Checkpoint SecurePlatform Virtual Appliance

I've just downloaded and setuped the Checkpoint SecurePlatform virtual appliance in my laptop. This is perfect for anyone trying to learn the Checkpoint firewall like me. This must be the equivalent of Dynamips in the Checkpoint world.

Among the recent developments in the IT world, virtualization must be the coolest thing happening. VMWare is spearheading this revolution and their online library of virtual appliance is a panacea for labrats like me. In theory, with enough CPU and memory, you can build a virtual datacenter inside a PC!!!

Quick, Learn More ! from Cisco's QLM

If you're preparing for a CC*P exam or just want to learn about a certain feature, you'll surely find this short tutorials or what Cisco calls Quick Learning Modules (QLM) very useful. They are available on the following links.

Security and VPN QLMs
Cisco IOS Software
CCNP Prep Center Exam Study Section (Login required)
more modules are available from the Cisco Learning Connection Main Page

Be clued on Protocol Analysis

It pays to know how to read packet captures when troubleshooting network problems like latency problems. Like there was one time when we were investigating why a server response became slow after moving it behind a firewall. Finger pointing ensues until we decided to do sniff the traffic in the firewall to know whats happening. From the capture, we see the server sending reverse DNS lookup for every client request it receives. So before processing the client requests, it waits for the reverse DNS result until it times out because the firewall is blocking the DNS requests. After understanding what was going on, the administrator turned off the reverse DNS lookup in the server.

Most of the time, people will be looking at bandwidth utilization issues/network congestion but it is rarely the cause if application response over the network is slow. Sure there are peer-to-peer traffic and worm scans to watch out for especially on slow links but there are more possible factors that can cause slow application access. Slow backend server response, problematic SQL queries (those long, long SELECT statements) and chatty applications are some possibilities that I can think of. The point is you should know how to push the blame on others. :)

Here's a helpful presentation slide from Laura Chappell that should help you get started in analysing slow networks. While you're at it, browse through the Protocol Analysis Institute website and you'll see more articles from Laura Chappell.

Router: Scripting in Cisco routers and Management Enhancements

Cisco IOS have features available which enables you to create custom commands and scripts which will aid in managing IOS routers using the TCL scripting command.
Tool Command Language

With embedded management tools, you can even monitor events or set thresholds that will trigger a script or CLI applet.
Embedded Event Manager (EEM)
Embedded Syslog Manager (ESM)
Embedded Resource Manager (ERM)

To automate tasks, you can schedule EXEC commands to run periodically Unix Cron-style.
Command Scheduler (KRON)

You can archive multiple versions of the config, then either replace or rollback configurations.
Configuration Replace & Rollback

Using the command "show archive config differences", the router can do a line-by-line comparison of two versions of the configurations ie. between the startup config and the running config.
Contextual Configuration DIFF utility

Wow! All this I unearthed after chancing upon this page for the Embedded Event Manager (EEM) Scripting Community. Proceed with caution. This is the domain of the Cisco l33t.

It's a feature!!!

Overheard from the office.

Phone rings.

Help Desk: Sir, remote office in Manila reported a downtime.
Manager: Let me check... I see.. the router rebooted, tell them it's a feature!

Help desk follows obediently.

Free Treats from Cisco and IPExpert

Here are a couple of free study resources available.
On Feb. 1, Cisco’s CCNA TV will air IP Addressing, Subnetting, & Variable-Length Subnet Masks (VLSM), that will cover basic IP addressing, subnetting and VLSM concepts, and route summarization. You have to register first in the CCNA Prep Center to view the broadcast.
"IP Addressing, Subnetting, & Variable-Length Subnet Masks (VLSM)" on CCNA TV

Also, IPExpert is offering all their eScenarios for free. This used to be a product that you have to pay (previously worth $100+ i think).
IPEXPERT Free CCIE Lab eScenarios

Take note: Recently announced Cisco Vulnerabilities

Well, I got this from our company's trusty security advisory system but I'm sure it will be all over the Internet by now based on the seriousness of these security bulletins.

Crafted TCP Packet can cause denial of service (cisco-sa-20070124-crafted-tcp)
Crafted IP Option vulnerability (cisco-sa-20070124-crafted-ip-option)
IPv6 Routing Header vulnerability (cisco-sa-20070124-IOS-IPv6)

After going through the security advisory, continue reading through these documents:
Detecting and mitigating cisco-sa-20070124-crafted-tcp
Detecting and mitigating cisco-sa-20070124-crafted-ip-option
Detecting and mitigating cisco-sa-20070124-IOS-IPv6

It will give you wealth of information on the features and capabilities that Cisco IOS have in dealing with these issues. Previously, I didn't know about IP Options Selective Drop , Control Plane Policing and ACL Support for Filtering IP Options. Makes me feel like a n00b.

Some notes I learned:

1. On Cisco PIX Security Appliances, Cisco ASA Adaptive Security Appliances, and Firewall Service Modules (FWSM) for Cisco Catalyst 6500 Switches and Cisco 7600 Routers, packets with IP Options are dropped by default.
2. Configure Policing then apply the service-policy to the Control Plane to protect the router itself from attacks directed to it. The control plane and the management plane handle such packets as routing updates, keepalives, and network management.
3. IP Protocol 103 = PIMv2
4. IP Protocol 113 = PGM Reliable Transport Protocol
5. Resource Reservation Protocol (RSVP) (Multiprotocol Label Switching traffic engineering [MPLS TE]), Internet Group Management Protocol Version 2 (IGMPv2), and other protocols that use IP options packets may not function when IP Options are filtered.
6. Configuring Access Lists to Filter Packets That Contain IP Options
7. Protecting Your Core: Infrastructure Protection Access Control Lists
   

I remember a similar bug last 2003 (Cisco IOS Interface Blocked by IPv4 Packets) that caused much furor and panic to upgrade routers. I wonder how Cisco customers will react to this one.

Time to bring out the console cable and fire up TFTP!