Cisco VG Trust List

Why?

When someone gets access to a company’s voice gateway, a door is opened to use this gateway to make calls to all over the world, which costs the company huge amount of money, in addition to reputation/security issues that may arise.
Cisco has introduced a security feature in IOS 15.1(2)T to combat this vulnerability, voice gateway Toll-Fraud, and to secure it against such behavior.

The Config

router1(config)#voice service voip
router1(conf-voi-serv)#ip address trusted list
router1(cfg-iptrust-list)#ipv4 x.x.x.x

Where x.x.x.x is your CUCM server, if there are more than 1 server/IP, just repeat the command for each IP address.

The default action in IOS 15.1(2)T and later is to deny access to voice services and drop any attempt made. So, it is mandatory to have such configuration to get a complete working voice gateway.

Network Time Protocol (NTP) setup and configuration

Introduction

Based on the previous NTP and Linux post, this will cover setting up any Cisco device to be a time server of your network.

Setup

Setting up the timezone of your area:

router1(config)#clock timezone AST 3 0

I am living in a UTC +3:00 zone thus my config reflects it, if you are living in UTC 0:00 use:

router1(config)#no clock timezone

more timezone setup is available at this Cisco page.

router1(config)#clock calendar-valid

configures the device as an authoritative time source for a network based on its hardware clock.

router1(config)#ntp master

configures the Cisco IOS software as a master clock (at default stratum 7) to which peers synchronize themselves when an external source is not available. Here, when the device cannot sync to an external NTP (no Internet connection as an example), it will rely on its internal clock (again at the default stratum number 7) to satisfy any request.

router1(config)#ntp update-calendar

periodically updates the hardware clock (calendar) from the configured time source(s).
Now, setup time source(s):

router1(config)#ntp server ip-address or hostname

if you use hostname in this command, IOS will resolve it to an IP address and then save it. Use as many as you need (I am using 3 sources).

A Working NTP

Leave the device working for around 10 minutes and then issue:

router1#sh ntp a

an output such as:

  address         ref clock       st   when   poll reach  delay  offset   disp
 ~127.127.1.1     .LOCL.           7     12     16   377  0.000   0.000  0.250
*~xxx.xxx.xxx.xxx .MSF.            1    434   1024   377 165.60  -6.331 14.827
+~yyy.yyy.yyy.yyy .PTB.            1    695   1024   377 170.05   7.694 14.834
+~zzz.zzz.zzz.zzz aaa.aaa.aaa.aaa  2    184   1024   377 173.38  -0.953 14.815
 * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured

and:

router1#sh ntp s
Clock is synchronized, stratum 2, reference is xxx.xxx.xxx.xxx
nominal freq is 250.0000 Hz, actual freq is 249.9943 Hz, precision is 2**24
reference time is D6DC17CD.061F0269 (17:57:17.023 AST Tue Mar 25 2014)
clock offset is -6.3312 msec, root delay is 165.60 msec
root dispersion is 42.01 msec, peer dispersion is 14.82 msec
loopfilter state is 'CTRL' (Normal Controlled Loop), drift is 0.000022822 s/s
system poll interval is 1024, last update was 692 sec ago.

Finally

Setup all your internal devices to use this Cisco node as their master NTP clock.

Using Squid as a transparent proxy/cache with Cisco Routers

Introduction

When I was planning my home network, I wanted to have basic components available, e.g. local DNS, local proxy/cache, etc… I started by having a Cisco 1750 router as my home ADSL device, as it has a wide range of configuration capabilities.
One item was in my home networking to-do list, a proxy/cache service. Having such a service in any multiuser environment is a must, at least for common Internet related activities (e.g. Windows update, antivirus updates, etc…) which have the same files downloaded again and again for each and every PC you have connected. Another thing by the way, from time to time, I bring several PCs/Laptops home for maintenance or reinstallation of Windows, so the need is obvious, having these files locally save both the Internet bandwidth (download it once – have it locally then) and time.
Besides saving bandwidth, tricks can be done with schedule downloads, most of my family members read newspapers online (PDF version), by having a schedule task to download all PDF files from all newspapers we read, I would have them all saved locally in the central cache, thus ready for local access from all PCs/Laptops in my local network.

The Hardware

Any PC with at least 128MB of RAM can do the required job efficiently. Squid runs under Linux (mainly) operating system.

The Software

Linux as an operating system.

Preparing the Software

I am not going into details on how to install the Linux OS. One thing I would like to mention, usually I install Linux Command-Prompt only, as I never use the graphical interface.
After installing Linux (by the way, I use the latest CentOS Linux distro), I make sure that I use yum to install Squid and any dependencies automatically. After installing Squid, I configure it directly with the following (do a search in /etc/squid/squid.conf file and edit accordingly):

http_port xxx.xxx.xxx.xxx:3128 transparent
icp_port 0
maximum_object_size 71680 KB
cache_replacement_policy heap GDSF
memory_replacement_policy heap GDSF
cache_dir diskd /dir ssss 16 256
acl localnet src nnn.nnn.nnn.0/24
wccp2_router rrr.rrr.rrr.rrr

Where:

• xxx.xxx.xxx.xxx is the IP address you want Squid to bind to,
• transparent instructs Squid to run in transparent mode (a mode which does not need enduser configuration, it transparently redirects http traffic),
• maximum_object_size is the maximum file size stored in the disk cache (here I allow up to 70MB filesize to be stored),
• /dir is the cache directory on disk,
• ssss is the total size (in MB) of the cache directory (the maximum size of which if reached a replacement policy is performed),
• nnn.nnn.nnn.0 is the network number you are using,
• rrr.rrr.rrr.rrr is the IP address of your Cisco router.

I use a general rule for the total cache size based upon the link speed you have, for example, I have a 1Mbps ADSL line to the Internet, multiply this by 60 and then by 60 to have the maximum size downloaded (theoretically of course in megabits) per hour, 1*60*60 = 3600Mbph, multiply the result by 24 to have it for a full day, 3600*24=86400Mbpd, then divide this result by 8 (remember, it is still in bits not bytes) and the final result is 86400/8=10800MBpd. So you have around 10GBs of Internet traffic if it is 100% utilized for 24 hours (neglecting the effect of TCP and other headers to simplify the calculation). Then, based on the total disk size you have (nowdays, disks are cheap, so getting a 160GB one is easy), you can decide how many days worth of cache wanted (under 100% utilization). My choice was 40GB of cache so ssss in my case is 40960.

Other Linux Settings

A GRE network interface configuration is needed in the Linux box, so do the following:

• In /etc/rc.local add the following lines:

iptables -F; iptables -t nat -F; iptables -t mangle -F
iptables -P INPUT ACCEPT
iptables -t nat -A PREROUTING -s nnn.nnn.nnn.0/255.255.255.0 -d ! nnn.nnn.nnn.0/255.255.255.0 -i gre0 -p tcp -m tcp --dport 80 -j DNAT --to-destination xxx.xxx.xxx.xxx:3128

Where: nnn.nnn.nnn.0 is the network number you are using, xxx.xxx.xxx.xxx is the IP address of the Linux box which Squid is bind to. Keep in mind that the third line is continuous with the forth and fifth lines. What these line do is to redirect any port 80 request (HTTP) coming from the router through GRE0 interface to port 3128 (SQUID) to have it processed by Squid.

• In /etc/modprobe.conf add the following in a separate line:

alias gre0 ip_gre

• Make a new file in /etc/sysconfig/network-scripts named ifcfg-gre0 with the following lines:

DEVICE=gre0
BOOTPROTO=static
IPADDR=10.190.19.19
NETMASK=255.255.255.252
ONBOOT=yes

First addition is to enable the GRE interface module in Linux Kernel, second addition is to configure it with a static IP address (any private IP will do the trick, make sure that it is not the same range used locally).

Now you can bring the GRE interface up using:

#ifup gre0

If everything is going smooth, you should have it up without any error, for checking, issue this command:

#ifconfig gre0

and you should have an output similar to this:

gre0 Link encap:UNSPEC HWaddr 00-00-05-08-60-FC-00-00-00-00-00-00-00-00
inet addr:10.190.19.19 Mask:255.255.255.252
UP RUNNING NOARP MTU:1476 Metric:1
RX packets:14168479 errors:0 dropped:0 overruns:0 frame:0
TX packets:15 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1707102933 (1.5 GiB) TX bytes:3611 (3.5 KiB)

Here, our Linux settings are finished.

Configuring the Router

Configuring the router is a straight forward job, do the following:

router1#conf t
router1(config)#ip wccp web-cache
router1(config)#int f0
router1(config-if)#ip wccp web-cache redirect in
router1(config-if)#exit
router1(config)#exit

Here, router configuration is finished.

Cache is Working

A simple way to findout whether cache redirection is working or not, issue this command in the router:

router1#show ip wccp

The output should be similar to this:

Global WCCP information:
Router information:
Router Identifier: xxx.xxx.xxx.xxx
Protocol Version: 2.0
Service Identifier: web-cache
Number of Cache Engines: 1
Number of routers: 1
Total Packets Redirected: 2967084
Redirect access-list: -none-
Total Packets Denied Redirect: 0
Total Packets Unassigned: 22
Group access-list: -none-
Total Messages Denied to Group: 0
Total Authentication failures: 0

Where xxx.xxx.xxx.xxx is your router IP address. Another thing you will notice in the router console output if you stop Squid (#/etc/init.d/squid stop):

.Dec 16 2008 12:54:17: %WCCP-1-CACHELOST: Web Cache ccc.ccc.ccc.ccc lost

And when you start Squid (#/etc/init.d/squid start):

.Dec 16 2008 12:55:14: %WCCP-5-CACHEFOUND: Web Cache ccc.ccc.ccc.ccc acquired

Where ccc.ccc.ccc.ccc is your Squid IP address.
Now browse the Internet for a while, then issue this command in the Linux box:

#tail /var/log/squid/access.log

If you have some output with your PC IP address and some sites you visited, your cache and router redirection are working perfectly.

Deploying a Cisco router with WIC-1ADSL card for Internet connectivity

Why?

The main reason of having all of this is: to have a small operational lab at home, so I can practice various configuration and situations (on a smaller scale of course).

The Hardware

I have purchased two Cisco 1750 routers from eBay, having 16MB of flash and 48MB of RAM each. Included in the purchase were two WIC-1ADSL WIC cards, Cisco’s ADSLoPSTN interface.

The Software

As a minimum requirement for the WIC card, the IOS version must be at least 12.2 and the IOS feature set must be of the type C1700-Y7-MZ as number 7 in this notation means that the IOS has the ADSL feature set (c1700 = Cisco 1700 image, Y = IP feature set, 7 = ADSL feature set). Additional feature sets are available (e.g. S = IP Plus feature set, V3 = voice feature set, and more). For more information please refer to router product page.

The Network Plan

A simple home network found in any household constructed with a single switch, a wireless access point, PCs, etc…

Basic Cisco Setup

The setup is basically simple; a cable from the telco wall socket is coming through an ADSL filter and then directly connected to the WIC-1ADSL port. From services point-of-view, all I need is pure NATing (all network services like DHCP, DNS, etc… are running in my internal Compaq server). So the configuration is pretty simple, do ADSL connectivity, do NATing, and that’s all.
Note: for initial configuration to be done (assuming the router is not configured previously, a serial console cable is needed and the entire configuration is done through it).

IOS Configuration

Let’s begin with the configuration; entering global configuration area is straight forward command:

router1#conf t

In my situation, DHCP service is not needed in the router, this command is issued in the global configuration area:

router1(config)#no service dhcp

Then as I have DNS service up and running on my Compaq server, the following command points the router to the default DNS I am using:

router1(config)#ip name-server xxx.xxx.xxx.xxx

xxx.xxx.xxx.xxx is the IP address of my Compaq server.
Now it is the time to configure the ATM port (my provider has PPPoA 8.35 ADSL connectivity so change this according to your provider’s values), these commands are issued:

router1(config)#int atm0
router1(config-if)#no ip address
router1(config-if)#no ip mroute-cache
router1(config-if)#no atm ilmi-keepalive
router1(config-if)#dsl operating-mode auto
router1(config-if)#hold-queue 244 in
router1(config-if)#pvc 8/35

Notice that after issuing the last command – pvc 8/35 – the prompt changes to:

router1(config-if-atm-vc)#

Then, continuing with the following commands:

router1(config-if-atm-vc)#encapsulation aal5mux ppp dialer
router1(config-if-atm-vc)#dialer pool-member 1
router1(config-if-atm-vc)#exit
router1(config-if)#exit

Issuing exit command twice will return back to the global configuration area and the prompt will return back to:

router1(config)#

FastEthernet interface needs an entry for NATing, the following commands are issued:

router1(config)#int f0
router1(config-if)#ip nat inside
router1(config-if)#exit
router1(config)#

Now Dialer1 interface has to be configured, these commands will configure it:

router1(config)#int dialer1
router1(config-if)#ip address negotiated
router1(config-if)#ip access-group dialer-in in
router1(config-if)#ip nat outside
router1(config-if)#encapsulation ppp
router1(config-if)#dialer pool 1
router1(config-if)#no cdp enable
router1(config-if)#ppp pap sent-username your-username password your-password
router1(config-if)#exit
router1(config)#

your-username and your-password here represent the actual credentials given by the service provider, replacing them directly. Again, after issuing exit command the prompt returns to the global configuration area.
Now, continuing with the following commands in the global configuration area:

router1(config)#ip nat inside source list 1 interface Dialer1 overload
router1(config)#access-list 1 permit xxx.xxx.xxx.0 0.0.0.255
router1(config)#access-list 1 deny any
router1(config)#dialer-list 1 protocol ip permit
router1(config)#ip route 0.0.0.0 0.0.0.0 Dialer1
router1(config)#ip access-list extended dialer-in
router1(config-ext-nacl)#deny ip host 0.0.0.0 any
router1(config-ext-nacl)#deny ip 10.0.0.0 0.255.255.255 any
router1(config-ext-nacl)#deny ip 127.0.0.0 0.255.255.255 any
router1(config-ext-nacl)#deny ip 169.254.0.0 0.0.255.255 any
router1(config-ext-nacl)#deny ip 172.16.0.0 0.15.255.255 any
router1(config-ext-nacl)#deny ip 192.168.0.0 0.0.255.255 any
router1(config-ext-nacl)#deny ip 224.0.0.0 31.255.255.255 any
router1(config-ext-nacl)#permit ip any any
router1(config-ext-nacl)#exit
router1(config)#exit
router1#

The xxx.xxx.xxx.0 is the network address being used internally.

By now, the router should be negotiating ADSL, once it is up, the Internet is connected within seconds (provided that everything is correct including username & password). A test contecting to the Internet is done using any PC directly connected to the internal network.

Conclusion

As this part is done without any problems, my internal network enjoying the Internet by all means.