Unaprjeñenje sigurnosti u mrežama pružatelja
|
|
|
- Deirdre Clarke
- 6 years ago
- Views:
Transcription
1 Unaprjeñenje sigurnosti u mrežama pružatelja usluga Miroslav Šimić miroslav.simic@snt.hr CCIE #19429
2 Agenda Zaštita mrežne infrastrukture Zaštita na rubovima mreže Uočavanje i sprječavanje napada
3 Agenda Zaštita mrežne infrastrukture Zaštita na rubovima mreže Uočavanje i sprječavanje napada
4 Gašenje nepotrebnih servisa CDP: Globalno na cijelom ureñaju router(config)# no cdp run Na pojedinom sučelju router(config-if)# no cdp enable Directed Broadcast (SMURF napad): router(config-if)# no ip directed-broadcast U verziji IOS-a 11.2 i kasnijim verzijama ta je funkcionalnost isključena.
5 Gašenje nepotrebnih servisa Finger: Prije 12.1(5) i 12.1(5)T bio je uključen router(config)# no service finger Nakon 12.1(5) i 12.1(5)T je isključen. Ako ga treba isključiti: router(config)# no ip finger Maintenance Operations Protocol (MOP) router(config-if)# no mop enabled HTTP Server Isključen je. Ako ga treba isključiti: router(config)# no ip http server
6 Gašenje nepotrebnih servisa IP BOOTP Server router(config)# no ip bootp server IP Redirects router(config-if)# no ip redirects IP Source Routing router(config)# no ip source-route
7 Gašenje nepotrebnih servisa PAD router(config)# no service pad Proxy ARP router(config-if)# no ip proxy-arp Ident router(config)# no ip identd TCP i UDP small servers echo, chargen, daytime and discard services router(config)# no service tcp-small-servers router(config)# no service udp-small-servers
8 Implementacija korisnih alata i servisa Authentication, authorization, and accounting (AAA) Praćenje i spremanje konfiguracija Logiranje poruka Syslog Network Time Protocol (NTP) Out-of-band pristup ureñajima
9 Osnovne tehnike za zaštitu mreže Input Queues router(config-if)# hold-queue 1500 ICMP Unreachable router(config-if)# no ip unreachables router(config)# ip icmp rate-limit unreachable [df] milliseconds router(config)# mls rate-limit unicast ip icmp unreachable (SUP720 hardware based rate limit) Scheduler allocation router(config)# scheduler interval 500 router(config)# scheduler allocate
10 Osnovne tehnike za zaštitu mreže Skrivanje mreže MPLS VPN MPLS Core je sakriven, korisnik ima pristup samo PE usmjerniku Router(config)# no mpls ip propagate-ttl [forwarded local]
11 Kontrola prometa koji pristupa procesoru Control Plane Policing - COPP Usmjerivački protokoli Upravljački promet telnet, SSH, SNMP Promet koji kao odredište ima IP adresu koja se nalazi na samom ureñaju Razni drugi prometi ICMP, IP Options
12 Kontrola prometa koji pristupa procesoru Centralizirani COPP router(config)# control-plane router(config-<<???>>)# service-policy {input output} service_policy_name COPP na distribuiranim platformama router(config)# control-plane router(config-<<???>>)# service-policy input service_policy_name router(config)# control-plane slot slot_number router(config-<<???>>)# service-policy input service_policy_name Sup 720 router(config)# mls qos router(config)# control-plane router(config-<<???>>)# service-policy input service_policy_name router(config)# mls qos protocol arp police bps
13 Kontrola prometa koji pristupa procesoru Receive Access Control List router(config)# ip receive access-list num
14 Agenda Zaštita mrežne infrastrukture Zaštita na rubovima mreže Uočavanje i sprječavanje napada
15 Zaštita na rubovima mreže Infrastructure Protection Access Control Lists iacl
16 Zaštita na rubovima mreže 1. Dio! Deny your infrastructure space as a source of external packets access-list 101 deny ip your_public_infrastructure_block any! Deny src addresses of and 127/8 (special useipv4 addresses) access-list 101 deny ip host any access-list 101 deny ip any! Deny RFC1918 space from entering AS access-list 101 deny ip any access-list 101 deny ip any access-list 101 deny ip any
17 Zaštita na rubovima mreže 2. dio! Permit ebgp session access-list 101 permit tcp host bgp_peer host local_ip eq 179 access-list 101 permit tcp host bgp_peer eq 179 host local_ip! Permit OSPF access-list 101 permit ospf host ospf_neighbour host ! Permit DR multicast address, if needed access-list 101 permit ospf host ospf_neighbour host access-list 101 permit ospf host ospf_neighbour host local_ip 3. dio! Deny all other access to infrastructure access-list 101 deny ip any your_public_infrastructure_block 4. dio! Permit transit traffic (ISP). access-list 101 permit ip any any
18 Zaštita na rubovima mreže Filtriranje prometa od korisnika! Permit ebgp session access-list 101 permit tcp host bgp_peer host local_ip eq 179 access-list 101 permit tcp host bgp_peer eq 179 host local_ip! Permit OSPF access-list 101 permit ospf host ospf_neighbour host ! Permit DR multicast address, if needed access-list 101 permit ospf host ospf_neighbour host access-list 101 permit ospf host ospf_neighbour host local_ip! Deny access to infrastructure access-list 101 deny ip any your_public_infrastructure_block! Permit transit traffic (ISP). access-list 101 permit ip user_address_block any! Deny any other traffic. access-list 101 deny ip any any
19 Agenda Zaštita mrežne infrastrukture Zaštita na rubovima mreže Uočavanje i sprječavanje napada
20 Uočavanje i sprječavanje napada ACL Extended IP access list 169 permit icmp any any echo (2 matches) permit icmp any any echo reply (21374 matches) permit udp any any eq echo permit udp any eq echo any permit tcp any any established (150 matches) permit tcp any any (15 matches) permit ip any any (45 matches)
21 Netflow Uočavanje i sprječavanje napada
22 Uočavanje i sprječavanje napada Sink Holes
23 Uočavanje i sprječavanje napada Sink Holes
24 Uočavanje i sprječavanje napada Sink Holes
25 Uočavanje i sprječavanje napada Sink Holes! Static route to /3 network ip route !...! ip arp c arpa!
26 Uočavanje i sprječavanje napada Black Holes ip route 171.xxx.xxx Null0
27 Uočavanje i sprječavanje napada Remote trigered Black Hole
28 Uočavanje i sprječavanje napada Remote trigered Black Hole preusmjeravanje po odredišnoj adresi Svi ruteri: ip route Null0
29 Uočavanje i sprječavanje napada Remote trigered Black Hole preusmjeravanje po odredišnoj adresi Ruter sa kojega se oglašava ruta: router bgp redistribute static route-map STATIC-TO-BGP! route-map STATIC-TO-BGP permit 10 match tag 66 set ip next-hop set local-preference 50 set community no-export 999:000! Route-map STATIC-TO-BGP permit 20! ip route 171.xxx.xxx Null0 Tag 66!
30 Uočavanje i sprječavanje napada Remote trigered Black Hole preusmjeravanje po source adresi (Unicast Reverse Path Forwarding (urpf) Loose mode) Svi ruteri:! interface FastEthernet2/0 ip address 192.xxx.xxx ip verify unicast source reachable-via any... speed 100 full-duplex!
31 Uočavanje i sprječavanje napada Remote trigered Black Hole preusmjeravanje po source adresi Ruter sa kojega se oglašava ruta: router bgp redistribute static route-map STATIC-TO-BGP! route-map STATIC-TO-BGP permit 10 match tag 66 set ip next-hop set local-preference 50 set community no-export 999:000! Route-map STATIC-TO-BGP permit 20! ip route 171.xxx.xxx Null0 Tag 66!
32 Uočavanje i sprječavanje napada Cisco Traffic Anomaly Detector Module Cisco Anomaly Guard Module
33 Miroslav Šimić, dipl. ing. CCIE #
Device Resiliency and Survivability
CHAPTER 4 Routers and switches may be subject to attacks designed to or that indirectly affect the network availability. Possible attacks include DoS based on unauthorized and authorized protocols, Distributed
Network Infrastructure Filtering at the border. stole slides from Fakrul Alam
Network Infrastructure Filtering at the border maz@iij.ad.jp stole slides from Fakrul Alam fakrul@bdhbu.com Acknowledgement Original slides prepared by Merike Kaeo What we have in network? Router Switch
Network security session 9-2 Router Security. Network II
Network security session 9-2 Router Security Network II Router security First line of defense of the network Compromise of a router can lead to many issues: Denial of network services Degrading of network
Cisco Router Security: Principles and Practise. The foundation of network security is router security.
The foundation of network security is router security. 1) Router security within a general IT security plan, IOS software and standard access. 2) Password security and authentication. 3) Services, applications
AutoSecure. Finding Feature Information. Last Updated: January 18, 2012
AutoSecure Last Updated: January 18, 2012 The AutoSecure feature secures a router by using a single CLI command to disable common IP services that can be exploited for network attacks, enable IP services
Network Infrastructure Filtering at the border. PacNOG19 28th November - 2nd December 2016 Nadi, Fiji
Network Infrastructure Filtering at the border PacNOG19 28th November - 2nd December 2016 Nadi, Fiji Issue Date: [Date] Revision: [XX] What we have in network? Router Switch CPE (ADSL Router / WiFi Router)
CCNP (Routing & Switching and T.SHOOT)
CCNP (Routing & Switching and T.SHOOT) Course Content Module -300-101 ROUTE 1.0 Network Principles 1.1 Identify Cisco Express Forwarding concepts 1.1.a FIB 1.1.b Adjacency table 1.2 Explain general network
Configuring VRF-lite CHAPTER
CHAPTER 36 Virtual Private Networks (VPNs) provide a secure way for customers to share bandwidth over an ISP backbone network. A VPN is a collection of sites sharing a common routing table. A customer
Implementing Cisco IP Routing
300-101 Implementing Cisco IP Routing NWExam.com SUCCESS GUIDE TO CISCO CERTIFICATION Exam Summary Syllabus Questions Table of Contents Introduction to 300-101 Exam on Implementing Cisco IP Routing...
Welcome! APNIC Security Tutorial. Securing edge network devices. Overview
Welcome! APNIC Security Tutorial Securing edge network devices 6 September 2005, Hanoi, Vietnam In conjunction with APNIC20 Overview Edge security principles Threats categories Securing edge devices Routing
CISCO NETWORK FOUNDATION PROTECTION: PROTECTING THE CISCO CATALYST SERIES PLATFORM
CISCO NETWORK FOUNDATION PROTECTION: PROTECTING THE CISCO CATALYST SERIES PLATFORM SECURITY TECHNOLOGY GROUP JANUARY 2005 1 Agenda Introduction Configuring Control Plane Protection Deployment Guide Summary
Contents. Configuring urpf 1
Contents Configuring urpf 1 Overview 1 urpf check modes 1 Features 1 urpf operation 2 Network application 3 Configuration procedure 4 Displaying and maintaining urpf 4 urpf configuration example 4 Configuring
Internetwork Expert s CCNA Security Bootcamp. Common Security Threats
Internetwork Expert s CCNA Security Bootcamp Common Security Threats http:// Today s s Network Security Challenge The goal of the network is to provide high availability and easy access to data to meet
Network Infra Security Filtering at the Border. Network Security Workshop April 2017 Bali Indonesia
Network Infra Security Filtering at the Border Network Security Workshop 25-27 April 2017 Bali Indonesia Issue Date: [31-12-2015] Revision: [V.1] What is in the network? Routers Switches CPE (ADSL Router
Syllabus. Cisco Certified Design Professional. Implementing Cisco IP Routing
Syllabus Cisco Certified Design Professional Implementing Cisco IP Routing 1.0 Network Principles 1.1 Identify Cisco Express Forwarding concepts 1.1.a FIB 1.1.b Adjacency table 1.2 Explain general network
Vendor: Cisco. Exam Code: Exam Name: Implementing Cisco IP Routing (ROUTE v2.0) Version: Demo
Vendor: Cisco Exam Code: 300-101 Exam Name: Implementing Cisco IP Routing (ROUTE v2.0) Version: Demo DEMO QUESTION 1 Refer to the exhibit. The DHCP client is unable to receive a DHCP address from the DHCP
Data Plane Protection. The googles they do nothing.
Data Plane Protection The googles they do nothing. Types of DoS Single Source. Multiple Sources. Reflection attacks, DoS and DDoS. Spoofed addressing. Can be, ICMP (smurf, POD), SYN, Application attacks.
Appendix B Policies and Filters
Appendix B Policies and Filters NOTE: This appendix does not describe Access Control Lists (ACLs) or IPX SAP ACLs, which are additional methods for filtering packets. See Software-Based IP Access Control
Routing Configuration Guide, Cisco IOS XE Everest a (Catalyst 9300 Switches)
Routing Configuration Guide, Cisco IOS XE Everest 16.5.1a (Catalyst 9300 Switches) First Published: 2017-06-20 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA
Access Rules. Controlling Network Access
This chapter describes how to control network access through or to the ASA using access rules. You use access rules to control network access in both routed and transparent firewall modes. In transparent
2002, Cisco Systems, Inc. All rights reserved.
2002, Cisco Systems, Inc. All rights reserved. Configuring IP Access Lists 2002, Cisco Systems, Inc. All All rights reserved. ICND v2.0 6-2 2 Objectives Upon completing this lesson, you will be able to:
CCIE Route & Switch Written (CCIERSW) 1.0
CCIE Route & Switch Written (CCIERSW) 1.0 COURSE OVERVIEW: CCIE Route and Switch Written (CCIERSW) preparation course is a five-day course that prepares the student for the written exam portion of the
Configuring Control Plane Policing
21 CHAPTER This chapter describes how to configure control plane policing (CoPP) on the NX-OS device. This chapter includes the following sections: Information About CoPP, page 21-1 Guidelines and Limitations,
Configuring Control Plane Policing
This chapter contains the following sections: Information About CoPP Information About CoPP, on page 1 Control Plane Protection, on page 2 CoPP Policy Templates, on page 4 CoPP Class Maps, on page 8 Packets
Question: 1 Which three parameters must match to establish OSPF neighbor adjacency? (Choose three.)
Volume: 217 Questions Question: 1 Which three parameters must match to establish OSPF neighbor adjacency? (Choose three.) A. the process ID B. the hello interval C. the subnet mask D. authentication E.
Network Operation Tips and Tricks
South Asian Network Operators Group Network Operation Tips and Tricks Simon Sohel Baroi Fiber@Home Ltd Md. Zobair Khan Fiber@Home Ltd 2 Case Studies : 1. TCP MSS Tweaks 2. MPLS L2 VPN Tweaks 3. IPv6 Subnetting
Network Infrastructure Filtering at the border. Cyber Security & Network Security March, 2017 Dhaka, Bangladesh
Network Infrastructure Filtering at the border Cyber Security & Network Security 20-22 March, 2017 Dhaka, Bangladesh Issue Date: [Date] Revision: [XX] What we have in network? Router Switch CPE (ADSL Router
Note that you can also use the password command but the secret command gives you a better encryption algorithm.
Router Device Security Lab Configuring Secure Passwords 1. Configure the enable secret and password enable password TRUSTME enable secret letmein Look at the configuration: show config terminal Note the
ITBraindumps. Latest IT Braindumps study guide
ITBraindumps http://www.itbraindumps.com Latest IT Braindumps study guide Exam : 300-101 Title : Implementing Cisco IP Routing Vendor : Cisco Version : DEMO Get Latest & Valid 300-101 Exam's Question and
InterAS Option B. Information About InterAS. InterAS and ASBR
This chapter explains the different InterAS option B configuration options. The available options are InterAS option B, InterAS option B (with RFC 3107), and InterAS option B lite. The InterAS option B
Internet Control Message Protocol (ICMP)
Internet Control Message Protocol (ICMP) 1 Overview The IP (Internet Protocol) relies on several other protocols to perform necessary control and routing functions: Control functions (ICMP) Multicast signaling
MPLS VPN--Inter-AS Option AB
The feature combines the best functionality of an Inter-AS Option (10) A and Inter-AS Option (10) B network to allow a Multiprotocol Label Switching (MPLS) Virtual Private Network (VPN) service provider
Network Policy Enforcement
CHAPTER 6 Baseline network policy enforcement is primarily concerned with ensuring that traffic entering a network conforms to the network policy, including the IP address range and traffic types. Anomalous
Configuring Control Plane Policing
This chapter contains the following sections: Information About CoPP Information About CoPP, on page 1 Control Plane Protection, on page 3 CoPP Policy Templates, on page 4 CoPP Class Maps, on page 11 Packets
Connecting to the Management Network and Securing Access
CHAPTER 3 Connecting to the Network and Securing Access This chapter provides Cisco NX-OS recommended best practices for connecting a Cisco Nexus 7000 Series switch to the management network(s) and securing
Securing network infrastructure
Securing network infrastructure Matsuzaki maz Yoshinobu maz@iij.ad.jp 1 Our Goals Ensuring Network Availability Controlling Routing Policy Protecting Information Preventing Misuse Mitigating
MPLS VPN Inter-AS Option AB
First Published: December 17, 2007 Last Updated: September 21, 2011 The feature combines the best functionality of an Inter-AS Option (10) A and Inter-AS Option (10) B network to allow a Multiprotocol
TestOut Routing and Switching Pro - English 6.0.x COURSE OUTLINE. Modified
TestOut Routing and Switching Pro - English 6.0.x COURSE OUTLINE Modified 2017-07-10 TestOut Routing and Switching Pro Outline- English 6.0.x Videos: 133 (15:42:34) Demonstrations: 78 (7:22:19) Simulations:
Modular Policy Framework. Class Maps SECTION 4. Advanced Configuration
[ 59 ] Section 4: We have now covered the basic configuration and delved into AAA services on the ASA. In this section, we cover some of the more advanced features of the ASA that break it away from a
Deploying Cisco ASA Firewall Solutions (FIREWALL v1.0)
Cisco 642-617 Deploying Cisco ASA Firewall Solutions (FIREWALL v1.0) Version: 4.8 QUESTION NO: 1 Which Cisco ASA feature enables the ASA to do these two things? 1) Act as a proxy for the server and generate
HP 6125 Blade Switch Series
HP 6125 Blade Switch Series About the HP 6125 Blade s Part number: 5998-3152 Software version: Release 2103 Document version: 6W100-20120907 Legal and notice information Copyright 2012 Hewlett-Packard
CCIE Routing & Switching
CCIE Routing & Switching Cisco Certified Internetwork Expert Routing and Switching (CCIE Routing and Switching) certifies the skills required of expert-level network engineers to plan, operate and troubleshoot
Chapter 6 Global CONFIG Commands
Chapter 6 Global CONFIG Commands aaa accounting Configures RADIUS or TACACS+ accounting for recording information about user activity and system events. When you configure accounting on an HP device, information
IP Services Commands. Cisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services IP1R-157
Use the commands in this chapter to configure various IP services. For configuration information and examples on IP services, refer to the Configuring IP Services chapter of the Cisco IOS IP Configuration
Extended ACL Configuration Mode Commands
Extended ACL Configuration Mode Commands To create and modify extended access lists on a WAAS device for controlling access to interfaces or applications, use the ip access-list extended global configuration
Borderless Networks Security: Cisco Catalyst 6500 Series Control Plane Protection Techniques for Maximum Uptime
Borderless Networks Security: Cisco Catalyst 6500 Series Control Plane Protection Techniques for Maximum Uptime What You Will Learn The goal of this white paper is to help network design engineers and
About the HP A7500 Configuration Guides
About the HP A7500 s The HP A7500 configuration guides are part of the HP A7500 documentation set. They describe the software features for the HP A7500 Release 6620 & 6630 Series, and guide you through
A Commands CHAPTER. Commands that are identical to those documented in the Cisco IOS software documentation have been removed from this chapter.
CHAPTER 1 The commands shown in this chapter apply to the Catalyst 8540 MSR, Catalyst 8510 MSR, and LightStream 1010 ATM switch routers. Where an entire command or certain attributes of a command have
DMVPN to Group Encrypted Transport VPN Migration
DMVPN to Group Encrypted Transport VPN Migration This document provides the steps for Dynamic Multipoint VPN (DMVPN) to Group Encrypted Transport VPN migration. DMVPN to Group Encrypted Transport VPN Migration
R&E ROUTING SECURITY BEST PRACTICES. Grover Browning Karl Newell
R&E ROUTING SECURITY BEST PRACTICES Grover Browning Karl Newell RFC 7454 BGP Operations & Security Feb, 2015 https://tools.ietf.org/html/rfc7454 [ 2 ] Agenda Background / Community Development Overview
CCNP TSHOOT. Quick Reference Sheet Exam
CCNP TSHOOT Quick Reference Sheet Exam 300-135 Chapter 1. Network Principles Troubleshooting Steps Problem Identification Collection of Information Examination and Action Plan Verification Basic Troubleshooting
Routing Security DDoS and Route Hijacks. Merike Kaeo CEO, Double Shot Security
Routing Security DDoS and Route Hijacks Merike Kaeo CEO, Double Shot Security merike@doubleshotsecurity.com DISCUSSION POINTS Understanding The Growing Complexity DDoS Attack Trends Packet Filters and
Remote Access MPLS-VPNs
First Published: August 12, 2002 Last Updated: May 4, 2009 The feature allows the service provider to offer a scalable end-to-end Virtual Private Network (VPN) service to remote users. This feature integrates
IPv6. Copyright 2017 NTT corp. All Rights Reserved. 1
IPv6 IPv6 NTT IPv6 Copyright 2017 NTT corp. All Rights Reserved. 1 IPv6 IPv4 IPv6 Copyright 2017 NTT corp. All Rights Reserved. 2 IPv4 http://www.potaroo.net/tools/ipv4/ 2018.3.5 Copyright 2017 NTT corp.
MPLS VPN Carrier Supporting Carrier IPv4 BGP Label Distribution
MPLS VPN Carrier Supporting Carrier IPv4 BGP Label Distribution This feature lets you configure your carrier supporting carrier network to enable Border Gateway Protocol (BGP) to transport routes and Multiprotocol
MPLS VPN Carrier Supporting Carrier IPv4 BGP Label Distribution
MPLS VPN Carrier Supporting Carrier IPv4 BGP Label Distribution This feature enables you to configure your carrier supporting carrier network to enable Border Gateway Protocol (BGP) to transport routes
Junos Security. Chapter 3: Zones Juniper Networks, Inc. All rights reserved. Worldwide Education Services
Junos Security Chapter 3: Zones 2012 Juniper Networks, Inc. All rights reserved. www.juniper.net Worldwide Education Services Chapter Objectives After successfully completing this chapter, you will be
Unsupported Commands in Cisco IOS Release 12.2(25)SEE
APPENDIX C Unsupported Commands in Cisco IOS Release 12.2(25)SEE This appendix lists some of the command-line interface (CLI) commands that appear when you enter the question mark (?) at the Catalyst 3750
PrepAwayExam. High-efficient Exam Materials are the best high pass-rate Exam Dumps
PrepAwayExam http://www.prepawayexam.com/ High-efficient Exam Materials are the best high pass-rate Exam Dumps Exam : 642-618 Title : Deploying Cisco ASA Firewall Solutions (FIREWALL v2.0) Vendors : Cisco
IP - The Internet Protocol. Based on the slides of Dr. Jorg Liebeherr, University of Virginia
IP - The Internet Protocol Based on the slides of Dr. Jorg Liebeherr, University of Virginia Orientation IP (Internet Protocol) is a Network Layer Protocol. IP: The waist of the hourglass IP is the waist
CCNA. The knowledge and skills that a learner must have before attending this course are as follows:
CCNA SRM CCNAX v2.0 CCNA Routing & Switching course is the ultimate training program for engineers pursuing the Cisco Certified Network Associate (CCNA) certification. Cisco has announced an extensive
Contents. BGP commands 1
Contents BGP commands 1 address-family ipv4 1 address-family ipv6 2 address-family link-state 3 advertise-rib-active 4 aggregate 5 balance 7 balance as-path-neglect 9 bestroute as-path-neglect 10 bestroute
TCP/IP Networking. Training Details. About Training. About Training. What You'll Learn. Training Time : 9 Hours. Capacity : 12
TCP/IP Networking Training Details Training Time : 9 Hours Capacity : 12 Prerequisites : There are no prerequisites for this course. About Training About Training TCP/IP is the globally accepted group
Access List Commands
Access List Commands This module describes the Cisco IOS XR software commands used to configure IP Version 4 (IPv4) and IP Version 6 (IPv6) access lists. An access control list (ACL) consists of one or
CCIE R&S v5.0. Troubleshooting Lab. Q1. PC 110 cannot access R7/R8, fix the problem so that PC 110 can ping R7
Troubleshooting Lab Q1. PC 110 cannot access R7/R8, fix the problem so that PC 110 can ping R7 Q2. R17 should have one default route which points to R12 via PPP as shown below R17# sh ip route S* 0.0.0.0/0
26 CHAPTER Virtual Private Networks (VPNs) provide a secure way for customers to share bandwidth over an ISP backbone network. A VPN is a collection of sites sharing a common routing table. A customer
Access List Commands
This chapter describes the Cisco IOS XR software commands used to configure IP Version 4 (IPv4) and IP Version 6 (IPv6) access lists on Cisco ASR 9000 Series Aggregation Services Routers. An access control
Unicast Reverse Path Forwarding Loose Mode
The feature creates a new option for Unicast Reverse Path Forwarding (Unicast RPF), providing a scalable anti-spoofing mechanism suitable for use in multihome network scenarios. This mechanism is especially
Using the Management Ethernet Interface
The Cisco ASR 920 Series Router has one Gigabit Ethernet Management Ethernet interface on each Route Switch Processor. The purpose of this interface is to allow users to perform management tasks on the
set active-probe (PfR)
set active-probe (PfR) set active-probe (PfR) To configure a Performance Routing (PfR) active probe with a forced target assignment within a PfR map, use the set active-probe command in PfR map configuration
Chapter 4 Lab A: Configuring CBAC and Zone-Based Firewalls
Chapter 4 Lab A: Configuring CBAC and Zone-Based Firewalls Topology Note: ISR G2 devices have Gigabit Ethernet interfaces instead of Fast Ethernet Interfaces. IP Addressing Table Device Interface IP Address
Phase 4 Traceback the Attack. 2002, Cisco Systems, Inc. All rights reserved.
Phase 4 Traceback the Attack 1 Six Phases to ISP Security Incident Response Preparation Identification Classification Traceback Reaction Post Mortem 2 Traceback Attacks to their Source Valid IPv4 Source
Remember Extension Headers?
IPv6 Security 1 Remember Extension Headers? IPv6 allows an optional Extension Header in between the IPv6 header and upper layer header Allows adding new features to IPv6 protocol without major re-engineering
Exam Actual. Higher Quality. Better Service! QUESTION & ANSWER
Higher Quality Better Service! Exam Actual QUESTION & ANSWER Accurate study guides, High passing rate! Exam Actual provides update free of charge in one year! http://www.examactual.com Exam : 642-617 Title
WiNG 5.x How-To Guide
WiNG 5.x How-To Guide Tunneling Remote Traffic using L2TPv3 Part No. TME-08-2012-01 Rev. A MOTOROLA, MOTO, MOTOROLA SOLUTIONS and the Stylized M Logo are trademarks or registered trademarks of Motorola
Chapter 4 Software-Based IP Access Control Lists (ACLs)
Chapter 4 Software-Based IP Access Control Lists (ACLs) This chapter describes software-based ACLs, which are ACLs that processed traffic in software or CPU. (This type of ACL was also referred to as flow-based
CCIE R&S LAB CFG H2/A5 (Jacob s & Jameson s)
Contents Section 1 Layer 2 Technologies... 2 1.1 Jameson s Datacenter: Access port... 2 1.2 Jameson s Datacenter: Trunk ports... 4 1.3 Jameson s Datacenter: Link bundling... 5 1.4 Jameson s Branch Offices...
CCNA Practice test. 2. Which protocol can cause high CPU usage? A. NTP B. WCCP C. Telnet D. SNMP Answer: D
1. Which network would support at least 30 hosts? A. 10.0.0.0 255.255.255.252 B. 10.0.0.0 255.255.255.240 C. 10.0.0.0 255.255.255.224 D. 10.0.0.0 255.255.255.248 2. Which protocol can cause high CPU usage?
Exam Name: Implementing Cisco Edge Network Security Solutions
Vendor: Cisco Exam Code: 300-206 Exam Name: Implementing Cisco Edge Network Security Solutions Version: Demo QUESTION 1 The Cisco ASA must support dynamic routing and terminating VPN traffic. Which three
Organization of Product Documentation... xi
Contents Organization of Product Documentation... xi Chapter 1 Getting Started... 1-1 Introduction...1-1 Software Versions Covered...1-1 Audience...1-1 Conventions...1-1 Terminology...1-2 Support and Warranty
The Loopback Interface
1 Overview The Loopback Interface ISP/IXP Workshops Requires IOS 11.1CC or 12.0 trains ISP software trains Covers router access, security, information gathering, configuration and scalability. 2 Motivation
Sink Holes, Dark IP, and HoneyNets
Sink Holes, Dark IP, and HoneyNets Sink Hole Routers/Networks Sink Holes are a Swiss Army Knife security tool. BGP speaking Router or Workstation that built to suck in attacks. Used to redirect attacks
Configuring Commonly Used IP ACLs
Configuring Commonly Used IP ACLs Document ID: 26448 Contents Introduction Prerequisites Requirements Components Used Conventions Configuration Examples Allow a Select Host to Access the Network Deny a
Symbols I N D E X. (vertical bar), string searches, 19 20
I N D E X Symbols A (vertical bar), string searches, 19 20 AAA (Authorization, Authentication, and Accounting) command auditing, 156 158 controlling router access, 154 155 access, out-of-band management
Cisco CCIE Service Provider.
Cisco 400-201 CCIE Service Provider http://killexams.com/pass4sure/exam-detail/400-201 Question: 569 **Refer to the exhibit. After the BGP TCP negotiation between RouterA and RouterB, what will be the
BRKDCT The Comprehensive Guide to Securing NX-OS Devices Derek Huckaby Technical Marketing Engineer (TME)
BRKDCT-3102 - The Comprehensive Guide to Securing NX-OS Devices Derek Huckaby Technical Marketing Engineer (TME) Session Goals Learn about the solutions Nexus switches have for securing themselves and
Performing Path Traces
About Path Trace, page 1 Performing a Path Trace, page 13 Collecting QoS and Interface Statistics in a Path Trace, page 15 About Path Trace With Path Trace, the controller reviews and collects network
WCCPv2 and WCCP Enhancements
WCCPv2 and WCCP Enhancements Release 12.0(11)S June 20, 2000 This feature module describes the Web Cache Communication Protocol (WCCP) Enhancements feature and includes information on the benefits of the
HP 6125XLG Blade Switch
HP 6125XLG Blade Switch Network Management and Monitoring Configuration Guide Part number: 5998-5376a Software version: Release 240x Document version: 6W101-20150515 Legal and notice information Copyright
Configuring NetFlow and NDE
CHAPTER 47 This chapter describes how to configure NetFlow statistics collection and NetFlow Data Export (NDE) on the Cisco 7600 series routers. Note For complete syntax and usage information for the commands
Exam Questions Demo Cisco. Exam Questions CCIE SP CCIE Service Provider Written Exam
Cisco Exam Questions 400-201 CCIE SP CCIE Service Provider Written Exam Version:Demo 1. Which is one difference between H-VPLS and VPLS? A. VPLS is a point-to-point Layer-2 services and H-VPLS is a multipoint
CCIE(Routing & Switching) Course Catalog
CCIE(Routing & Switching) Course Catalog 2012-2013 Cisco Certified Internetworking Expert (CCIE) R&S Written CCIE R&S Written Boot Camp offered by CSLiT Training is an intensive and accelerated program
Using the Management Ethernet Interface
This chapter covers the following topics: Gigabit Ethernet Management Interface Overview, page 1 Gigabit Ethernet Port Numbering, page 1 IP Address Handling in ROMmon and the Management Ethernet Port,
Configuring IP Unicast Routing
CHAPTER 39 This chapter describes how to configure IP Version 4 (IPv4) unicast routing on the switch. Unless otherwise noted, the term switch refers to a standalone switch and to a switch stack. A switch
MPLS VPN. 5 ian 2010
MPLS VPN 5 ian 2010 What this lecture is about: IP CEF MPLS architecture What is MPLS? MPLS labels Packet forwarding in MPLS MPLS VPNs 3 IP CEF & MPLS Overview How does a router forward packets? Process
HP FlexFabric 5930 Switch Series
HP FlexFabric 5930 Switch Series Network Management and Monitoring Configuration Guide Part number: 5998-7772b Software version: Release 241x Document version: 6W102-20171117 Legal and notice information
OER uses the following default value if this command is not configured or if the no form of this command is entered: timer: 300
holddown holddown To configure the Optimized Edge Routing (OER) prefix route dampening timer to set the minimum period of time that a new exit must be used before an alternate exit can be selected, use
Chapter 3 Command List
Chapter 3 Command List This chapter lists all the commands in the CLI. The commands are listed in two ways: All commands are listed together in a single alphabetic list. See Complete Command List on page
Configuring IP Version 6
CHAPTER 24 Configuring IP Version 6 Internet Protocol version 6 (IPv6), formerly called IPng (next generation), is the latest version of IP. IPv6 offers many advantages over the previous version of IP,
INDEX. BGP Attributes Download. bgp policy accounting command broadcast addresses, used instead of bundle-hash command. cache entries, definition
INDEX HC IC MCC MNC MPC QC RC SC SMC A Cisco IOS XR Interface and Hardware Component Configuration Guide Cisco IOS XR IP Addresses and Services Configuration Guide Cisco IOS XR Multicast Configuration