Menu Close

Category: Practical – Cisco

Port-Mirroring

Port-Mirroring

Port mirroring is used on a network switch to send a copy of network packets seen on one switch port (or an entire VLAN) to a network monitoring connection on another switch port. This is commonly used for network appliances that require monitoring of network traffic such as an intrusion detection system, passive probe or real user monitoring (RUM) technology that is used to support application performance management (APM).

In our particular case, the faculty provided us with a Cisco Catalyst 2960 switch. We have configured this switch to mirror all internet-bound data traffic traversing the interface connected to network gateway, to the interface connected to Moloch server. As a result, we can now monitor all inbound and outbound lab traffic.

Enabling traceroute on Cisco ASA

There are three steps to enable traceroute:

  1. In policy map “global_policy” in class “inspection_default” you need to add “inspect icmp” and “inspect icmp error”
  2. In policy map “global_policy” in class “class_default” you need to add “set connection decrement-ttl”
  3. On your oudside interface, you need add access list, that permits ICMP with “time-exceeded” on ingress direction

There is code, that you can paste in your ASA firewall:

Possible bugs/limitations encountered in Cisco’s RIP implementation

  1. Default route origination not working reliably.
  2. Automatic summarization turned on causes major networks to be propagated throughout the RIP domain with a metric of 1.
  3. Using RIPv2 on NBMA hub-and-spoke topology causes the hub router to rewrite the next hop field in the RIPv2 update to the IP address of the spoke router advertising the originalupdate, thereby creating reachability issues

Cisco-Linksys SRW 248G4 – system firmware recovery

In this article I will describe how to proceed if your firmware upgrade on SRW 248G4 switch failed and the switch then stop working.

I have found only one solution how to recover from this disaster and it is sending a new firmware over PC serial (COM) port using xmodem protocol. A new firmware can be send to the failed switch with the help of Startup menu of the switch. The Startup menu can be entered when the switch is booting.