Secure IT

common Switch troubleshooting commands For CPU related issues: Show process cpu sorted Show process cpu history Show platform port-asic stats drop Show controllers cpu-interface Debug platform cpu-queues Show plat for ip For memory issues Show memory statistics Show process memory sorted Show buffers For link issues Show interface status | inc connected Test cable-diagnostics tdr interface <> Show cable-diagnostic tdr interface <> Show interface <> Show interface <> counters Show interface <> counters errors Show interface counter errors Show controller Ethernet-controller <> Show platform pm if-numbers Show controllers Ethernet-controller port-asic statistics Show platform port-asic stats drop <> Layer 2 forwarding issues Show interface <> status Show spanning-tree interface <> Show interface <> counter Show mac address-table interfa...

                                                 IPSEC IPSEC consist of multiple protocols: Internet Security Association and Key Management Protocol (ISAKMP) A framework for the negotiation and management of security associations between peers (traverses UDP/500) Internet Key Exchange (IKE) Responsible for key agreement using asymmetric cryptography Encapsulating Security Payload (ESP) Provides data encryption, data integrity, and peer authentication; IP protocol 50 Authentication Header (AH) Provides data integrity and peer authentication, but not data encryption; IP protocol 51 Encryption algorithm:   Type Key Length (Bits) Strength DES Symmetric 56 Weak ...

Checkpoint firewall common commands part1 For starting or stopping firewall services cpstop -Stop all Check Point services except cprid . You can also stop specific services by issuing an option with cpstop. For instance cpstop FW1 stops FW-1/VPN-1 or use cpstop WebAccess to stop WebAccess. cpstart -Start all Check Point services except cprid . cpstart works with the same options as cpstop . cprestart -Combined cpstop and cpstart . Complete restart. cpridstop, cpridstart, cpridrestart -Stop, start or restart cprid , the Check Point Remote Installation Daemon. fw kill [-t sig] proc -Kill a Firewall process. PID file in $FWDIR/tmp/ must be present. Per default sends signal 15 (SIGTERM).Example: fw kill -t 9 fwm fw unloadlocal – Uninstalls local security policy and disables IP forwarding. For getting basic firewall information : fw ver [-k] , fwm [mds] ver, vpn ver [-k], fgate ver -Show major and minor version as well as build numb...

Checkpoint firewall common commands part 2 For basic firewall informaton gathering: fgate stat -Status and statistics of Flood-Gate-1. fwaccel <stat|stats|conns>  – View status, statistics or connection table of SecureXL. fw getifs -Show list of configured interfaces with IP and netmask. cpstat <app_flag> [-f flavour] -View OS, HW and CP application status. Issue cpstat without any options to see all possible application flags <app_flag> and corresponding flavours. Examples: cpstat fw -f policy – verbose policy info cpstat os -f cpu – CPU utilization statistics cpinfo -y all   -List all installed patches and hotfixes. cpd_sched_config print -Show task scheduled with CPD scheduler. enabled_blades -View enabled software blades avsu_client [-app <app>]   , get_version <app>  -Get signature version and status of content security .Without the -app option “Anti Virus” is used. show co...

Checkpoint firewall common commands Part 3 For administration and configuration tasks: cpconfig  -Menu based configuration tool. Options depend on the installed products and modules. sysconfig -Start SPLAT OS and Check Point product configuration tool. cp_conf admin add <user> <pass> <perm> -Add admin user with password pass and permissions perm where w is read/write access and r is read only. Note:permission w does not allow account administration. cp_admin_convert -Export admin definitions created in cpconfig to SmartDashboard. fwm lock_admin -v -View list of locked administrators. fwm lock_admin -u <user> -Unlock admin user . Unlock all with -ua . cp_conf admin del <user> -Delete the admin account user . fwm expdate <dd-mmm-yyy> [-f <dd-mmm-yyyy>] -Set new expiration date for all users or with -f for all users matching the expiration date filter: fwm expdate 31-Dec-2020 -f 31-Dec-201...

Palo Alto-CLI cheat sheet Device management: Show general system-health information –> show system info Show percent usage of disk partitions –> show system disk-space Show the maximum log file size –> show system logdb-quota Show running processes –> show system software status Show processes running in the management plane –> show system resources Show resource utilization in the dataplane –> show running resource-monitor Show the licenses installed on the device –> request license info Show when commits, downloads, and/or upgrades are completed –> show jobs processed Show session information –> show session info Show information about a specific session –> show session id <session-id> Show the running security policy –> show running security-policy Show the authentication logs –> less mp-log authd.log Restart the device –> request -restart system Display the routing table –...

                              PACKET FLOW CHECKPOINT AND PALOALTO Checkpoint packet IN -> antispoofing -> rule Base (connection table) -> Nat for destination -> routing -> NAT for source -> ( NATted) Packet out Paloalto Basic: Initial Packet Processing —-> Security Pre-Policy —-> Application —-> Security Policy —-> Post Policy Processing Advance: Initial Packet Processing  —-> Source Zone/Source Address —-> Forward Lookup —-> Destination Zone/Destination Address —-> NAT policy evaluated Security Pre-Policy  —-> Check Allowed Ports —-> Session Created Application  —-> Check for Encrypted Traffic —-> Decryption Policy —-> Application Override Policy —-> Application ID Security Policy —-> Check Secu...

What is the use of default route?

VLAN, TRUNKING, VTP Vlan trunking -Vlan divides the broadcast domain -In New switch, Default Vlan = Native Vlan = Vlan 1 -Native Vlan can be changed from Vlan 1 to Vlan10, 20 etc. -Vlan 1 cannot be deleted even after entering command -Vlan 1 carries critical traffic like CDP, VTP etc. -Access port carries traffic of only one vlan -Trunk port carries traffic of more than one vlan -Voice vlan can carry traffic of two vlan’s -Layer 3 vlan required for Inter-Vlan communication -On Router, For Inter-Vlan comunication, “Router on Stick” is implemented -On Switches, For Inter-Vlan comunication,”Layer 3 vlan or SVI” is implemented -To allow end to end communication, we need to allow Vlan on all the trunk ports in between -Vlan can be created on Router, Switch, Firewall etc. -Trunking is the process to enable multiple vlan’s traffic between different switches -Conditions -Connected Port should be trunk, Encapsulation should match, Allowed Vlans o...

OSI layer in short with example 7. Application layer -Responsible for initiating or services the request. e.g SMTP, DNS, HTTP, and Telnet 6. Presentation layer -Formats the information so that it is understood by the receiving system e.g Compression and encryption depending on the implementation 5. Session layer – Responsible for establishing, managing, and terminating the session e.g NetBIOS 4. Transport layer -Breaks information into segments and is responsible for connection and connectionless communication e.g TCP and UDP 3. Network layer -Responsible for logical addressing and routing e.g IP, ICMP, ARP, RIP, IGRP, and routers 2. Data Link layer- Responsible for physical addressing, error correction, and preparing the information for the media e.g MAC address, CSMA/CD, switches, and bridges 1. Physical layer -Deals with the electrical signal e.g Cables, connectors, hubs, and repeaters