#!/bin/sh
# This is a shell archive (produced by GNU sharutils 4.2.1).
# To extract the files from this archive, save it to some FILE, remove
# everything before the `!/bin/sh' line above, then type `sh FILE'.
#
# Made on 2005-01-10 14:29 PST by <jrb@murzim.cs.pdx.edu>.
# Source directory was `/u/jrb/classes/routing/webpages/lectures/routertalk'.
#
# Existing files will *not* be overwritten unless `-c' is specified.
#
# This shar contains:
# length mode       name
# ------ ---------- ------------------------------------------
#   9970 -rw-r--r-- routerintro.txt
#   1642 -rwxr-xr-x dexter-confg
#   2737 -rwxr-xr-x minshall-confg
#   3659 -rw-r--r-- allowjrb.acl
#   3879 -rw-r--r-- denyjrb.acl
#
save_IFS="${IFS}"
IFS="${IFS}:"
gettext_dir=FAILED
locale_dir=FAILED
first_param="$1"
for dir in $PATH
do
  if test "$gettext_dir" = FAILED && test -f $dir/gettext \
     && ($dir/gettext --version >/dev/null 2>&1)
  then
    set `$dir/gettext --version 2>&1`
    if test "$3" = GNU
    then
      gettext_dir=$dir
    fi
  fi
  if test "$locale_dir" = FAILED && test -f $dir/shar \
     && ($dir/shar --print-text-domain-dir >/dev/null 2>&1)
  then
    locale_dir=`$dir/shar --print-text-domain-dir`
  fi
done
IFS="$save_IFS"
if test "$locale_dir" = FAILED || test "$gettext_dir" = FAILED
then
  echo=echo
else
  TEXTDOMAINDIR=$locale_dir
  export TEXTDOMAINDIR
  TEXTDOMAIN=sharutils
  export TEXTDOMAIN
  echo="$gettext_dir/gettext -s"
fi
if touch -am -t 200112312359.59 $$.touch >/dev/null 2>&1 && test ! -f 200112312359.59 -a -f $$.touch; then
  shar_touch='touch -am -t $1$2$3$4$5$6.$7 "$8"'
elif touch -am 123123592001.59 $$.touch >/dev/null 2>&1 && test ! -f 123123592001.59 -a ! -f 123123592001.5 -a -f $$.touch; then
  shar_touch='touch -am $3$4$5$6$1$2.$7 "$8"'
elif touch -am 1231235901 $$.touch >/dev/null 2>&1 && test ! -f 1231235901 -a -f $$.touch; then
  shar_touch='touch -am $3$4$5$6$2 "$8"'
else
  shar_touch=:
  echo
  $echo 'WARNING: not restoring timestamps.  Consider getting and'
  $echo "installing GNU \`touch', distributed in GNU File Utilities..."
  echo
fi
rm -f 200112312359.59 123123592001.59 123123592001.5 1231235901 $$.touch
#
if mkdir _sh23863; then
  $echo 'x -' 'creating lock directory'
else
  $echo 'failed to create lock directory'
  exit 1
fi
# ============= routerintro.txt ==============
if test -f 'routerintro.txt' && test "$first_param" != -c; then
  $echo 'x -' SKIPPING 'routerintro.txt' '(file already exists)'
else
  $echo 'x -' extracting 'routerintro.txt' '(text)'
  sed 's/^X//' << 'SHAR_EOF' > 'routerintro.txt' &&
a brief introduction to cisco router/s
--------------------------------------
X
outline
X
bibliography
hardware
X	basic setup
X		memory
X	redundancy
software
X	command overview
X	command modes
X		exec/enable
X	configuration
X	image/config upload/download
X	security
X	short tour 
X		on-line (telnet to router and demo some commands...) 
X
------------------------------------------------
bibliography
X	http://www.cisco.com  (and more if you are a smartnet member
X		and can login to cco)
X		look at route.html class page at bottom for
X			Cisco IOS "cd" on-line documentation
X	ORA book - "Managing IP Networks, with Cisco Routers",
X			by Scott Ballew.
X		ISBN: 9-78165-923201
X	various Cisco Press books; .e.g.,
X		1. Cisco IOS Configuration Fundamentals
X		2. Cisco Router Configuration
X		and more ...
------------------------------------------------
hardware
X
a router (or switch) is: 
X	ports + supervisor/memory (nvram/flash and runtime) + power supplies
X
X	ports of the WAN or LAN variety (interfaces)
X	can be bundled in cards (modules)
X
X	the box itself may either be a 
X		chassis with expandability or a fixed set of ports.
X
X	chassis:  it has N slots for different kinds of boards
X		  typically big
X
X		you can buy/add/swap new cards with new
X			capabilities
X
X		a new OC-3/Sonet WAN card
X		24 10/100BASE ethernet ports
X		9 1 G/ethernet ports
X		overhead: a supervisor (CPU/memory) card
X		other kinds of memory cards (flash)
X
X		example:
X			cisco 7513 (13 slots)
X				fairly big router
X			cisco 550X switch
X				can take RSM card (router card)
X
X	fixed number of slots: (typically smaller)
X		although even smaller boxes may have some expandability
X		e.g., Cisco 2621 router
X			has 2 10/100 ethernet slots
X			and WAN ports (for ISDN, and other low-speed
X				possibilities)
X
X		example: Cisco 2926 switch (fixed set of ports)
X
X	port naming:
X
X		if fixed ports, then names like
X			Ethernet0
X			Serial0,  Serial1
X
X		if modules, then two-tuple (module/port)
X			FastEthernet 1/0
X
X		names may be more complex in case of virtual interfaces
X			(vlans) or VIP controller (multi-module) cards
X
X			FastEthernet 0/0/1
X
X	memory:
X		NO hard disk
X		one has two "objects" (configuration/os) stored in memory
X		both of which can be stored on remote file systems
X			with tftp/anonymous ftp and possibly other means
X
X		three kinds of memory (storage of objects + runtime mem):
X		1. flash or "permanent" non-volative memory, where
X			os is stored
X		2. nvram where configuration is stored
X		3. runtime RAM memory for the operating system, processes,
X			and configuration itself while they are being used
X
X		two kinds of objects:
X		1. the configuration 
X			view it as a ASCII file that can be
X				uploaded in part or all at boot or other times 
X			the configuration is a set of IOS commands
X			it can be modifed in runtime memory in part by
X				IOS commands
X			saved to remote disk or nvram storage
X		2. the kernel image itself
X			loaded to/from flash
X				may have multiple copies in flash memory
X				(current image and test image)
X			loaded into RAM memory by reboot
X
X		thus the objects can be stored in non-volative memory
X		locally and loaded either from that memory or a 
X		remote hard disk at boot
X
X		and saved to flash or a remote hard disk too
X
X		downside: you must be careful that what is running
X			(e.g., with the configuration) is actually
X			saved to Non Volatile memory (and on disk)
X	
X		pro: you may also try out a few changes in runtime memory
X			configuration and only save them if they work
X
X	redundancy:
X		one of the definite PROs when we compare a cisco router
X			to say a UNIX workstation/router
X
X		power-supply redundancy - may be hot-swappable
X			2 power-supplies on a bigger chassis not unusual
X
X			keep in mind less useful if 2 power supplies
X			plugged into same AC circuits (but not useless)
X
X			good UPS (with snmp management) worthwhile
X
X		ethernet and WAN boards may be hot-swappable
X
X		may have failover system.  2 boards as one.
X			board A goes away, board B automatically takes over
X			2 ethernet boards would have to share MAC address
X		
X		important note:  no HARD disk is a pro ...
X			two things likely to fail are: disk/power supply(fan)
X			harder to hack into it 
X			it can't fail if it doesn't exist :->
X
X		redundancy pros:
X			improve odds of 7x24 production system
X		cons:
X			costs hw/capital money -- you pay for it 
X	
X	misc. considerations:
X		good power needed
X		air conditioning likely required for big boxes
X		wiring fabric should certainly converge where
X		    core router/switches exist
X
----------------------------------------------------
software
X
IOS command set is huge
X	and commands have options
X		options have options
X
X	focus is on IOS ASCII configuration
X	set of ASCII commands but one can also of course
X	
X	1. dump tables (interface stats/route tables/arp/access-list hits)
X	2. turn debugging on/off/which may go to remote syslog
X	3. clear counters
X	4. ping/tracerouter/telnet elsewhere
X		to test connectivity
X
-------------------
command-modes (exec/enable) :
X
X	basic modes are exec/enable/configuration modes within enable:
X
X	to enable mode:
X
X	% telnet cisco-box
X
X	password: xyzzy-whatever
X
X	router>
X
X	login (1st-level password) gets you to exec mode.
X
X	exec modes mostly allows readonly access.
X	you can look at some things (show commands), and clear 
X	some things (clear interfaces)
X
X	look at ip table/arp table/go to enable mode/clear counters
X
X	prompt is: router>
X
X	exec mode commands include:
X
X	router> help
X		tell you at any level how to use help system.
X		in general, when in doubt type in ?
X		e.g.,
X
X			router> ?   
X			router> show ?
X				list of show commands
X			router> show ip ?
X			router#> ?  --- enable level commands
X			router(config)# ?   ---- commands in config mode
X	router> logout
X	router> trace/mtrace  
X	router> ping
X	router> telnet
X	router> show flash
X	router> show ip route
X	router> show ip arp
X	router> show interface
X	router> show processes
X	router> show modules (some switches)
X		(show mac and show port too for higher breed of switches)
X	router> show version
X	router> show snmp
X	router> show ip ospf  (for example)
X	router> enable
X
-----------------------------
X	from exec mode:
X
X	router> enable
X	password: (enable password)
X
X	router#>
X
X	now you can change/configure things. note that certain
X		configuration moves will take you into sub-configuration
X		areas (router/interface/access-list commands)
X
X	you can also view the entire RAM configuration:
X		router# show running-conf
X
X	router# reload to reboot
X	router# debug to debug (of course)
X
X	router# exit or logout to get out
X
---------------------------------------------------
short overview of config commands:
X
X	configuration is a mode from enable mode
X		sub-configuration modes exist too (acl/interface/router ...)
X
X	router# config terminal
X	which are infinite by their vary nature
X
X	1. general (entire setup)
X
X		time (NTP)
X		logging
X		DNS
X		specific ip routes (e.g., static default)
X		snmp
X
X		do:
X		router# config term
X			Cntrl-Z  to get out
X
X	2. per interface oriented
X		router# config term
X		router-config#
X			interface Ethernet0
X				per interface command
X		example:
X			interface Ethernet1
X				shutdown   <---- turn it off
X
X	3. router process oriented
X		router-config# router ospf
X			ospf command
X
X	4. various lists (often of ip addresses or tcp/udp ports)
X		access-control list (acl) for security
X		router map for filtering
X
X	5. terminal setup (vty and console)
X		acl for vty access (who can telnet)
X
----------------------------------------------------
upload/download config/image to/from disk/memory 
X
names: running-confg  <--- the running configuration
X       startup-config   <---- the startup config saved in nvram
X
1. manipulate config file to/from nvram
X
router# show running-config
router# show startup-config
X
router# copy running-config startup-config  <-- copy running to startup
older:
router # write memory  (same thing)
X
router# copy startup-config running-config  <-- copy startup to running
X
router# erase startup-config  <--- wipe out config in nvram
X
2. upload/download config file from 2ndary disk
X
router# copy running-config tftp:
X	(or older # write network)
X
3. upload/download binary image
X	
X	copy from tftp/disk to flash memory (and then reload to reboot)
X
X	router# copy tftp flash
X		you will be prompted for filename/remote ip
X
X	router# reload
X
X	IOS image might be named c2500-i-l.112-9.P.bin
X
X	note: router may have more than one space for images.  You
X		may have flash partitioned for > 1 image.
X
X	router# show flash
X
X	copy from image to disk
X	router# copy flash tftp
X
X	zap flash
X	router# erase flash
X
X	strong suggestion: keep the last known working image on
X		a known backed-up disk
X
----------------------------
security:
X
X	1. router's own security must be considered
X		USE acls to disallow access to/from router as desired,
X		especially on external WAN or Inet i/f.  
X		acl may be used to enable snmp access as well.
X	2. ACL mechanism used for many purposes including security,
X		route filtering (we will look at examples)
X	3. ACL may apply to VTY which controls telnet access
X		e.g., you can only allow one local system to get
X		access via telnet
X	4. dialup much more complex (AAA/radius, etc.) - need to tie
X		dialin login to backend workstation accounts
X	5. cisco now supports IPSEC as well
X
X	see acl demos and acl log.
X	Look at 1. accept a few things/deny rest (security is stronger)
X		2. deny a few things/accept rest (security is weaker)
X
X	# see what access list has been denying
X	router> show ip access list
X
X	use syslog.
X
X	use ntp time.
X		you want log time to be accurate with real time in
X		case of reconstruction post security event/random crash
X
X	be careful about what you syslog in terms of acls.
X		you don't want everything, else risk router spending
X		too much time processing logging, not enough on packets
X
----------------------------
short tour
----------
X
visual on-line demo of cisco commands during class
X
ssh note: consider using ssh to get as close to router as possible.
X	then telnet.  minimize sniffer attack on passwords.
SHAR_EOF
  (set 20 04 01 13 15 02 32 'routerintro.txt'; eval "$shar_touch") &&
  chmod 0644 'routerintro.txt' ||
  $echo 'restore of' 'routerintro.txt' 'failed'
  if ( md5sum --help 2>&1 | grep 'sage: md5sum \[' ) >/dev/null 2>&1 \
  && ( md5sum --version 2>&1 | grep -v 'textutils 1.12' ) >/dev/null; then
    md5sum -c << SHAR_EOF >/dev/null 2>&1 \
    || $echo 'routerintro.txt:' 'MD5 check failed'
7a25ab9e3c023468ee39c852442230a3  routerintro.txt
SHAR_EOF
  else
    shar_count="`LC_ALL= LC_CTYPE= LANG= wc -c < 'routerintro.txt'`"
    test 9970 -eq "$shar_count" ||
    $echo 'routerintro.txt:' 'original size' '9970,' 'current size' "$shar_count!"
  fi
fi
# ============= dexter-confg ==============
if test -f 'dexter-confg' && test "$first_param" != -c; then
  $echo 'x -' SKIPPING 'dexter-confg' '(file already exists)'
else
  $echo 'x -' extracting 'dexter-confg' '(text)'
  sed 's/^X//' << 'SHAR_EOF' > 'dexter-confg' &&
X
!
! Last configuration change at 14:51:04 PS Wed Jan 5 2000
! NVRAM config last updated at 14:52:02 PS Wed Jan 5 2000
!
version 12.0
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname dexter
!
boot system flash:c2600-js56i-mz.120-2.XC2.bin
enable secret 5 $1$Vj/C$GLaYn2mecQGihv22oswee0
!
clock timezone PS -8
clock summer-time PDT recurring
ip subnet-zero
ip domain-list .
ip domain-name cs.pdx.edu
ip name-server 131.252.208.38
ip name-server 131.252.208.58
!
!
!
!
X !
X !
X !
X interface FastEthernet0/0
X ip address 131.252.215.4 255.255.255.224
X no ip directed-broadcast
!
interface FastEthernet0/1
X ip address 131.252.215.33 255.255.255.240
X no ip directed-broadcast
!
ip classless
ip route 0.0.0.0 0.0.0.0 131.252.215.1
ip route 131.252.215.48 255.255.255.240 131.252.215.34
ip route 131.252.215.64 255.255.255.240 131.252.215.34
ip route 131.252.215.80 255.255.255.240 131.252.215.34
no ip http server
!
!
snmp-server community public RO
snmp-server location FAB/netlab
snmp-server contact jrb@cs.pdx.edu
snmp-server enable traps snmp
snmp-server enable traps isdn call-information
snmp-server enable traps config
snmp-server enable traps entity
snmp-server enable traps envmon
snmp-server enable traps bgp
snmp-server enable traps rsvp
snmp-server enable traps frame-relay
snmp-server enable traps syslog
snmp-server enable traps rtr
snmp-server host 131.252.215.5 traps public
!
line con 0
X transport preferred none
X transport input none
X exec-timeout 0 0
line aux 0
line vty 0 4
X password 7 050D0A0E335C0E3A17550D080709
X login
X transport preferred none
!
ntp server 131.252.215.1
end
SHAR_EOF
  (set 20 05 01 10 14 29 08 'dexter-confg'; eval "$shar_touch") &&
  chmod 0755 'dexter-confg' ||
  $echo 'restore of' 'dexter-confg' 'failed'
  if ( md5sum --help 2>&1 | grep 'sage: md5sum \[' ) >/dev/null 2>&1 \
  && ( md5sum --version 2>&1 | grep -v 'textutils 1.12' ) >/dev/null; then
    md5sum -c << SHAR_EOF >/dev/null 2>&1 \
    || $echo 'dexter-confg:' 'MD5 check failed'
3b7296e68dc22f9769541b1b3368331a  dexter-confg
SHAR_EOF
  else
    shar_count="`LC_ALL= LC_CTYPE= LANG= wc -c < 'dexter-confg'`"
    test 1642 -eq "$shar_count" ||
    $echo 'dexter-confg:' 'original size' '1642,' 'current size' "$shar_count!"
  fi
fi
# ============= minshall-confg ==============
if test -f 'minshall-confg' && test "$first_param" != -c; then
  $echo 'x -' SKIPPING 'minshall-confg' '(file already exists)'
else
  $echo 'x -' extracting 'minshall-confg' '(text)'
  sed 's/^X//' << 'SHAR_EOF' > 'minshall-confg' &&
X
!
version 11.2
no service pad
service password-encryption
no service udp-small-servers
no service tcp-small-servers
!
hostname minshall
!
enable secret 5 $1$1Cra$aVyf9.VNDVViB4dg5mFJX1
!
!
ip domain-name cs.pdx.edu
ip name-server 131.252.208.38
ip name-server 131.252.208.58
!
interface VLAN1
X ip address 131.252.215.14 255.255.255.240
X no ip route-cache
!
interface FastEthernet0/1
X description rdot/port 0
!
interface FastEthernet0/2
X description bellovin.cs.pdx.edu
!
interface FastEthernet0/3
X description dexter/port 0
!
interface FastEthernet0/4
X description lixia/port 1
!
interface FastEthernet0/5
X description dexter/port 1
X switchport access vlan 2
!
interface FastEthernet0/6
X description radia/ port 0
X switchport access vlan 2
!
interface FastEthernet0/7
X description mrhorse/port 0
X switchport access vlan 2
!
interface FastEthernet0/8
X description no connection
X switchport access vlan 2
!
interface FastEthernet0/9
X description radia/port 1
X switchport access vlan 3
!
interface FastEthernet0/10
X description tony/port 0
X switchport access vlan 3
!
interface FastEthernet0/11
X description no connection
X switchport access vlan 3
!
interface FastEthernet0/12
X description no connection
X switchport access vlan 3
!
interface FastEthernet0/13
X description tony/port 1
X switchport access vlan 4
!
interface FastEthernet0/14
X description yakov/port 0
X switchport access vlan 4
!
interface FastEthernet0/15
X description mrhorse/port 1
X switchport access vlan 4
!
interface FastEthernet0/16
X description no connection
X switchport access vlan 4
!
interface FastEthernet0/17
X description yakov/port 1
X switchport access vlan 5
!
interface FastEthernet0/18
X description big baby/port 0
X switchport access vlan 5
!
interface FastEthernet0/19
X description no connection
X switchport access vlan 5
!
interface FastEthernet0/20
X description no connection
X switchport access vlan 5
!
interface FastEthernet0/21
X description no connection
X switchport access vlan 6
!
interface FastEthernet0/22
X description no connection
X switchport access vlan 6
!
interface FastEthernet0/23
X description no connection
X switchport access vlan 6
!
interface FastEthernet0/24
X no port monitor FastEthernet0/13
X no port monitor FastEthernet0/14
X no port monitor FastEthernet0/15
X switchport access vlan 6
!
interface GigabitEthernet1/1
!
ip default-gateway 131.252.215.1
snmp-server community public RO
snmp-server location pcat144-network lab
snmp-server contact jrb@cs.pdx.edu
snmp-server chassis-id 0x10
!
line con 0
X transport preferred none
X stopbits 1
X exec-timeout 0 0
line vty 0 4
X password 7 01150A05491B463C2F1C54131500
X login
X transport preferred none
line vty 5 9
X password 7 00021F07164B4B3501715654051C
X login
X transport preferred none
!
end
SHAR_EOF
  (set 20 05 01 10 14 29 08 'minshall-confg'; eval "$shar_touch") &&
  chmod 0755 'minshall-confg' ||
  $echo 'restore of' 'minshall-confg' 'failed'
  if ( md5sum --help 2>&1 | grep 'sage: md5sum \[' ) >/dev/null 2>&1 \
  && ( md5sum --version 2>&1 | grep -v 'textutils 1.12' ) >/dev/null; then
    md5sum -c << SHAR_EOF >/dev/null 2>&1 \
    || $echo 'minshall-confg:' 'MD5 check failed'
f1863a3f1eb8610fb4c2895e437c19bb  minshall-confg
SHAR_EOF
  else
    shar_count="`LC_ALL= LC_CTYPE= LANG= wc -c < 'minshall-confg'`"
    test 2737 -eq "$shar_count" ||
    $echo 'minshall-confg:' 'original size' '2737,' 'current size' "$shar_count!"
  fi
fi
# ============= allowjrb.acl ==============
if test -f 'allowjrb.acl' && test "$first_param" != -c; then
  $echo 'x -' SKIPPING 'allowjrb.acl' '(file already exists)'
else
  $echo 'x -' extracting 'allowjrb.acl' '(text)'
  sed 's/^X//' << 'SHAR_EOF' > 'allowjrb.acl' &&
Incoming Cisco WAN i/f ACL:
X	example of: deny bad things, accept everything else
X
The incoming Internet facing i/f acl is structured to deny a 
certain set of bad things, else allow everything else.  
Assume a classic class B address (e.g., 179.1.0.0), with a subnet 
mask 255.255.255.0.
X
Typically in IOS speak, access lists are bound to interface as for 
X	example
X
interface fastethernet0/1 
X	ip access-group in 122
X	ip access-group out 122
X
WARNING: this is meant to be illustrative and should
X	not be taken to be useful in the real world without
X	reexamination of what new bugs might exist.
X
note: this can be improved substantially by denying all < 1024 ports except
X	for certain "ok" ports, but then it isn't so
X	much deny bad/allow rest
X
----------------------------------------------------------
! some paranoid NOs.  these are here to squash certain types
! 	of spoofing behavior fast
!
! deny external spoofing
access-list 122 deny   ip <my class B> 0.0.255.255 any
!
! deny spoofing from "reserved" addresses
access-list 122 deny   ip 10.0.0.0 0.255.255.255 any
access-list 122 deny   ip 127.0.0.0 0.255.255.255 any
access-list 122 deny   ip 172.16.0.0 0.15.255.255 any
access-list 122 deny   ip 192.168.0.0 0.0.255.255 any
access-list 122 deny   ip host 0.0.0.0 any
access-list 122 deny   ip host 255.255.255.255 any
X
! just say no to ICMP denial of service attacks
! assumption here is that we are class B/24. 
! note we squash attacks via 0's as well.
!
access-list 122 deny   icmp any 0.0.0.255 255.255.255.0
access-list 122 deny   icmp any 0.0.0.0 255.255.255.0
X
! just say no to all unauthorized tunnels
access-list 122 deny   ipinip any any 
access-list 122 deny   gre any any
X
! known bad things to stomp on
! nfs
access-list 122 deny   tcp any any eq 2049 
access-list 122 deny   udp any any eq 2049 
! tftp
access-list 122 deny   udp any any eq tftp 
access-list 122 deny   tcp any any eq tftp 
! ttyline
access-list 122 deny   tcp any any eq 87 
access-list 122 deny   udp any any eq 87
! rsh (512)
access-list 122 deny   tcp any any eq exec 
! rlogin
access-list 122 deny   tcp any any eq 513 
! rcmd
access-list 122 deny   tcp any any eq cmd 
! example hole in access list (bad ...)
! 
access-list 122 permit tcp host <external server> host 
X	<internal printer> eq lpd 
! lpd
access-list 122 deny   tcp any any eq lpd 
access-list 122 deny   udp any any eq lpd
! X11
access-list 122 deny   tcp any any eq 6000 
access-list 122 deny   tcp any any eq 6001 
access-list 122 deny   tcp any any eq 6002 
! snmp
access-list 122 deny   tcp any any eq 161 
access-list 122 deny   udp any any eq 161 
access-list 122 deny   tcp any any eq 162 
access-list 122 deny   udp any any eq 162 
! syslog
access-list 122 deny   udp any any eq syslog  
! sunrpc/rpcbind (NIS portmapper)  (this may not be enough)
access-list 122 deny   tcp any any eq sunrpc 
access-list 122 deny   udp any any eq sunrpc 
! 137-139 netbios (thank you microsoft)
access-list 122 deny   tcp any any eq 137 
access-list 122 deny   tcp any any eq 138 
access-list 122 deny   tcp any any eq 139 
access-list 122 deny   udp any any eq 137
access-list 122 deny   udp any any eq 138
access-list 122 deny   udp any any eq 139
! echo
access-list 122 deny   tcp any any eq echo 
access-list 122 deny   udp any any eq echo 
! discard
access-list 122 deny   tcp any any eq discard 
access-list 122 deny   udp any any eq discard	
! chargen
access-list 122 deny   tcp any any eq chargen 
access-list 122 deny   udp any any eq 19 
! nameserver
access-list 122 deny   tcp any any eq 42 
access-list 122 deny   udp any any eq nameserver		
X
! else accept
access-list 122 permit ip any any 
SHAR_EOF
  (set 20 04 01 13 14 59 14 'allowjrb.acl'; eval "$shar_touch") &&
  chmod 0644 'allowjrb.acl' ||
  $echo 'restore of' 'allowjrb.acl' 'failed'
  if ( md5sum --help 2>&1 | grep 'sage: md5sum \[' ) >/dev/null 2>&1 \
  && ( md5sum --version 2>&1 | grep -v 'textutils 1.12' ) >/dev/null; then
    md5sum -c << SHAR_EOF >/dev/null 2>&1 \
    || $echo 'allowjrb.acl:' 'MD5 check failed'
adc6d56ab66e9fa8d1eb7da14fea8840  allowjrb.acl
SHAR_EOF
  else
    shar_count="`LC_ALL= LC_CTYPE= LANG= wc -c < 'allowjrb.acl'`"
    test 3659 -eq "$shar_count" ||
    $echo 'allowjrb.acl:' 'original size' '3659,' 'current size' "$shar_count!"
  fi
fi
# ============= denyjrb.acl ==============
if test -f 'denyjrb.acl' && test "$first_param" != -c; then
  $echo 'x -' SKIPPING 'denyjrb.acl' '(file already exists)'
else
  $echo 'x -' extracting 'denyjrb.acl' '(text)'
  sed 's/^X//' << 'SHAR_EOF' > 'denyjrb.acl' &&
cisco acl example: allow a few good things/deny the rest
X
ACL orientation:  very restrictive "firewall"-style list.
X	This ACL is assumed to be bound to the outside WAN/Inet
X	interface and affects packets coming into the site.
X
X	All access to/from site is restricted.  Only
X	certain services are allowed, and these go
X	to either open networks or bastion hosts
X
X	Note: you also need a list for outbound packets.
X	This may be bound as the incoming ACL for the inside interface.
X	Minimally it should prevent ip spoofing, and permit
X	access to/from known bastion hosts or subnets permitted
X	to talk to the Internet.
X
X	Assumption for this acl:  Class B site address with /24
X		subnets inside.
X 
----------------------------------------------------------
! some paranoid NOs.  these are here to squash certain types
! 	of spoofing behavior fast
!
! deny external spoofing
access-list 122 deny   ip <my class B> 0.0.255.255 any
!
! deny spoofing from "reserved" addresses
access-list 122 deny   ip 10.0.0.0 0.255.255.255 any
access-list 122 deny   ip 127.0.0.0 0.255.255.255 any
access-list 122 deny   ip 172.16.0.0 0.15.255.255 any
access-list 122 deny   ip 192.168.0.0 0.0.255.255 any
access-list 122 deny   ip host 0.0.0.0 any
access-list 122 deny   ip host 255.255.255.255 any
X
! just say no to ICMP denial of service attacks
! assumption here is that we are class B/24. 
!
access-list 122 deny   icmp any 0.0.0.255 255.255.255.0
access-list 122 deny   icmp any 0.0.0.0 255.255.255.0
X
! just say no to all unauthorized tunnels
access-list 122 deny   ipinip any any 
access-list 122 deny   gre any any
X
! deny external access to my router (check NTP below though)
! e.g., if router is NTP peer/server you would want to enable
! that before this line
! alternative: you might just block external telnet access on the vty line
access-list 122 deny   ip <my site> <mask>  host <router address>
access-list 122 deny   ip <my site> <mask>  host <router address>
access-list 122 deny   ip <my site> <mask>  host <router address>
!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!	
! PERMIT a few SERVICES, then DENY ALL
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
X
! permit access to a certain subnet
access-list 122 permit   ip any <restricted subnet> 0.0.0.255
!
! permit access to a certain bastion host
! you may want to be more restrictive of course
! BUT remember to think through problems 2-ways (client port/server port)
!
access-list 122 permit   ip any host <host address>
X
! Wherever possible, limit traffic 
!
! eg replace "any" with "host <host address>"
!    replace "any" with "<subnet> <subnet mask>"
!
X
! permit ftp to ftp bastion host server
!ftp tcp 20 & 21
access-list 122 permit   tcp any host <ftp-bastion-host> eq 20	
access-list 122 permit   tcp any host <ftp-bastion-host> eq 21
!
!secure shell (ssh) tcp 22
access-list 122 permit   tcp any host <ftp-bastion-host> eq 22
!
!telnet tcp 23
access-list 122 permit   tcp any host <telnet-bastion-host> eq 23
!
!smtp 25
access-list 122 permit   tcp any host <email-server> eq 25
!
!DNS 53/53  
!     note: this takes care of DNS in.  DNS as client
!	out will require ports >= 1024 for that bastion host
access-list 122 permit   tcp any host <dns-server1> eq 53
access-list 122 permit   udp any host <dns-server1> eq 53
X
!
! tcp 80 http
access-list 122 permit   tcp any host <web-server> eq 80
!
! network time protocol 123/123
!	consider if this is/is not your border router
access-list 122 permit   udp any <ntp-server> eq 123
!
!
! may (but should not) allow access to all other unrestricted 
! ports 1024 and over.  Consider doing this on a per bastion host
! basis.  Remember this prevents a remote server from talking to
! a local client.
!access-list 122 permit   tcp any any eq ge 1024
!access-list 122 permit   udp any any eq ge 1024
!
! else deny (default anyway)
access-list 122 deny   ip any any 
X
SHAR_EOF
  (set 20 03 01 17 07 45 58 'denyjrb.acl'; eval "$shar_touch") &&
  chmod 0644 'denyjrb.acl' ||
  $echo 'restore of' 'denyjrb.acl' 'failed'
  if ( md5sum --help 2>&1 | grep 'sage: md5sum \[' ) >/dev/null 2>&1 \
  && ( md5sum --version 2>&1 | grep -v 'textutils 1.12' ) >/dev/null; then
    md5sum -c << SHAR_EOF >/dev/null 2>&1 \
    || $echo 'denyjrb.acl:' 'MD5 check failed'
353ad64254a2dd27c118d7a8808e9e05  denyjrb.acl
SHAR_EOF
  else
    shar_count="`LC_ALL= LC_CTYPE= LANG= wc -c < 'denyjrb.acl'`"
    test 3879 -eq "$shar_count" ||
    $echo 'denyjrb.acl:' 'original size' '3879,' 'current size' "$shar_count!"
  fi
fi
rm -fr _sh23863
exit 0
