I hear the phrase from many of my clients: “What is best practice?” It comes when I am asked to design a new Internet perimeter, a VPN system or deploy a wireless network. The assumption is that there is a single correct design for their network (after all, a network…

The Cisco NAC device filter is used to allow computers to bypass authentication and optionally perform posture assessment.  The optional posture assessment is based on the role that is assigned to the device filter.  The MAC addresses, used in the device filter list, can be added through the NAC Manager…

I needed to get Java working with Firefox on my CentOS box.  The primary reason was to do some additional NAC testing with Linux.  I've been having a much harder time getting it installed than I originally thought.  I finally got it working and wanted to share my steps and…

The Cisco NAC subnet filter is used to allow computers to bypass authentication and optionally perform posture assessment.  The optional posture assessment is based on the role that is assigned to the subnet filter.  These subnets can be added through the NAC Manager Web GUI or through the NAC API.…

When Cisco NAC is used in out-of-band (OOB) mode, SNMP read and write functionality is critically important.  The NAC Manager uses the SNMP write community to change the VLAN that individual switch ports are connected to.  For example, after a user passes NAC authentication and posture assessment, the end computer…

With SSL certificates, there is the concept of a public key and a private key.  When looking at traffic sent from the client to the web server, the public key is used to encrypt data and the private key is used to decrypt data.  The client gets the public key…

#!/usr/bin/perluse strict;use warnings;use Getopt::Long;use Opsware::NAS::Connect; my($host,$port,$user,$pass) = (‘localhost’,’$tc_proxy_telnet_port$’,’$tc_user_username$’,’$tc_user_password$’);my $device = ‘#$tc_device_id$’;my @output;my @data;my @auth_ports = ();my $foundauth_flag = 0;my $foundaccess_flag = 0;my $done_flag = 0;my $access_vlan;my $auth_vlan; my $con = [...]

ASA 8.3 was recently released.  One welcome improvement was a new method of managing failover licenses.  Previously, ASAs in a failover pair each needed to have a license for a feature.  For example, let's say that an ASA failover pair required a 100 session SSL license.  In version 8.2 and…

Earlier this year I started my "Potentially Infinite Series" on What It's Like to be a NetCraftsmen.  As promised, this won't be a one and done top ten list.  A fair amount of time has passed since my original blog, so it is now time for Installment 2 (aka, Part…

The Cisco AnyConnect VPN client is Cisco’s SSL VPN client offering.  Cisco currently supports this VPN client and the legacy IPSec VPN client, called the Cisco VPN Client.  The Cisco VPN client will be phased out over time.  This can be seen by the Cisco VPN Client FAQ explaining that…

For those of you that think professional hackers don't care about your small business, let me introduce you to Zeus, the number one threat of 2009.  According to SC Magazine: "Zeus:  Also known as Ztob, this bank credential-stealing trojan is masterfully built.  It is designed to evade anti-virus detection and…

Recently a client approached me about improving their VPN authentication. Although the current VPN authentication method had been in place for many years without any issues, the new IT manager's goal was to migrate the Windows server farm to the latest and greatest version (Windows Server 2008) and improve the…