You are here: Home / Archives for Cisco

Upgrade Cisco IOS on the 877W

December 30, 2012 by · Leave a Comment

Cisco LogoYesterday it struck me I was using a less secure wireless setup while the more secure was just a simple configuration change away. While adjusting the configuration I noticed the software version was pretty dated because my last IOS update (12.4.24T1) was from May 2009. To stay current I decided to upgrade my home router.

12.4.24T8 is the latest IOS in the 12.4T series. This version was released on 19 September 2012. I don’t have enough flash capacity to store the new 15.1.4 release, so I will stick with the 12.4.24 release. So I downloaded c870-advipservicesk9-mz.124-24.T8.bin from Cisco.

I have described the steps below so it will be a walk in the park next time.

[Read more...]

Filed Under: Blog · Tagged With: , , ,

Improve wireless security on the 877W

December 29, 2012 by · Leave a Comment

cisco-877w-frontI just discovered my three year old Cisco wireless router was configured to do WPA encryption instead of the more secure WPA2 version, which is the standard nowadays. WPA uses TKIP (Temporal Key Integrity Protocol) while WPA2 is capable of using TKIP or the more advanced AES algorithm. Doing a search on Google it appears it’s just a IOS configuration option.

Change:

interface Dot11Radio0
no ip address
!
encryption vlan 2 mode ciphers tkip
!

To:

interface Dot11Radio0
no ip address
!
encryption vlan 2 mode ciphers aes-ccm
!

If the option is not there, your IOS version does not support it. I’m currently using: C870 Software, Version 12.4(24)T1 (c870-advipservicesk9-mz.124-24.T1.bin).

Filed Under: Blog · Tagged With: , ,

Intermittent WiFi signal

June 7, 2012 by · Leave a Comment

I experienced a intermittent WiFi signal lately on multiple devices. Since I haven’t touched my router configuration for a while it had to be something different. Some time passed before I realized it could be a neighbor who was using the same frequency I was using. Looking into my router configuration it turned out I was using a fixed frequency (2462).  Below are the frequencies that can be configured.

Channel 1 : 2412 Mhz 11g
Channel 2 : 2417 Mhz 11g
Channel 3 : 2422 Mhz 11g
Channel 4 : 2427 Mhz 11g
Channel 5 : 2432 Mhz 11g
Channel 6 : 2437* Mhz 11g
Channel 7 : 2442 Mhz 11g
Channel 8 : 2447 Mhz 11g
Channel 9 : 2452 Mhz 11g
Channel 10 : 2457 Mhz 11g
Channel 11 : 2462 Mhz 11g
Channel 12 : 2467 Mhz 11g
Channel 13 : 2472 Mhz 11g

While thinking about which new frequency to choose I figured out there is an option to choose the least congested. That’s what I need in an area where there are at least 30+ different access-points.

router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
router(config)#interface Dot11Radio0
router(config-if)#channel 2457
router(config-if)# channel ?
<1-2472>         One of: 1 2 3 4 5 6 7 8 9 10 11 12 13 2412 2417 2422 2427
2432 2437 2442 2447 2452 2457 2462 2467 2472
least-congested  Scan for best frequency

router(config-if)# channel least-congested
router(config-if)#end

Now every WiFi enabled device in the house is happy again.

Filed Under: Blog · Tagged With: , ,

Cisco 877W CCKM authentication failed

August 10, 2009 by · 1 Comment

Using the wireless functionality of the Cisco 877W router I discovered that the wireless connection being disconnected en reconnected intermittently. At fist I thought it might be my Linux notebook doing wierd things, but as other wireless clients acting the same I suspected my new broadband router. Looking at the router log it appears that Cisco IOS reports “CCKM authentication failed”, in which CCKM stands for Cisco Centralized Key Management.

%DOT11-7-CCKM_AUTH_FAILED: Station 0016.44d7.xxxx CCKM authentication failed

So I started searching the web for this particular error message. As I found out more people have reported it and some were suggesting raising the broadcast key change interval, but that didn’t work for me. Also downgrading the IOS software was mentioned, but hey I don’t like to downgrade so I upgraded to a more up to date IOS version and the problem seems to be fixed! The last two days since the upgrade there are no more annoying dis- and reconnects. It starting to look like Cisco has done a good job!

I did the upgrade from IOS version c870-advipservicesk9-mz.124-22.T.bin to c870-advipservicesk9-mz.124-24.T1.bin.

Beware of IOS version c870-advipservicesk9-mz.124-24.T.bin, this one seems to be unstable.

This will most certainly apply to the complete Cisco 870 series.

Filed Under: Blog · Tagged With: ,

Cisco doing secure SNMP

June 3, 2009 by · Leave a Comment

Version 3 of the Simple Network Management Protocol (SNMP) is developed with as main purpose securing the insecure SNMP protocol. Since I needed to setup SNMP for a monitoring tool I decided to do it the secure way, which is SNMP v3. This article will describe how to configure SNMPv3 on a Cisco device using Cisco IOS, in my case a broadband router.

The first task is to login at the console as a privileged user and switch to configuration mode.

router#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
router(config)#

The next task is to define a view. To keep it simple, we’ll create a view that allows access to the entire internet subtree:

#snmp-server view readview internet included

Next, create a group that uses the just created view. This command creates a group called readonly and v3 means that SNMPv3 should be used. The auth keyword specifies that the entity should authenticate packets without encrypting them. The read readview says that the view named readview should be used whenever members of the readonly group access the router.

#snmp-server group readonly v3 auth read readview

The following command creates a user called snmpro, who belongs to the readonly group. auth md5 specifies that the router should use MD5 to authenticate the user (sha is also possible). The next item is the user’s password or passphrase, which is limited to 64 characters. The last item priv des56 specifies the encryption of the SNMP packets.

#snmp-server user snmpro readonly v3 auth md5 password priv des56 passphrase

This configuration uses encryption to prevent passwords from being transferred in clear text and also encrypts the SNMP packets themselves, which may contain information that you don’t want available to the public.

End config mode with CNTL/Z or simple type ‘end’. And issue ‘write mem’ to save the current configuration to non-volatile memory to make this change permanent.

router(config)#end
router#write mem
Building configuration...
[OK]
router#

To verify if it’s working you can use snmpwalk. In the example below I use a Linux system to execute the snmpwalk command to request the system description (sysDescr.0) from a host called router.

$ snmpwalk -v 3 -u snmpro -l authPriv -a MD5 -A password -x DES -X passphrase \
router sysDescr.0
SNMPv2-MIB::sysDescr.0 = STRING: Cisco IOS Software, C870 Software (C870-ADVSECURITYK9-M), Version 12.4(15)T5, RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 01-May-08 02:31 by prod_rel_team
$

As you can see the system description is returned successfully.

Filed Under: Blog · Tagged With: ,

877W wireless config

May 13, 2009 by · 4 Comments

As mentioned earlier I would post my wireless configuration of the Cisco 877W router as soon as I got it to work the way I like. In this setup the commonly used IRB bridge option is not used. This configuration will also work on the 857W model.

!
dot11 ssid <your ssid>
   vlan 2
   authentication open
   authentication key-management wpa
   guest-mode
   wpa-psk ascii 0 <your password>
!
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.2.1
!
ip dhcp pool wireless
   network 192.168.2.0 255.255.255.0
   default-router 192.168.2.1
   dns-server <dns server> <dns server>
!
interface Dot11Radio0
 no ip address
 !
 encryption vlan 2 mode ciphers tkip
 !
 ssid <your ssid>
 !
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
 channel least-congested 2412 2442 2462
 station-role root
 no cdp enable
!
interface Dot11Radio0.1
 description WLAN vlan2
 encapsulation dot1Q 2
 ip address 192.168.2.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 no cdp enable
!
interface Vlan2
 no ip address
!

On the (outside) dialer0 interface I had to add the following line to enable NAT:

ip nat outside

And at last you’ll need the next ip nat and access-list lines to make it work:

ip nat inside source list 103 interface Dialer0 overload
access-list 103 remark Traffic allowed to enter the router from the WLAN
access-list 103 permit 192.168.2.0 0.0.0.255

You can use the show dot11 or debug dot11 commands to troubleshoot. For example, the following output displays a associated device:

router#show dot11 associations

802.11 Client Stations on Dot11Radio0:

SSID [<your ssid>] :

MAC Address    IP address      Device        Name            Parent         State
xxxx.xxxx.xxxx 192.168.2.2     unknown       -               self           Assoc

router#

Enjoy being wireless!

Filed Under: Blog · Tagged With: , , ,

New ISP, new router

May 4, 2009 by · 4 Comments

Recently I had to choose another ISP for my home internet connection, and because my previous modem was a bit limited in it’s capabilities I decided it was time to invest in a Cisco 877W Integrated Services Router.
The main reason to choose for the 877W is that I used to work with Cisco appliances, so I’m familiar with IOS and like the CLI to manage the device.

After unpacking the device I connected the serial console cable which comes with the 877W to my laptop and turned on the device. The first step was to make the internal LAN work. My new internet connection comes with 8 public IP addresses, so I had to change my internal LAN from private space to public. Now the LAN part was done I could setup the WAN interface, which took quite some time to figure out how to setup correctly.

While discovering the device it appeared that the preinstalled IOS version was a really old one that goes back to 2006. I decided to load a more recent firmware image, better safe than sorry.

With the following specs I’ve created a configuration that works well for the SurfSnel ADSL product of InterNLnet:

Provider: InterNLnet (SurfSnel ADSL)
Protocol: PPPoA routed (RFC 2364)
Encapsulation: VC MUX
VPI/VCI: 0/35
Authentication: PAP

!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service sequence-numbers
!
hostname router
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
clock timezone CET 1
clock summer-time CET recurring last Sun Mar 2:00 last Sun Oct 3:00
!
dot11 syslog
no ip source-route
ip cef
!
!
ip inspect name firewall appfw firewall
ip inspect name firewall tcp
ip inspect name firewall udp
ip inspect name firewall cuseeme
ip inspect name firewall h323
ip inspect name firewall rcmd
ip inspect name firewall realaudio
ip inspect name firewall streamworks
ip inspect name firewall vdolive
ip inspect name firewall sqlnet
ip inspect name firewall tftp
ip inspect name firewall ftp
ip inspect name firewall icmp
ip inspect name firewall esmtp max-data 52428800
ip inspect name firewall fragment maximum 256 timeout 1
ip inspect name firewall netshow
ip inspect name firewall rtsp
ip inspect name firewall pptp
ip inspect name firewall skinny
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
ip domain name yourdomain.com
ip name-server 217.149.196.6
ip name-server 217.149.192.6
!
appfw policy-name firewall
  application http
    strict-http action allow alarm
    content-type-verification unknown-type match-req-rsp action allow alarm
    port-misuse tunneling action allow alarm
!
!
archive
 log config
  hidekeys
!
!
interface ATM0
 description Physical ADSL (ATM) Interface
 no ip address
 no ip proxy-arp
 no atm ilmi-keepalive
 dsl operating-mode auto
 dsl enable-training-log
!
interface ATM0.1 point-to-point
 description ATM subinterface enables PPP over ATM
 no ip proxy-arp
 pvc 0/35
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Dot11Radio0
 no ip address
 shutdown
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
 station-role root
!
interface Vlan1
 ip address 145.99.xxx.xxx 255.255.255.248
 ip access-group 102 in
 ip virtual-reassembly
!
interface Dialer0
 ip address negotiated
 ip access-group 101 in
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip mtu 1492
 ip inspect firewall in
 ip virtual-reassembly
 encapsulation ppp
 dialer pool 1
 dialer idle-timeout 0
 dialer-group 1
 no cdp enable
 ppp pap sent-username <username>@dsl.inter.nl.net password 0 <password>
 ppp ipcp dns request
 ppp ipcp route default
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
access-list 101 remark Traffic allowed to enter the router from the Internet
access-list 101 permit tcp any any established
access-list 101 permit icmp any any administratively-prohibited
access-list 101 permit icmp any any echo
access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any packet-too-big
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any traceroute
access-list 101 permit icmp any any unreachable
access-list 101 remark DNS In and Out
access-list 101 permit udp any eq domain any eq domain
access-list 101 permit udp any eq domain any gt 1023
access-list 101 remark DHCP client requests
access-list 101 permit udp any eq bootps any eq bootpc
access-list 101 remark NTP client requests
access-list 101 permit udp host 192.87.106.2 eq ntp any eq ntp
access-list 101 permit udp host 192.87.36.4 eq ntp any eq ntp
access-list 101 permit udp host 192.87.110.2 eq ntp any eq ntp
access-list 101 deny   ip any any log
dialer-list 1 protocol ip permit
no cdp run
!
!
control-plane
!
!
line con 0
 login local
 no modem enable
line aux 0
line vty 0 4
 privilege level 15
 login local
 transport input telnet ssh
!
scheduler max-task-time 5000
ntp clock-period 17179591
ntp source Vlan1
ntp server 192.87.36.4
ntp server 192.87.106.2 prefer
ntp server 192.87.110.2
end

The above configuration will most likely also work on the 857W! As you’ll probably notice the wireless configuration has not been setup, so later more on this story..

Filed Under: Blog · Tagged With: , , ,