L3 Forwarding Resources
FIB TCAM usage: Total Used %Used
72 bits (IPv4, MPLS, EoM) 245760 216837 88%
144 bits (IP mcast, IPv6) 8192 243 3%
detail: Protocol Used %Used
IPv4 216837 88%
MPLS 0 0%
EoM 0 0%
IPv6 240 3%
IPv4 mcast 3 1%
IPv6 mcast 0 0%
Adjacency usage: Total Used %Used
1048576 448 1%
// ====
// ACLs
// ====
acl "ournetworks" {
127.0.0.0/8;
10.0.0.0/8;
};
acl "ispns" {
8.8.8.0/24;
};
// ============================
// Konfigurace pro dotazy z LAN
// ============================
view "internal" {
match-clients {
ournetworks;
};
recursion yes;
// =============
// special zones
// =============
zone "." {
type hint;
file "/etc/bind/db.root";
};
zone "localhost" {
type master;
file "/etc/bind/db.local";
};
zone "127.in-addr.arpa" {
type master;
file "/etc/bind/db.127";
};
zone "0.in-addr.arpa" {
type master;
file "/etc/bind/db.0";
};
zone "255.in-addr.arpa" {
type master;
file "/etc/bind/db.255";
};
zone "255.in-addr.arpa" {
type master;
file "/etc/bind/db.255";
};
// =========
// our zones
// =========
zone "domena.cz" {
type master;
file "/etc/bind/db.cz.domena.internal";
allow-transfer { any; };
};
zone "0.0.10.in-addr.arpa" {
type master;
file "/etc/bind/db.10.0.0";
allow-transfer { any; };
};
};
// =================================
// Konfiguace pro dotazy z internetu
// =================================
view "external" {
match-clients {
any;
};
recursion no;
// =============
// special zones
// =============
zone "." {
type hint;
file "/etc/bind/db.root";
};
zone "localhost" {
type master;
file "/etc/bind/db.local";
};
zone "127.in-addr.arpa" {
type master;
file "/etc/bind/db.127";
};
zone "0.in-addr.arpa" {
type master;
file "/etc/bind/db.0";
};
zone "255.in-addr.arpa" {
type master;
file "/etc/bind/db.255";
};
// =========
// our zones
// =========
zone "domena.cz" {
type master;
file "/etc/bind/db.cz.domena.external";
allow-transfer { ispns; };
};
};
ASNumber 29086 Gity
ASNumber 42000 Global_Inspiration
ASNumber 35361 GREPA
ASNumber 2819 GTS_NOVERA
ASNumber 15935 ha-vel_internet
ASNumber 29134 IGNUM
ASNumber 24806 INTERNET_CZ
ASNumber 25424 INTERNEXT2000
ASNumber 8928 Interoute
ASNumber 9080 Ipex
ASNumber 15598 IP_Exchange
ASNumber 24971 Master_Internet
ASNumber 34315 MAXPROGRES
ASNumber 20723 MGI
ASNumber 34080 MIRAMO
ASNumber 8913 Mopos
ASNumber 9148 net4net
ASNumber 8422 NetCologne
ASNumber 35236 NETWAY
ASNumber 8251 NFX
ASNumber 6881 NIX
ASNumber 39817 OVANET
ASNumber 35214 OXID
ASNumber 12306 Plusline
ASNumber 30764 PODA
ASNumber 12767 PRAGONET
ASNumber 25248 RADIOKOMUNIKACE
ASNumber 12570 SELFservis
ASNumber 5407 Skynet
ASNumber 29113 Sloane
ASNumber 31246 SMART_Comp
ASNumber 39392 SuperNetwork
ASNumber 5610 Telefonica_O2
ASNumber 28725 TelefonicaO2-Eurotel
ASNumber 25036 TERMS
ASNumber 13036 T-Mobile
ASNumber 38949 Trestel_SK
ASNumber 33883 TRIOPTIMUM
ASNumber 29583 Unient
ASNumber 6830 UPC
ASNumber 702 Verizon
ASNumber 16019 Vodafone
ASNumber 6706 VOLNY
ASNumber 39790 Web4U
ASNumber 21430 WIA
ip flow-export version 5 peer-as
ip flow-export version 5 origin-as
mother ~/tmp>>> openssl genrsa -out mail.somewhere.org.key 1024
Generating RSA private key, 1024 bit long modulus
................................................++++++
.........................++++++
e is 65537 (0x10001)
mother ~/tmp>>>
mother ~/tmp>>> openssl req -new -key mail.somewhere.org.key /
-out mail.somewhere.org.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CZ
State or Province Name (full name) [Some-State]:Czech republic
Locality Name (eg, city) []:Silikonova Lhota
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ISP s.r.o.
Organizational Unit Name (eg, section) []:NOC
Common Name (eg, YOUR name) []:pop3.somewhere.org
Common Name (eq, YOUR name) []:imap.somewhere.org
Email Address []:admin@somewhere.org
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:secret
An optional company name []:
mother ~/tmp>>>
mother:/etc/ssl# diff openssl.cnf.orig openssl.cnf
144,145c144,147
< commonName = Common Name (eg, YOUR name)
< commonName_max = 64
---
> 0.commonName = Common Name (eg, YOUR name)
> 0.commonName_max = 64
> 1.commonName = Common Name (eq, YOUR name)
> 1.commonName_max = 64
mother:/etc/ssl#
mother ~/tmp>>> openssl genrsa -out mail.somewhere.org.key 1024
Generating RSA private key, 1024 bit long modulus
................................................++++++
.........................++++++
e is 65537 (0x10001)
mother ~/tmp>>>
mother ~/tmp>>> openssl req -new -key mail.somewhere.org.key /
-out mail.somewhere.org.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:CZ
State or Province Name (full name) [Some-State]:Czech republic
Locality Name (eg, city) []:Silikonova Lhota
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ISP s.r.o.
Organizational Unit Name (eg, section) []:NOC
Common Name (eg, YOUR name) []:pop3.somewhere.org
Common Name (eq, YOUR name) []:imap.somewhere.org
Email Address []:admin@somewhere.org
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:secret
An optional company name []:
mother ~/tmp>>>
mother:/etc/ssl# diff openssl.cnf.orig openssl.cnf
144,145c144,147
< commonName = Common Name (eg, YOUR name)
< commonName_max = 64
---
> 0.commonName = Common Name (eg, YOUR name)
> 0.commonName_max = 64
> 1.commonName = Common Name (eq, YOUR name)
> 1.commonName_max = 64
mother:/etc/ssl#
mysql> SHOW VARIABLES LIKE 'character_set%';
+--------------------------+----------------------------+
| Variable_name | Value |
+--------------------------+----------------------------+
| character_set_client | utf8 |
| character_set_connection | utf8 |
| character_set_database | utf8 |
| character_set_filesystem | binary |
| character_set_results | utf8 |
| character_set_server | latin1 |
| character_set_system | utf8 |
| character_sets_dir | /usr/share/mysql/charsets/ |
+--------------------------+----------------------------+
8 rows in set (0.00 sec)
##
## SSH AGENT
##
BIN_SSH_AGENT=`which ssh-agent`
BIN_SSH_ADD=`which ssh-add`
SSH_AGENT_ENV=~/.ssh/ssh_agent_env
function start_ssh_agent {
$BIN_SSH_AGENT -s > $SSH_AGENT_ENV
. $SSH_AGENT_ENV
$BIN_SSH_ADD
}
if [ -f $SSH_AGENT_ENV ]; then
. $SSH_AGENT_ENV >/dev/null
ps x | grep $SSH_AGENT_PID | grep ssh-agent >/dev/null \
|| start_ssh_agent
else
start_ssh_agent;
fi
##
## SSH AGENT
##
BIN_SSH_AGENT=`which ssh-agent`
BIN_SSH_ADD=`which ssh-add`
SSH_AGENT_ENV=~/.ssh/ssh_agent_env
function start_ssh_agent {
$BIN_SSH_AGENT -s > $SSH_AGENT_ENV
. $SSH_AGENT_ENV
$BIN_SSH_ADD
}
if [ -f $SSH_AGENT_ENV ]; then
. $SSH_AGENT_ENV >/dev/null
ps x | grep $SSH_AGENT_PID | grep ssh-agent >/dev/null \
|| start_ssh_agent
else
start_ssh_agent;
fi
apt-get install flow-tools flowscan flowscan-cuflow \
flowscan-cugrapher ksh libboulder-perl libcflow-perl \
libconfigreader-perl libhtml-parser-perl libhtml-table-perl \
libhtml-tagset-perl libhtml-tree-perl libnet-patricia-perl \
liburi-perl libwww-perl libxml-parser-perl rrdtool
-w /var/flow/firewall -n 275 -N 0 0/192.168.1.12/3000
conf term
ip flow-export source FastEthernet0/0
ip flow-export version 5
ip flow-export destination 192.168.1.16 3000
int fa0/0
ip flow ingress
ip flow egress
end
OutputDir /var/flow/reports/rrds
Subnet 192.168.0.0/16
Network 192.168.1.0/24 servers
Network 192.168.3.0/24 ucebny
Network 192.168.4.0/24 internat1
Network 192.168.5.0/24 internat2
OutputDir /var/flow/reports/rrds
Multicast
Scoreboard 10 /var/flow/reports/scoreboard
/var/www/flow/topten.html
AggregateScore 10 /var/flow/reports/scoreboard/agg.dat
/var/www/flow/overall.html
Router 192.168.1.12 firewall
Service 20-21/tcp ftp
Service 22/tcp ssh
Service 23/tcp telnet
Service 25/tcp smtp
Service 53/udp,53/tcp dns
Service 80/tcp http
Service 110/tcp pop3
Service 119/tcp nntp
Service 143/tcp imap
Service 412/tcp,412/udp dc
Service 443/tcp https
Service 1214/tcp kazaa
Service 4661-4662/tcp,4665/udp edonkey
Service 5190/tcp aim
Service 6346-6347/tcp gnutella
Service 6665-6669/tcp irc
Service 54320/tcp bo2k
Service 7070/tcp,554/tcp,6970-7170/udp real
Protocol 1 icmp
Protocol 4 ipinip
Protocol 6 tcp
Protocol 17 udp
Protocol 47 gre
Protocol 50 esp
Protocol 51 ah
Protocol 57 skip
Protocol 88 eigrp
Protocol 169
Protocol 255
TOS 0 normal
TOS 1-255 other
ASNumber 1 Genuity
FlowFileGlob /var/flow/firewall/*ft-v05.*
ReportClasses CUFlow
WaitSeconds 30
Verbose 1
