TIP: IKEv2 MACOSX

The latest  offering of MACOSX 10.11.x supports IKEv2 for IPSEC vpns. It very easily to over look this when using the native vpn client.

When selecting VPN ipsec you have choices for Cisco-Client ( aka ikev1 ) or L2TPipsec or IKEv2

Ken
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

HOWTO: to determine in a ACT-ACT Fortigate HA cluster which unit is handing traffic

HERE's a few tips/tricks on  locating the ACT fortigate in a HA ACT vcluster1 & 2  setup where you have  vdoms  over clustered units

First you have to use the  ha management command ( similar to switch context  in  a cisco ASA )

e.g

execute ha manage <id#>

1:  You can  use the cli diag debug flow command

2:or the cli cmd  diag system session list  ( which filters if you have a lot of traffic ) will reflect  if that unit is active

and lastly,

3: And with any  remote logging ,  the devname=YYYYYYY and devid=XXXXXXX will be populated of the fortigate unit chassis  that handle that particular session.

Ken
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

locking down SSL/TLS version fortimail

Here's a quick tip on restricting the TLS versions that are used on the fortimail appliance. The setting is done from t he CLI and global configuration.

To test, you can  use  openssl  or curl.

Ken
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

cisco NX-OS logging woes

Within  NXOS and version "system:    version 7.0(5)N1(1)"  we found a strange issue with the log entries upon execution of "show logging last 30" or "show logging" where out of order. The year and month and in top-2-bottom or bottom-2-top was not following in any normal sequence.

This made it hard to track most current events. The only way we got around this was to clear the logging buffer. During the course of this investigation I found under this same code version that you could  add duplicate server entries

e.g

   logging server 10.10.10.10  4 use-vrf default
   logging server 10.10.10.10  4 use-vrf default

With previous and other IOS or NXOS version the above would never happen.

The next issues that was found, "when clearing the logs", our Nexus switch would not display the actual "user" who cleared the logs.

Ken
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

NX-OS bash access again

if you recalled the recent  earlier post { http://socpuppet.blogspot.com/2016/04/howto-enable-linux-bash-nx-os.html },
 we have one more means for execution of a bash shell. It's to use the guestshell service with NX-OS.

You only need to enable  the guestshell service to use it & for runn linux commands.

example

(from cli )

   guestshell enable
   show guestshell detail

Now you can now  run "unix" like commands  from the NX-OS  cli ;

examples

Be aware that you should enclose commands in  between " " quotes but it's not always required and if you use  any "s in any commands execution to escape them;

example

Within the NXOS guestshell you can execute a full shell via the following;


example

To disable the guestshell feature;




SOCNX01SW# guestshell disable
You will not be able to access your guest shell if it is disabled. Are you sure you want to disable the guest shell? (y/n) [n] y

Ken
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

turnning off pager display F5LTMos

Within various network devices, the pager display can become problematic. On the F5 LTMs we can disable the pager display pause  with the classic "Y/N"

Review this screenshot of the b4 and after to see the differences

Ken
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \

HOWTO: enable linux bash NX-OS

If you recalled my ASR unix shell  support

http://socpuppet.blogspot.com/2013/10/tip-how-to-gain-shell-in-ios-xr.html

With in the NX-OS  it also supports linux bash shell. It's a linux host after all  and has a limited access for linux shells and commands.

1st you need to enable the bash feature  { feature bash-shell } from config mode.


2nd, you have a restrict access for various unix commands by using the run via  the run bash  +command or by just  running a full bash shell via  run bash

e,g


run bash ls

or

run bash 

examples

enjoy


Ken
NSE ( network security expert) and Route/Switching Engineer
kfelix  -----a----t---- socpuppets ---dot---com

     ^      ^
=(  @  @ )=
         o 
        /  \