> On 13/09/2011 07:00 PM, Francois Labreque wrote:

>>>>> No, I mean there's a *hardware* firewall in the way. You know, with
>>>>> the
>>>>> big Cisco sticker on it and the 3-digit price tag? (Although obviously
>>>>> that's only because I'm at work right now. My house doesn't have
>>>>> one of
>>>>> those...)
>>>>
>>
>> You're off by two orders of magnitude. Most Cisco firewalls are in teh 5
>> digit price tag.
>
> True. But not this particular one.
>
>
http://www.ebuyer.com/135532-cisco-asa-5505-firewall-edition-bundle-asa5505-50-bun-k9
>

Ok. you got me.  I usually don't deal with small-office/home-office gear.

>
> (Go on, hack me. You know you want to.)
>
>>>> And that hardware firewall is completely incapable of forwarding ssh
>>>> connections? Pretty useless, I'd say.
>>>
>>> No, I don't have the password to configure it.
>
> Still stands.
>
>>> (And besides, have *you*
>>> tried configuring Cisco stuff? It's not exactly intuitive. You probably
>>> need Certified Engineer status to figure it out.)
>>
>> You don't need to be a Cisco Certified Internetwork Expert to figure it
>> out. The Cisco manuals are usually pretty easy to follow, and freely
>> available on their web site.
>
> Really? That might be worth reading...
>

This is a good place to start:

For routers and switches:
http://www.cisco.com/en/US/docs/ios-xml/ios/fundamentals/command/cf-cr-book.html

Or "Support | IOS & NX OS | IOS 12.4 Mainline " from the home page.

Firewalls are a little different, but the syntax is still related. 
Kinda like French and Italian.

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/conf_gd.html

Or "Support | Security | PIX firewall software | Configuration Guide | 
Version 8.0" from the home page.

Note: Even though Cisco firewall appliances are now called ASAs, their 
documentation still cals them PIXes all over the place.

>> And it is actually pretty intuitive...
>>
>> - Give each interface an ip address.
>> - Create your NAT tables.
>> - And off you go.
>
>  From what I've seen, you telnet into the router, enter a password, and
> then enter lines of gibberish such as "enh eth gw all". You would
> *definitely* need a manual to figure out WTH that actually means, or
> what the name of the command you want is.

Two things:

First thing, typing ? at any point will list all the available commands 
at that point.

Second thing, you don't have to enter gibberish.  the commands are plain 
english words.  They can be abbreviated for speed, but

sh ip int fa0/0 bri

Is exactly the same as typing

show ip interface fastethernet0/0 brief

which would show you a brief summary of all the stats it keeps for the 
IP protocol on interface fastethernet0/0. (protocol distribution, packet 
counts, etc...)

>
>> The only difference between a Cisco firewall and a D-link or NetGear
>> home router, besides performance and scalability, is that you can (and
>> should!) override the basic "everything outbound is ok, nothing inbound
>> can come in" configuration.
>
> I'm still guessing that, between the configuration for routing to
> multiple LANs, multiple VPN endpoints, and remote access, adding a line
> that forwards SSH to a port on a desktop PC who's IP address is
> configured via DHCP is probably going to take some doing. (!)

Routing for the multiple lans actually comes straigh out of the box. 
You confiugre an ip address on all the interfaces and it will know that 
any packets it receives whose destination is on another lan interface, 
it will forward it (let's disregard security rules, for the moment!). 
Remote lans are handled the same way they would be on a Windows or Unix 
machine.  By either configuring a routing protocol, or by adding static 
routes.

On Windows, you'd type:

route add 192.168.200.0 mask 255.255.255.0 192.168.1.1

On a router, you'd type:

ip route 192.168.200.0 255.255.255.0 192.168.1.1

On a firewall, you'd type:

ip route [interfacename] 192.168.200.0 255.255.255.0 192.168.1.1

You have to specify the interface name because, as opposed to a router, 
the firewall will drop any packet that has to be routed back out the 
same interface it came in.

VPN endpoints are not more complicated than on any other platform, but 
that's a bit like saying that changing the transmission of a Formula One 
is not more complicated than changing it on a Toyota...  It may not Be 
for a complete noob.

Allowing inbound ssh connections will need that PC to have a static NAT 
address, and therefore a static local IP address.  Your Netgear or 
Linksys home router can work around this because it also acts as the 
DHCP server, so it knows to which MAC adress to send the traffic, but in 
an entreprise where the firewall is a separate piece of hardware, there 
is simply no way to do this.

>
> And we still have the minor issue that I don't have the password. :-P
>

If you have physical access to the box, you can do a password recovery 
and put a new password in, but since this would likely cost you your job 
and may very well land you in jail, I do not recommend you try it at the 
office....

> Actually, I have a NetGear router in my house. I used it to create a VPN
> between my house and my grandparents' house. It lets you do all sorts of
> port forwarding and stuff. The only trouble is... it's not reliable.
> Like, when certain datagrams pass through it, the firmware crashes, and
> you have to power-cycle it to get the Internet back. Eventually I was
> forced to take it out of the circuit, because it was pissing me off so
> much! (No, there isn't a firmware update available.)
>
> Given the price of the Cisco ASA, I'm almost tempted...
>


-- 
/*Francois Labreque*/#local a=x+y;#local b=x+a;#local c=a+b;#macro P(F//
/*    flabreque    */L)polygon{5,F,F+z,L+z,L,F pigment{rgb 9}}#end union
/*        @        */{P(0,a)P(a,b)P(b,c)P(2*a,2*b)P(2*b,b+c)P(b+c,<2,3>)
/*   gmail.com     */}camera{orthographic location<6,1.25,-6>look_at a }

Post a reply to this message