ISIS

IS-IS

Link-state routing protocol
Uses Partical Route Calculation (PRC) for IP routes
Uses the DEFAULT metric on cisco routers (0-63)
Does not have a BACKBONE Area.Rather, a Backbone LEVEL
Requires a Single OSI ADDRESS

OSI Addressing
Hexadecimal
Composed of three parts
 -Area ID(Variable length)
 -Sytem ID(6 Bytes) --like a host address
 -NSEL(1 Byte) --like a service port
Read address from right to left because of Area ID(variable length)
49.003.1111.2222.3333.00
49.0152.3135.1AB2.FE00.63C9.00
49.005.1111.1111.1111.00
49 is a private address.

IS-IS routing maintains 2 IP Databases. 
  Level 1 Database: contains intra-area routes
  Level 2 Database: contains backbone routes
Routers may be L1, L2 or L1/L2.

Configuration
-trun on the routing process
-assign an OSI/NET address
-ip router isis -in each interface you want to run isis

OSPF

Administrative distance - 110

Technial overview of OSPF
1. OSPF send HELLO packet to multicast address 224.0.0.5 (all OSPF routers)
2. Neighbor evaluates packet. May or may not form neighbor
3. Link-state data exchange (DBD)
4. Net info. Recorded and Flooded.
5. When database complete, SPF Algorigthm runs.
6. Valid routes enter the routing table

OSPF Hello Packet
contains the followings
1. Router ID
2. Area ID (x)
3. Address of originate terface
4. Authentication information (x)
5. Hello Interval (x)
6. Dead Interval (x)
7. Priority
8. DR/BDR IDs
9. Neighbor Router IDs
 (x) = must match

OSPF Network Types
- Point to Point
There is no DR/BDR selection. Updates sent to 224.0.0.5.
- Broadcast
DR/BDR selection. They listen to 224.0.0.6
- NBMA network
Frame relay, ATM, Virtual circuti, Hub & spoke,
All neighbors are statically defined and unicast is used to communicate instead of multicast. DR selection-DR must have full connectivity to all neighbors.
- Point to multipoint
Very similar to NBMA but there is no DR election and messages will be multicasted.It treats its own virtual circuit as point to point(from HUB view)connection even though it's configured on multipoint interface.

http://www.youtube.com/watch?v=tSzJoxcep5o

----

Building OSPF neighbors and neighbor states

OSPF Areas, Router Types and LSAs

Reason to create normal area is for route summarization.
Unlike EIGRP, OSPF does not support route summarization anywhere in the network excpet at Area boundary routers(ABR) and Autonomous system boundary routers(ASBR).

STUB area blocks external route advertisements but still accept LSA type 3.
Totally stubby area blocks external route advertisements and ads from other areas.It only knows about routes in its area.

ABRs for Stub and Stubby areas inject default routes into these areas.
-----

LSA Type 1 - Router LSA. current networks that the router is connected to.
LSA Type 2 - DR advertising on behalf of a network. DR/BDR to other internal routers
LSA Type 3 - inter area routes injected by ABR. Routes from other areas
LSA Type 4 - Info about ASBR. Injected by ABR connected to other areas
LSA Type 5 - external LSA/routes injected by ASBR.
-------------
OSPF Link State database, Redistribution, Summarization

In stub area, default route is added automatically.

When redistributing Eigrp to ospf, must include 'subnets' command to redistribute classless subnets. If not, only classful networks are redistributed.
When redistributing to OSPF, E1 will add cost while E2 is a fixed cost in OSPF Areas.

To see OSPF link state database info -sh ip ospf database 

Summarization can be only done at/by ABR (hmm ASBR as well).
To summarize LSA Type 3 Area 1 route to inject to Area 0 at ABR - area 1 range 172.16.0.0 255.255.0.0
To summarize LSA Type 5 Area 1 route to inject to Area 0 at ASBR - summary-address 172.18.0.0 255.255.0.0

ASA inter interface and intra interface traffic

Higher security level interfaces can talk pass traffic to lower security interfaces by default but what if they are on the same security level? By default this is not permitted. Even if you define access-lists to permit the traffic, it is still denied.

Inter-interface traffic

Inter interface communication allows communications between different interfaces of the same security level.

ciscoasa(config)# same-security-traffic permit inter-interface

Intra-interface trafficIntra-interface permits flows of traffic that comes in on an interface and routed back out the same interface. This is denied by default. An example of this would be hair-pinning; Hub and Spoke VPN topologies utilize this methodology. 

ciscoasa(config)# same-security-traffic permit intra-interface

Redudant interface
active and standby interface. whichever interface comes first in config is activeinterface.

ACL, Routing, MPF, TCP advanced Options

ASA Access Control List

look at real IP address instead of global or mapped address
'Public Servers' option does NAT and access-list together
Normal mask in ACL; no wild card mask.

If there is global ACL, interace implicit deny is no longer effective. After interface ACL is checked and no match is found, traffic is checked against global ACL. If no match, then deny.
Choose 'Any' interface for Global ACL.

-------------

ASA Static route
The name of the interface we gonna use to reach that(advertised) network

-------------
clear config all -- clear running config
write erase -- clear startup config

Prioritization is always done outbound
Policing is inbound and outbound

Use TCP-map for TCP options
ASA performs ISN, Random sequence numbering
Use TCP-State Bypass option to ignore assymentric routing between source & destination
Use TCP Intercept for sync-flood attack. Set Half-formed session threshold limit, once it's above threshold, ASA intercept TCP Sync and respond on behalf of the server. If handshake is completed with the valid user, ASA send TCP 3 way handshake with the server.
ASA has a feature called TCP Sync cookies to handle DOS or Sync flood attack.

backtrack? for penetration testing

Layer 5-7 Advance application layer Inspection
policy-map type inspect ... match-all/match-any name

drop doesn't send a Reset packet. ASA does not allow any more packet for this session/connection.

NAT on Cisco ASA

TCP Ping on ASA can be used to test if the specified port is opened at destination IP
ping tcp x.x.x.x 22

For IOS 8.2 and older

Dynamic nat, pat, static nat, identity nat

nat (inside) 1 10.0.0.0 255.255.255.0 (creation of NAT group id 1 for 10./24 subnet coming in from inside)
global (outside) 1 192.168.1.51-192.168.1.100 (if group 1 traffic is going outside, map IP to )
global (outside) 1 192.168.1.101 (if group 1 traffic is going outside, map IP to 1.101; PAT )

static (dmz(real/incoming), outside(mapped/outgoing)) 192.168.1.175(mapped IP) 172.16.0.5(real IP)
static (dmz(real), inside(mapped)) 172.16.0.6(mapped IP) 172.16.0.6(original IP) – identity NAT

NAT 0 – do not translate if traffic matches the specified access list

Access-list NONAT permit ip (source net to dest net)
nat (inside) 0 access-list NONAT – 0 is reserved for NAT 0

-------------------------------------------------------------------------------------------------
http://www.tunnelsup.com/nat-for-cisco-asas-version-8-3/

NAT (IOS 8.3, 8.4 and newer)

The 3 sections of NAT

1.       Manual NAT

2.       Auto NAT

3.       Manual NAT (detailed)

If no NAT rule is hit for the traffic, traffic will be just forwarded as it is.

Auto/Object NAT (starts with object command)

Dynamic NAT
object network inside_10
   subnet 10.0.0.0 255.255.255.0
object network outside-pool
   range 192.168.1.51 192.168.1.100
object network inside_10
   nat dynamic outside-pool

Above config is for any 10.x address going through ASA (regardless of going to dmz, outside)

object network winxp-inside
 nat (inside,outside) static winxp-outside

object network inside_10

   nat (inside,any) dynamic outside-pool

Above config is for any 10.x address coming in from inside interface going through ASA (regardless of going to dmz, outside)
----------------------

Static NAT
nat (inside,outside) 1 source static <inside local> <inside global> destination static <outside local> <outside global>

Static NAT adds a rule for each direction (so total 2 NAT rules)
For static NAT, its xlate entry is always there in xlate table. So, can be used for server to be accessed by outside.

For dynamic NAT, tt only adds one rule.
---------------------

NOTES

http://www.tunnelsup.com/nat-for-cisco-asas-version-8-3/

The limitation that Auto NAT has is that it cannot take the destination into consideration when conducting it’s NAT. This also of course results in it not being able to alter the destination address either. To accomplish either of these tasks you must use “manual NAT”.

All of these terms are identical: Manual NAT, Twice NAT, Policy NAT, Reverse NAT. Don’t be confused by fancy mumbo jumbo.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/asdm63/configuration_guide/config/nat_overview.html#wpxref64594

Main Differences Between Network Object NAT and Twice NAT

The main differences between these two NAT types are:

•How you define the real address.

–Network object NAT—You define NAT as a parameter for a network object; the network object definition itself provides the real address. This method lets you easily add NAT to network objects. The objects can also be used in other parts of your configuration, for example, for access rules or even in twice NAT rules.

–Twice NAT—You identify a network object or network object group for both the real and mapped addresses. In this case, NAT is not a parameter of the network object; the network object or group is a parameter of the NAT configuration. The ability to use a network object group for the real address means that twice NAT is more scalable.

•How source and destination NAT is implemented.

–Network object NAT— Each rule can apply to either the source or destination of a packet. So two rules might be used, one for the source IP address, and one for the destination IP address. These two rules cannot be tied together to enforce a specific translation for a source/destination combination.

–Twice NAT—A single rule translates both the source and destination. A matching packet only matches the one rule, and further rules are not checked. Even if you do not configure the optional destination address for twice NAT, a matching packet still only matches one twice NAT rule. The source and destination are tied together, so you can enforce different translations depending on the source/destination combination. For example, sourceA/destinationA can have a different translation than sourceA/destinationB.

•Order of NAT Rules.

–Network object NAT—Automatically ordered in the NAT table.

–Twice NAT—Manually ordered in the NAT table (before or after network object NAT rules).

See the "NAT Rule Order" section for more information.

We recommend using network object NAT unless you need the extra features that twice NAT provides. Network object NAT is easier to configure, and might be more reliable for applications such as Voice over IP (VoIP). (For VoIP, because twice NAT is applicable only between two objects, you might see a failure in the translation of indirect addresses that do not belong to either of the objects.)

Interpreting TcpDump

1. 14:05:27.083238 ftp.client.org.1057 > ftp.server.edu.21: S 1484414:1484414(0) win 8192 <mss 536,nop,nop,sackOK> (DF)

sequence number of first byte in packet:sequence number of first byte in NEXT packet (data)
(0) = no. of byte

win = TCP available window size advertised by sender

mss = maximum segment size advertised by sender
<mss 536, - an admission by the client that its local network segment can accommodate a packet, without fragmentation, no larger than 536 bytes. 536 bytes is only the size of the data payload; the TCP and IP headers must still be added to the packet, and are assumed to occupy 40 bytes total.

sackOK" denotes acceptance by the client/sender of the "selective acknowledgement" option

The purpose of an ACK is to help track bytes exchanged


http://www.taosecurity.com/intv2-8.html

Richard Stevens - TCP/IP Illustrated, Volume 1: The Protocols

How Markets work - Supply and Demand-1

                               Supply and Demand

Microeconomic -
building blocks that create big economy

Opportunity cost

   Implicit versus explicit(accounting) costs
   economic cost versus accounting cost

Sunk cost/benefits - Anything that is common to whatever choices you have can be filtered out of the analysis.

The Determinants of Demand

Law of Demand - When you lower the price of any good or activity, consumers will demand more of that good or activity.

No just price alone. It's important to understand how Price versus non-price factors affect quantity demanded.Price induces just a movement along a given demand curve.Any other factor changes, it'll shift the entire price quantity relationship. For any constant price, quantity demanded will differ if income is changed or substitutes, prices of substitutes or compliments are changed or government taxes and subsidies have been instituted.

Substitutes(lexus, bmw), complement (car,oil) affect the price of the item. some items are substitutes or complement.

The Determinants of Supply

The law of supply - The higher the price the greater the quantity supplied
Technology, input prices, government taxes/susidies

Market Equilibrium 

The point where the demand curve and supply curve intersect.

Lecture slides(PDF)

Definition: The nominal value of a good is its value in terms of money. The real value is its value in terms of some other good, service, or bundle of goods.

Examples:

• Nominal: That CD costs $18. Japan's science and technology spending is about 3 trillion yen per year.
• Real: A year of college costs about the value of a Toyota Camry. Those tickets to see Van Halen cost me three weeks' worth of food!

Relative price is another term for the real price of a good or service. When we say that the relative price of computers has fallen in recent years, we mean that the price of computers relative to or measured in terms of other goods and services—such as TVs or cars—has declined. Relative prices of individual goods and services can decrease even if nominal prices are all increasing, because of inflation.