Passed my CCNA yesterday with a score of 894. Next stop should be training for the CCNP and maybe some JNCIS stuff possibly.
Asymmetric routing with Cisco ASA firewalls
Last month I installed a new Cisco ASA 5510 for a client and came across an issue where traffic was hitting the “inside” interface of the firewall before travelling back out the same interface and into another router on the internal LAN – an issue as reported in this article Cisco ASA Deny TCP (no connection)
The diagram below demonstrates the network setup with PC1 trying to communicate with PC2. When the traffic leaves the MPLS router (RED line) it does not traverse the ASA and the next packet will follow the original route (GREEN then ORANGE lines) to get to PC2
Long term the resolution is to place the extra routers into their own DMZ networks on the perimeter network but as this didn’t exist at the time I needed to disable the TCP SYN checking for the traffic being routed to the MPLS routers – a process described in this article by Cisco – Configuring TCP State Bypass
First thing we do is create an ACL for all the items we want to bypass the SYN check
|
1 2 3 |
access-list firewall_bypass extended permit ip object Local_LAN object Remote_LAN_1 access-list firewall_bypass extended permit ip object Local_LAN object Remote_LAN_2 access-list firewall_bypass extended permit ip object Local_LAN object Remote_LAN_3 |
Now we create a class map to match the ACL
|
1 2 |
class-map class_firewall_bypass match access-list firewall_bypass |
Then apply this to a policy map
|
1 2 3 |
policy-map inside-policy class class_firewall_bypass set connection advanced-options tcp-state-bypass |
Finally we assign that policy to the inside interface on the firewall
|
1 |
service-policy inside-policy interface inside |
Traffic that hits the inside interface of the firewall that matches the rules on the ACL will not be checked for their tcp state and traffic should now flow.
In the long term it is recommended that this isnt the adopted approach and the firewall is configured to have the traffic traverse through from the inside to a DMZ interface to prevent the issues with the TCP SYN issue
RANCID: Issue backing up Cisco Aironet access points
I have had RANCID setup to backup switch and firewall config for a while now but not I had always had issues with backups of my Cisco access points which I had thought was an issue with the version of RANCID or the slight differences in IOS run on the WAPs versus the Switches. Turns out after revisiting it yesterday it was more a PEBKAC or ID-10-T error on my part!
What I had in my .cloginrc file was:
|
1 2 3 4 |
add user ip_address {username} add password ip_address {password} add method ip_address {ssh} add noenable ip_address 1 |
when I ran bin/clogin ip_address the device would login and get me to the enable prompt as expected but when run as part of rancid_run nothing was coming back for the config. After a bit of reading and searching the solution was simple enough and it wasnt a problem with RANCID or the Aironets….
|
1 |
add autoenable ip_address 1 |
should have been used instead of the noenable line.
I also managed to get RANCID to backup the config on my Juniper EX switches but that is a story for another post
Rancid email notification issues
Just spent a few days getting RANCID setup on one of my monitoring servers to backup my device configs on a daily basis. Whilst setting it up I followed a number of guides to get my config files setup and checked. The one thing I couldnt get to work however was the email when RACID detected a config change on one of the network devices.
Scouring the Internet I couldnt find what I had missed. Postfix was setup correctly and I could use the aliases I setup in /etc/alises if i “telnet localhost 25” and mail was delivered. In the end looking at the update logs I could see a line saying it couldnt find sendmail.
A quick look at racnid_control and I updated the lines that referenced sendmail to include a full path to /usr/sbin/sendmail and low and behold my inbox was full of config changes this morning.
I’m sure that if I was able to get the money to buy Opsview Enterprise I would make full use of the RANCID module within this but for the moment this works well enough for me.
My next goal is to get SNMP Trap processing setup so that if the appropriate trap is received from a monitored device it will pull the latest config down and we will always have the latest config.