JNCIS-FWV

Today I've passed the JNCIS-FWV exam. The JNCIS-FWV is designed for networking professionals with advanced knowledge of, and experience with, Juniper Firewall/VPN products and ScreenOS software. The JNCIS-FWV exam tests for a wider and deeper level of knowledge than does the JNCIA-FWV exam.
JNCIS-FWV Exam Objectives (Exam: JN0-530)

Tags: Security, Networking, Juniper, Egypt, JNCIS-FWV, Gr33n Data

Foundry IEEE 802.1x

To configure a foundry switch in order to authenticate people using their IEEE 802.1x clients on their PCs.

You need to enable the RADIUS authentication on the switch first

BigIron(config)# aaa authentication dot1x default radius

Then you net to tell it the RADIUS server's IP and other parameters

radius-server host 209.157.22.99 auth-port 1812 acct-port 1813 default key abc123 dot1x

Now let only one user has access to ethernet port "3/2"

BigIron(config)# int e 3/2
BigIron(config-if-e100-3/2)# port security
BigIron(config-port-security-e100-3/2)# maximum 2
BigIron(config-port-security-e100-3/2)# exit

Then enable the 802.1x on the switch, and enable multi-user policy

BigIron#(config) dot1x enable
BigIron#(config-dot1x)# multi-user-policy enable

And enable flow-based ACL

BigIron#(config) interface e 3/11
BigIron#(config-if-e1000-3/11)# ip access-group flow-mode
BigIron#(config-if-e1000-3/11)#exit

Configure place holder ACL, just a fake ACL with fake IP in it to redirect the first packet of the session to the CPU

BigIron(config)# access-list 131 deny tcp host 1.1.1.1 any
BigIron(config)# access-list 131 deny udp host 1.1.1.1 any
BigIron(config)# access-list 131 deny icmp host 1.1.1.1 any
BigIron(config)# access-list 131 permit ip any any

BigIron(config) interface e 3/11
BigIron#(config-if-e1000-3/11)# ip access-group flow-mode
BigIron#(config-if-e1000-3/11)# ip access-group 131 in
BigIron#(config-if-e1000-3/11)# ip access-group 131 out
BigIron#(config-if-e1000-3/11)# exit

So, if the source MAC address of the flow is already associated with a successfully authenticated 802.1X host that has a dynamically assigned IP ACL applied to it, then that dynamically assigned IP ACL is applied to the flow. When a port is authenticated using 802.1X security, an IP ACL or MAC address filter that exists in the running-config on the Foundry device can be dynamically applied to the port. To do this, you configure the Filter-ID (type 11) attribute on the RADIUS server. The Filter-ID attribute specifies the name or number of the Foundry IP ACL or MAC address filter. For example, " ip..in", applies the specified numbered ACL to the 802.1X authenticated port in the inbound direction.

So to configure a dynamic ACL to permit incoming traffic from 10.0.0.4 then add the following command to the switch: " access-list 2 permit host 10.0.0.4", and then make the RADIUS send the following attribute value " ip.2.in"
You may do the same but with a MAC filter by applying the following command on the switch: " mac filter 2 permit 3333.3333.3333 ffff.ffff.ffff any etype eq 0800" and let the RADIUS send this: " mac.2.in"

References:
Foundry, Configuring 802.1X Port Security
Foundry, Software-Based IP Access Control Lists (ACLs)

Tags: Networks, Security, Foundry, Gr33n Data

IEEE OUI & Company ID's

The MAC address is six bytes (48 bits) long, where the first three bytes (OUI) represent the manufacturer of the Network Card. And here is a link from IEEE in order to search for the different OUI's and their equivalent Companies.

One nice trick to know the manufacturer of a certain host is to "ping" it (it has to be in the same subnet with you), and then type "arp -a" to get his MAC address.

http://standards.ieee.org/regauth/oui/index.shtml

Tags: Networking, IEEE, Gr33n Data

Basic NetScreen Firewall Configuration

Juniper NetScreen firewalls are one of the most popular firewalls when it comes to High End firewalls. They are installed in the major ISPs and Large Data Centers worldwide. So here is a basic intro to configuring a NetScreen firewall.

You first need a console and the default username and password are "netscreen"/"netscreen". Then you have to determine if you are going to install it in Layer-II mode or LayerIII. We are going to consider the Layer-II (Transparent) mode configuration.

First, put all the interfaces in Layer-II zones (V1-Trust, V1-Untrust, V1-DMZ)

set interface [interface-name] zone [zone-name]
Eg. set interface e1 zone V1-Trust

Then configure an IP address to VLAN1 interface (The management interface in case of Transparent mode operation)

set interface vlan1 ip [ip-address]/[subnet-mask]
Eg. set interface vlan1 ip 10.0.0.1/24

Now after adding the interfaces to different zones, there must be policies in order to allow traffic to cross the different zones ... policies is how you are going to decide who is allowed to communicate with who and with whcih TCP/UDP services

set police from [source-zone] to [destination-zone] [src-ip] [dst-ip] [service] {permit|deny} [log]
Eg. set policy from V1-Trust to V1-Untrust 10.0.0.10 10.0.0.2 FTP permit

Network Configuration

PC1: 10.0.0.10/24 (V1-Trust)
PC2: 10.0.0.2/24 (V1-Untrust)
VLAN1: 10.0.0.1/24

[PC1]------------[Firewall]------------[PC2]

Notes:

1. In Transparent mode the firewall acts as a bridge in the way the traffic is forwarded, so it is normal for the hosts connected to the different interfaces to have IP addresses from the same subnet.
2. The default behavior of the firewall is to block traffic between different zones, so you have to create policies in order to path traffic. However this default can be changed.

Tags: Networking, Security, Firewalls, Juniper, NetScreen Gr33n Data

Bye Bye Cisco

Earlier this month Michael Lynn and x-employee in ISS (Internet Security System) gave a speech in the Black Hat forum about some security breaches he has found in Cisco IOS that may get them to their knees. He also explained how this can lead to Arbitrary Code Execution in the Cisco products that may in some stage let hackers to make various exploits and worms that can infect the Cisco routers, switches, etc.

The problem here is not that the Cisco products are that vulnerable and insecure as Michael Lynn said, but it is how Cisco reacted to that speech and decided to sue him and the Black Hat organizers. It is really shameful that a company that has a significant share in security products market reacts that way instead of trying to fix their own security weakness or at least announce that they are going to fix them.