#cisco ccnp

[networkgeek]

Today I decided to practice more DMVPN here is my lab with Phase one for those who would like to follow see below commands used. Also basic routing was done between Serial interfaces with static routes. EIGRP was used for Tunnel interfaces.

Configuration for practice lab below:

router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.101.0  exit

router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.102.0  exit

 router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.103.0  exit

 router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.104.0  exit

 crypto isakmp policy 1  authentication pre-share  encryption aes  hash sha  group 5  lifetime 1800  exit crypto isakmp key cisco address 0.0.0.0 0.0.0.0 ! ! crypto ipsec transform-set t-set esp-aes esp-sha-hmac mode transport ! crypto ipsec profile cisco set transform-set t-set !

  interface tunnel 0  ip address 192.168.1.1 255.255.255.0  tunnel source s 0/0  tunnel mode gre multipoint  tunnel key 1  ip nhrp map multicast dynamic  ip nhrp authentication cisco  ip nhrp network-id 1  ip nhrp holdtime 300  tunnel protection ipsec profile cisco  no ip split-horizon eigrp 100  exit

  interface tunnel 0  tunnel source serial 0/0  ip address 192.168.1.2 255.255.255.0  tunnel source s 0/0  tunnel key 1  tunnel destination 101.1.1.100  ip nhrp map 192.168.1.1 101.1.1.100  ip nhrp map multicast 101.1.1.100  ip nhrp  authentication cisco  ip nhrp network-id 1  ip nhrp holdtime 300  tunnel protection ipsec profile cisco  ip nhrp nhs 192.168.1.1

 interface tunnel 0  tunnel source serial 0/0  ip address 192.168.1.3 255.255.255.0  tunnel source s 0/0  tunnel key 1  tunnel destination 101.1.1.100  ip nhrp map 192.168.1.1 101.1.1.100  ip nhrp map multicast 101.1.1.100  ip nhrp  authentication cisco  ip nhrp network-id 1  ip nhrp holdtime 300  tunnel protection ipsec profile cisco  ip nhrp nhs 192.168.1.1

 interface tunnel 0  tunnel source serial 0/0  ip address 192.168.1.4 255.255.255.0  tunnel source s 0/0  tunnel key 1  tunnel destination 101.1.1.100  ip nhrp map 192.168.1.1 101.1.1.100  ip nhrp map multicast 101.1.1.100  ip nhrp  authentication cisco  ip nhrp network-id 1  ip nhrp holdtime 300  tunnel protection ipsec profile cisco  ip nhrp nhs 192.168.1.1

[networkgeek]

So this is a lab setup I practiced DMVPN with EIGRP below I have the configuration if you want to follow what I have done.

Static routes were used for the basic connectivity then EIGRP was used to build the DMVPN. I highly recommend that if you have very little experience with this kind of configuration to first do some reading or viewing some videos on YouTube.

Below is some of the configuration used:

MVPN Crypto config hub

crypto isakmp policy 1  authentication pre-share  encryption aes  hash sha  group 5  lifetime 1800  exit  crypto isakmp key 0 cisco address 102.1.1.100  crypto isakmp key 0 cisco address 103.1.1.100  crypto isakmp key 0 cisco address 104.1.1.100  crypto ipsec transform-set t-set esp-aes esp-sha-hmac  mode transport  exit  crypto ipsec profile cisco  set transform-set t-set  exit

 **************************************************************  spoke

 crypto isakmp policy 1  authentication pre-share  encryption aes  hash sha  group 5  lifetime 1800  exit  crypto isakmp key 0 cisco address 101.1.1.100  crypto isakmp key 0 cisco address 103.1.1.100  crypto isakmp key 0 cisco address 104.1.1.100  crypto ipsec transform-set t-set esp-aes esp-sha-hmac  mode transport  exit  crypto ipsec profile cisco  set transform-set t-set  exit

 ************************************************************   soke

 crypto isakmp policy 1  authentication pre-share  encryption aes  hash sha  group 5  lifetime 1800  exit  crypto isakmp key 0 cisco address 101.1.1.100  crypto isakmp key 0 cisco address 102.1.1.100  crypto isakmp key 0 cisco address 104.1.1.100  crypto ipsec transform-set t-set esp-aes esp-sha-hmac  mode transport  exit  crypto ipsec profile cisco  set transform-set t-set  exit

 ***************************************************************

 spoke

 crypto isakmp policy 1  authentication pre-share  encryption aes  hash sha  group 5  lifetime 1800  exit  crypto isakmp key 0 cisco address 101.1.1.100  crypto isakmp key 0 cisco address 102.1.1.100  crypto isakmp key 0 cisco address 103.1.1.100  crypto ipsec transform-set t-set esp-aes esp-sha-hmac  mode transport  exit  crypto ipsec profile cisco  set transform-set t-set  exit

 ****************************************************************

 Routing hub

 router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.101.0  exit

 ****************************************************************

 Spoke

 router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.102.0  exit

 *******************************************************************

 spoke

 router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.103.0  exit

 ******************************************************************

 Spoke

 router eigrp 100  no auto-summary  network 192.168.1.0  network 192.168.104.0  exit

 ******************************************************************

 interface tunnel configuration

  int t0  ip address 192.168.1.2 255.255.255.0  tunnel source serial 0/0  tunnel mode gre multipoint  tunnel key 1  ip nhrp map 192.168.1.1 101.1.1.100  ip nhrp map multicast 101.1.1.100  ip nhrp authentication cisco  ip nhrp network-id 1  ip nhrp holdtime 300  tunnel protection ipsec profile cisco  ip nhrp nhs 192.168.1.1

 *********************************************************************

 interface tunnel configuration

  int t0  ip address 192.168.1.3 255.255.255.0  tunnel source serial 0/0  tunnel mode gre multipoint  tunnel key 1  ip nhrp map 192.168.1.1 101.1.1.100  ip nhrp map multicast 101.1.1.100  ip nhrp authentication cisco  ip nhrp network-id 1  ip nhrp holdtime 300  tunnel protection ipsec profile cisco  ip nhrp nhs 192.168.1.1

 **************************************************************************

 interface tunnel configuration

  int t0  ip address 192.168.1.4 255.255.255.0  tunnel source serial 0/0  tunnel mode gre multipoint  tunnel key 1  ip nhrp map 192.168.1.1 101.1.1.100  ip nhrp map multicast 101.1.1.100  ip nhrp authentication cisco  ip nhrp network-id 1  ip nhrp holdtime 300  tunnel protection ipsec profile cisco  ip nhrp nhs 192.168.1.1  exit

 **************************************************************************

 R1#show ip eigrp neighbors IP-EIGRP neighbors for process 100 H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq                                            (sec)         (ms)       Cnt Num 2   192.168.1.4             Tu0               14 00:01:09  152  5000  0  3 1   192.168.1.3             Tu0               10 00:01:43   96  5000  0  3 0   192.168.1.2             Tu0               12 00:04:46   41  5000  0  3

*****************************************************************************

R1#show ip route eigrp D    192.168.104.0/24 [90/297270016] via 192.168.1.4, 00:02:05, Tunnel0 D    192.168.102.0/24 [90/297270016] via 192.168.1.2, 00:05:14, Tunnel0 D    192.168.103.0/24 [90/297270016] via 192.168.1.3, 00:02:40, Tunnel0 R1#

*****************************************************************************

R4#show crypto ipsec sa

interface: Tunnel0    Crypto map tag: Tunnel0-head-0, local addr 104.1.1.100

  protected vrf: (none)   local  ident (addr/mask/prot/port): (104.1.1.100/255.255.255.255/47/0)   remote ident (addr/mask/prot/port): (101.1.1.100/255.255.255.255/47/0)   current_peer 101.1.1.100 port 500     PERMIT, flags={origin_is_acl,}    #pkts encaps: 59, #pkts encrypt: 59, #pkts digest: 59    #pkts decaps: 60, #pkts decrypt: 60, #pkts verify: 60    #pkts compressed: 0, #pkts decompressed: 0    #pkts not compressed: 0, #pkts compr. failed: 0    #pkts not decompressed: 0, #pkts decompress failed: 0    #send errors 1, #recv errors 0

    local crypto endpt.: 104.1.1.100, remote crypto endpt.: 101.1.1.100     path mtu 1500, ip mtu 1500, ip mtu idb Serial0/0     current outbound spi: 0xA347CF36(2739392310)

    inbound esp sas:      spi: 0x37DB83F1(937133041)        transform: esp-aes esp-sha-hmac ,        in use settings ={Transport, }        conn id: 2001, flow_id: SW:1, crypto map: Tunnel0-head-0        sa timing: remaining key lifetime (k/sec): (4398054/3374)        IV size: 16 bytes        replay detection support: Y        Status: ACTIVE

    inbound ah sas:

    inbound pcp sas:

    outbound esp sas:      spi: 0xA347CF36(2739392310)        transform: esp-aes esp-sha-hmac ,        in use settings ={Transport, }        conn id: 2002, flow_id: SW:2, crypto map: Tunnel0-head-0        sa timing: remaining key lifetime (k/sec): (4398054/3372)        IV size: 16 bytes        replay detection support: Y        Status: ACTIVE

    outbound ah sas:

    outbound pcp sas: R4#

**********************************************************************************

R4#ping 192.168.102.1 source fastEthernet 0/0 repeat 1000

Type escape sequence to abort. Sending 1000, 100-byte ICMP Echos to 192.168.102.1, timeout is 2 seconds: Packet sent with a source address of 192.168.104.1 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!! Success rate is 100 percent (1000/1000), round-trip min/avg/max = 1/2/56 ms

***********************************************************************************

R4#show ip nhrp 192.168.1.1/32 via 192.168.1.1, Tunnel0 created 00:07:16, never expire  Type: static, Flags: authoritative used  NBMA address: 101.1.1.100 192.168.1.2/32 via 192.168.1.2, Tunnel0 created 00:00:30, expire 00:04:32  Type: dynamic, Flags: router  NBMA address: 102.1.1.100 R4#

************************************************************************************

Thanks

[networkgeek]

This is an example of a Static VTI configuration:

See above topology, same as last config ensure that both “sites” have internet connection to the ISP router.

Below is the configuration used, ensure both sides are configured correctly with the same configuration:

From Configuration Terminal

crypto isakmp policy 1 authentication pre-share encryption aes hash sha group 5 lifetime 1800 exit crypto isakmp key cisco add 0.0.0.0 crypto ipsec transform-set t-set esp-aes esp-sha-hmac mode tunnel exit crypto ipsec profile cisco set transform-set t-set exit interface tunnel 0 %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to down ip add 192.168.1.2 255.255.255.0 tunnel mode ipsec ipv4 tunnel protection ipsec profile cisco exit %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON interface tunnel 0 ip ospf 10 area 0 exit router ospf 10 network 192.168.0.0 0.0.255.255 area 0 exit interface tunnel0 tunnel source fa0/0 tunnel destination 102.1.1.100 exit

%LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up %OSPF-5-ADJCHG: Process 10, Nbr 102.1.1.100 on Tunnel0 from LOADING to FULL, Loading Done

To Confirm configuration

R1#show crypto ipsec sa

interface: Tunnel0    Crypto map tag: Tunnel0-head-0, local addr 101.1.1.100

  protected vrf: (none)   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)   current_peer 102.1.1.100 port 500     PERMIT, flags={origin_is_acl,}    #pkts encaps: 40, #pkts encrypt: 40, #pkts digest: 40    #pkts decaps: 39, #pkts decrypt: 39, #pkts verify: 39    #pkts compressed: 0, #pkts decompressed: 0    #pkts not compressed: 0, #pkts compr. failed: 0    #pkts not decompressed: 0, #pkts decompress failed: 0    #send errors 0, #recv errors 0

    local crypto endpt.: 101.1.1.100, remote crypto endpt.: 102.1.1.100     path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet0/1     current outbound spi: 0x33306896(858810518)     PFS (Y/N): N, DH group: none

    inbound esp sas:      spi: 0x15FCFCCD(368901325)        transform: esp-aes esp-sha-hmac ,        in use settings ={Tunnel, }        conn id: 1, flow_id: 1, sibling_flags 80000040, crypto map: Tunnel0-head-0        sa timing: remaining key lifetime (k/sec): (4297365/3396)        IV size: 16 bytes        replay detection support: Y        Status: ACTIVE(ACTIVE)

    inbound ah sas:

    inbound pcp sas:

    outbound esp sas:      spi: 0x33306896(858810518)        transform: esp-aes esp-sha-hmac ,        in use settings ={Tunnel, }        conn id: 2, flow_id: 2, sibling_flags 80000040, crypto map: Tunnel0-head-0        sa timing: remaining key lifetime (k/sec): (4297365/3396)        IV size: 16 bytes        replay detection support: Y        Status: ACTIVE(ACTIVE)

    outbound ah sas:

    outbound pcp sas:

R1#show crypto engine connections active Crypto Engine Connections

  ID  Type    Algorithm           Encrypt  Decrypt LastSeqN IP-Address    1  IPsec   AES+SHA                   0       40       40 101.1.1.100    2  IPsec   AES+SHA                  41        0        0 101.1.1.100 1002  IKE     SHA+AES                   0        0        0 101.1.1.100

[networkgeek]

So This is just a basic configuration to demo how to setup GRE over IPsec

Below are some of the commands I used, Also note that the config must be exactly the same on both sides. R1 in my topology is the IPS router with the other 2 being the sites.

Remember to setup normal routing between them they are suppose to work just like normal sites with internet break out. for my routing i used OSPF.

Commands used for GRE and IPsec:

gre part

R1(config-if)#do show hist  interface tunnel 0  ip address 192.168.1.2 255.255.255.0  tunnel source fastEthernet 0/1  tunnel destination 101.1.1.100  tunnel mode gre ip  ip ospf 10 area 0  do show hist R1(config-if)#

ipsec part

R2(config)#crypto isakmp policy 1 R2(config-isakmp)#authentication pre-share R2(config-isakmp)#encryption aes R2(config-isakmp)#hash sha R2(config-isakmp)#group 5 R2(config-isakmp)#life R2(config-isakmp)#lifetime 1800 R2(config-isakmp)#exit R2(config)#cry R2(config)#crypto isakmp key cisco address 101.1.1.100 R2(config)#crypto ipsec transform-set t-set esp-aes esp-sha-hmac R2(cfg-crypto-trans)#mode tunnel R2(cfg-crypto-trans)#exit R2(config)#crypto ipsec profile cisco R2(ipsec-profile)#set tran R2(ipsec-profile)#set transform-set t-set R2(ipsec-profile)#int t0 R2(config-if)#tunnel protection ipsec profile cisco R2(config-if)# *Jun 20 17:03:18.259: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON R2(config-if)#

once configured on both sides you will receive a log message confirming connectivity, you can also do show crypto engine connections active that should give you below printout:

R2#show crypto engine connections active Crypto Engine Connections

  ID  Type    Algorithm           Encrypt  Decrypt LastSeqN IP-Address    1  IPsec   AES+SHA                   0        7        7 102.1.1.100    2  IPsec   AES+SHA                   6        0        0 102.1.1.100    3  IPsec   AES+SHA                   0       27       27 102.1.1.100    4  IPsec   AES+SHA                  28        0        0 102.1.1.100 1001  IKE     SHA+AES                   0        0        0 102.1.1.100 1002  IKE     SHA+AES                   0        0        0 102.1.1.100

If you have any questions or require assistance let me know.

[pynet-labs]

Cisco CCNP Enterprise (300-410 ENARSI) Training Course

300-410 ENARSI is one of Cisco's concentration examinations under the Enterprise track that deals with implementing and troubleshooting Cisco Enterprise Advanced Routing and Services. Professionals with ENARSI training and certification are supposed to have skills to install, configure, operate, and troubleshoot an enterprise network.

[jessicastone07-blog]

Visit Original Link

Cisco CCNP Security Attacks: How Criminals Exploit Data Flaws

Do you want to know about cisco CCNP security attacks and data flaws, then you got to the right place, here is everything you need to know.

Original Source:  https://www.appsdevelopmentcompanies.co.uk/blog/cisco-ccnp-security-attacks-how-criminals-exploit-data-flaws/

[certccna]

350-401 ccnp certification details and practice test details with 300+ practice questions according to latest objectives. Question types include Multiple Choice, Drag-and-Drop, True/False, and Testlets

[passhotdumps]

Newest CCNP Security Salary & Job Description in 2021

Newest CCNP Security Salary & Job Description in 2021

Software and networking would be ending up being increasingly more interconnected day by day, developing an even higher requirement for scalable, robust security throughout all platforms, from networks to mobile phones.

With intent-based networking, security groups would benefit from automation for scaling their security solutions. For taking advantage of these opportunities, today’s security professionals would need a broader series of abilities and a more in-depth focus in strategic innovation locations.

The CCNP Security accreditation program would be able to provide you precisely that breadth and depth. Also, you would need to enlist yourself in excellent and reputable training courses like such used by the PASSHOT for getting this certification.

Cisco would have created the CCNP Security certification to help the prospects prove their skills in the ever-changing landscape of security technologies. The certificate would be covering core technologies as well as a security focus location of your option.

Advantages

· Showing the world you know your things by getting a high-value accreditation

· Customizing your accreditation to your technical focus.

· Positioning yourself to achieve improvement in the busy world of security innovations.

· Adding security automation skills to your locations of proficiency.

· Earning a Specialist accreditation for clearing any CCNP examination — core or concentration.

· Qualifying for the CCIE Security lab exam by clearing the CCNP core exam.

· Linking that CCNP accreditation badge to all your social media profiles would provide you the recognition.

Earning your CCNP Security accreditation

The CCNP Security accreditation program would be preparing you for today’s professional-level job roles in security technologies. One of the industry’s most appreciated certifications, CCNP, would verify the core understanding you require while offering the versatility to choose a focus location.

For making CCNP Security, you would require to clear two exams: a core examination and a concentration exam of your choice.

The core examination, otherwise known as Implementing and Operating Cisco Security Core Technologies v1.0 with examination code 350–701 SCOR, would be concentrating on your understanding of security facilities which would be consisting of network security, content security, exposure, cloud security, endpoint detection, and protection, safe network gain access to, and enforcement.

· The core examination is likewise considered the exam through which you could even get approved for CCIE Security accreditation.

Concentration examinations would be concentrating on emerging and industry-specific subjects like the Cisco Firepower, e-mail security, identity services, web security, VPNs, and automation. You would have the ability to prepare for concentration exams by taking matching Cisco training courses.

You could select your CCNP Security concentration exam from these options:

· Automating and Programming Cisco Security Solutions

· Implementing and Configuring Cisco Identity Services Engine

· Implementing Secure Solutions with Virtual Private Networks

· Securing Email with Cisco Email Security Appliance

· Securing Networks with Cisco Firepower

· Securing the online with Cisco Web Security Appliance

Salary and Job Opportunities:

The CCNP Security certification and training program would provide real-world, job-focused abilities in essential locations. CCNP Security would be verifying the understanding which you require to master your job. If we speak about the salary, the CCNP Security expert salary would be ranging from around $87,915 per year for the post of Network Engineer to $109,474 per annum for the Network Security Engineer position.

Hence, if you wish to get your profession in Informational Security, you ought to obtain the CCNP Security Certification. For that, you will require proper and reliable training and research study discards providers like the PASSHOT.

Why Choose PASSHOT?

– 100% Pass Rate PASSHOT can guarantee

– 100% Real Exam and Questions PASSHOT supplies

– Professionals Tutor Teams PASSHOT has