Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About martlee2
06-01-2019
Stats
Member since
12-15-2014
142
Posts
0
Helpful
0
Solutions
Created by
martlee2
in Other Security Subjects
in Other Security Subjects
03-25-2018
05:29 PM
03-25-2018
05:29 PM
https://www.cisco.com/c/dam/m/sl_si/events/2016/cisco_dan_inovativnih_resitev/pdf/the_modern_threat_landscape_marius_baczynski.pdf
From the before, during and after aspect, how do cisco solve the security business challenge mentioned in the event above for the following topics?
1. Exploit Network by Dos
Before - Network - Software - Physical - Social Engineering - During - Network - Software - Physical - Social Engineering -
After - Network - Software - Physical - Social Engineering -
2. Industrial Espionage
Before - Network - Software - Physical - Social Engineering - During - Network - Software - Physical - Social Engineering -
After - Network - Software - Physical - Social Engineering - 3. Pivot through Us to attack customer
Before - Network - Software - Physical - Social Engineering - During - Network - Software - Physical - Social Engineering -
After - Network - Software - Physical - Social Engineering - 4. Steal IP by criminal
Before - Network - Software - Physical - Social Engineering - During - Network - Software - Physical - Social Engineering -
After - Network - Software - Physical - Social Engineering - 5. Damage the Brand
Before - Network - Software - Physical - Social Engineering - During - Network - Software - Physical - Social Engineering -
After - Network - Software - Physical - Social Engineering - 6. Game the stock price 7. Fraud
Before - Network - Software - Physical - Social Engineering - During - Network - Software - Physical - Social Engineering -
After - Network - Software - Physical - Social Engineering - 8. Steal Customer Data by Insider
Before - Network - Software - Physical - Social Engineering - During - Network - Software - Physical - Social Engineering -
After - Network - Software - Physical - Social Engineering -
... View more
Labels:
02-17-2018
10:49 PM
Am my finding correct?
is the TCN coming from
cps01cr01-private# sh int Ethernet3/2
cps01as38#sh int TenGigabitEthernet1/1 TenGigabitEthernet1/1 is up, line protocol is up (connected) Description: cps01cr01-pri-T3/1
cps01cr01-private# sh int Eth3/1 Ethernet3/1 is up admin state is up, Dedicated Interface Description: cps01as38 Te1/1
cps01as38#sh int Te1/1 TenGigabitEthernet1/1 is up, line protocol is up (connected) Description: cps01cr01-pri-T3/1
cps01cr01-private# sh spanning-tree vlan 102 detail
MST0002 is executing the mstp compatible Spanning Tree protocol Configured hello time 2, max age 20, forward delay 15 Root port is 385 (Ethernet3/1), cost of root path is 24000 Topology change flag set, detected flag not set Number of topology changes 246446 last change occurred 0:00:15 ago from Ethernet3/1 Times: hold 1, topology change 35, notification 2 hello 2, max age 20, forward delay 15 Timers: hello 0, topology change 19, notification 0
Port 385 (Ethernet3/1) of MST0002 is root forwarding Port path cost 20000, Port priority 128, Port Identifier 128.385 Designated port id is 64.4097, designated path cost 4000 Timers: message age 4, forward delay 0, hold 0 Number of transitions to forwarding state: 1 Link type is point-to-point by default, Internal PVST Simulation is enabled by default BPDU: sent 404, received 21228841
Port 386 (Ethernet3/2) of MST0002 is designated forwarding Port path cost 2000, Port priority 128, Port Identifier 128.386 Designated port id is 128.386, designated path cost 24000 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 14 Link type is point-to-point by default, Internal PVST Simulation is enabled by default BPDU: sent 5954645, received 0
cps01cr01-private# sh int Ethernet3/2 Ethernet3/2 is up admin state is up, Dedicated Interface
... View more
02-17-2018
09:19 PM
then i investigate number of BPDU sent
and find maximum sent is 570906520
and find maximum received is 403483675
as juniper vendor said TCN sent from cisco , cisco support said TCN sent from juniper
what does this sent mean?
do it mean "sent to this switch" or "sent to this port from this switch" ?
what does this received mean?
do it mean "received by this switch" or "received by this port"?
if using sent, find
Port 2571 (Port-channel11) of MST0 is designated forwarding Port path cost 1000, Port priority 128, Port Identifier 128.2571. Designated port id is 128.2571, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 3 Link type is point-to-point by default, Boundary PVST BPDU: sent 570987196, received 403556083
if using received, find
Port 2571 (Port-channel11) of MST0 is designated forwarding Port path cost 1000, Port priority 128, Port Identifier 128.2571. Designated port id is 128.2571, designated path cost 0 Timers: message age 0, forward delay 0, hold 0 Number of transitions to forwarding state: 3 Link type is point-to-point by default, Boundary PVST BPDU: sent 571042972, received 403606345
cdx01as38#sh int po11 Port-channel11 is up, line protocol is up (connected) Description: Po11 c3e05ms01 Ae70(xe-0/0/80,xe-1/0/80)
... View more
02-17-2018
08:32 PM
i attached the result i searched.
but there are many
i sorted the 5 largest changes
and
i highlighted smallest last changes occurred time with yellow
i am not sure 00:00:00 mean nothing occur or the lastest
using latest change occur find
Port 1308 (TenGigabitEthernet2/1/28) of MST1 is designated forwarding
which is a link to secondary site
but using BPDU sent or received number find port channel which connected to a juniper switch
which one is related with TCN ?
... View more
02-17-2018
04:35 PM
how to trace the source of TCN from core switch (Catalyst 4500 L3 Switch Version 03.06.05.E, cisco WS-C4500X-32 (MPC8572) processor (revision 9)) to interface of access switch?
MST0 Spanning tree enabled protocol mstp Root ID Priority 0 Address 0008.e3ff.fc50 This bridge is the root Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Bridge ID Priority 0 (priority 0 sys-id-ext 0) Address 0008.e3ff.fc50 Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec
Interface Role Sts Cost Prio.Nbr Type ------------------- ---- --- --------- -------- -------------------------------- Te1/1/2 Desg FWD 2000 128.2 P2p Te1/1/9 Desg FWD 40000 128.9 P2p Te1/1/13 Desg FWD 2000 128.13 P2p Te1/1/17 Desg FWD 20000 128.17 P2p Te2/1/2 Desg FWD 2000 128.1282 P2p Te2/1/13 Desg FWD 2000 128.1293 P2p Te2/1/28 Desg FWD 5000 128.1308 P2p Po11 Desg FWD 1000 128.2571 P2p Bound(PVST) Po12 Desg FWD 1000 128.2572 P2p Po13 Desg FWD 20000 128.2573 P2p Bound(PVST) Po20 Desg FWD 1000 128.2580 P2p Po110 Desg FWD 10000 128.2670 P2p Po161 Desg FWD 40000 128.2721 P2p Pre-STD Po162 Desg FWD 10000 128.2722 P2p Pre-STD Po180 Desg FWD 40000 128.2740 P2p Pre-STD Po181 Desg FWD 60000 128.2741 P2p Pre-STD Po250 Desg FWD 5000 128.2810 P2p
Track the Source of a TCN
In itself, a topology change notification is not a bad thing, but as a good network administrator, it is better to know their origin in order to be sure that they are not related to a real problem. Identifying the bridge that issued the topology change is not an easy task. However, it is not technically complex.
Most bridges only count the number of TCNs they have issued or received. The Catalyst 4500/4000, 5500/5000, and 6500/6000 are able to show the port and the ID of the bridge that sent the last topology change they received. Starting from the root, it is then possible to go downstream to the initiator bridge. Refer to the show spantree statisticscommand for more information.
If you have the output of a show spantree statistics command from your Cisco device, use Cisco CLI Analyzer (registered customers only) to display potential issues and fixes. To use Cisco CLI Analyzer (registered customers only), you must login as a registered customer, and have JavaScript enabled.
There is no command show spantree statistics in Catalyst 4500
cdx01as38>en
Password:
cdx01as38#show spantree statistics
^
% Invalid input detected at '^' marker.
cdx01as38#show spann
cdx01as38#show spanning-tree statis
cdx01as38#show spanning-tree statis
cdx01as38#show spanning-tree statistics
^
% Invalid input detected at '^' marker.
cdx01as38#sh ver
Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500e-UNIVERSALK9-M), Version 03.06.05.E RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2016 by Cisco Systems, Inc.
Compiled Thu 02-Jun-16 04:02 by prod_rel_team
then i try show standby, and use file analysis, it got error.
then i use show tech support to analysis in CLI analyzer
there is no loop or TCN keywords in result
is there another things related with TCN?
... View more
Labels:
06-12-2017
05:10 PM
if distribution layer switch is juniper , access switch is cisco
is it true that cisco switch not need to configure loop guard at etherchannel which are root port ?
if distribution layer switch is cisco , access switch is juniper
is it true that cisco switch not need to configure root guard at etherchannel which trunk to juniper?
are loop guard and root guard for single link and one port only?
i had experience in creating a loop at distribution layer when connect a switch to access switch which had not configured root guard at trunk port
i remembered that the distribution layer using etherchannel too
... View more
06-12-2017
04:57 PM
it seems that loop guard should not enable in port channel because it will block the whole logical link
if loop guard should not enable in port channel,
then can it imply loop never occur in port channel?
if distribution layer switch is juniper , access switch is cisco
is it true that cisco switch not need to configure loop guard at etherchannel which are root port ?
if distribution layer switch is cisco , access switch is juniper
is it true that cisco switch not need to configure root guard at etherchannel which trunk to juniper?
... View more
06-12-2017
04:42 PM
all trunk port using port channels, one port channel is connected with backup switch
another port channel is connected with cisco switch
it seems that loop guard should not enable in port channel because it will block the whole logical link
... View more
06-12-2017
04:30 PM
they said that MSTP approach is not feasible if connecting with juniper
... View more
06-12-2017
10:21 AM
in our case, they said our case is to not separate vlans into different STP,
mixed with cisco switch, it can not use MSTP, it need RSTP
... View more
06-12-2017
08:12 AM
juniper engineer told me that all links are port channel from juniper with cisco switch,
so spanning tree loop impossible to occur, master and backup juniper switch are all port channels, and to cisco switch are all port channel too
i am thinking whether this is only true in mixed juniper and cisco topology but not in topology if all cisco switch, is it true?
... View more
06-12-2017
04:15 AM
is it true that spanning tree loop never occur if all links are using port channel?
if it is true, does it mean that no need to apply loop guard and root guard for all port channels?
... View more
Labels:
06-10-2017
02:20 AM
besides automate query and configure and https://blogs.cisco.com/enterprise/five-cool-router-tricks-with-onepk,
Any more useful topics to automate with onepk?
... View more
Labels:
Created by
martlee2
in Intrusion Prevention and Detection Systems (IPS - IDS)
in Intrusion Prevention and Detection Systems (IPS - IDS)
06-10-2017
01:20 AM
06-10-2017
01:20 AM
medium 06/06/2017 16:13:28 cdx01id01 UDP Source Port 0 24199/1 x.x.x.x x.x.x.x 4500 85 85 medium 06/06/2017 16:15:32 cdx01id01 UDP Source Port 0 24199/1 0.0.0.0 x.x.x.x 0 85 85
threat-detection rate dos-drop rate-interval 600 average-rate 100 burst-rate 400 threat-detection rate dos-drop rate-interval 3600 average-rate 80 burst-rate 320
ASA log do not have rate about the source and destination ip pair for the keyword rate
however, it is defined as medium risk in Cisco IME
1. how to identify whether it is dos attack in ASA or IPS when client see many TCP sessions?
2. is it the dos rate low and not enough to trigger the dos drop?
3. how to find the rate of this low dos attack in log and tune the dos drop rate?
... View more
Labels:
05-31-2017
09:38 PM
would like to pass traffic to ASA first before inter vlan routing at 2901 router because I would like to control vlan 2 can access vlan 3 but
not allow vlan 3 to access vlan 2
2960 vlan 2 switch 1 ---> 2960 switch 0 ---> ASA ---> 2901 router 0 --> 2960 switch 0 ---> 2960 vlan 3 switch
1.how to let vlan 2 and vlan 3 traffic out from switch 0 Gig0/2 which is vlan 1 to ASA's vlan 1 in packettracer ?
2.is it possible there another traffic to go outside of ASA which means if ip address are public address then go outside, private ip address go inside by passing through the ASA and then do intervlan routing?
updated
if above is impossible, then when I set trunk port at ASA e0/2, it can not set trunk port, how can let vlan 2 and vlan 3 default gateway to this ASA in packet tracer?
juniper can use trunk port accept different vlan traffic, how do ASA do this?
conf t int e0/2 switchport mode trunk switchport trunk allowed vlan 1 switchport trunk allowed vlan add 2 switchport trunk allowed vlan add 3 shut no shut end
ciscoasa#conf t
ciscoasa(config)#int e0/2
ciscoasa(config-if)#switchport
% Incomplete command.
ciscoasa(config-if)#switchport ?
interface mode commands/options:
access Set access mode characteristics of the interface
ciscoasa(config-if)#switchport mode
^
% Invalid input detected at '^' marker.
switch 0 conf t hostname switch3 vlan dot1q tag native end conf t vlan 2 vlan 3 end conf t int f0/1 switchport mode trunk switchport trunk allowed vlan 2 switchport trunk allowed vlan add 3 no shut end conf t int f0/2 switchport mode trunk switchport trunk allowed vlan 3 switchport trunk allowed vlan add 2 no shut end conf t int GigabitEthernet0/1 switchport mode trunk switchport trunk allowed vlan 2 switchport trunk allowed vlan add 3 switchport trunk allowed vlan add 5 no shut end conf t ip default-gateway 192.168.5.254 end
conf t spanning-tree vlan 1 priority 0 spanning-tree vlan 2 priority 0 spanning-tree vlan 3 priority 0 end conf t int vlan 2 ip address 192.168.2.3 255.255.255.0 no shut end conf t int vlan 3 ip address 192.168.3.3 255.255.255.0 no shut end conf t int vlan 5 ip address 192.168.5.3 255.255.255.0 shut no shut end conf t int vlan 1 ip address 192.168.5.9 255.255.255.0 shut no shut end conf t int GigabitEthernet0/2 switchport mode trunk switchport trunk allowed vlan 1 shut no shut end conf t ip default-gateway 192.168.5.254 end
ASA conf t no dhcpd auto_config outside no dhcpd address 192.168.1.5-192.168.1.36 inside no dhcpd enable inside end conf t int vlan 2 no ip address end conf t int vlan 1 nameif inside security 100 ip address 192.168.5.254 255.255.255.0 end conf t int e0/2 switchport access vlan 1 shut no shut end conf t int e0/1 switchport access vlan 1 shut no shut end conf t route inside 192.168.2.0 255.255.255.0 192.168.5.5 route inside 192.168.3.0 255.255.255.0 192.168.5.5 end
... View more
Labels:
Created by
martlee2
in Other Security Subjects
03-25-2018
03-25-2018
https://www.cisco.com/c/dam/m/sl_si/events/2016/cisco_dan_inovativnih_resitev/pdf/the_modern_threat_...
06-12-2017
if distribution layer switch is juniper , access switch is cisco is it
true that cisco switch not ne...
06-12-2017
it seems that loop guard should not enable in port channel because it
will block the whole logical l...
06-12-2017
all trunk port using port channels, one port channel is connected with
backup switch another port ch...
06-12-2017
in our case, they said our case is to not separate vlans into different
STP, mixed with cisco switch...
06-12-2017
juniper engineer told me that all links are port channel from juniper
with cisco switch, so spanning...
06-10-2017
besides automate query and configure and
https://blogs.cisco.com/enterprise/five-cool-router-tricks-...
Created by
martlee2
in Intrusion Prevention and Detection Systems (IPS - IDS)
06-10-2017
06-10-2017
medium 06/06/2017 16:13:28 cdx01id01 UDP Source Port 0 24199/1 x.x.x.x
x.x.x.x 4500 85 85 medium 06/...
Public Statistics
| Date Registered | 12-15-2014 02:44 PM |
| Date Last Visited | 06-01-2019 01:36 AM |
| Total Messages Posted | 142 |
