9 More Discussions You Might Find Interesting
1. IP Networking
I have a Cisco 1841 router configured as Easy VPN Server. Here is the configuration of the router:
Cisco# Cisco#show running-config Building configuration... Current configura - Pastebin.com
I have a Centos 5.7 server with installed Cisco VPN client for Linux. The client successfully... (0 Replies)
Discussion started by: rcbandit
0 Replies
2. IP Networking
I was given my pcf file to login to work from home and wanted to use OpenVPN instead of the Cisco VPN client software. Can I use this pcf file with OpenVPN? I attempted to use vpnc:
http://wiki.centos.org/HowTos/vpnc
but it just times out
?? (2 Replies)
Discussion started by: metallica1973
2 Replies
3. UNIX for Dummies Questions & Answers
Hi Gurus of UNIX, I have a problem when I try to install a software VPN Cisco in Laptop (HP530).
I do the following procedures:
Part 2 - VPN Client Compilation
We will now set up the vpn client. As there is no official Cisco VPN Client for OpenSolaris X86 available, we will use vpnc.... (1 Reply)
Discussion started by: andresguillen
1 Replies
4. Ubuntu
Hi all,
I am trying to configure and connect Cisco VPN on Ubuntu 10.04.
I've imported .pcf file. The new vpn conn appears in the VPN Connections option. Now when I select it, it doesn't connect. Nothing happens.
I am not able to connect to VPN at all. I tried using kvpnc as well but it... (10 Replies)
Discussion started by: morningSunshine
10 Replies
5. Red Hat
Anyone had installed Cisco AnyConnect VPN client on RedHat5.3 EL or CentOS 5.3?
I tried on CentOS 5.3 but always getting host unreachable error. Same for windows xp works fine.
The error log reports:
Sep 1 19:14:03 localhost vpnagent: Function: tableCallbackHandler File: RouteMgr.cpp Line:... (3 Replies)
Discussion started by: zing_foru
3 Replies
6. Solaris
How do I tell if Cisco IOS VPN server IKE is running on my solaris 10 system (1 Reply)
Discussion started by: pgsanders
1 Replies
7. Shell Programming and Scripting
Hi all, This will save me a tremendous amount of time if i can get this script working. I have alot of sites i need to connect to using cisco vpn and then ssh onto servers to retrieve some info. Its all repetitative and it needs scripted.
what i have done so far is put this into a script.
... (0 Replies)
Discussion started by: borderblaster
0 Replies
8. IP Networking
Who in the 64 ubuntu adopted cisco vpn client on the wireless network
I downloaded the cisco vpn client for linux but run vpn_install make file when an error in cisco with the help of the document read in half a day, nor do I know this vpn client in the 64 systems in use.
Who can help me, a... (1 Reply)
Discussion started by: Eason
1 Replies
9. IP Networking
Dear All,
I have worked with xDSL routers working in bridged mode, and linux behind them working as a Firewall utilizing IPTABLES. My question is, how this will change if the xDSL router is replaced with a Cisco Router?
I mean to ask that, can I assign a public ip on the linux machine, which... (0 Replies)
Discussion started by: tmm
0 Replies
flow-tools-examples(1) General Commands Manual flow-tools-examples(1)
NAME
flow-tools-examples -- Example usage of flow-tools.
EXAMPLE - Configuring Cisco IOS Router
NetFlow is configured on each input interface, then global commands are used to specify the export destination. To ensure a consistant
source address address Loopback0 is configured as the export source.
ip cef distributed
ip flow-export version 5 origin-as
ip flow-export destination 10.0.0.100 5004
ip flow-export source Loopback0
interface Loopback0
ip address 10.1.1.1 255.255.255.255
interface FastEthernet0/1/0
ip address 10.0.0.1 255.255.255.0
no ip directed-broadcast
ip route-cache flow
ip route-cache distributed
Many other options exist such as aggregated NetFlow and sampled NetFlow which are detailed at (link to URL http://www.cisco.com) .
EXAMPLE - Configuring Cisco CatIOS Switch
Some Cisco Catalyst switches support a different implementation of NetFlow that is performed on the supervisor. With the cache based for-
warding model which is implemented in the Catalyst 55xx with Route Switch Module (RSM) and NetFlow Feature Card (NFFC), the RSM processes
the first flow and the remaining packets in the flow are forwarded by the Supervisor. This is also implemented in the early versions of
the 65xx with MSFC. The deterministic forwarding model used in the 65xx with MSFC2 do not use NetFlow to determine the forwarding path,
the flow cache is only used for statistics as in the current IOS implementations. In all of of the above configurations flow exports
arrive from both the RSM/MSFC and the Supervisor engines as distinct streams. In the worst cast the RSM exports in version 5 and the
Supervisor exports in version 7. Fortunately flow-capture and flow-receive can sort all this out by processing flows from both sources and
converting them to a common export format.
The router side running IOS is configured identically to the example given above. The CatIOS NetFlow Data Export configuration follows:
set mls flow full
set mls nde version 7
set mls nde 10.0.0.1 9800
set mls nde enable
When the 65xx is running in Native mode, from a users perspective the switch is only running IOS.
More detailed examples can be found on Cisco's web site
(link to URL http://www.cisco.com) .
EXAMPLE - Configuring Juniper Router
Juniper supports flow exports by the routing engine sampling packet headers and aggregating them into flows. Packet sampling is done by
defining a firewall filter to accept and sample all traffic, applying that rule to the interface, then configuring the sampling forwarding
option.
interfaces {
ge-0/3/0 {
unit 0 {
family inet {
filter {
input all;
output all;
}
address 10.0.0.1/24;
}
}
}
firewall {
filter all {
term all {
then {
sample;
accept;
}
}
}
}
forwarding-options {
sampling {
input {
family inet {
rate 100;
}
}
output {
cflowd 10.0.0.100 {
port 9800;
version 5;
}
}
}
}
Other options exist such as aggregated flows which are detailed at (link to URL http://www.juniper.net) .
EXAMPLE - Network topology and flow.acl
The network topology and flow.acl will be used for many of the examples that follow. Flows are collected and stored in /flows/R.
ISP-A ISP-B
+ +
+ +
IP=10.1.2.1/24 + + IP=10.1.1.1/24
ifIndex=2 + + ifIndex=1
interface=serial1/1 + + interface=serial0/0
-----
| R | Campus Router
-----
+ +
IP=10.1.4.1/24 + + IP=10.1.3.1/24
ifIndex=4 + + ifIndex=3
interface=Ethernet1/1 + + interface=Ethernet0/0
+ +
Sales Marketing
ip access-list standard sales permit 10.1.4.0 0.0.0.255
ip access-list standard not_sales deny 10.1.4.0 0.0.0.255
ip access-list standard marketing permit 10.1.3.0 0.0.0.255
ip access-list standard not_marketing deny 10.1.3.0 0.0.0.255
ip access-list standard campus permit 10.1.4.0 0.0.0.255
ip access-list standard campus permit 10.1.3.0 0.0.0.255
ip access-list standard not_campus deny 10.1.4.0 0.0.0.255
ip access-list standard not_campus deny 10.1.3.0 0.0.0.255
ip access-list standard evil_hacket permit host 10.6.6.6
ip access-list standard spoofer permit host 10.9.9.9
ip access-list standard multicast 224.0.0.0 15.255.255.255
EXAMPLE - Finding spoofed addresses
A common problem on the Internet is the use of "spoofed" (addresses that are not assigned to an organization) for use in DoS attacks or
compromising servers that rely on the source IP address for authentication.
Display all flow records that originate from the campus and are sent to the Internet but are not using legal addresses.
flow-cat /flows/R | flow-filter -Snot_campus -I1,2 | flow-print
Summary of the destinations of the internally spoofed addresses sorted by octets.
flow-cat /flows/R | flow-filter -Snot_campus -I1,2 | flow-stat -f8 -S2
Summary of the sources of the internally spoofed addresses sorted by flows.
flow-cat /flows/R | flow-filter -Snot_campus -I1,2 | flow-stat -f9 -S1
Summary of the internally spoofed sources and destination pairs sorted by packets.
flow-cat /flows/R | flow-filter -Snot_campus -I1,2 | flow-stat -f10 -S4
Display all flow records that originate external to the campus that have campus addresses. Many times these can be attackers trying to
exploit host based authentication mechanisms like unix r* commands. Another common source is mobile clients which send packets with their
campus addresses before obtaining a valid IP.
flow-cat /flows/R | flow-filter -Scampus -i1,2 | flow-print
Summary of the destinations of the externally spoofed addresses sorted by octets.
flow-cat /flows/R | flow-filter -Scampus -i1,2 | flow-stat -f8 -S2
EXAMPLE - Locate hosts using or running services
Find all SMTP servers active during the collection period that have established connections to the Internet. Summarize sorted by octets.
flow-cat /flows/R | flow-filter -I1,2 -P25 | flow-stat -f9 -S2
Find all outbound NNTP connections to the Internet. Summarize with source and destination IP sorted by octets.
flow-cat /flows/R | flow-filter -I1,2 -P119 | flow-stat -f10 -S3
Find all inbound NNTP connections to the Internet. Summarize with source and destination IP sorted by octets.
flow-cat /flows/R | flow-filter -i1,2 -P119 | flow-stat -f10 -S3
EXAMPLE - Multicast usage
Summarize Multicast S,G where sources are on campus.
flow-cat /flows/R | flow-filter -Dmulticast -I1,2 | flow-stat -f10 -S3
Summarize Multicast S,G where sources are off campus.
flow-cat /flows/R | flow-filter -Dmulticast -i1,2 | flow-stat -f10 -S3
EXAMPLE - Find scanners
Find SMTP scanners with flow-dscan. This will also find SMTP clients which try to contact many servers. This behavior is characterized by
a recent Microsoft worm.
touch dscan.suppress.src dscan.suppress.dst
flow-cat /flows/R | flow-filter -P25 | flow-dscan -b
AUTHOR
Mark Fullmer maf@splintered.net
SEE ALSO
flow-tools(1)
flow-tools-examples(1)