LTLnetworker | IT hálózatok, biztonság, Cisco

               IT networks, security, Cisco

Archive for the ‘router IOS’ Category

Using Cisco ISE as a generic RADIUS server

Posted by ltlnetworker on August 31, 2014

Cisco ISE is an identity-based policy server featuring a wide range of functions from RADIUS CLI authentication to workstation posturing. With just a base license it includes a full-featured RADIUS server and it is capable of performing trivial RADIUS tasks which would not require such a sophisticated product themselves. For the functions described in this article Cisco Secure ACS could have been commonly chosen some years earlier. ISE’s policy logic and web interface is quite different.

The following use cases are described:

Posted in AAA, ASA, Cisco, IPsec, ISE, remote access, router IOS, switch | Tagged: , , , | 8 Comments »

Route not advertised due to EIGRP zero successor

Posted by ltlnetworker on December 4, 2013

This article’s topic really fits in this blog’s genre. It focuses on a case of classic routing protocol behaviour inspection.

I was looking at the subnets in the routing tables when I noticed that a network I picked up was absent in one of the devices. It is a VLAN routed on a pair of core switches (SW1,SW2). The switches advertise the VLANs by EIGRP and all other routers learn it as external EIGRP routes (due to redistribute connected). However, there’s a router R2 connected to SW2 by a L3 link that doesn’t have the network in the routing table.

Let’s see R2’s EIGRP config :
Read the rest of this entry »

Posted in Cisco, router IOS, routing | Tagged: | Leave a Comment »

IOS Easy VPN Server with LDAP authentication

Posted by ltlnetworker on November 9, 2010

LDAP support for authentication and authorization was introduced in IOS 15.1(1)T.  In this article we are testing Cisco VPN client connection authenticated against Novell NetWare eDirectory.

Structure of the LDAP directory:
Read the rest of this entry »

Posted in AAA, Cisco, IPsec, remote access, router IOS | Tagged: , | Leave a Comment »

IPv6 host’s default router selection

Posted by ltlnetworker on May 14, 2010

An IPv6 host’s default router selection is affected both by manual static routes and received router advertisements.

I am very happy with my HE IPv6 tunnel. Szívesen lennék natív IPv6 felhasználó is, de az UPC nem ad információt, hogy milyen IPv6 tervei vannak. )-: I bookmarked Google’s IPv6 site but once it turned inaccessible. What could have happened?

Read the rest of this entry »

Posted in Cisco, IPv6, router IOS | Tagged: , , , | 3 Comments »

IOS Easy VPN with RADIUS, Cisco Secure ACS 5.1 and AAA cache

Posted by ltlnetworker on May 10, 2010

AAA Authorization and Authentication Cache was integrated in IOS 15.0(1)M. This feature enables the router to store AAA credentials in its cache after it received the RADIUS or TACACS+ reply to an AAA request. The cache can be used either for performance boost (avoiding sending requests to the AAA server) or for a fallback method in case the servers are unreachable. The mode depends on the order you place your authentication methods in the aaa commands (see below).

In this example we are caching TACACS admin users’ credentials (telnet, vty) and RADIUS VPN users’ credentials (IKE xauth). The VPN group is also defined on the RADIUS server.

Read the rest of this entry »

Posted in ACS, Cisco, IPsec, remote access, router IOS | Tagged: , , , , | 2 Comments »

Local user group-lock in IOS Easy VPN

Posted by ltlnetworker on May 7, 2010

Cisco router IOS Easy VPN Server

Group-Lock feature can also be used with local users, we can even create something like ‘local user groups’. Possible formats are:

name/group, name\group, name@group, or name%group
Read the rest of this entry »

Posted in AAA, Cisco, IPsec, remote access, router IOS | Tagged: , , | Leave a Comment »