PART1: VRR Junos for BGP route reflectors

In very big networks, we need a means for sharing the routers iBGP information. This is a challenge when you have  dozens or more of devices in the network .The  BGP confederations concepts helps, but the iBGP router_reflector with iBGP clients is even better in some case and does not require major changes to an existing network like in a case of redesigning & deploying for a bgp confederations.

Juniper has made it simple with a prepackaged VRR ( virtual router reflector machine )

http://www.juniper.net/documentation/en_US/junos14.2/topics/concept/virtual-route-reflector-overview.html

It's probably one of the best ideal yet by Juniper imho


I've used  OpenBGPd on virtual machines to accomplished the same task,  but a  pre-made  image that ready for install is just as great.

http://www.openbgpd.org/ 

Cisco also have  XRv  & CS1000v but these are are actually data forwarding devices.

I'm not going to argue one  over the other, but will suggest that the commercial offerings are great if you have a Network Deptmartment  or CTO that hates or won't accept a  open source solution. The OpenBGD solution is very flexible, advance and best of all... FREE! YMMV

1st let's look at a typical BGP_RR designs. Take this network with  10x BGP device.

All BGP routers would need to be fully mesh for internal bgp connectivity. This would require more than  80+ peers defined for the above topology. iBGP requires all BGP peers within the same AS to be fully meshed for various reasons.

So how can we reduce the configuration efforts? & maintain this full-meshed requirements ?

Easy we can deploy a BGP-Route/Reflector. We could take any one of the routers here and make a router-reflector or installed 2 dedicate routers for just route-reflectors  operations within the iBGP peers.

example

NOTE:  A dual BGP_RRs with top-level fully meshed and bottom-level RR  connected.

note: It's ideal to deploy 2x for redundant operations in case one BGP_RR is lost, powered down. With a redundant virtual-hosting architect, you can continue to keep  your bgp mesh contact with all peers.


Now let's look at the Juniper VRR. It's a low impact image that ready to go.  I will install this on a  linux-KVM Host.

The image is prepackage as a qcow2 image format. You can set the unit and start the boot process and login in  as the user  "root".

 

The very 1st thing you should do is to set the root password & then we can look over the interface lists.

Enable ssh services just in case you want to login via ssh & then build a loopback address and test the ssh access and the login for the user "root".

 

Now we can start the basic cfg setups which we will cover in my PART2 but the steps in general;

   1: we 1st will build the local vNIC that will sit in our DC-design. This interface will be ether-encapsulation and assigned to our local subnet

  2: we will define the BGP configuration

  3: and set the bgp policy 

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

The fortigate sizing app

The forticlient app on my tablet has a "find my fortigate"  tool  that allows you to set basic  requirements and the application will find the models that matches these requirements.

Requirements can be items IPS/VPN/AV  thruput speeds and even wireless security &  interface support for 10gig. The application only provides the match models, but you will still need to do a side-by-side comparison of the listed models to determine the final model for your implementation.

Here's a few photos  from the android-app

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

cisco tac android app

I broke down and installed & tried the  cisco tech-support mobile app. This is a good approach  for support and  providing customers access to the vendor support portal.
 

https://play.google.com/store/apps/details?id=com.cisco.swtg_android&hl=en

We have apps for  everything from weather, news, food sport, airline status, hospital appointments, movie info, ......." heck why not support ? "


I push this andorid app &  installed it on a Samsung Galaxy 12.2" tablet for trial and my 1st attempts at login was a failure.

But soon I was able to login and review support contracts, review open/closed cases & in the same fashion as that of the web acces. I didn't try to open a new case but it looks like you will need to know the serial # and complete some simple search to find the device.

I'm sure plenty of other vendors will start offering a mobile app support tool & the future will see more customer interface tools design around the mobile end-device.


Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

smtp-mailhost honeypot

I've been working on a mail honeypot for the last year or so. The goal was to analyze  smtp-auth failures on a dummy mailhost that;

        1: I never had any MX/A/TXT/SPF record installed ( the ISP did install generic PTR )
        2: never sent any email 
        3: never received email under any official means

My top smtp-auths failures are show in this simple ms-excel graph.

 The graph here's shows % by continents using a geo-IP lookup  and  against  the 7 continent model

Now to summarize,

• I took total failures  and reduce any duplicates ( address )  so these where unique event for each user

• Asia was  the #1 continent by geoIP lookup

• The "Administrator" was the #1 account that failed

• The ideal was taken from  the honypot folks at  https://www.projecthoneypot.org/

My future goals are to extract the data for developing timed ACL for  repeat offenders. I also want to explore ipv6 mail-abusers to see if this issues exists in the ipv6 domain.

On a different approach I have a few domains being used for email-traps, this is another means for trapping and luring  abuser in regards to mail. The abuser are so blunt  the trap emails have email address such as ;  dontsendmemail@mydomain.com or similar , and the abuser still send spam email.

My hyperfeed.com domain which was a big target when it was productive back in the later 90s early 2000s is still receive spam emails to various emailserver but yet it has no MX record.

Btw, me and a few friends are setting up a ipv6 only honeypot & for tracking in the next few weeks on a virtual machine to see if we get any hits.

The ideal that if a you have a honeypot & that it ( address ) was never publish and folks are attempting to relay thru you, they are most likely up to no-good

SMTP/POP  honeypots are great for trending and general awareness of abusers. This approach can  be used for both personal awareness & knowledge , of just to see how rampart  mail-abuse exists.

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

FTNT blog ( fortinet )

Fortinet has a blog that 's pretty well laid out. Here's the link for the Fortinet blog

http://blog.fortinet.com/

This following blog entry caught my eye about bots and C&C within http.Status-Codes

http://blog.fortinet.com/post/hiding-malicious-traffic-under-the-http-404-error

Enjoy

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

cisco ASA 9.4.1

Will time has came for ASA code 9.4.1. Here's the one striking new feature that caught my eye. It has been out for some time now , so I was  decided to kick the tires and to upgrade a cluster of firewalls to this new version.


NOTE: PBR has finally landed in the  cisco software version

The migration path is quite simple from  version 9.3.x.

I was hoping to see  more new introduced features for ipv6 and routing, but I guess we have to wait for a later  asa9.4.x release.

So far,  no big reveiws on the 9.4.1 cisco asa site. This could be a big or small thing. I've only found one review posted on CSCO.

Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \

TFTP blocksize ( be aware)

TftpServers and various network devices such as cisco routers and switches, some time has problems with tftp transfer if the blocksize is too small. Typical tftp uses a blksize of 512bytes. What this means, the max file chunk is configured at 512 bytes

NOTE: The size of the block will effect the overall transfer rate ( greater much quicker , lesser much slower )

Take this screenshot of a typical file size with the  blocksize against a tftp-server running on a macosx machine

Here's a tftp-server running on a cisco 2960 switch with various blocksizes defined by the client from 8 bytes to 9128 bytes

Okay so await a minute, we adjust the  client requested blocksize from 8 to 9128 bytes but the transfer speed for the same file-size of 7075041bytes stayed the same. A dump of  the packets during the tftp transfer will show that the blocksize was set only to 512bytes;

e.g

So no matter what the client requests, the block sent by the tftp-server was only set to 512bytes. So if I change the client to operate in binary mode, and request the file we also find out that the  tftp-server ( cisco ) ignores the requested blocksize and set all blocks served at 512bytes


e.g

So keep all of  this in mind when your complaining about why a tftp transfer takes so long.


Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \


Ken Felix
NSE ( Network Security Expert) and Route/Switching Engineer.
kfelix  -----a----t---- socpuppets ---dot---com

    ^     ^
=(  *  * )=
        o 
       /  \