A Cisco Router running Cisco IOS can function as a Caching or Forwarding DNS Server which answers to DNS queries from clients either from its host table or cache or forward it to a DNS server which can respond to the query.
This feature can come in handy in small network environments where the router can act as a Caching DNS server forwarding queries to the ISPs DNS servers or infact any external DNS servers. Also, makes sense using on under utilized DNS servers.
Cisco IOS supports multiple IP Addresses on an interface. There will be one Primary IP Address on the interaface and multiple Secondary IP Addresses on the interface. There is no limit on the number of IP Addresses that can be configure on an interface. Configurng multiple IP Addresses on your cisco routers can sometime help where you have multiple subnets having one physical router interface.
The IP Addresses can be from different subnets and from different networks.
Cisco routers running Cisco IOS supports pased based IP Routing which can route packets based on a set IP Policy exiting an Interface.
Policy based routing in Cisco ROuters can be performed by using "route-map" and then applying as a policy to the interface of the IP Packets.
The route-map has a list of "match" and "set" commands where match defines the criteria under which the policy routing is performed (say, match a destination IP or a standard or Extended ACL) and set defines the actions to perform when match criteris met (say, set next hop).
ACLs in Cisco IOS can be used to control traffic flow and to use it as a simple list to define another function like NATing or Route-Maps. Standard Access List (ACL) in Cisco IOS are the simplest and oldest type of ACLs. Standard ACLs simply compare the Source IP Address on the packet against the IP Address defined on the ACL and decides whether to permit or deny the traffic as per the definition in the ACL.
When used to control traffic, it is recommended that the ACLs in general are applied to the interface closest to the segment where the traffic originates.
The Day Light savings time kicked in today in the UK today and it is this part of the year (and when the GMT kicks back in) we do a sanity check on all the Network Devices, Appliances and Servers for time.
It is important to set the time appropriately on the devices as an incorrect time on the devices can cause authentication issues and ofcourse incorrect time stampls on the logs.
You can enable the Day Light Savings time in Cisco IOS. This just takes a couple of commands from the Global Configuration mode.
HSRP stands for Hot Standy Routing Protocol which provides Automatic Router backup when an active router in the group fails. HSRP allows building resiliency in the network gateways wherein should an Active Router fail in a HSRP group, the standby router assumes the role of the active router and continue routing packets.
HSRP works by sending multicast "Hello" messages (default: every 3 secs). If the Standby router do not receive any Hello packets from the active router for a preset time (default 10secs) then it assumes the active router is down and becomes the active router. Also, if we are tracking an interface and if the tracked interface is down, the Active Router reduces its priority so a Standby Router can assume to role of Primary Router.
While no security is fool proof, it is important that we do as much as we can to ensure maximum protection on our netowrk devices like Routers and Switches. Cisco IOS has enhanced Login restriction features which can control login attempts to it. This includes time delay between failed login attempts, block period after a set of failed login attempts and audit logs of successful and failed login attempts.
These login restrictions provides more control and make it that more harder for unauthorised accesses and prevent against Dictionary based DoS attacks.
(more…)