Apr
5
2018
Cisco Smart Install Remote Code Execution
Cisco-Smart-Install-Remote-Code-Execution

At the end of March, Cisco published a stack-based buffer overflow vulnerability in Smart Install Client code. This vulnerability enables an attacker to remotely execute arbitrary code without authentication. So it allows getting full control over a vulnerable network equipment. Cisco Smart Install is a “plug-and-play” configuration and image-management feature that provides zero-touch deployment for new (typically access layer) switches. The feature allows a customer to ship a Cisco switch to any location, install it in the network, and power it on without additional configuration requirements. The Smart Install feature incorporates no authentication by design.

Feb
3
2018
Cisco WebVPN critical bug. Patch it now!
Cisco-WebVPN-critical-bug-patch-it-now

Few days ago, Cisco published a critical advisor with a score of 10/10 about ASA and Firepower devices. The vulnerability known as CVE-2018-0101 and discovered by Cedric Halbronn, Senior Researcher at NCC Group is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. This vulnerability allows the attacker to see all of the data passing through the system and provides them with administrative privileges, enabling them to remotely […]

Jan
10
2018
Cisco EIGRP named, a better approach
Cisco-EIGRP-named-a-better-approach

The Enhanced Interior Gateway Routing Protocol can be configured using either the classic mode or the named mode. The classic mode is the old way of configuring EIGRP. In classic mode, EIGRP configurations are scattered across the router mode and the interface mode. The named mode is the new way of configuring EIGRP; this mode allows EIGRP configurations to be entered in a hierarchical manner under the router mode. Each named mode configuration can have multiple address families and autonomous system number combinations. In the named mode, you can have similar configurations across IPv4 and IPv6.

Oct
17
2017
WPA2 is no more secure
WPA2-is-no-more-secure

WPA2 (Wi-Fi Protected Access 2) is a network security technology commonly used on Wi-Fi wireless networks. It’s an upgrade from the original WPA technology, which was designed as a replacement for the older and much less secure WEP. WPA2 is used on all certified Wi-Fi hardware since 2006 and is based on the IEEE 802.11i technology standard for data encryption. Yesterday, researchers Mathy Vanhoef and Frank Piessens, from the University of Leuven, has officially published a series of vulnerabilities that target the session establishment and management process in WPA(1/2)-PSK and WPA(1/2)-Enterprise. I say “officially” because the first notification by this […]

Sep
25
2017
The power of prefix lists
The-power-of-prefix-lists

Prefix lists are used in route maps and route filtering operations and can be used as an alternative to access lists in many route filtering commands. The most notable and important difference is that a prefix-list allows you to filter networks based on their subnet mask. ACLs used in distribute list filter networks only by network addresses but they do not perform matching on subnet mask; in other words, for an ACL used in distribute list, the networks 192.168.100.0/24 and 192.168.100.0/28 are indistinguishable. Moreover, the prefix-list also allows you to specify networks in much more natural format that ACLs.

Apr
27
2017
How to install Cisco ISE using USB or CIMC interface
Cisco-ISE-CIMC

In one of my last job activities, the customer has requested to reinstall the Cisco ISE appliance (SNS-3495). The first option, a DVD reader, is not feasible due the large ISO image file; in fact, the Cisco ISE Software Version 2.2.0 full installation iso file requires more or less 8Gb. So, how can we install the software? There are two options: Using an USB pendrive(al least 16Gb) Using the Cisco Integrated Management Interface (CIMC)

Feb
8
2017
Cisco will fail after 18 months
Cisco-fail-18-months

Recently, Cisco published a critical advisory concerning a clock signal component problem. Devices that contain the faulty component could potentially fail after 18 months of use; once the component has failed, the system will stop functioning, will not boot, and is not recoverable. Cisco did not release specifics of the faulty clock part, but probably the component affected by this problem is the Intel’s Atom C2000 processor family that effectively bricks devices. There is no workaround for this issue, so the only solution is to replace products under warranty or covered by any valid services contract dated as of November 16, […]

Feb
1
2017
Cisco 2017 Annual Cybersecurity Report
Cisco-2017-Cybersecurity-Report

Cisco published the annual Cybersecurity report that presents the latest security industry advances designed to help organizations and users defend against attacks. The report also highlights major findings from the Cisco 2017 Security Capabilities Benchmark Study, which examines the security posture of enterprises and their perceptions of their preparedness to defend against attacks.

Jan
16
2017
How to access network devices via Radius server
How-to-access-network-devices-via-radius-server

Suppose you manage hundreds of Cisco devices; how can you connect and secure it against unauthorized access? You can use local username, but it isn’t scalable and granular, or use an AAA Server. In fact, the benefits of AAA are: Increased flexibility and control of access configuration. Scalability. Standardized authentication methods. Multiple backup system. Additionally, AAA provides a modular way of performing the following services:

Nov
23
2016
DDNS: How to manage a device with a dynamic public IP

The DDNS aka Dynamic DNS is an old feature that several routers (non only Cisco devices) have implemented and, in some circumstances, it is very useful. DDNS is a method of automatically updating a name server in the Domain Name System (DNS), often in real time, with the active DDNS configuration of its configured hostnames, addresses or other information. It provides two mechanisms to generate or perform DDNS: the IETF standard as defined by RFC 2136 and a generic HTTP using various DNS services. In a nutshell, when this feature can simplify our lifes? When we haven’t a static IP public […]

Pages:1234567...26»