Skip to content


Cisco Netflow performance data

Not much of a post but link to the Cisco site stating how much Netflow loads the Cisco routers:
Netflow data sheet
I, personally, do a lot of Netflow monitoring and can say that on unloaded routers , passing 2-5 mbits/sec of traffic, the additional load will be some 1-2% of CPU cycles. For the most loaded pair of routers I do monitoring for , two Cisco 2800 passing about 70 Mbits/sec of traffic and creating about 900 Mbytes of Netflow data a day each, enabling Netflow added 8% of CPU load and they cope with it perfectly well.

Posted in Cisco, IOS Cisco.

Tagged with , , .


My Amazon book list for CCIE Security Lab exam

Not limited to CCIE Security Lab only, of course, here is the list of books I find really useful in preparing for the Lab .
Amazon Listmania list

Posted in ASA/PIX Cisco, Cisco, IOS Cisco.

Tagged with , , .


Cisco ASA 5500 Series Content Security and Control Security Services Module or just CSC-SSM and how it looks

While the reason for me getting involved with this ASA 5510 module is of less interest (client was getting notification message ” LogServer has recently stopped on InterScan for CSC SSM” , more about that at the end of the post) , the module itself looks cute , so I bring here some output to give you a taste what it is.
- General status of the module from ASA CLI prompt.

See that some traffic actually gets redirected to the module.
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
class global-class
csc fail-open

#show service-policy

Class-map: global-class
CSC: packet sent 324010194
CSC: packet received 359600712

# show module 1 det

Getting details from the Service Module, please wait…
ASA 5500 Series Content Security Services Module-10
Model: ASA-SSM-CSC-10-K9
Hardware version: 1.0
Serial Number: JAF777777
Firmware version: 1.0(11)5
Software version: CSC SSM 6.3.1172.4
MAC Address Range: c333.7333.b333 to c333.7333.b333
App. name: CSC SSM
App. Status: Up
App. Status Desc: CSC SSM scan services are available
App. version: 6.3.1172.4
Data plane Status: Up
Status: Up
HTTP Service: Up
Mail Service: Up
FTP Service: Up
Activated: Yes
Mgmt IP addr: 192.168.21.119
Mgmt web port: 8443

# show module all

Mod Card Type Model Serial No.
— ——————————————– —————— ———–
0 ASA 5510 Adaptive Security Appliance ASA5510 JMX333333
1 ASA 5500 Series Content Security Services Mo ASA-SSM-CSC-10-K9 JAF333333

Mod MAC Address Range Hw Version Fw Version Sw Version
— ——————————— ———— ———— —————
0 3333.3333.3333 to 3333.3333.3333 2.0 1.0(11)5 8.2(3)
1 3333.3333.3333 to 3333.3333.3333 1.0 1.0(11)5 CSC SSM 6.3.1172.4

Mod SSM Application Name Status SSM Application Version
— —————————— —————- ————————–
1 CSC SSM Up 6.3.1172.4

Mod Status Data Plane Status Compatibility
— —————— ——————— ————-
0 Up Sys Not Applicable
1 Up Up

- Now let’s enter the module itself

# session 1

Opening command session with slot 1.
Connected to slot 1. Escape character sequence is ‘CTRL-^X’.

login: cisco
Password:
***NOTICE***
This product contains cryptographic features and is subject to United States
and local country laws governing import, export, transfer and use. Delivery
of Cisco cryptographic products does not imply third-party authority to import,
export, distribute or use encryption. Importers, exporters, distributors and
users are responsible for compliance with U.S. and local country laws. By using
this product you agree to comply with applicable laws and regulations. If you
are unable to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:

http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.
Trend Micro InterScan for Cisco CSC SSM Setup Main Menu
———————————————————————

1. Network Settings
2. Date/Time Settings
3. Product Information
4. Service Status
5. Password Management
6. Restore Factory Default Settings
7. Troubleshooting Tools
8. Reset Management Port Access Control List
9. Ping
10. Exit …

Enter a number from [1-10]:

- Are all services are actually running ?
Enter a number from [1-10]: 4

Service Status
———————————————————————

The CSC SSM RegServer service is running
The CSC SSM URLFD service is running
The CSC SSM ScanServer service is running
The CSC SSM HTTP service is running
The CSC SSM FTP service is running
The CSC SSM Notification service is running
The CSC SSM Mail service is running
The CSC SSM GUI service is running
The CSC SSM SysMonitor service is running
The CSC SSM Failoverd service is running
The CSC SSM LogServer service is running
The CSC SSM SyslogAdaptor service is running
The CSC SSM Syslog-ng service is running
The CSC SSM TMCM-Agent service is not enabled
- Troubleshooting information is rather overwhelming

Enter a number from [1-7]: 2

Troubleshooting Tools – Show System Information
———————————————————————

1. Show System Information on Screen
2. Upload System Information
3. Return to Troubleshooting Tools Menu

Enter a number [1-3]: 1
++++++++++++++++++++++
Thu Feb 17 08:04:17 IST 2011 (2)

System is : Up

#@ Product Information
Trend Micro InterScan for Cisco CSC SSM
Version: 6.3.1172.4
Upgrade History: 6.3.1172.4
Engineering Build:
SSM Model: SSM-10
SSM S/N: JAF7777777

#@ Scan Engine and Pattern Information
Virus Scan Engine: 9.2.1012 (Updated: 2010-10-14 07:51:11)
Virus Pattern: 7.841.00 (Updated: 2011-02-17 05:51:23)
Spyware/Grayware Pattern: 1.151.00 (Updated: 2011-02-17 06:51:20)
AntiSpam Engine: 6.5.1024 (Updated: 2010-10-14 07:51:54)
AntiSpam Rule: 17960 (Updated: 2011-02-16 16:53:55)
IntelliTrap Pattern: 0.151.00 (Updated: 2011-02-01 09:07:20)
IntelliTrap Exception Pattern: 0.631.00 (Updated: 2011-02-15 08:51:15)

#@ License Information
Product:Base License
License profile host info check OK.
Version:Standard
Activation Code:PX-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Seats:000100
Status:Activated
Expiration date:10/6/2011
Product:Plus License
License profile host info check OK.
Version:Standard
Activation Code:PX-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Status:Activated
Expiration date:10/6/2011

Daily Node Count: 221
Current Node Count: 85

#@ Kernel Information
Linux ssm 2.6.17.8 #13 PREEMPT Fri Nov 6 06:32:00 PST 2009 i686 unknown

ASDP Driver 1.1(0) is UP:
Total Connection Records: 159623
Connection Records in Use: 156
Free Connection Records: 159467

—— Shared Memory Segments ——–
key shmid owner perms bytes nattch status
0×00003186 4653056 root 666 2621440 1
0×00000000 4456449 root 600 16 2 dest
0×00000000 4620290 root 600 1000000 1 dest
0×00000000 4685827 root 600 1048576 1 dest
0×00000000 4718596 root 600 1048576 1 dest
0×00000000 4325381 isvw 600 24632 22 dest

Continued…

Posted in ASA/PIX Cisco, Cisco, Cisco IPS.

Tagged with .


How to enable SCP protocol on Checkpoint firewall for transferring files – video

Hi everyone, in this video I tell and show how to enable SCP file transfer in Checkpoint firewall. I am beta testing it at the present therefore a bit shy to present to the wide audience, but be sure to check later when this idea of my site goes public . Thanks and see you soon.

Posted in Checkpoint NG/NGX.

Tagged with .


Not sure what p2p-proxy-webspider-voip-bittorrent to use – ask Checkpoint

AppWiki from CheckpointRecently Checkpoint introduced new feature on their website – AppWiki that lists with short but informative descriptions lots of software they deem interesting enough.
Even more of goodies – it is public. Since I learned about this cute resource I don’t waddle through the zillions of pages in Google for say Twitter client ;) – I go straight to the AppWiki from Checkpoint and pick the one I like. To showcase I attach the screenshot of the website.
Thanks guys and gals and Happy New Year everyone.

Posted in Checkpoint NG/NGX.

Tagged with .


New Year present from Checkpoint – R75

New Year present from Checkpoint - R75Well, saying ‘present’ I was a bit sarcastic – just another release in the NGX family – R75 , that is now available for download: R75 release .

So go ahead , install it , use it, enjoy its new features and bugs and report back to the mothership .
Note At the present trial download of R75 is not available but you can download R71.10 that isn’t that different . The usual way to go – Trial software from Checkpoint.

Posted in Checkpoint NG/NGX.

Tagged with .


Check Point Certified Master Architect Certification is more accessible than ever

Hello, fellow checkpoint-heads.
I know you have been waiting for this for a long long time, and now it happens – Checkpoint announced that Check Point Certified Master Architect Certification lab can be taken at “convenience of your desktop” – that is Online. You don’t need to ride your horses over the dusty Texas any more, for mere 1500US$ you can take it online and be happy ever after (me thinks you will be happy anyway, cause if you can throw away easily 1500 bucks you are all set already).
In addition their CCSA/CCSE training classes are also available online,details on their website.

Posted in Checkpoint NG/NGX.

Tagged with .


CCIE Security travel diaries are here

Bonjour à tous , as they say in Brussels (sorry – Bruxelles) .

I started a new blog about preparing/thinking/sweating/labbing for/about/for/in Cisco CCIE Security Lab exam. You are welcome to read it here : ccie-security-blog.com. The first post is titled “Tips on how to fail your CCIE Security Lab exam” and summarizes my first attempt I took in November in Brussels.

Also it inevitable means I will post less and less here , about Checkpoint, so bear with me until I attain this coveted badge, CCIE Security Expert.

Cheers,

Happy New Year everyone!

Posted in ASA/PIX Cisco, Cisco, IOS Cisco.

Tagged with .


New spam on the block

May be not new , but new to me – spam mails that instead of direct links to their websites list links cached in google. So , you get in the email not http://degayfisk.com/ but http://google.nr/search?q=cache:c2tHRUQ2mx4J:google.co.nz
It is ,by the way, recognized by eSafe 8.5 as a Clean mail, what a shame.

Posted in Esafe.

Tagged with , .


Best open source Netflow/sFlow analyzing software

People ask me frequently what software I would   recommend   for Netflow analysis , especially with security implementations in mind.  I made my choice a long ago and haven’t been complaining so far – Nfsen graphical frontend that has Nfdump as its data processing backend . It provides most flexibility, configurability; its filter syntax is very tcpdump-like; graphic front provides just enough of interactivity; the alerts system is just amazing.Moreover it supports not only Netflow but sFlow as well,so all Fortigate appliances with the last OS can be monitored this way.

Posted in Firewall, Networking.

Tagged with , , .