Tejas Jain

Traditional catalyst switches like Cisco Catalyst 3750 / 3560, by default do not have IPv6 routing enabled, and simply entering the " ipv6 unicast-routing " won't work! First, enable dual-stack routing by: sdm prefer dual-ipv4-and-ipv6 This should be followed by a reboot, post which enable IPv6 routing by: ipv6 unicast-routing Post which you should be able to do all the IPv6 configuration..

A VPC has been created with an address scope, subnets have been created within that scope and EC2 instances have been created in the VPC. Now, you wish to provide your EC2 instances with Internet access. This can be done either by selection "Allocate a public IP" during the instance creation or allocating an Elastic IP to your account and associating the elastic IP to your instance. All this is possible only if you have an Internet Gateway associated with the VPC and the route table having the internet routes (or default route) pointing towards Internet Gateway. Let's create Internet Gateway. Go to Services >> VPC >> On the left pane, under Virtual Private Cloud, click Internet Gateways. Internet Gateway Click on "Create internet gateway", enter the Name tag and "Create" Internet Gateway Now associate the Internet Gateway with a VPC, by clicking on the internet gateway (just created), and Actions: Attach to VPC Attach to VPC In my case s...

So you have created a VPC and your EC2 instance is ready.. (here I am assuming we haven't configured public IP, while creating EC2 instance). Let us now allocate an Elastic IP address to our AWS account from the Amazon's reserved public IP range. This can be done by Services >> EC2 >> Scroll down the left navigation pane and under Network & Security, click on Elastic IPs . Click on the Allocate Elastic IP address button AWS Elastic IP Once this IP address is allocated, select the Elastic IP, click on Actions and click on "Associate Elastic IP address", as below: Associate Elastic IP with an instance This would bring up the below page which gives an option to select the EC2 instance which this Elastic IP needs to be allocated to. [I have erased my Elastic IP address and the Instance ID] Associate Elastic IP with an instance And that should be it. There is a catch here, however! The above process won't work if there is no Internet Gateway associa...

Depending upon your platform find the setup file below: https://www.elastic.co/downloads/beats/auditbeat Unzip the file, rename it to Auditbeat and copy the unzipped folder to C:\Program Files as below: Auditbeat 2. Open Powershell with Administrator privileges, and type the following: In case of code execution restriction, please check my post here . Once the installation is successful, modify the C:\Program Files\Auditbeat\auditbeat.yml file to establish the connection with Elastic Cloud tenant we created above. Scroll down and un-comment: "cloud-id" to enter the following: cloud.id: " Deployment:Cloud ID " cloud.auth: "username:<password>" I have masked the Cloud ID and password details for my deployment (Deployment-1) Enter the following commands in Powershell to load Kibana dashboards. The setup is ready.. Check on Kibana if the Windows Audit logs are getting populated in Kibana. The logs can be found by clicking on the compass icon in ...

My first foray into the Security SIEM seems is going to be with the prodigal ELK stack. Keeping the discussion later, w.r.t. the pros, cons and features of ELK, let's dive into our first implementation (integration of Windows Server with ELK) For testing purpose, I have created a 14 day free trial that ELK offers. Go to https://elastic.co Select Try Free Scroll down to find ElasticSearch and Click Launch on Elastic Cloud. It should ask for email details which needs to be verified. Create a Deployment. My deployment details are as below: Elasticsearch Deployment Click on the deployment to check the Cloud ID . Save this somewhere as this will be very crucial to direct traffic from endpoints to this Cloud Tenant Now, once the Cloud tenant is ready, let us install Winlogbeat on our Windows server to send Windows event logs to Kibana (ELK's GUI) Winlogbeat installation Download Winlogbeat from https://www.elastic.co/products/beats/winlogbeat Extract the contents of the zip file to...

OSPF Options Field DN = Down bit : used in MPLS Layer 3 VPNs. If a route learnt from a customer network via OSPF is advertised across a BGP / MPLS VPN using Multiprotocol BGP, and is advertised back to a customer network via OSPF, there is a possibility of a loop to occur in which the OSPF route is redistributed back to the VPN service provider network via BGP. The DN bit prevents this type of routing loop. O = The “O” bit is set when the originating router supports Type 9,10 and 11 opaque LSAs. Not used in normal OSPF implementations DC = The “DC” bit is set when the originating router supports OSPF over Demand Circuits. Not used in normal OSPF implementations L = Indicates whether the OSPF packet contains a LLS (Link-Local signalling) data block. This bit is set only in Hello and DBD packets. N = The N bit is used only in Hello packets. The N bit is set when the originating router supports Type-7 NSSA-External-LSAs. Neighboring routers with mismatched N bit value will not form ...

BGP communities are optional transitive attributes They are used mainly to associate an administrative tag to a BGP route In spite of the communities being transitive, Cisco IOS routers do not pass them across the BGP sessions by default. The feature needs to be activated using the command “neighbor send-community” To display the community in the structured notation, you need to enter the global configuration command “ip bgp-community new-format” In order to set a community value, use the route-map command “ set community etc” or to add the community value on the existing community values use “set community additive ” The routes with communities assigned to them can be matched using “community-list” and which can then be referenced in a route-map later. There are two types of community lists : standard and extended. For eg. ip community-list 1 permit 101:1 101:2 ip community list 1 deny no-export Std community list NO-ADVERTISE community attribute: The well-known NO_ADVERTISE...