CISCO CALL MANAGER BEST PRACTICES....
http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a00807f8b31.shtml
I would strive to bring you the latest happenings in the Networking area, life beyond networking ( entertainment ) and personal musings.
CISCO CALL MANAGER BEST PRACTICES....
http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a00807f8b31.shtml
Using PPTP for Remote Access
This section describes how to implement the Point-to-Point Tunneling Protocol (PPTP) using the PIX Firewall. It contains the following topics:
Overview
The firewall provides support for Microsoft PPTP, which is an alternative to IPSec handling for VPN clients. While PPTP is less secure than IPSec, PPTP may be easier in some networks to implement and maintain.
The vpdn command implements the PPTP feature for inbound connections between the firewall and a Windows client. Point-to-Point Tunneling Protocol (PPTP) is a Layer 2 tunneling protocol, which lets a remote client use a public IP network to communicate securely with servers at a private corporate network. PPTP tunnels the IP protocol. RFC 2637 describes the PPTP protocol.
Support is provided for only inbound PPTP and only one firewall interface can have the vpdn command enabled.
Supported authentication protocols include: PAP, CHAP, and MS-CHAP using external AAA (RADIUS or TACACS+) servers or the firewall local username and password database. Through the PPP IPCP protocol negotiation, the firewall assigns a dynamic internal IP address to the PPTP client allocated from a locally defined IP address pool.
The firewall PPTP VPN supports standard PPP CCP negotiations with Microsoft Point-To-Point Encryption (MPPE) extensions using RSA/RC4 algorithm. MPPE currently supports 40-bit and 128-bit session keys. MPPE generates an initial key during user authentication and refreshes the key regularly. In this release, compression is not supported.
When you specify MPPE, use the MS-CHAP PPP authentication protocol. If you are using an external AAA server, the protocol should be RADIUS and the external RADIUS server should be able to return the Microsoft MSCHAP_MPPE_KEY attribute to the firewall in the RADIUS Authentication Accept packet. See RFC 2548, "Microsoft Vendor Specific RADIUS Attributes," for more information on the MSCHAP_MPPE_KEY attribute.
Cisco Secure ACS 2.5/2.6 and higher releases support the MS-CHAP/MPPE encryption.
The firewall PPTP VPN has been tested with the following Microsoft Windows products: Windows 95 with DUN1.3, Windows 98, Windows NT 4.0 with SP6, and Windows 2000.
Note If you configure the firewall for 128-bit encryption and if a Windows 95 or Windows 98 client does not support 128-bit or greater encryption, then the connection to the firewall is refused. When this occurs, the Windows client moves the dial-up connection menu down to the screen corner while the PPP negotiation is in progress. This gives the appearance that the connection is accepted when it is not. When the PPP negotiation completes, the tunnel terminates and the firewall ends the connection. The Windows client eventually times out and disconnects.
PPTP Configuration
Use the vpdn command with the sysopt connection permit-pptp command to allow PPTP traffic to bypass checking of access-list command statements.
The show vpdn command lists tunnel and session information.
The clear vpdn command removes all vpdn commands from the configurations and stops all the active PPTP tunnels. The clear vpdn all command lets you remove all tunnels, and the clear vpdn id tunnel_id command lets you remove tunnels associated with tunnel_id. (You can view the tunnel_id with the show vpdn command.)
The clear vpdn group command removes all the vpdn group commands from the configuration. The clear vpdn username command removes all the vpdn username commands from the configuration. The clear vpdn command removes all vpdn commands from the configuration.
You can troubleshoot PPTP traffic with the debug ppp and debug vpdn commands.
PPTP Configuration Example
Example 8-3 shows a simple configuration, which lets a Windows PPTP client dial in without any authentication (not recommended). Refer to the vpdn command page in the Cisco PIX Firewall Command Reference for more examples and descriptions of the vpdn commands and the command syntax.
Example 8-3 PPTP Configuration Example
ip local pool my-addr-pool 10.1.1.1-10.1.1.254
vpdn group 1 accept dialin pptp
vpdn group 1 client configuration address local my-addr-pool
vpdn enable outside
static (inside, outside) 209.165.201.2 192.168.0.2 netmask 255.255.255.255
access-list acl_out permit tcp any host 209.165.201.2 eq telnet
access-group acl_out in interface outside
The ip local pool command specifies the IP addresses assigned to each VPN client as they log in to the network. The Windows client can Telnet to host 192.168.0.2 through the global IP address 209.165.201.2 in the static command statement. The access-list command statement permits Telnet access to the host.
Importance Of Directed Broadcasts
Do we know what problem we will face if we enable ' ip directed-broadcast' in an Interface???
IP directed broadcasts are used in the common and popular smurf denial of service attack, and can also be used in related attacks.
An IP directed broadcast is a datagram which is sent to the broadcast address of a subnet to which the sending machine is not directly attached. The directed broadcast is routed through the network as a unicast packet until it arrives at the target subnet, where it is converted into a link-layer broadcast. Because of the nature of the IP addressing architecture, only the last router in the chain, the one that is connected directly to the target subnet, can conclusively identify a directed broadcast. Directed broadcasts are occasionally used for legitimate purposes, but such use is not common outside the financial services industry.
In a smurf attack, the attacker sends ICMP echo requests from a falsified source address to a directed broadcast address. This causes all the hosts on the target subnet to send replies to the falsified source. By sending a continuous stream of such requests, the attacker can create a much larger stream of replies. This can completely inundate the host, whose address is falsified.
If a Cisco interface is configured with the no ip directed-broadcast command, directed broadcasts that are otherwise exploded into link-layer broadcasts at that interface are dropped instead. This means that the no ip directed-broadcast command must be configured on every interface of every router that is connected to a target subnet. It is not sufficient to configure only on firewall routers. The no ip directed-broadcast command is the default in Cisco IOS Software Release 12.0 and later. In earlier releases, the command should be applied to every LAN interface that is not known to forward legitimate directed broadcasts.
Configuring Load Balancing with VRRP
===============================
SWITCH A
CatalystA(config)# interface vlan 50
CatalystA(config-if)# ip address 192.168.1.10 255.255.255.0
CatalystA(config-if)# vrrp 1 priority 200
CatalystA(config-if)# vrrp 1 ip 192.168.1.1
CatalystA(config-if)# vrrp 2 priority 100
CatalystA(config-if)# no vrrp 2 preempt
CatalystA(config-if)# vrrp 2 ip 192.168.1.2
SWITCH B
CatalystB(config)# interface vlan 50
CatalystB(config-if)# ip address 192.168.1.11 255.255.255.0
CatalystB(config-if)# vrrp 1 priority 100
CatalystA(config-if)# no vrrp 1 preempt
CatalystB(config-if)# vrrp 1 ip 192.168.1.1
CatalystB(config-if)# vrrp 2 priority 200
CatalystB(config-if)# vrrp 2 ip 192.168.1.2
--------------------
Displaying Switch Roles for VRRP Load Balancing
-------------
CatalystA# show vrrp brief
Interface Grp Pri Time Own Pre State Master addr Group addr
Vlan50 1 200 3218 Y Master 192.168.1.10 192.168.1.1
Vlan50 2 100 3609 Backup 192.168.1.11 192.168.1.2
CatalystA#
CatalystB# show vrrp brief
Interface Grp Pri Time Own Pre State Master addr Group addr
Vlan50 1 100 3609 Backup 192.168.1.10 192.168.1.1
Vlan50 2 200 3218 Y Master 192.168.1.11 192.168.1.2
CatalystB#
-------------------
Verifying VRRP Status for Multiple VRRP Groups
-----------------------------
Catalyst A
CatalystA# show vrrp
Vlan50 - Group 1
State is Master
Virtual IP address is 192.168.1.1
Virtual MAC address is 0000.5e00.0101
Advertisement interval is 1.000 sec
Preemption is enabled
min delay is 0.000 sec
Priority is 200
Authentication is enabled
Master Router is 192.168.1.10 (local),
priority is 200
Master Advertisement interval is
1.000 sec
Master Down interval is 3.218 sec
Vlan50 - Group 2
State is Backup
Virtual IP address is 192.168.1.2
Virtual MAC address is 0000.5e00.0102
Advertisement interval is 1.000 sec
Preemption is disabled
Priority is 100
Authentication is enabled
Master Router is 192.168.1.11, priority
is 200
Master Advertisement interval is
1.000 sec
Master Down interval is 3.609 sec
(expires in 2.977 sec)
CatalystA#
-------------
Catalyst B
CatalystB# show vrrp
Vlan50 - Group 1
State is Backup
Virtual IP address is 192.168.1.1
Virtual MAC address is 0000.5e00.0101
Advertisement interval is 1.000 sec
Preemption is disabled
Priority is 100
Authentication is enabled
Master Router is 192.168.1.10, priority
is 200
Master Advertisement interval is
1.000 sec
Master Down interval is 3.609 sec
(expires in 2.833 sec)
Vlan50 - Group 2
State is Master
Virtual IP address is 192.168.1.2
Virtual MAC address is 0000.5e00.0102
Advertisement interval is 1.000 sec
Preemption is enabled
min delay is 0.000 sec
Priority is 200
Authentication is enabled
Master Router is 192.168.1.11 (local),
priority is 200
Master Advertisement interval is
1.000 sec
Master Down interval is 3.218 sec
CatalystB#
=================
1. I know people who work 12 hours a day, 6 days a week, or more.
2. Some people do so because of a work emergency where the long hours are only temporary.
•Other people I know have put in these hours for years.
•I don’t know if they are working all these hours, but I do know they are in the office this long.
•Others put in long office hours because they are addicted to the work-place.
•Whatever the reason for putting in overtime, working long hours over the long term is harmful to the person and to the organization.
•There are things Managers can do to change this for everyone’s benefit.
•Being in the office long hours, over long periods of time, makes way for POTENTIAL ERRORS.
•My colleagues who are in the office long hours frequently MAKE MISTAKES caused by FATIGUE.
•Correcting these mistakes requires THEIR TIME as well as the TIME and ENERGY of OTHERS.
•I have seen people work Tuesday thro’ Friday TO CORRECT mistakes made AFTER 5:00 p.m. on Monday.
•Another problem is that people who are in the office long hours are not a PLEASANT COMPANY.
•They often COMPLAIN about other people (who aren’t working as hard); they are IRRITABLE, OR CRANKY, OR EVEN ANGRY.
•Other people avoid them.
•Such behavior poses problems, where work goes much better when people work together instead of avoiding one another.
•As Managers, there are things we can do to help people leave the office.
•First and foremost, is to set the example and go home ourselves.
•I work with a Manager who chides people for working long hours.
•His words quickly lose their meaning when he sends these chiding group e-mails with a time-stamp of 2:00 a.m., Sunday.
•Second, is to encourage people to put some BALANCE in their lives.
•For instance, here is a guideline I find helpful:-
1)Wake up, eat a good breakfast and go to work.
1)Work hard and smart for eight or nine hours.
1)Go home.
1)Read the books/comics, watch a funny movie, dig in the dirt, play with your kids etc.
1)Eat well and sleep well
•This is called re-creating. Doing steps 1,3,4 and 5 enables step 2.
•Working regular hours and re-creating daily are simple concepts.
•They are hard for some of us because that requires ‘PERSONAL CHANGE’.
•In considering the issue of overtime, I am reminded of my oldest son.
•They are possible since we all have the power to choose to do them.
•When he was a toddler, if people were visiting the apartment, he’d not fall asleep no matter how long the visit, and no matter what time of day it was.
•He would fight off sleep until the visitors left.
•It was as if he was afraid that he would miss something.
•Once our visitors’ left, he would go to sleep.
•By this time, however, he was OVER TIRED and would scream thro’ half the night with nightmares.
•He, my wife and I, all paid the price for his fear of missing out.
•Perhaps some people put in such long hours because they don’t want to miss anything when they leave the office.
•The trouble with this is that events will NEVER STOP HAPPENING. That’s life.
•Thing happen 24 hours a day.
•Allowing for little rest is not ultimately practical.
•So, take a nap.
•Things will happen while you’re asleep, but you’ll have the energy to catch up when you wake.
•Even when you are gone for good, things will still happen.
•No one is indispensable, it may take a while to get a replacement, but you will be replaced.
•Hence, “LOVE YOUR JOB BUT NEVER FALL IN LOVE WITH YOUR COMPANY.