ASA 5506

The new ASA frustrated me for quite a while. First I couldn't get the ASDM to run. Turns out it needs Java 7. I use Java 6 for Cisco CCP (a software predating the ASDM). So after playing with my network I got it to work in a Linux virtual machine (I like to do all of my Cisco networking changes in one environment). Turns out that sometimes on that linux bot the ASDM just stops loading until you restart the software. Well beggars can't be choosers I guess (another reason why the CLI is better... that worked instantly no problems at all). I did find the initial set up of the router a bit more friendly. DHCP is already enabled. ASDM is already enabled, and the wizard in the ASDM is a bit more friendly.

I have 6 of these to configure. Three sites each with a failover unit. One of them is supposed to have wifi. I spent a good amount of time trying to login the the wifi part of the unit. I had to dig around for a while before I found the command "hw-module module wlan recover configuration" after running that I was able to finally get in. I will mention I did use the wrong IP at first the default IP is http://192.168.10.2 while I was using http://192.168.10.1 an simple quick read error. I got the 5GHz up but not the 2.4, still not sure why its not up.

This is mostly a bit of ranting to remind me of two things 1) the correct IP for the wife and 2) the fact that ASDM has to be on Java 7 on in a Linux box. As an aside I also was unable to use Chrome and had to use Firefox to get it to work right.

As an update to this post the 5506 will not run properly in the newest Java either. Java 8 update 51 is the closest I can find to allowing everything to run correctly. On a separate machine I had to revert back to Java 8 update 11. I haven't tested everything with both of them and in part it is because we tunnel into machines that we get some problems. I also found that my Linux vm won't do for configuring everything on these machines as it doesn't show the entire spectrum of options. I am not sure why but this means that I will have to continue to have a windows box (or two depending on what we do with our old router I need Java 6 on).

SELinux

So I have commented on SELinux before and to be honest it frustrates me very badly, but it also makes a system much more secure. I have heard taht A lot of people just turn SELinux off. Working with Health Care info that is not an option.

I have found that most of the time you can either fix it simply by going through the logs and a quick google search or if you know the context is supposed to be like another files by copying it (for example I ran into an error when a file did not have permissions due to recently being ssh'd over so a service would not start). I have found 2 commands to be extremely helpful.

This one copies the security permissions of one file to the new one
chcon --reference=/path/to/existingfile /path/to/newfile

The other one is restorecon -R /path/to/file(s) which I had to do when I deleted the entire folder in /etc/folder that was being used instead of just the contents of the folder.

All in all I have to say PLEASE don't just disable SELinux. You'll find the answer somewhere that's what the internet is for.

.eml file? and other IE uses

So I haven't done much ever with outlook and I have only dinked around with Thunderbird. These applications just are just too much from what I want in email. I do know however that many people use them in a professional environment. Normally this has no problem in sending emails back and forth but I got an attachment as a .eml file. I needed the file because it had how to set up specific VPN. Turns out this is a file type that Outlook and Thunderbird use (and quite possibly other systems from what I can gather)!

There are a few solutions to viewing it, changing the extension to be html and any browser will work but as it turns out the only one that will simply load it (and format it perfectly) was Internet Explorer.

Now I dislike IE as much as the next guy (well any one under the age of 60 to be fair), but as it turns out I have found 2 uses for it now. One being this .eml file viewer and the other being that you can disable the certificate check. Normally I would say NEVER DO THIS and if you are using IE make sure it is enabled but in my case it was necessary as the certificate was never properly installed on a server (which is now in the process of being fixed so we can all go back to using Chrome and Fire Fox).

I mentioned installing certificates for websites in this post but I probably will not write on that if I don't do it for a personal site. It is a fairly straight forward process that involves creating a .csr and .key files and uploading/emailing them and then downloading the .crt file and it will depend on who you get your domain from etc. Most sites will have specific instructions on how to make them.

Here is the one from GoDaddy. It also has ones for generating a CSR etc.

Learning Python

So I am learning the python coding language (definatly not my favorite) but it can be a powerful tool (just like any language). There are lots of tools for free (don't go and spend money on learning a language unless you have to for a class).

There is a book for about $25 - $30 called Learn Python the Hard Way. Well the guy (Zed Shaw) decided to also publish everything online free (with option to pay for support and videos etc).

http://learnpythonthehardway.org/

I have found it useful but at the same time I am not using it enough for it to be amazing, although it has helped me understand some of the back end things that go on with our system.

I am currently on lesson 24 of 50. I have to say this is a good site to use to teach the basics for anyone who wants to learn a language. I will most likely post when I finish. The real learning comes with doing the additional work though, not just creating the mimic files he makes.

Most of what I have done has been in the Cisco field, as such I was able to take a few basics and use them to rewrite the Cisco config quickly so I can use the same basic schema with a few differences.

Lots of New Stuff

So I went to Open West there was a lot of cool things. I tried to get Fedora 21 up and running but turned out I had a server disk and I am not too good with out a GUI so I ended up not able to create my VPN yet. Fedora 22  is coming out (it comes out the 26th of this month).

In the mean time a quick update about things I think are interesting. So I have been in both a PCI and HIPPA environment now, and as such I have dealt with different security things. Hopefully I can find some things to show.

In the mean time a quick note about Wifi security I learned at Open West: Wifi security is crap. You can do a lot of things to be more secure, but all and all if someone wants to get you they can.

Here are the things you can do to make you more secure than your neighbor though, which means they get hacked and not you!
-Once you have every device you want connected turn off your SSID broadcasting.
-Don't have a password under 10 characters (the guy giving the seminar said his is over 50, but he was a little extreme, Mine is about 15) and make it alpha numeric, the more random the better.
-Use WPA2 encrytion, for now that is the most secure.
-Pay attention to what Wifi you are connecting too. There are devices that can essentially broadcast and connect your computer to any network.

That is it for this update. I will be dedicating some time to blogging this week so we should see regular updates again for a while at least.

Cisco Site to Site VPN

So the reason I have not posted is because I have been working on setting up a site to site VPN using Cisco. I had gone through the configs a few times and couldn't figure out what I was doing wrong. After a week we got Cisco support involved, but it took a week to get the support.

All in all I found out a few things in the process. The most important thing I found out was that make sure you send the correct data to the other end. I had put in an incorrect IP in the form I sent them which made my end correct according to what they sent me and their end incorrect.

I'll post some of the other things I learned along the way in another post (for example the troubleshooting that I did).

I am also planning on putting up a VPN at home this week so I will let you know how it goes!

Tunneling

So sometimes it is necessary to tunnel to get access to a router (which is a way more secure way to get to that router).

Windows:
Windows doesn't have a native terminal. I use PuTTY (tty - teletypewriter new fun fact)
UPDATE: Windows 10 does have a Linux terminal now (its basically an Ubuntu shell if I remember correctly). I will add a post on how to enable it but honestly I have found I prefer KiTTY.
In the settings under Connections>SSH>Tunnels you can add a tunnel. Source port is the port you want to connect through and then the ip of the gateway and port. Click add and it adds it to the list above.

Then go to 127.0.0.1:8080

For those seeking an alternative to PuTTY I found KiTTY it is similar but gives the end user a few more options, as well as allows for saving sessions to a directory or registry. I am pretty sure it was built with the PuTTY backbone though.

Linux:
ssh -f user@ip.of.lan.machine -L 8080:ip.of.default.gateway:443 -N
-L is for local-port:hostname:remote-port format
-N is to not execute a command on the remote system.

Then go to 127.0.0.1:8080 -note if it is https you may have to put in https:// before the 127
A Ctrl + c should end the tunnel.