Cisco Router IPSec VPN with Dynamic IP address

Last month, I worked on an IPSec VPN site-to-site connection project between the Sophos XG firewall and Cisco routers that connect more than 50 branches. Where both ends have a dynamic public IP address. I am not willing to share the configuration of the Sophos XG router or firewall, but I am willing to share a dynamic IP address solution for the IP address.

Technical Details:  Sophos XG is installed in the client's central office with a dynamic public IP address (which will resolve to FQDN) and also the Cisco router installed with a dynamic public IP address in branches. We plan to redirect all traffic in the central office for the intranet and internet for the implementation of security policies.

Issue: Both Headoffice and remote sites have a dynamic public IP address, so routers could not connect VPN after changing the IP address in Sophos XG (Headoffice). We use a DynDNS in the central office only due to budget constraints and simplify the administrative process.

Root cause: Cisco has a predefined method to resolve DDNS only once during configuration. If you set up IPSec VPN with an FQDN as the "set target peer" command but the show run command shows the IP address instead of the name. This is because the resolution occurs only once:


How we solved the problem: there is a simple method to solve this problem since your router must resolve the FQDN from time to time, so we plan to use the EEM scripts. Here, the client also added some additional requirements, as it must obtain the IP address of the interface when connecting or disconnecting the VPN services of each Cisco router.

Then, we had chosen an additional and fast method to detect inactive VPN and erase peer SAs and update the FQDN at a specific interval. We use the EEM and IP SLA script for the same as:

ip sla 2

icmp-echo 10.100.1.90 source-ip 10.100.119.90    

threshold 300

timeout 600

frequency 2

ip sla schedule 2 life forever start-time now

!

track 2 ip sla 2 reachability

!

Here, 10.100.1.90 is the IP address of the central office and 10.100.119.90 is the IP address of the LAN interface of the branch office router.

 

event manager environment _email_to notify@xyz.net

event manager environment _email_from notify@xyz.net

event manager environment _email_server mail.xyz.net

!

event manager applet IPSec_Down

event syslog pattern "%TRACK-6-STATE: 2 ip sla 2 reachability Up -> Down"

action 1.0 cli command "enable"

action 1.5 cli command "clear crypto isakmp"

action 1.6 cli command "clear crypto sa"

action 2.0 cli command "config t"

action 2.5 cli command "crypto map IPSEC-SITE-TO-SITE-VPN 10 ipsec-isakmp "

action 2.9 cli command "set peer sophos.xyz.co"

action 3.0 cli command "end"

action 4.5 syslog priority notifications msg "VPN failed at Brach1"

!

Here, you can see that we are detecting the status of the track and once it detects that it is inactive, the router will execute some commands to clear the existing Phase 1 and 2 tunnels and add a new DYDNS name under the crypto map. It will help us deactivate the VPN immediately after the IP SLA fails without the wait for a timeout.

 

event manager applet NEW_DNS_Update

event timer watchdog time 120

action 1.0 cli command "enable"

action 1.5 cli command "config t"

action 2.0 cli command "crypto map IPSEC-SITE-TO-SITE-VPN 10 ipsec-isakmp "

action 2.5 cli command "set peer sophos.xyz.co"

action 3.0 cli command "end"

action 4.5 syslog priority notifications msg "DNS_Updated_IPSEC"

!

Here, we are updating the FQDN every 120 seconds so that the router has updated the DYDNS resolution.

 

event manager applet IP_Change_Down

event syslog pattern "%TRACK-6-STATE: 2 ip sla 2 reachability Up -> Down"

action 1.0 cli command "enable"

action 3.6 cli command "sho ip interface brief | exclude unassigned"

action 4.0 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "$_event_pub_time: VPN & IP address failed at Brach1" body "$_cli_result"

action 4.5 syslog priority notifications msg "VPN down & IP at Branch1 mail sent"

!

Somehow, if the VPN goes down, the client will receive the public IP address of the router. If necessary, you can access the router using the public IP address (do not worry, we have taken some additional steps for SSH security).

 

event manager applet IP_Change_up

event syslog pattern " %TRACK-6-STATE: 2 ip sla 2 reachability Down -> Up"

action 1.0 cli command "enable"

action 3.6 cli command "sho ip interface brief | exclude unassigned"

action 4.0 mail server "$_email_server" to "$_email_to" from "$_email_from" subject "$_event_pub_time: VPN up & IP address at Branch1" body "$_cli_result"

action 4.5 syslog priority notifications msg "VPN up & IP Branch1 mail sent"

!

Once the VPN will restore then the client will also receive the router's public IP address.

 

Sophos XG VPN issue with FortiGate and Sophos SG Devices

Last week, my customer has raised a case with us. He is using a site to site IPSec VPN between Sophos XG and Sophos SG devices. The tunnel was not getting up. After verifying logs on the XG device, we found the root cause as Local and Remote ID mismatch. But How? Because we can't change Local ID on the SG devices so there was no Remote ID was assigned on the XG firewall.

I remember that same issue I faced between FortiGate and Sophos XG devices.

Let's come on the issue, finding and resolution.

Case 1: IPSec VPN between SG and XG firewall.
Finding/Root Cause: As XG firewall was showing Remote ID mismatch error so I started investigating the issue was found as SG firewall was sending Its LOCAL ID as It's WAN IP address but As Sophos XG firewall was having remote gateway as DYDNS address so XG was looking remote ID as the same DYDNS address.

Sophos SG Configuration: 
Remote Gateway: DYDNS address of the XG firewall.
Local & Remote ID: not enabled.

Sophos XG Configuration:
Remote Gateway: DYDNS address of the SG Firewall
Local & Remote ID: not enabled.

Here Point to be noted we had not enabled the Remote ID/Local ID on the XG and SG firewall. But still, Sophos XG firewall was looking to match remote ID.

I found some tricky solution as If I will assign Remote ID 0.0.0.0 on the XG firewall then tunnel getting UP. I had discussed with the Sophos tech team about remote ID 0.0.0.0 and meaning of it. He told me that avoids assigning 0.0.0.0 as remote ID it means you are going to accept any remote ID for this tunnel means you really don't care about the Remote ID (remote device local ID).

I checked on the SG firewall, gone through the configuration guide and found that we can't change LOCAL IPSec VPN ID on the SG firewall and it was the default behavior of the box.

Issue Resolved: As Customer has configured XG firewall in respond mode, So there is no such requirement to configure remote Gateway so I changed to the any. We also disabled the remote ID on the XG firewall. Due to the respect of the customer security concern, I enabled Local ID on the XG firewall and Remote ID was also enabled on the SG firewall. Wow VPN getting UP.

Case 2: IPSec VPN between Fortigate and XG firewall
Finding/Root Cause: Here, The Fortigate was having a dynamic WAN IP address but Sophos was configured with Static public IP address. So the Customer configured a DYDNS on the Fortigate and was trying to establish IPSec VPN between both devices.

Fortigate Configuration: 
Remote Gateway: Public IP of the XG firewall.
Local & Remote ID: not enabled.

Sophos XG Configuration:
Remote Gateway: DYDNS address of the Fortigate Address
Local & Remote ID: not enabled.

Here Point to be noted we had not enabled the Remote ID/Local ID on the XG and FortiGate firewall. But still, Sophos XG firewall was looking to match remote ID with DYDNS address of the FortiGate firewall. But FortiGate was sending Local ID as WAN Interface IP address.

Issue Resolved: I had login in the Fortigate device and changed Local ID as it's DYDNS address in the VPN configuration portal.  Wow... The issue was resolved.

Here I have a concern about Sophos XG/Strongswan VPN architecture that If you had disabled the Remote ID then why it is still looking remote ID must be matched if you had configured Remote gateway as DYDNS address of the remote device?
Maybe it is part of the security but not sure. There are no such clear documents on the Sophos website for the same.

Let's move forward and resolve the issue while I will try to get an answer from the Sophos team.

Are you planning for CCNP before February 23, 2020?

As we all are aware of recent changes in the Cisco certifications. This is a big change in the Cisco Education/Learning module from the last few years. If you are looking CCNP certification before this changes then you are not an alone person in the queue, I am also in the same queue. Recently I cleared CCNP Switch 300-115 certificate in the first attempt. Now I am busy in next certificate as CCNP Route 300-101 and I found the best place (www.ucertify.com) where everything is a well-organized, study planner, simple and easy language, Quizzes and flashcards on each topic at end of each lesson. Really I like its Exercises option and it is best for the exam preparation and interviews.

As you are studying CCNP so you need topics with a technical deep dive for a future interview, planning, and troubleshooting of a network. This is a negative point for this course but this course is designed for CCNP route exam so it is ok. Overall I am very happy with the course. I hope you will also enjoy this course and it is here: https://www.ucertify.com/exams/ccnp-route-300-101.html

I feel that adding certifications in your resume will open more opportunity and good salary hike. Here, I do not ignore experience and knowledge of technology but certification is an addon. As www.ucertify.com is simplifying things for exam and interview preparation. Best of luck for your certification and career.

How Sophos XG firewall handling IPSec VPN Pre-shared Keys

I am wondering that How to Sophos XG firewall is handling Preshared key for IPSec VPN.  I configured more than 100 XG firewalls and VPN but never minded. Today I am going to implement 49 VPNs (Site to Site) on XG 210 on 17.5 GA version.




It is handling based on Local and Remote gateway address.
 
 For easy undersatding, You have configured two VPN with Local gateway is your WAN interface and Remote gateway will be * (any) for both connections. In this condition your Pre-Shared key must be same on both VPN connection configuration. There is no matter that your LOCAL ID, Remote ID, Local Subnet, Remote Subnet etc are different. If you will chenge a preshared key on one VPN tunnel configuration then it will autometically update on both VPN tunnel interfaces. 

I think, Sophos must be think about this process. It will making more difficulty then XG firewall in only "Responder".

Hon'ble Prime Minister's Interaction with IT Professionals

DHCP Server and unnecessary traffic for your DHCP server.

Have you ever implemented central DHCP server for all of your network (VLANS), and you used a command "IP Helper-Address? The ip helper-address will actually forward many other UDP-based broadcasts to the address specified as tft, dns, time, netbios-ns, netbios-dgm, tacacs, bootpc, bootps etc. 

Many times it is generating unnecessary traffic for your DHCP server. Have you applied "ip forward-protocol udp ...." command to prevent this?

Voice VLAN and Port Fast Combination on Cisco Switch

The Port Fast feature is automatically enabled when voice VLAN is configured. When you disable voice VLAN, the Port Fast feature is not automatically disabled.

Why?
I will be share shortly. 

Design Tips: Guide for choose VLAN Number

Design Tip— To ensure optimal convergence for voice traffic Cisco recommends that VLAN number assignments be mapped such that the most loss-sensitive applications such as voice are assigned the lowest VLAN numbers on each physical interface, as shown in table:

Table Recommendations for VLAN Assignments 

VLAN Function	VLAN Interface
Wired_Voice_VLAN	7
Wireless_Voice_VLAN	57
Wired_Data_VLAN	107
Wireless_Multicast_VLAN	157

Not all VLANs trunked on a specific interface converge at the same time. Cisco IOS throttles the notifications for VLAN loss to the routing process (EIGRP/OSPF) at a rate of one every 100 msec. As an example, if you configure six VLANs per access switch, upon failure of an uplink, fiber traffic on the sixth VLAN converges 500 msec after the first.

Network Ready for Use Testing (NFRU)

NRFU testing is often a mandatory, final step in certifying that a new network infrastructure has been implemented correctly and is ready to carry production traffic. During NRFU testing, every device is methodically checked to ensure that it has been implemented according to the design specifications and is operating error-free. Network services are verified, devices are added as elements into NMS and Operational Support Systems (OSS) systems, and a baseline of application performance is recorded.

The testing was broken into four separate phases:

• Phase I: During this phase, device-level verification was done. This phase included activities such as serial number verification, line card checks, Cisco IOS level confirmation, and power checks.

• Phase II: This phase included logical configuration and connectivity verification. In this phase, actions such as circuit connectivity verifications, routing protocol checks, and traceroutes were performed. Multicast and QoS configurations were checked.

• Phase III: This included service verification and traffic testing. Service verification included features such as IP telephony, video, wireless, and common IP services (DHCP, DNS, NTP).

• Phase IV: This was the application testing phase. Production applications and network and security management were tested during this phase.

The tests performed in each phase were further broken into three different types:

• Tests that were performed on all Cisco routers and switches installed

• Platform/role-specific tests:

• Access layer switches

• Core layer switches

• Distribution layer switches

• Video distribution switches

• Server farm switches

• Service-specific tests

I will share reset details soon. 

 

Cisco Nexus : Executive Multiple Commands in one Go

Executing multiple CLI's in one go
CLI stands for Command line Interface

N7k-LabSW# show clock ; show switchname ; show license host-id
19:10:59.016 UTC Mon Apr 04 2016
N7k-LabSW
License hostid: VDH=TBM14354170

 # Works for configuration too:

N7k-LabSW# conf t ; hostname N7k-LabSW-DEFAULT ; end
Enter configuration commands, one per line.  End with CNTL/Z.
N7k-LabSW-DEFAULT#

How to router prevent from ARP Strom?

 How to Router Prevent from ARP Strom?
Why some ARP entry will showing in ARP Table after respective time expires?


The extra time is the jitter added to each dynamic ARP entry when it is created. Random jitter is added to the ARP cache timeout in order to avoid synchronous expiration of the ARP entries, which might trigger an ARP storm. Jitter should be a random number between 0 seconds and 30 minutes, with a maximum jitter of 30 minutes.

Bursty Traffic Identification on Switch port

Traffic bursts can cause output drops even when the interface output rate is significantly lower than the maximum interface capacity. By default, the output rates in the show interface command are averaged over five minutes, which is not adequate to capture any short-lived bursts. It is best to average them over 30 seconds. In this case, you can use Wireshark in order to capture egress traffic with the Switched Port Analyzer (SPAN), which is analyzed in order to identify the bursts.

HP 5412R Switch basic configuration - VLAN, SVI, OOBM Management Interface

OSPF Prefix Suppression

OSPF prefix-suppression is a useful feature in order to reduce the number of Link State Advertisement (LSA) that are flooded within an area. In an OSPF area which has multiple transit links between hosts and actual communication is between the hosts. There is no need to advertise the transit link LSAs to all the routers. You can only advertise the LSAs related to end hosts. By default, OSPF advertises all the LSAs that include the transit link LSAs.

OSPF prefix-suppression feature helps to overcome this behavior and reduces the number of Type 1(router) and Type 2(network) LSAs advertised.

This feature can be enabled globally on a router or on per interfaces basis.

OSPF prefix-suppression helps in faster Shortest Path First (SPF) calculation due to less number of prefixes in the database (DB). OSPF Type 3, Type 4, Type 5, or Type 7 LSAs are not suppressed.

Jitter timer in HSRP Protocol

 Jitter timers HSRP Protocol

Jitter timers are used in HSRP. They are recommended for timers running on services that work realtime and scale. Jitter timers are intended to significantly improve the reliability of HSRP, and other FHRP protocols, by reducing the chance of bunching of HSRP groups operations, and thus help reduce CPU and network traffic spikes. In the case of HSRP, a given device may have up to 4000 operational groups configured. In order to distribute the load on the device and network, the HSRP timers use a jitter. A given timer instance may take up to 20% more than the configured value. For example, for a hold time set to 15 seconds, the actual hold time may take 18 seconds.

In HSRP, the Hello timer (which sends the Hello Packet) has a negative Jitter, while the Holddown timer (which checks for failure of a peer) has a positive jitter.

Minor Stack Protocol Version Number Incompatibility Among Stack-Capable Switches

Minor Stack Protocol Version Number Incompatibility Among Stack-Capable Switches


Switches with the same major version number but with a different minor version number are considered partially compatible. When connected to a switch stack, a partially compatible switch enters version-mismatch (VM) mode and cannot join the stack as a fully functioning member. The software detects the mismatched software and tries to upgrade (or downgrade) the switch in VM mode with the switch stack image or with a tar file image from the switch stack flash memory. The software uses the automatic upgrade (auto-upgrade) and the automatic advise (auto-advise) features.

The port LEDs on switches in version-mismatch mode will also remain off. Pressing the Mode button does not change the LED mode.

OSPFv2 and OSPFv3 headers

#DoYouKnow #OSFP #Routing

All OSPFv2 packets have a common 24-byte header, and OSPFv3 packets have a common 16-byte header, that contains all information necessary to determine whether OSPF should accept the packet. The header consists of the following fields:

• Version number—The current OSPF version number. This can be either 2 or 3.
• Type—Type of OSPF packet.
• Packet length—Length of the packet, in bytes, including the header.
• Router ID—IP address of the router from which the packet originated.
• Area ID—Identifier of the area in which the packet is traveling. Each OSPF packet is associated with a single area. Packets traveling over a virtual link are labeled with the backbone area ID, 0.0.0.0. .
• Checksum—Fletcher checksum.
• Authentication—(OSPFv2 only) Authentication scheme and authentication information.
• Instance ID—(OSPFv3 only) Identifier used when there are multiple OSPFv3 realms configured on a link.

Cisco router load balancing and CEF (Cisco Express Forwarding)

#DoYouKnow #CiscoTips #Cisco

Per-destination or per-packet load-balancing depends on the type of switching scheme used for IP packets. By default, on most Cisco routers, fast switching is enabled under interfaces. This is a demand caching scheme that does per-destination load-balancing. To set per-packet load-balancing, enable process switching (or disable fast switching), use these commands:

Router(config-if)# no ip route-cache

Now the router CPU looks at every single packet and load balances on the number of routes in the routing table for the destination. This can crash a low-end router because the CPU must do all the processing.

Newer switching schemes such as Cisco Express Forwarding (CEF) allow you to do per-packet and per-destination load-balancing more quickly. However, it does imply that you have the extra resources to deal with maintaining CEF entries and adjacencies.

When you work with CEF, you could ask: Who does the load balancing, CEF or the routing protocol used? The way in which CEF works is that CEF does the switching of the packet based on the routing table which is being populated by the routing protocols.

I like cef...

#Extra tips for my blog readers:

, CEF performs the load-balancing once the routing protocol table is calculated.

Block "Botnet and Control & Command Servers" on Fortigate

Are you making same "big" mistake in Fortigate firewall configuration?  Are you blocking "Botnet & C&C Servers"? He (My friend, Security Implementation Engineer) is unaware or ignoring about configuration changes onward Forti OS 5.4. This is called "Scan Outgoing Connections to Botnet Sites".  Previously it was (5.2)  "Detect Connections to Botnet C&C Servers" in Security Profiles -> AntiVirus. but today this is available "Scan Outgoing Connections to Botnet Sites"  in Network->Interfaces->Edit Interface (WAN).  #securities #Fortigate #fortinet #securityawareness #DoYouKnow

Multicast OSPF LSA (Type 6) on Cisco router

Cisco routers do not support LSA Type 6 Multicast OSPF (MOSPF), and they generate syslog messages if they receive such packets. If the router is receiving many MOSPF packets, you might want to configure the router to ignore the packets and thus prevent a large number of syslog messages.


Commands:
#Router ospf 0.0.0.1
#ignore lsa mospf