Tag Archives: VPN

My IPv6/Routing/Cisco Lab Rack (2019)

2019-06-24Memorandum, Off-Topic19", CCNA, CCNP, Cisco Router, Cisco Switch, Internet, Juniper SA, Juniper ScreenOS, Juniper SRX, Juniper SSG, Palo Alto Networks, PoE, Raspberry Pi, VPN, WebcamJohannes Weber

My lab rack of 2019 consists of multiple Cisco routers and switches, as well as Juniper ScreenOS firewalls for routing purposes, a Palo Alto Networks firewall, a Juniper SRX firewall, a server for virtualization and some Raspberry Pis. That is: This rack can be used for basic Cisco courses such as CCNA or CCNP, or for even bigger BGP/OSPF or IPsec VPN scenarios since those ScreenOS firewalls are perfect routers as well. Of course, everything is IPv6 capable. Having some PoE-powered Raspberry Pis you can simulate basic client-server connections. A Juniper SA-2500 (aka Pulse Connect Secure) for remote accessing the Lab rounds things up.

I am just writing down a few thoughts on why I have “designed” the rack in that way. It’s basically a reminder for myself. ;)

Continue reading My IPv6/Routing/Cisco Lab Rack (2019) →

IPv6 Renumbering: A Pain in the …

2018-08-27IPv6Configuration, DNS, fail, Firewall, IP Address, IPv6, IPv6 Global Unicast Address, IPv6 Renumbering, NAT, Syslog, VPNJohannes Weber

If you’re following my blog you probably know that I am using IPv6 everywhere. Everything in my lab is dual-stacked if not already IPv6-only. Great so far.

A few months ago my lab moved to another ISP which required to change all IP addresses (since I don’t have PI space yet). Oh boy! While it was almost no problem to change the legacy IPv4 addresses (only a few NATs), it was a huge pain in the … to change the complete infrastructure with its global unicast IPv6 addresses. It turned out that changing the interface IPv6 addresses was merely the first step, while many modifications at different services were the actual problem. And this was *only* my lab and not a complex company or the like.

Following you find a list of changes I made for IPv6 and for legacy IP. Just an overview to get an idea of differences and stumbling blocks.

Continue reading IPv6 Renumbering: A Pain in the … →

Route- vs. Policy-Based VPN Tunnels

2018-07-10Design/Policy, IPsec/VPNCisco ASA, Crypto Map, FortiGate, IKE, IPsec, Juniper ScreenOS, Palo Alto Networks, Policy-Based VPN, Proxy-ID, Route-Based VPN, Security Association, Site-to-Site VPN, uRPF, VPNJohannes Weber

There are two methods of site-to-site VPN tunnels: route-based and policy-based. While some of you may already be familiar with this, some may have never heard of it. Some firewalls only implement one of these types, so you probably don’t have a chance to configure the other one anyway. Too bad since route-based VPNs have many advantages over policy-based ones which I will highlight here.

I had many situations in which network admins did not know the differences between those two methods and simply configured “some kind of” VPN tunnel regardless of any methodology. In this blogpost I am explaining the structural differences between them along with screenshots of common firewalls. I am explaining all advantages of route-based VPNs and listing a table comparing some firewalls regarding their VPN features.

Continue reading Route- vs. Policy-Based VPN Tunnels →

Network Transfer: 1 Big vs. 100 Small Files

2016-03-09Bandwidth/Delay, MemorandumBandwidth, Delay, FortiGate, FTP, I/O Graph, Speed, Throughput, Transfer, VPN, WiresharkJohannes Weber

A common mistake when analyzing network speed/bandwidth between different applications and servers is to fully rely on the mere size of the files being transferred. In fact, one big file will transfer much faster than thousands of small files that have the same accumulated size. This depends on the overhead of reading/writing these files, building TCP/IP sessions, scanning them for viruses, etc. Furthermore, it is application dependent.

I built a small lab with an FTP server, switch, firewall, and an FTP client in which I played a bit with different file sizes. In this blog post I am showing the measured transfer times and some Wireshark graphs.

Continue reading Network Transfer: 1 Big vs. 100 Small Files →

Considerations about IPsec Pre-Shared Keys

2015-01-19Authentication, Crypto, IPsec/VPNBrute-Force, IKE, IPsec, Man-in-the-Middle, Pre-Shared Key, PSK, Site-to-Site VPN, VPNJohannes Weber

Pre-shared keys (PSK) are the most common authentication method for site-to-site IPsec VPN tunnels. So what’s to say about the security of PSKs? What is its role for the network security? How complex should PSKs be? Should they be stored additionally? What happens if an attacker catches my PSKs?

I am listing my best practice steps for generating PSKs.

Continue reading Considerations about IPsec Pre-Shared Keys →

Grep Commands for Cisco ASA Syslog Messages

2014-07-25Cisco ASA, Memorandum, SyslogCisco ASA, CLI, Commands, grep, IPsec, Syslog, VPNJohannes Weber

In a basic environment with a Cisco ASA firewall I am logging everything to a syslog-ng server. As there aren’t any reporting tools installed, I am using grep to filter the huge amount of syslog messages in order to get the information I want to know. In this blog post I list a few greps for getting the interesting data.

Continue reading Grep Commands for Cisco ASA Syslog Messages →

Weberblog.net

IT-Security, Networks, IPv6, VPN, DNSSEC, NTP