Configuring Policy Based Routing on Cisco ASA


138 views

cisco

Overview

Normally when a routing device receives a packet it decides where to forward it based on the destination address of the packet. Policy Based Routing (PBR) is a mechanism which allows you forward packets based on policies manually defined by network administrators. A good use case for PBR is when a company which has multiple outside connections to different ISPs needs to control how traffic can be distributed across these connections. Compared to traditional routing PBR allows you to implement routing policies based on different criterias like source or destination address, source or destination port, protocol, size of the packet, packet classification and so on. Cisco introduced this feature on Cisco ASA beginning with version 9.4(1). Let’s dive into the PBR configuration.

Continue reading…

Configuring and deploying Cisco IOS certificate server


176 views

cisco

Overview

A Certificate Authority is a trusted entity is that issues digital certificates to devices which need secure communication and plays an important part in the public key infrastructure (PKI). There are several CA implementations provided by third-party CA vendors like Microsoft or the open source OpenSSL implementation but in this article we will focus on configuring the internal Certificate Authority server which is available on Cisco IOS. We will also discuss about the certificate enrollment process with a CA and how these digital certificates can be used for authentication purposes. This feature has been introduced in Cisco IOS version 12.3(4)T and it’s available only on Cisco IOS images with the security feature set.

Continue reading…

Configuring Cisco ASA active standby failover


1,014 views

cisco

Overview

In modern datacenters one of the most important things that needs to be addressed is uptime. Cisco ASA offers high availability mechanisms like failover in order to provide network uptime and redundancy. In order to configure failover we need two identical ASA devices connected to each other through a dedicated failover link and, optionally, a stateful failover link. There are two different failover modes that are supported on the ASA platform: active/standby and active/active. In this article we will focus only on configuring active/standby failover. In an active/standby failover setup only one unit called the active unit is passing traffic. The standby unit is used as a backup of the active unit and only accepts management connections (all transit traffic is dropped). When the active unit fails, it changes to the standby state while the standby unit changes to the active state.

Continue reading…

Configuring private vlans on Cisco switches


142 views

cisco

Overview

Private VLANs are used to provide layer 2 isolation between members of the same broadcast domain. Private VLANs are documented in RFC 5517. In a standard VLAN environment traffic between members of the same VLAN can flow without restrictions. We can think of private VLANs like a segmentation of a normal VLAN in multiple subdomains. This feature is available only on layer 3 Catalyst 3560s and higher switches. Private VLANs can be used to address two issues found in service provider networks. First using normal VLANs an ISP must assign one VLAN per customer and thus a scalability problem would arise if the ISP needs to support more than 4094 clients which is the maximum number of supported VLANs by a device. Secondly when using IP routing each VLAN requires a separate subnet, which can lead to IP address management problems by wasting unused IP addresses.

Continue reading…

How to configure Port Address Translation (PAT) on Cisco routers


56 views

cisco

Overview

Port Address Translation (PAT), is an extension to the well known Network Address Translation (NAT) protocol that allows multiple devices on a local area network (LAN) to access Internet resources using a single public IP address. NAT is defined in RFC 1631 and the main purpose of using it was to slow the depletion of public IP address space. A practical use of PAT is for example when an ISP allocates a public IP address for an organization which has many devices which need Internet access. PAT uses private IP address classes defined in RFC 1918 for all inside devices and also uses port numbers to identify the connection. When an internal host wants to communicate with the outside it sends a datagram with its private source address and a random port. The NAT router will then rewrite the source address and port with its public IP and sends the datagram to the requested resource. The response will come back to this same public address and port combination (called a socket) and can be translated back again.

Continue reading…

Page 1 of 4123...Last »