Wednesday 16 December 2015

Cisco ASA named to number port mapping

 aol                              5120
  bgp                              179
  chargen                          19
  cifs                             3020
  citrix-ica                       1494
  cmd                              514
  ctiqbe                           2748
  daytime                           13
  discard                            9
  domain                            53
  echo                               7
  exec                              512
  finger                            79
  ftp                               21
  ftp-data                           20
  gopher                             70
  h323                              1720
  hostname                          101
  http                              80
  https                             443
  ident                             113
  imap4                             143
  irc                               194
  kerberos                          88
  klogin                            543
  kshell                            544
  ldap                              389
  ldaps                             636
  login                             513
  lotusnotes                        1352
  lpd                                515
  netbios-ssn                        139
  nfs                             2049
  nntp                            119
  pcanywhere-data                 5631
  pim-auto-rp                     496
  pop2                            109
  pop3                            110
  pptp                            1723
  rsh                             514
  rtsp                            554
  sip                             5060
  smtp                            25
  sqlnet                          1522
  ssh                             22
  sunrpc                          111
  tacacs                          49
  talk                            517
  telnet                          23
  uucp                            540
  whois                           43
  www                             80

Cisco ASA syslog messages

http://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs.html


Some useful ones
302013 - built inbound TCP connection
302014 - teardown TCP connection

725012 - Device chooses cipher cipher for the SSL session
725008 - ssl client propose cipher
725007 - teardown new ssl connection / terminated

725001 - starting ssl handshake
725002 - ssl handsake completed
725003 - ssl request to resume previous session

113005 - The AAA authentication on a connection has failed. The username is hidden when invalid or unknown, but appears when valid or the no logging hide username command has been configured

Tuesday 15 December 2015

Static NAT on checkpoint

https://sc1.checkpoint.com/documents/R76/CP_R76_Firewall_WebAdmin/6724.htm

Create your objects
Edit properties on inside object
Configure Static NAT with public IP
Install policy
Configure ACLs to allow the traffic
Install polucy

Monday 14 December 2015

How to save hosts cisco anyconnect client

https://supportforums.cisco.com/discussion/11489861/anyconnect-30-profile-drop-down-list

Save .xml files in  %ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\Profile

<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/">;
  <ServerList>
    <HostEntry>
      <HostName>VPN2</HostName>
      <HostAddress>VPN2 ADDRESS</HostAddress>
    </HostEntry>
  </ServerList>
</AnyConnectProfile>