ASA inter interface and intra interface traffic

Higher security level interfaces can talk pass traffic to lower security interfaces by default but what if they are on the same security level? By default this is not permitted. Even if you define access-lists to permit the traffic, it is still denied.

Inter-interface traffic

Inter interface communication allows communications between different interfaces of the same security level.

ciscoasa(config)# same-security-traffic permit inter-interface

Intra-interface trafficIntra-interface permits flows of traffic that comes in on an interface and routed back out the same interface. This is denied by default. An example of this would be hair-pinning; Hub and Spoke VPN topologies utilize this methodology. 

ciscoasa(config)# same-security-traffic permit intra-interface

Redudant interface
active and standby interface. whichever interface comes first in config is activeinterface.

ACL, Routing, MPF, TCP advanced Options

ASA Access Control List

look at real IP address instead of global or mapped address
'Public Servers' option does NAT and access-list together
Normal mask in ACL; no wild card mask.

If there is global ACL, interace implicit deny is no longer effective. After interface ACL is checked and no match is found, traffic is checked against global ACL. If no match, then deny.
Choose 'Any' interface for Global ACL.

-------------

ASA Static route
The name of the interface we gonna use to reach that(advertised) network

-------------
clear config all -- clear running config
write erase -- clear startup config

Prioritization is always done outbound
Policing is inbound and outbound

Use TCP-map for TCP options
ASA performs ISN, Random sequence numbering
Use TCP-State Bypass option to ignore assymentric routing between source & destination
Use TCP Intercept for sync-flood attack. Set Half-formed session threshold limit, once it's above threshold, ASA intercept TCP Sync and respond on behalf of the server. If handshake is completed with the valid user, ASA send TCP 3 way handshake with the server.
ASA has a feature called TCP Sync cookies to handle DOS or Sync flood attack.

backtrack? for penetration testing

Layer 5-7 Advance application layer Inspection
policy-map type inspect ... match-all/match-any name

drop doesn't send a Reset packet. ASA does not allow any more packet for this session/connection.

NAT on Cisco ASA

TCP Ping on ASA can be used to test if the specified port is opened at destination IP
ping tcp x.x.x.x 22

For IOS 8.2 and older

Dynamic nat, pat, static nat, identity nat

nat (inside) 1 10.0.0.0 255.255.255.0 (creation of NAT group id 1 for 10./24 subnet coming in from inside)
global (outside) 1 192.168.1.51-192.168.1.100 (if group 1 traffic is going outside, map IP to )
global (outside) 1 192.168.1.101 (if group 1 traffic is going outside, map IP to 1.101; PAT )

static (dmz(real/incoming), outside(mapped/outgoing)) 192.168.1.175(mapped IP) 172.16.0.5(real IP)
static (dmz(real), inside(mapped)) 172.16.0.6(mapped IP) 172.16.0.6(original IP) – identity NAT

NAT 0 – do not translate if traffic matches the specified access list

Access-list NONAT permit ip (source net to dest net)
nat (inside) 0 access-list NONAT – 0 is reserved for NAT 0

-------------------------------------------------------------------------------------------------
http://www.tunnelsup.com/nat-for-cisco-asas-version-8-3/

NAT (IOS 8.3, 8.4 and newer)

The 3 sections of NAT

1.       Manual NAT

2.       Auto NAT

3.       Manual NAT (detailed)

If no NAT rule is hit for the traffic, traffic will be just forwarded as it is.

Auto/Object NAT (starts with object command)

Dynamic NAT
object network inside_10
   subnet 10.0.0.0 255.255.255.0
object network outside-pool
   range 192.168.1.51 192.168.1.100
object network inside_10
   nat dynamic outside-pool

Above config is for any 10.x address going through ASA (regardless of going to dmz, outside)

object network winxp-inside
 nat (inside,outside) static winxp-outside

object network inside_10

   nat (inside,any) dynamic outside-pool

Above config is for any 10.x address coming in from inside interface going through ASA (regardless of going to dmz, outside)
----------------------

Static NAT
nat (inside,outside) 1 source static <inside local> <inside global> destination static <outside local> <outside global>

Static NAT adds a rule for each direction (so total 2 NAT rules)
For static NAT, its xlate entry is always there in xlate table. So, can be used for server to be accessed by outside.

For dynamic NAT, tt only adds one rule.
---------------------

NOTES

http://www.tunnelsup.com/nat-for-cisco-asas-version-8-3/

The limitation that Auto NAT has is that it cannot take the destination into consideration when conducting it’s NAT. This also of course results in it not being able to alter the destination address either. To accomplish either of these tasks you must use “manual NAT”.

All of these terms are identical: Manual NAT, Twice NAT, Policy NAT, Reverse NAT. Don’t be confused by fancy mumbo jumbo.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/asdm63/configuration_guide/config/nat_overview.html#wpxref64594

Main Differences Between Network Object NAT and Twice NAT

The main differences between these two NAT types are:

•How you define the real address.

–Network object NAT—You define NAT as a parameter for a network object; the network object definition itself provides the real address. This method lets you easily add NAT to network objects. The objects can also be used in other parts of your configuration, for example, for access rules or even in twice NAT rules.

–Twice NAT—You identify a network object or network object group for both the real and mapped addresses. In this case, NAT is not a parameter of the network object; the network object or group is a parameter of the NAT configuration. The ability to use a network object group for the real address means that twice NAT is more scalable.

•How source and destination NAT is implemented.

–Network object NAT— Each rule can apply to either the source or destination of a packet. So two rules might be used, one for the source IP address, and one for the destination IP address. These two rules cannot be tied together to enforce a specific translation for a source/destination combination.

–Twice NAT—A single rule translates both the source and destination. A matching packet only matches the one rule, and further rules are not checked. Even if you do not configure the optional destination address for twice NAT, a matching packet still only matches one twice NAT rule. The source and destination are tied together, so you can enforce different translations depending on the source/destination combination. For example, sourceA/destinationA can have a different translation than sourceA/destinationB.

•Order of NAT Rules.

–Network object NAT—Automatically ordered in the NAT table.

–Twice NAT—Manually ordered in the NAT table (before or after network object NAT rules).

See the "NAT Rule Order" section for more information.

We recommend using network object NAT unless you need the extra features that twice NAT provides. Network object NAT is easier to configure, and might be more reliable for applications such as Voice over IP (VoIP). (For VoIP, because twice NAT is applicable only between two objects, you might see a failure in the translation of indirect addresses that do not belong to either of the objects.)

Interpreting TcpDump

1. 14:05:27.083238 ftp.client.org.1057 > ftp.server.edu.21: S 1484414:1484414(0) win 8192 <mss 536,nop,nop,sackOK> (DF)

sequence number of first byte in packet:sequence number of first byte in NEXT packet (data)
(0) = no. of byte

win = TCP available window size advertised by sender

mss = maximum segment size advertised by sender
<mss 536, - an admission by the client that its local network segment can accommodate a packet, without fragmentation, no larger than 536 bytes. 536 bytes is only the size of the data payload; the TCP and IP headers must still be added to the packet, and are assumed to occupy 40 bytes total.

sackOK" denotes acceptance by the client/sender of the "selective acknowledgement" option

The purpose of an ACK is to help track bytes exchanged


http://www.taosecurity.com/intv2-8.html

Richard Stevens - TCP/IP Illustrated, Volume 1: The Protocols

How Markets work - Supply and Demand-1

                               Supply and Demand

Microeconomic -
building blocks that create big economy

Opportunity cost

   Implicit versus explicit(accounting) costs
   economic cost versus accounting cost

Sunk cost/benefits - Anything that is common to whatever choices you have can be filtered out of the analysis.

The Determinants of Demand

Law of Demand - When you lower the price of any good or activity, consumers will demand more of that good or activity.

No just price alone. It's important to understand how Price versus non-price factors affect quantity demanded.Price induces just a movement along a given demand curve.Any other factor changes, it'll shift the entire price quantity relationship. For any constant price, quantity demanded will differ if income is changed or substitutes, prices of substitutes or compliments are changed or government taxes and subsidies have been instituted.

Substitutes(lexus, bmw), complement (car,oil) affect the price of the item. some items are substitutes or complement.

The Determinants of Supply

The law of supply - The higher the price the greater the quantity supplied
Technology, input prices, government taxes/susidies

Market Equilibrium 

The point where the demand curve and supply curve intersect.

Lecture slides(PDF)

Definition: The nominal value of a good is its value in terms of money. The real value is its value in terms of some other good, service, or bundle of goods.

Examples:

• Nominal: That CD costs $18. Japan's science and technology spending is about 3 trillion yen per year.
• Real: A year of college costs about the value of a Toyota Camry. Those tickets to see Van Halen cost me three weeks' worth of food!

Relative price is another term for the real price of a good or service. When we say that the relative price of computers has fallen in recent years, we mean that the price of computers relative to or measured in terms of other goods and services—such as TVs or cars—has declined. Relative prices of individual goods and services can decrease even if nominal prices are all increasing, because of inflation.

Wireless installation site survey

Wireless RF signal

The initial placement of an access point is based on an estimate of the signal loss that will occur between the access point and the users of the access point.

The starting point for an estimate depends on how much loss in power a signal would experience in the vacuum of space, without any obstructions or other interference. This is called the free space path loss and is specified in decibels (dB)

The estimate is tuned with an understanding that the actual expected signal loss depends on the medium through which the signal will travel, which is undoubtedly not a vacuum. An RF singal can be affected by

• Reflection(steel, metal door)
• Absorption(water,tree,thick wood)
• Refraction(signal is bent when going through a medium with one density to a medium with another density.eg.water tank)
• Diffraction(signal which is bent while going through a region where reflective obstruction exits can interfere with that part of RF signal that is not bent

Wireless installation site survey

A site survey can be as simple as walking around with a wireless notebook computer and using the utility to measure signal strength.Signal strength can also be determined with a protocol analyzer. The WildPackets AiroPeek analyzer, for example, presents the signal strength for each frame received.

An access point typically sends a beacon frame every 100 milliseconds(ms).When evaluating the various metrics that are provided by wireless utilities, be sure to measure frame corruption and not just signal strength. With a protocol analyzer, capture frames and check for cyclic redundancy check (CRC) errors.

Wireless utility such as the Cisco ACU, WildPackets, OmniPeek, or NetStumbler to check signal strength 

Juniper Junos Interfaces

> show interfaces terse   --similar to sh ip int bri
> show interfaces g0/0/0 --similar to sh int g0/0/0



Backup router

Static route is only available when the system’s routing protocol process (rpd) is running. When Junos devices boot, the routing protocol process is not running; therefore, the system has no static or default routes. To allow the device to boot and to ensure that it is reachable over the network if the routing protocol process fails to start properly, you configure a backup router, which is a router or gateway device that is directly connected to the local system

[edit system]
root# show backup-router    

10.0.1.129 destination 10.0.15.0/24;


Hosts on the 10.0.15.0/24 subnet are reachable through the backup router. If the destination statement is omitted, then all hosts are reachable through the backup router.