802.1x parameters:

Supplicant : Mac OS X 10.6
Authenticator : Cisco 2950
Authentication Server : Windows 2000 + ACS

For more information:

You will find the list of VSA here :
http://www.ciscosystems.com/en/US/docs/net_mgmt/cisco_secure_access…
and the step to activate it on ACS here :
http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release…

Optimized for full-screen

Cliquer sur l’image pour avoir un résumé des commandes à entrer.

Et ici pour voir la vidéo de configuration d’un Remote VPN.

]]> http://www.madrouter.com/remote-vpn-configuration/feed/ 0 http://www.madrouter.com/role-based-cli/ http://www.madrouter.com/role-based-cli/#comments Sat, 24 Oct 2009 17:10:25 +0000 Alex http://www.madrouter.com/?p=193 Role-Based CLI is the possibility to use view into which you could assign commands for users. ( e.g. You don’t trust the new intern… ) You can create up to 15 view including superview ( mix of views )

Take a look at the video to know how to create and manipulate views.

I’ve just created a new tool in order to get informations from a Cisco router without using Telnet/SSH but showing output like the famous CLI

Based on HTTP GET request, this tool used the http server embedded in IOS.

The developpement was quickly-made and the code is not very optimised… I let you see the presentation by clicking on the pic below

The logical topology looks like something like this :

Whereas the physical topology is this :

Click on the next pic to see the video :

The script, when reduced to its minimal needs, has 18 lines …

Here is the video.

All the datas captured are stored in a file: Client-Source IP – Server-Destination IP

The script does not manage very well when several telnet connections are launched to the same Telnet server by a unique host.

Here’s the video of my new tool written with Scapy. The aim is to capture file configuration exported from cisco devices and walking on the wire in plain text.

Par ici la vidéo

So i make a tool to try to inject RIPv2 updates in my Linksys router. Here’s the result.

Well it was working but the funny part start now… With RIPv2, you can use an authentication to guarantee the source of your packets. Two authentication type are available :

• A simple password ( Clear text pass through the network )
• A md5-hashed-password

Watching the packet forger source code, there was no way to inject RIP Update with authentication, so i added a little part of code to use this feature. Let’s check what the RIPv2 RFC is telling us…

   Since authentication is a per message function, and since there is
   only one 2-octet field available in the message header, and since any
   reasonable authentication scheme will require more than two octets,
   the authentication scheme for RIP version 2 will use the space of an
   entire RIP entry.  If the Address Family Identifier of the first (and
   only the first) entry in the message is 0xFFFF, then the remainder of
   the entry contains the authentication.  This means that there can be,
   at most, 24 RIP entries in the remainder of the message.  If
   authentication is not in use, then no entries in the message should
   have an Address Family Identifier of 0xFFFF
   Currently, the only Authentication Type is simple password and it is
   type 2.  The remaining 16 octets contain the plain text password.  If
   the password is under 16 octets, it must be left-justified and padded
   to the right with nulls (0x00).

So i’ve just had to add to the source code this part :

class RIPAuth(Packet):
        name = "RIP Clear Authentication"
        fields_desc = [
                           ShortField("header",0xFFFF),
                           ShortField("authtype",2),
                           StrFixedLenField("password","",16),
                           ]

Click here to watch the video
http://www.madrouter.com/tutoriaux/RIPInjection/RIPInjection.htm