Showing posts with label Cisco. Show all posts
Showing posts with label Cisco. Show all posts

[Guide] How to Crack Cisco type 7 Password

  10:25 AM    Santosh

Cisco Password Cracker by IFM.NET.NZ



The Router/Switch passwords will be in lines like:

enable password 7 095C4F1A0A1218000F

username Santosh password 7 12090404011C03162E

Take the type 7 password, such as the text above in red, and paste it into the box shown in below screen shot and click "Crack Password".


Use below URL to crack the password from Cisco type 7 password,





  

[Guide] How to recover Cisco Router password

  10:24 AM    Santosh




    • Turn off & Turn on the Router.


    • Press the Break key or key sequence to put the router into ROM Monitor mode. The sequence might be CTRL-D, CTRL-Break or another combination.


    • At the > prompt, type 0 to record the current value of the configuration register normally 0x2102, or 0x102.



>o

Configuration register = 0x2102 at last boot

Bit# Configuration register option settings:

15 Diagnostic mode disabled.



  • Type o/r 0x2142 to tell the router to boot from flash without loading the configuration in NVRAM at the next reload.


  • Type i to have the router reboot. The router ignores the configuration in NVRAM.


  • The router runs the setup dialog, Type no or press Ctrl-C to skip the initial setup Dialog.


  • Type enable at the Router> prompt to go to privileged exec mode.


  • Copy the startup configuration to the running configuration by using the configure memory or copy startup-config running-config commands. Do not type configure terminal. If you use the configure terminal command, you overwrite the configuration stored in NVRAM.


  • View the configuration by typing write terminal or show running-config. View the configured line, vty and enable passwords. Any encrypted passwords need to be changed.


  • Enter the configuration mode by typing configure terminal. Change the line of enable passwords as necessary.


  • Type config-register 0x2102 to return the router to normal operation at the next reloads.


  • Exit configuration mode by pressing Ctrl-Z


  • Save your changes by typing write memory or copy running-config startup-config.


  • Reload the router and verify the passwords.


    You are Done..

  

[Guide] How to redirect http traffic from Cisco 3750/ASA 5520 to Squid Proxy Server

  10:22 AM    Santosh

Below is my scenario as shown,







Network Details -
My Cisco ASA - 172.16.1.1
Cisco Switch 3750 (interface which is facing to ASA) - 172.16.1.2
Cisco Switch 3750 Vlan2 IP - 10.10.10.1
Internal Network - 10.10.10.1/24

Vlan2 IP (i.e. 10.10.10.1) is my network gateway & I am going to redirect all port 80 i.e. http traffic to my Squid.
Here we go!!!!

1. Install & configure your Squid proxy server. I am going to cover squid installation steps in next post.
2. Configure the squid in transparent mode so that no need to manually specify the proxy server IP to each users.
http_port 3128 transparent
3. Login to the Cisco Gateway. My network gateway is Cisco 3750. Same below process applies to the Cisco ASA.
4. For policy based routing (PBR) we need to enable SDM templates if it’s not enabled on your Cisco 3750 switch. In some case you need to update your IOS to latest release.
# config t
config-t# sdm prefer routing

5. After enabling SDM templates save the switch configuration & reload it to apply the setting..
#wr
#reload
6. Now create access list to redirect http (port 80) traffic to the squid proxy server
access-list 111 deny tcp any any neq www
access-list 111 deny tcp host SQUID-PROXY-IP any
access-list 111 permit tcp any any

7. Now create Route Map
route-map proxy-redirect permit 100
match ip address 111
set ip next-hop SQUID-PROXY-IP

8. Now apply route map to the Switch interface Vlan2 (i.e. gateway of your network)
config-t#interface Vlan2
interface#ip policy route-map proxy-redirect

9. To check whether our gateway is redirecting port 80 traffic or not. Run below command

#sh route-map






  

[Guide] How to assign interface of Cisco switch to a Vlan

  10:19 AM    Santosh

Below example show how to configure Switch port or interface to a VLAN,

1. Login to the switch
2. go to configuration terminal
3. config#interface fastenternet 0/10
4. switchport mode access (configuration interface as access port)
5. switchport access VLAN1 (assign vlan to the port)

  

Cisco ASA Remote Access IPSec VPN Configuration Step by Step

  11:25 AM    Santosh

Today I am going to show you how to configure IPSec VPN on Cisco ASA firewall. The process is very easy so lets get started.  In my case I am going to configure Cisco 5510 Series Adaptive Security Appliance (ASA) using the Adaptive Security Device Manager (ASDM).
The remote VPN Client user authenticates against the Active Directory using a Microsoft Windows 2003 Internet  Authentication Service (IAS) RADIUS server or Local User database.




Configure the ASA as a Remote VPN Server using ASDM,

Select Wizards > VPN Wizard from the Home window.
Select the Remote Access VPN tunnel type and ensure that the VPN Tunnel Interface is set as desired.
 
  Click Next.
Enter a name for the Tunnel Group Name. Supply the authentication information to use.  such as Pre-shared Key 
Choose whether you want remote users to be authenticated to the local user database or to an external AAA server group. Here I am using my Cisco ACS Server.
 Define a pool of local addresses to be dynamically assigned to remote VPN Clients when they connect.
 Click Next
Specify the DNS and WINS server information and a Default Domain Name to be pushed to remote VPN Clients.
Specify the parameters for IKE, also known as IKE Phase 1. Configurations on both sides of the tunnel must match exactly. However, the Cisco VPN Client automatically selects the proper configuration for itself. Therefore, no IKE configuration is necessary on the client PC.
Specify which, if any, internal hosts or networks should be exposed to remote VPN users.
If you leave this list empty, it allows remote VPN users to access the entire inside network of the ASA.
This window shows a summary of the actions that you have taken. Click Finish if you are satisfied with your configuration.
Now open your Cisco VPN Client,
Attempt to connect to the Cisco ASA using the Cisco VPN Client in order to verify that the ASA is successfully configured.
Select Connection Entries > New.
Fill in the details of your new connection.
The Host field should contain the IP address or hostname of the previously configured Cisco ASA. The Group Authentication information should correspond to that used. Click Save when you are finished.

  

Cisco ASA Remote Access IPSec VPN Configuration Step by Step

  10:55 AM    Santosh

Today I am going to show you how to configure IPSec VPN on Cisco ASA firewall. The process is very easy so lets get started.  In my case I am going to configure Cisco 5510 Series Adaptive Security Appliance (ASA) using the Adaptive Security Device Manager (ASDM).
The remote VPN Client user authenticates against the Active Directory using a Microsoft Windows 2003 Internet  Authentication Service (IAS) RADIUS server or Local User database.




Configure the ASA as a Remote VPN Server using ASDM,

Select Wizards > VPN Wizard from the Home window.
Select the Remote Access VPN tunnel type and ensure that the VPN Tunnel Interface is set as desired.
 
  Click Next.
Enter a name for the Tunnel Group Name. Supply the authentication information to use.  such as Pre-shared Key 
Choose whether you want remote users to be authenticated to the local user database or to an external AAA server group. Here I am using my Cisco ACS Server.
 Define a pool of local addresses to be dynamically assigned to remote VPN Clients when they connect.
 Click Next
Specify the DNS and WINS server information and a Default Domain Name to be pushed to remote VPN Clients.
Specify the parameters for IKE, also known as IKE Phase 1. Configurations on both sides of the tunnel must match exactly. However, the Cisco VPN Client automatically selects the proper configuration for itself. Therefore, no IKE configuration is necessary on the client PC.
Specify which, if any, internal hosts or networks should be exposed to remote VPN users.
If you leave this list empty, it allows remote VPN users to access the entire inside network of the ASA.
This window shows a summary of the actions that you have taken. Click Finish if you are satisfied with your configuration.
Now open your Cisco VPN Client,
Attempt to connect to the Cisco ASA using the Cisco VPN Client in order to verify that the ASA is successfully configured.
Select Connection Entries > New.
Fill in the details of your new connection.
The Host field should contain the IP address or hostname of the previously configured Cisco ASA. The Group Authentication information should correspond to that used. Click Save when you are finished.

  

How to Configure SSH on Cisco Router and Switch

  10:39 PM    Santosh

In below post I have covered how to enable telnet on Cisco Router. 
http://www.mytricks.in/2011/08/how-to-enable-telnet-on-cisco-router.html


Now I am going to show to enable SSH on Cisco Router, as telnet is not secured for remote administration of Cisco Switchs & Routers. In telnet Data including user password is send in clear text. So SSH is used for remote administration of Cisco Router, Switchs & ASA Firewall.


Now days all Cisco devices are by default supplied with SSH feature. To use the SSH on Cisco devices you need to have the Cisco IOS version which supports SSH. So let's get started.


Check whether SSH is enable or not on your Cisco Router/Switch,


Router# show ip ssh


%SSH has not been enabled


To enable SSH follow below steps,


1. Configure the Hostname on the Cisco Switch or Router


Router(config)# hostname router


2. Configure the Domain name 


Router(config)# ip domain-name www.mytricks.in


3. Generate a RSA Key Pair


Router(config)# crypto key generate rsa


this command will enable SSH on the Cisco switch/Router.


4. Set the SSH Negotiation phase timeout interval (in seconds)


Router(config)# ip ssh time-out 60


This sets the time period for the Cisco Router/Switch to wait for 60 seconds before timing out the client during the SSH session.


5. Set the Maximum retry (maximum number of the Authentication retires )


Router(config)# ip ssh authetication-retries 2


6. To change the default port for SSH (default is 22)


MyRouter(config)# ip ssh port 22


7. Now disable Telnet access to the switch. This can be done by configuring SSH as the only transport agent.


Router(config)# line vty 0 15
Router(config)# transport input ssh


now only SSH is used to connect to the Cisco Routers/Switches remotely.


8. Save changes to the startup-config


MyRouter# wr mem


9. To check SSH status,


Router# show ip ssh


SSH Enabled – version 1.5


Authentication timeout: 60 secs; Authentication retries: 2


10. To view SSH connections


Router# show ssh


Connection      Version     Encryption State   Username


1.5       3DES    Session Started  guest




Note: If you want to disable SSH on the Cisco Router,


Router(config)# crypto key zeroize rsa


This deletes the RSA key-pair. Once you delete the RSA key-pair, it disables the SSH server.


& change transport mode to telnet,


MyRouter(config)# line vty 0 15
MyRouter(config)# transport input telnet





  

How to Enable Telnet on Cisco Router

  10:23 PM    Santosh


Here I am going to show you how to enable telnet on Cisco Router,


1. Check how many Virtual terminal your router supports. It depends on your router model
Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#line vty 0 ?
  <1-4>  Last Line number


2. Now to config mode & enable access to Virtual terminal & set password to "password"
Router#config t
Router(config)#line vty 0 4
Router(config-line)#password cisco
Router(config-line)#login


3. Now you can verify the telney by using below command & you can access the router via telnet.
Router#show line
   Tty Typ     Tx/Rx    A Modem  Roty AccO AccI   Uses   Noise  Overruns   Int
*     0 CTY              -    -      -    -    -      0       0     0/0       -
     97 AUX   9600/9600  -    -      -    -    -      0       0     0/0       -
     98 VTY              -    -      -    -    -      1       0     0/0       -
     99 VTY              -    -      -    -    -      0       0     0/0       -
    100 VTY              -    -      -    -    -      0       0     0/0       -
    101 VTY              -    -      -    -    -      0       0     0/0       -
    102 VTY              -    -      -    -    -      0       0     0/0       -

  

How to Configure SSH on Cisco Router and Switch

  10:09 PM    Santosh

In below post I have covered how to enable telnet on Cisco Router. 
http://www.mytricks.in/2011/08/how-to-enable-telnet-on-cisco-router.html


Now I am going to show to enable SSH on Cisco Router, as telnet is not secured for remote administration of Cisco Switchs & Routers. In telnet Data including user password is send in clear text. So SSH is used for remote administration of Cisco Router, Switchs & ASA Firewall.


Now days all Cisco devices are by default supplied with SSH feature. To use the SSH on Cisco devices you need to have the Cisco IOS version which supports SSH. So let's get started.


Check whether SSH is enable or not on your Cisco Router/Switch,


Router# show ip ssh


%SSH has not been enabled


To enable SSH follow below steps,


1. Configure the Hostname on the Cisco Switch or Router


Router(config)# hostname router


2. Configure the Domain name 


Router(config)# ip domain-name www.mytricks.in


3. Generate a RSA Key Pair


Router(config)# crypto key generate rsa


this command will enable SSH on the Cisco switch/Router.


4. Set the SSH Negotiation phase timeout interval (in seconds)


Router(config)# ip ssh time-out 60


This sets the time period for the Cisco Router/Switch to wait for 60 seconds before timing out the client during the SSH session.


5. Set the Maximum retry (maximum number of the Authentication retires )


Router(config)# ip ssh authetication-retries 2


6. To change the default port for SSH (default is 22)


MyRouter(config)# ip ssh port 22


7. Now disable Telnet access to the switch. This can be done by configuring SSH as the only transport agent.


Router(config)# line vty 0 15
Router(config)# transport input ssh


now only SSH is used to connect to the Cisco Routers/Switches remotely.


8. Save changes to the startup-config


MyRouter# wr mem


9. To check SSH status,


Router# show ip ssh


SSH Enabled – version 1.5


Authentication timeout: 60 secs; Authentication retries: 2


10. To view SSH connections


Router# show ssh


Connection      Version     Encryption State   Username


1.5       3DES    Session Started  guest




Note: If you want to disable SSH on the Cisco Router,


Router(config)# crypto key zeroize rsa


This deletes the RSA key-pair. Once you delete the RSA key-pair, it disables the SSH server.


& change transport mode to telnet,


MyRouter(config)# line vty 0 15
MyRouter(config)# transport input telnet





  

How to Enable Telnet on Cisco Router

  9:53 PM    Santosh


Here I am going to show you how to enable telnet on Cisco Router,


1. Check how many Virtual terminal your router supports. It depends on your router model
Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#line vty 0 ?
  <1-4>  Last Line number


2. Now to config mode & enable access to Virtual terminal & set password to "password"
Router#config t
Router(config)#line vty 0 4
Router(config-line)#password cisco
Router(config-line)#login


3. Now you can verify the telney by using below command & you can access the router via telnet.
Router#show line
   Tty Typ     Tx/Rx    A Modem  Roty AccO AccI   Uses   Noise  Overruns   Int
*     0 CTY              -    -      -    -    -      0       0     0/0       -
     97 AUX   9600/9600  -    -      -    -    -      0       0     0/0       -
     98 VTY              -    -      -    -    -      1       0     0/0       -
     99 VTY              -    -      -    -    -      0       0     0/0       -
    100 VTY              -    -      -    -    -      0       0     0/0       -
    101 VTY              -    -      -    -    -      0       0     0/0       -
    102 VTY              -    -      -    -    -      0       0     0/0       -

  

Free Public DNS Servers

  11:43 PM    Santosh


Free Public DNS Servers


Below is the list of Public DNS servers. These dns servers are free to all.


Google public dns servers,
8.8.8.8
8.8.4.4




GTEI DNS Verizon DNS Servers,
4.2.2.1
4.2.2.2
4.2.2.3
4.2.2.4
4.2.2.5
4.2.2.6


OpenDNS free dns servers
208.67.222.222
208.67.220.220


Dnsadvantage DNS Servers,
156.154.70.1
156.154.71.1


ScrubIt Public dns server address:
67.138.54.100
207.225.209.66


Norton free dns servers,
198.153.192.1
198.153.194.1



  

Free Public DNS Servers

  11:13 PM    Santosh


Free Public DNS Servers


Below is the list of Public DNS servers. These dns servers are free to all.


Google public dns servers,
8.8.8.8
8.8.4.4




GTEI DNS Verizon DNS Servers,
4.2.2.1
4.2.2.2
4.2.2.3
4.2.2.4
4.2.2.5
4.2.2.6


OpenDNS free dns servers
208.67.222.222
208.67.220.220


Dnsadvantage DNS Servers,
156.154.70.1
156.154.71.1


ScrubIt Public dns server address:
67.138.54.100
207.225.209.66


Norton free dns servers,
198.153.192.1
198.153.194.1



  

Cisco Disable DNS lookup or Configure DNS

  12:40 PM    Santosh


Cisco Disable DNS lookup or Configure DNS


On Cisco Router or Switch if you type a wrong command in the privileged mode, the switch/router thinks that user trying to connect to a remote host via telnet. So router/switch performs a DNS lookup.


If DNS is not configured on the Router/Switch the console prompt will hang until the DNS timeouts.


Router#abcd
Translating "abcd"...domain server (255.255.255.255)
 (255.255.255.255)
Translating "abcd"...domain server (255.255.255.255)

% Unknown command or computer name, or unable to find computer
address
Router#


To resolve this option option or to disable DNS doamin lookup use below command.


Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#no ip domain-lookup
Router(config)#WR




The second option is to configure DNS and point it to your DNS server. as shown below,


Router(config)# ip name-server 192.168.100.1

  

Cisco Disable DNS lookup or Configure DNS

  12:10 PM    Santosh


Cisco Disable DNS lookup or Configure DNS


On Cisco Router or Switch if you type a wrong command in the privileged mode, the switch/router thinks that user trying to connect to a remote host via telnet. So router/switch performs a DNS lookup.


If DNS is not configured on the Router/Switch the console prompt will hang until the DNS timeouts.


Router#abcd
Translating "abcd"...domain server (255.255.255.255)
 (255.255.255.255)
Translating "abcd"...domain server (255.255.255.255)

% Unknown command or computer name, or unable to find computer
address
Router#


To resolve this option option or to disable DNS doamin lookup use below command.


Router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#no ip domain-lookup
Router(config)#WR




The second option is to configure DNS and point it to your DNS server. as shown below,


Router(config)# ip name-server 192.168.100.1

  

Configuring VLAN's on Cisco Switch

  3:23 PM    Santosh



Configuring VLAN's on Cisco Switch




VLAN is a virtual LAN. In technical terms, a VLAN is a broadcast domain created by switches. When managing a switch, the management domain is always VLAN 1, the default VLAN. All ports of switch are assigned to VLAN 1 by default. VLAN increase the performance of a network because it divide a network logically in different parts and limit the broadcasts. Normally,router creating that broadcast domain. With VLAN’s, a switch can create the broadcast domain.




member of each vlan can not talk to each other for example any user of VLAN 5 can not talk with any users of VLAN 6 without router or layer 3 switch. But all users of VLAN5 & VLAN6 can talk to each others.


What is a trunk port?


When there is a link between two switches or a router and a switch that carries the traffic of more than one VLAN, that port is a trunk port.


A trunk port must run a special trunking protocol. The protocol used would be Cisco’s proprietary Inter-switch link (ISL) or the IEEE standard 802.1q.


Below example will show you how to create VLAN,s on a Cisco Switch...


1. create VLAN 5
(enter in global configuration mode)
SwitchA(config)#configure terminal
(defining the vlan 5)            
SwitchA(config)#vlan 5
(Assigning the name Marketing to vlan 5)                                  
SwitchA(config)#vlan 5 name marketing  
SwitchA(config)#exit    


2. Configuration to create VLAN 6
SwitchA(config)#configure terminal              
SwitchA(config)#vlan 6
(assigning the name management to vlan 6)                                  
SwitchA(config)#vlan 6 name management    
SwitchA(config)#exit


3. Now assigning the ports 2 and 3 to VLAN 5, it must be done from the interface mode. Enter the following commands to add port 2 and 3 to VLAN 5
(enter in global configuration mode)
SwitchA(config)#configure terminal
(select the Ethernet 0 of port 2)                            
SwitchA(config)#interface fastethernet 0/2
(allot the membership of vlan 5)                
SwitchA(config-if)#switchport access vlan 5                
SwitchA(config-if)#exit                                                      


4. Now assigning the ports 3 to VLAN 5
(enter in global configuration mode)
SwitchA(config)#configure terminal
(select the Ethernet 0 of port 3)                            
SwitchA(config)#interface fastethernet 0/3
(allot the membership of vlan 5)                
SwitchA(config-if)#switchport access vlan 5              
SwitchA(config-if)#exit  




Now assigning the ports 5 to VLAN 6,


(enter in global configuration mode)
SwitchA(config)#configure terminal
(select the Ethernet 0 of port 5)                            
SwitchA(config)#interface fastethernet 0/5
(allot the membership of vlan 6)                
SwitchA(config-if)#switchport access vlan 6                
SwitchA(config-if)#exit

  

Configuring VLAN's on Cisco Switch

  2:53 PM    Santosh



Configuring VLAN's on Cisco Switch




VLAN is a virtual LAN. In technical terms, a VLAN is a broadcast domain created by switches. When managing a switch, the management domain is always VLAN 1, the default VLAN. All ports of switch are assigned to VLAN 1 by default. VLAN increase the performance of a network because it divide a network logically in different parts and limit the broadcasts. Normally,router creating that broadcast domain. With VLAN’s, a switch can create the broadcast domain.




member of each vlan can not talk to each other for example any user of VLAN 5 can not talk with any users of VLAN 6 without router or layer 3 switch. But all users of VLAN5 & VLAN6 can talk to each others.


What is a trunk port?


When there is a link between two switches or a router and a switch that carries the traffic of more than one VLAN, that port is a trunk port.


A trunk port must run a special trunking protocol. The protocol used would be Cisco’s proprietary Inter-switch link (ISL) or the IEEE standard 802.1q.


Below example will show you how to create VLAN,s on a Cisco Switch...


1. create VLAN 5
(enter in global configuration mode)
SwitchA(config)#configure terminal
(defining the vlan 5)            
SwitchA(config)#vlan 5
(Assigning the name Marketing to vlan 5)                                  
SwitchA(config)#vlan 5 name marketing  
SwitchA(config)#exit    


2. Configuration to create VLAN 6
SwitchA(config)#configure terminal              
SwitchA(config)#vlan 6
(assigning the name management to vlan 6)                                  
SwitchA(config)#vlan 6 name management    
SwitchA(config)#exit


3. Now assigning the ports 2 and 3 to VLAN 5, it must be done from the interface mode. Enter the following commands to add port 2 and 3 to VLAN 5
(enter in global configuration mode)
SwitchA(config)#configure terminal
(select the Ethernet 0 of port 2)                            
SwitchA(config)#interface fastethernet 0/2
(allot the membership of vlan 5)                
SwitchA(config-if)#switchport access vlan 5                
SwitchA(config-if)#exit                                                      


4. Now assigning the ports 3 to VLAN 5
(enter in global configuration mode)
SwitchA(config)#configure terminal
(select the Ethernet 0 of port 3)                            
SwitchA(config)#interface fastethernet 0/3
(allot the membership of vlan 5)                
SwitchA(config-if)#switchport access vlan 5              
SwitchA(config-if)#exit  




Now assigning the ports 5 to VLAN 6,


(enter in global configuration mode)
SwitchA(config)#configure terminal
(select the Ethernet 0 of port 5)                            
SwitchA(config)#interface fastethernet 0/5
(allot the membership of vlan 6)                
SwitchA(config-if)#switchport access vlan 6                
SwitchA(config-if)#exit

  

Subscribe to: Posts (Atom)