investigating public IP addresses with ripe.net

If you come across a public IP address but your not sure what it is you can use tools such as ripe.net to investigate. In this example, I'm going to attempt to look up yahoo.com (98.138.253.109).

Go to http://www.ripe.net/
In the RIPE database section enter the IP address you want to investigate and click search.
If the details are held by RIPE they will be displayed
Sometimes the IP details are held by another provider
In that case the provider will be listed
In my case it was http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xml
I went to iana.org. My IP starts with 98 the page tells me this is held by http://whois.arin.net
I went to http://whois.arin.net/ui entered the IP address into the search bar and click search
This brought up the details of who owns that IP address which of course was Yahoo inc.

There are plenty of other web applications that help you get this information I've found that  http://network-tools.com to be useful.

Error 113 (net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH): Unknown error in google chrome when connecting to Cisco ASDM

Looks like the default ssl encryption is set to des-sha1. 

Run the following to see what yours is set to:

#sh run | i ssl encryption. 

I was connecting my laptops ethernet port to the management port on the ASA.

My IP address settings were set to obtain. The ASA gave me an IP address. I connected to the ASA with the console cable to run the commands.

des has been broken for ages now. Looks like chrome won't connect unless you use a good encryption. I did the following to resolve:

#conf t

#ssl encryption aes128-sha1  (you can use higer if you want)

#wr mem

Now open chrome and go to https://192.168.1.1/admin

object-groups on cisco ASA

object-groups can be used with your ACLs to keep them clean and easy to manage.

object-group

• network (host IPs or subnets)
• service (tcp / udp ports)
• icmp
• protocol

object-group network Internet_Access_Hosts
network-object host 10.10.10.1
network-object host 10.10.10.2
network-object host 10.10.10.3
network-object host 10.10.10.4

object-group service Standard_Internet_Ports
port-object eq 80 (user service-object 80 in later code)
port-object eq 443
port-object eq 53
port-object eq 25
port-object eq 110

access-list INSIDE_ACL permit tcp object-group Internet_Access_Hosts any object-group
Standard_Internet_Ports

access-list INSIDE_ACL permit udp object-group Internet_Access_Hosts any object-group Standard_Internet_Ports

sh access-list INSIDE_ACL

============================================================
an example from 8.2 code

object-group service DMZ_PORTS_ALLOWED_OUT
 service-object tcp eq 80
 service-object tcp eq 443
 service-object tcp eq 22
 service-object tcp eq 53

object-group network DMZ_HOSTS_ALLOWED_OUT
network-object network 10.10.10.1 255.255.255.255
network-object network 10.10.10.2 255.255.255.255

access-list DMZ_OUT permit object-group DMZ_PORTS_ALLOWED_OUT object-group DMZ_HOSTS_ALLOWED_OUT any

============================================================
an example from later code version (8.6)

object-group service DMZ_PORTS_ALLOWED_OUT tcp-udp
 port-object eq www
 port-object eq 443
 port-object eq 22
 port-object eq domain

object-group network DMZ_HOSTS_ALLOWED_OUT
 network-object host 10.10.10.1
 network-object host 10.10.10.2

access-list DMZ_OUT extended permit tcp object-group DMZ_HOSTS_ALLOWED_OUT any object-group DMZ_PORTS_ALLOWED_OUT

access-list DMZ_OUT extended permit udp object-group DMZ_HOSTS_ALLOWED_OUT any object-group DMZ_PORTS_ALLOWED_OUT

How to check if a juniper ssg is in a cluster

This SSG is in a cluster

MYSSG-> get nsrp
nsrp version: 2.0
cluster info:
cluster id: 1, name: SSG_CLUSTER
local unit id: xxxxxxxx
active units discovered:
index: 0, unit id:   xxxxxxx, ctrl mac: xxxxxxxxxxxx , data mac: xxxxxxxxxxxx
index: 1, unit id:    xxxxxxx, ctrl mac: yyyyyyyyyyy , data mac: yyyyyyyyy
total number of units: 2

This SSG is not

OtherSSG-> get nsrp
nsrp version: 2.0
cluster info:
 cluster id not set: nsrp is inactive

Using Bash(shell) history effectively

Using Bash(shell) history effectively

The majority of these tricks utilize the ‘history’ command in some way, so let’s cover that one first. Just type:

history

To execute a specific command from your history, you can just type an exclamation point followed by the number of the command as listed by history. Here, I’ll re-execute command number 510.

!510

By the way, an exclamation point is referred to as a “bang.”

You can also refer to a command by how long ago it was run. Next, let’s execute whatever we typed three commands ago.

!-3

Quick Substitutions

Let’s say you want to rerun your previous command. Just type two exclamation points. This is perfect for when you run a command that needs super-user privileges and you forgot to do that. Just give it the old “sudo bang bang” treatment:

sudo !!

Let’s say you want to run a command with the last argument you used. Typing it out is too tedious. Just use a “bang dollar” to substitute your last argument automatically.

cd !$

What if you ran a command with two arguments and you want to run the first one? “Bang caret” This works well when you make a backup of a config file and then want to edit it.

nano !^

Next, let’s search for a specific command from your history. Ctrl+R will search backwards for whatever you type. It will autocomplete as you type, and you can scroll back up through the history if you hit Ctrl+R again to find the specific instance you’re looking for.



If you know the last command you ran with a specific keyword, you can skip the search process and pare down your key presses by at least one.

!keyword

Now, for the power substitution: you can substitute an argument for your last specific command using something similar to the previous method. Just add a colon and the number of the argument.

ls !ln:2

Here, I substituted the second argument from my last ‘ln’ command.



As you can see, I used a Ctrl+R lookup to help illustrate where that argument came from.

Once you’ve found the command you have several options:

1. Run it verbatim – just press Enter
2. Edit it before running – you can use arrow keys or different key bindings to navigate to the point you want to edit
3. Cycle through other commands that match the letters you’ve typed – press Ctrl-R successively
4. Quit the search and back to the command line empty-handed – press Ctrl-G

Collecting logs from a juniper ssg firewall

Turn on logging in putty

set console page 0

get tech

set console page 22

If trouble shooting a VPN

set console page 0

get tech
get ike cookie
get sa
get route
get event include x.x.x.x (peer address)
get event type 536

set console page 22

Cisco NAT changes from version 8.3+

There is a short explanation of post-8.3 NAT implementation here:
https://supportforums.cisco.com/docs/DOC-12690#ACL_Changes

There is a very detailed document where you can find examples of every kind of nat in old and new syntax here:
http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html

There is a video here also:
https://supportforums.cisco.com/docs/DOC-12324

If you are migrating from pre 8.3 to post 8.3 you may need to convert your VPN, ACL and NAT configurations :(