Since a friend told me he was using putty from a (windows)VM with his Mac to get access to a CLI, I gave his this video and by the way I’m posting it.

I’m going here to show some of the new features that comes with!
Some are good… and others not ^^

Let’s start with the bad news

Memory Upgrade

To upgrade your ASA with 8.3 release, you will need to upgrade your hardware.
Memory requirement is more than the double default memory. 512 Mb for a 5505, 1GB for 5510 …

You will still be able to install the new release, but you’ll get some error message in CLI and in ASDM. The full features set will be not supported until you’ll get some memory.

Licencing Features

With the ASA ( and IOS 15.0 ) comes the new licensing feature. Time-based licences are required
now to unblock features.

The good news is that time-based licenses are stackable.
let’s say you purchased a licence for 1 one year, you won’t have to wait the last day to renew your licence. The count will be just incremented using your new licence.

You can also use multiples licenses at the same time and if you do not require a feature anymore, you can deactivate it and reactivate later.

Master Passphrase

The Master Passphrase is not new for IOS. This feature is the same as the IOS command service password-encryption. But instead of type 7, you will
get with ASA an encryption using AES.

Monitoring

High Performance Monitoring for ASDM is the ability to check the inside hosts connections ( who and how much )

to set it up :

ciscoasa(config)#hpm topn enable

Firewall features

New interface is coming! the global one! You can configure access-list and others things in a global way, not only in an interface-specific way

NAT can be configured directly in the network object

And to finish, the NAT configuration is… quite simple as how we did earlier!

Others new features here:

http://www.cisco.com/en/US/docs/security/asa/asa83/release/notes/asarn83.html

802.1x parameters:

Supplicant : Mac OS X 10.6
Authenticator : Cisco 2950
Authentication Server : Windows 2000 + ACS

For more information:

You will find the list of VSA here :
http://www.ciscosystems.com/en/US/docs/net_mgmt/cisco_secure_access…
and the step to activate it on ACS here :
http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release…

Optimized for full-screen

Cliquer sur l’image pour avoir un résumé des commandes à entrer.

Et ici pour voir la vidéo de configuration d’un Remote VPN.

]]> http://www.madrouter.com/remote-vpn-configuration/feed/ 0 http://www.madrouter.com/cotd-to-be-auto-mdix-or-not-to-be/ http://www.madrouter.com/cotd-to-be-auto-mdix-or-not-to-be/#comments Tue, 03 Nov 2009 10:26:24 +0000 Alex http://www.madrouter.com/?p=199 If you wanna know whether your interface is capable of Auto-MDIX, you will find this command useful :

Switch#show interfaces fastEthernet 0/1 transceiver properties
Name : Fa0/1
Administrative Speed: auto
Administrative Duplex: auto
Administrative Auto-MDIX: N/A
Operational Speed: auto
Operational Duplex: auto
Operational Auto-MDIX: N/A

Switch#

Take a look at the video to know how to create and manipulate views.

I’ve just created a new tool in order to get informations from a Cisco router without using Telnet/SSH but showing output like the famous CLI

Based on HTTP GET request, this tool used the http server embedded in IOS.

The developpement was quickly-made and the code is not very optimised… I let you see the presentation by clicking on the pic below

Vous connaissez sans doute la commande “show ip interface brief” qui vous affiche un détail bref de de vos interfaces ( Types/Addresse IPv4/Etat L1 et L2 )

R2>show ip interface brief
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            unassigned      YES NVRAM  administratively down down
Serial0/0                  10.0.12.2       YES manual up                    up
FastEthernet0/1            unassigned      YES NVRAM  administratively down down
Serial0/1                  10.0.23.2       YES manual up                    up
Loopback0                  10.0.2.1        YES manual up                    up

Cette commande est très utile pour du troubleshooting rapide sur l’hôte en lui-même. Laisser moi maintenant vous montrer une commande très utile : “description” . Cette commande se configure en mode de configuration d’interface. Elle permet d’ajouter une touche personnelle qui ne modifie pas le comportement de notre interface. Juste à la documenter. Cette commande est pour moi plus importante que “ip add {X.X.X.X}” et figure obligatoirement en top list lors d’une conf.

R2>
R2>en
R2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R2(config)#int serial 0/1
R2(config-if)#description R2 <-> R3
R2(config-if)#

Ici dans ma description j’indique que R2 est connecté a R3 par le biais de l’interface serial 0/1.

Maintenant l’envie me vient de checker rapidement à qui je suis connecté. On peut tjs utiliser CDP ( Si tout le monde est en Cisco ), ou OSPF ( Si tout mes voisins sont désignés comme adjacents dans OSPF ) ou bien EIGRP ( Si tout le monde est en Cisco et qu’en plus ils sont désigné comme adjacents dans EIGRP ) ou je peux tout simplement documenter toutes mes interfaces et utiliser la magnifique commande “show interfaces description” :

R2#show interfaces description
Interface                      Status         Protocol Description
Fa0/0                          admin down     down
Se0/0                          up             up       R2 <-> R1
Fa0/1                          admin down     down
Se0/1                          up             up       R2 <-> R3
Lo0                            up             up       => R2
R2#

Et c’est là que tout se corse… Je suis en train de configurer EIGRP et je veux désigner l’interface vers R3 comme une passive-interface, seulement je ne sais plus laquelle est-ce… En alliant magnifiquement un alias, un peu d’output filtering et cette dernière commande, on peut créer une fonction de recherche assez powerfull surtout si on bosse sur des switchs L3 à base de line card WS-X4124-RJ45.

The logical topology looks like something like this :

Whereas the physical topology is this :

Click on the next pic to see the video :