Firewall Ninja: IOS

Wednesday, June 8, 2016

IOS Zone Based Firewall

Posted by Alan on June 08, 2016 with No comments
In Firewall, IOS, Router

One of the most commonly covered security features when it comes to Cisco security is the ZBF. It wouldn't be much of a network security blog without at least one post on this topic, so here's my take.

With IOS version 12.4(6)T, Cisco introduced the Zone Based Firewall (ZBF), sometimes referred to as the Zone Policy Based Firewall. With this, the Classic IOS Firewall or Context-Based Access Control (CBAC), available since IOS version 11.2, is now deprecated. Nearly all of the features of the Classic IOS Firewall are implemented in ZBF as well as wide range of new features. In addition to the new features available in ZBF, it is also said to improve firewall performance over CBAC for most inspection activities. I've seen it stated in some places that if you attempt to inter-mingle CBAC configuration commands with your ZBF, it MIGHT work, however most documentation states that it wont. So I wouldn't risk it. Choose one or the other.

Wednesday, May 18, 2016

TCL Scripting

Posted by Alan on May 18, 2016 with 2 comments
In Cisco, IOS, tclsh

According to it's man page, "tclsh is a shell-like application that reads TCL commands from its standard input or from a file and evaluates them. If invoked with no arguments then it runs interactively, reading TCL commands from standard input and printing command results and error messages to standard output. It runs until the exit command is invoked or until it reaches end-of-file on its standard input." The TCL Developer Xchange describes the TCL language as "a very powerful but easy to learn dynamic programming language, suitable for a very wide range of uses, including web and desktop applications, networking, administration, testing and many more. Open source and business-friendly, TCL is a mature yet evolving language that is truly cross platform, easily deployed and highly extensible. "

The language was created John Ousterhout at the University of California, Berkley. It's either installed by default or available through the package repositories in nearly every Linux distribution and flavor of BSD. ActiveState maintains an edition called ActiveTcl. The community edition has precompiled binaries for Windows, Mac and Linux. The Enterprise Edition adds binaries for HP-UX, Solaris and AIX. ActiveState also the home of ActivePerl and ActivePython, which are solid editions of Perl and Python for the same platforms.

Tclsh was added to Cisco IOS in version 12.3(2)T and 12.2(25)S, and to Cisco NX-OS in Release 5.1(1) to provide scripting capability. With it, you are able to run TCL commands directly from the Cisco IOS prompt, or to create and execute scripts written in the TCL language. Just about anything you can do in tclsh on a Linux or BSD system can be done in tclsh on a Cisco router. This of course assumes you're using straight TCL and not any add-on packages.

To use tclsh, simply type the command tclsh at the exec prompt. To exit tclsh, type tclquit. While within tclsh you can create scripts with the proc command, by typing proc script_name {, and then ending your script with a closing }. A great example of the power of this scripting environment can be found in this post at INE, where Brian McGahan, along with an assist from reader Jason Cook, demonstrates a TCL script to generate a number of random IP addresses and subnet masks tied to Loopback interfaces. I've used this script several times in the lab to quickly add routes into a routing protocol. If you're feeling really adventurous, you can even get your router to Tweet. And that's the beauty of scripting, you are able to quickly and easily automate the mundane tasks that aren't what you are working on and interested in, but still need accomplished.

And though it is not suggested, you can change your login shell on a Linux, BSD or Unix system to tclsh and do your day to day work in it as a means of learning the language and environment. However, as noted, its not suggested as it's not really suited as being used a login script wasn't in the design goals. See this article for more details.

I'll be getting more into TCL on IOS in the near future.