Protected DMVPN

! R2

show ip nhrp : it displays mapping

show dmvpn

show ip route eigrp

ping 10.4.4.4 source 10.2.2.2 repeat 2

! R1
show crypto isakmp policy

conf t
crypto isakmp policy 5 : lower the number better the priority
hash sha
authentication pre-share
group 14
lifetime 86400
encr aes 256
exit

crypto isakmp key cisco123 address 0.0.0.0 : anybody having this key will be able to peer with R1

crypto ipsec transform-set OURSET esp-aes 256 esp-sha-hmac : for ike phase 2
mode transport : default mode is tunnel
exit

crypto ipsec profile OUR_IPSec_PROFILE
set transform-set OURSET
exit

interface tunnel 0
tunnel protection ipsec profile OUR_IPSec_PROFILE
exit

int gig 1/0
shutdown

no shutdown
end

! Repeat above on R2 - R4

! R2
show ip route

show ip route eigrp

show ip nhrp

ping 10.4.4.4 source 10.2.2.2 repeat 1

ping 10.3.3.3 source 10.2.2.2 repeat 1

show dmvpn

ping 10.3.3.3 repeat 1

show dmpvn

show dmvpn detail

show dmvpn peer nbma 45.0.0.4 detail

show crypto isakmp sa

show crypto isakmp sa detail

show crypto ipsec sa peer 15.0.0.1

show crypto ipsec sa peer 45.0.0.4

show dmvpn detail

Naked DMVPN

To have full connectivity between headquarter and remote routers.

! R1 HUB no IPsec yet
show ip int brief

conf t
int tunnel 0
tunnel source gig 1/0
tunnel mode gre multipoint: instead of specifying destination we specify dynamic multipoint vpn
tunnel key 6783: should match on any incoming traffic


NHRP config :
ip nhrp network-id 1: network should match
ip nhrp authentication cisco123
ip nhrp map multicast dynamic: learn NBMA address dynamically
ip nhrp shortcut
ip nhrp redirect
Above two commands are part of phase 3

ip address 172.16.0.1 255.255.255.0 : GRE address

tunnel path-mtu-discovery
no tunnel path-mtu-discovery

ip mtu 1400
ip tcp adjust-mss 1360
end

! Spoke R2:
conf t
interface tunnel 0
tunnel mode gre multipoint
tunnel source gig 1/0
tunnel key 6783

ip nhrp network-id 1
ip nhrp authentication cisco123
ip nhrp shortcut
ip nhrp nhs 172.16.0.1
ip nhrp map 172.16.0.1 15.0.0.1
ip nhrp map multicast 15.0.0.1

ip address 172.16.0.2 255.255.255.0
ip mtu 1400
ip tcp adjust-mss 1360
end

! R3
conf t
interface tunnel 0
tunnel mode gre multipoint
tunnel source gig 1/0
tunnel key 6783

ip nhrp network-id 1
ip nhrp authentication cisco123
ip nhrp nhs 172.16.0.1
ip nhrp map 172.16.0.1 15.0.0.1
ip nhrp map multicast 15.0.0.1
ip nhrp shortcut

ip address 172.16.0.3 255.255.255.0
ip mtu 1400
ip tcp adjust-mss 1360
end

! R4
conf t
interface tunnel 0
tunnel mode gre multipoint
tunnel source gig 1/0
tunnel key 6783

ip nhrp network-id 1
ip nhrp authentication cisco123
ip nhrp nhs 172.16.0.1
ip nhrp map 172.16.0.1 15.0.0.1
ip nhrp map multicast 15.0.0.1
ip nhrp shortcut

ip address 172.16.0.4 255.255.255.0
ip mtu 1400
ip tcp adjust-mss 1360
end


! R1 hub routing
show ip nhrp

To advertise networks:
R1#conf t
router eigrp 777
no auto-summary
network 10.0.0.0
network 172.16.0.0
exit


To disable split-horizon on eigrp:
interface tunnel 0
no ip next-hop-self eigrp 777 : to disable next-hop-self
no ip split-horizon eigrp 777
end

show ip protocols

!On R2-R3-R4
conf t
router eigrp 777
no auto-summary
network 10.0.0.0
network 172.16.0.0
end

!  R1
show ip eigrp neighbors
show ip route eigrp

! R2
show ip route eigrp

show ip route 10.4.4.4

show ip nhrp summary

show ip nhrp

debug nhrp

ping 10.4.4.4 repeat 1 source g 2/0

undebug all

show ip nhrp brief

Implementing IOS Based IPS

Risk Rating (RR) = Fidelity*Severity*TVR/10,000

All of the signatures used are a subset of the exact same signatures used across the cisco IPS family of IPS sensors.

AIP-SSM: Advanced inspection and prevention security Appliance
A removable module that runs IPS 5.x s/w

IPS can detect:
worms
virus
application abuse
application embedded attacks
stateful pattern recognition
protocol analysis
traffic anomaly detection
protocol anomaly detection

AIP-SSM can work in either of modes.
1. Promiscuous Mode (copies of traffic) - Intrusion detection
Can block connection
can reset a connection
can generate an alert

2. Inline Mode (actual traffic) Intrusion prevention
can block traffic

ASDM Config :
Configuration -> Security Policy -> Service Policy rules -> Add ->
Interface -> policy name -> Next -> create class map -> Next -> Add service policy -> Next
-> select Intrusion Prevention -> inline Mode -> finish -> apply -> save

asa# show module
asa# session 1
login : cisco
pass : cisco
sensor1# setup
yes
hostname : sensor1
ip address : 10.0.1.55/24, 10.0.1.2
enter web-server port 443
modify current access : yes
current access list entries
10.0.1.0/24
modify system clock settings no
sensor1 # reset
yes

On ASDM :
configuration -> IPS -> mgmt ip address -> continue -> provide IPS credentials ->