other 7 interfaces (Ethernet0/1 to 0/7) are assigned by default to VLAN 1 and are used for connecting to the internal network. Let's see the basic configuration setup of the most important steps that you need to configure.

Step1: Configure the internal interface vlan

ASA5505(config)# interface Vlan 1
ASA5505(config-if)# nameif inside
ASA5505(config-if)# security-level 100
ASA5505(config-if)# ip address 192.168.1.1 255.255.255.0
ASA5505(config-if)# no shut

Step 2: Configure the external interface vlan (connected to Internet)

ASA5505(config)# interface Vlan 2
ASA5505(config-if)# nameif outside
ASA5505(config-if)# security-level 0
ASA5505(config-if)# ip address 200.200.200.1 255.255.255.0
ASA5505(config-if)# no shut

Step 3: Assign Ethernet 0/0 to Vlan 2

ASA5505(config)# interface Ethernet0/0
ASA5505(config-if)# switchport access vlan 2
ASA5505(config-if)# no shut

Step 4: Enable the rest interfaces with no shut

ASA5505(config)# interface Ethernet0/1
ASA5505(config-if)# no shut

Do the same for Ethernet0/1 to 0/7.

Step 5: Configure PAT on the outside interface

ASA5505(config)# global (outside) 1 interface
ASA5505(config)# nat (inside) 1 0.0.0.0 0.0.0.0

Step 6: Configure default route towards the ISP (assume default gateway is 200.200.200.2

ASA5505(config)# route outside 0.0.0.0 0.0.0.0 200.200.200.2 1

The above steps are the absolutely necessary steps you need to configure for making the appliance operational. Of course there are much more configuration details that you need to implement in order to enhance the security and functionality of your appliance, such as Access Control Lists, Static NAT, DHCP, DMZ zones, authentication etc.