Re: [OSL | CCIE_Security] Generating RSA keys for IOS IPS - Sec 3.15

2010-02-17 Thread Stuart Hare
Kings, I never tried it without generating a key, but its noted as a pre-requisite in the documentation. If it does work without they may just be adding it to conform with the RSA Public/Private key pair model. Confusing thing for me in this case is that a public key is used to encrypt not

Re: [OSL | CCIE_Security] ACL's

2010-02-17 Thread Tolulope Ogunsina
Hi, With recent IOS releases, numbered access-lists are converted to named access-lists automatically, do you dont have to recreate the access-list to delete a line. On 2/16/10, Shawn Mesiatowsky sha...@digitalcortex.ca wrote: for numbered acls you can still use ip access-list. This has the

Re: [OSL | CCIE_Security] WB1 Lab 3, IPS

2010-02-17 Thread Stuart Hare
Again, I would not be hung up too much on this as long as your outcome provides the required results. If the task specifically states to use a particular engine or sig then do, if not you need to choose which one you feel best suits your requirements. And of course if you are unsure then consult

Re: [OSL | CCIE_Security] Lab 19 Task 1.3

2010-02-17 Thread Piotr Kaluzny
Johan, Looks there was a typo there - it should be 10.10.12.0 255.255.255.0 Regards, -- Piotr Kaluzny CCIE #25665 (Security), CCSP, CCNP Sr. Support Engineer - IPexpert, Inc. URL: http://www.IPexpert.com On Wed, Feb 17, 2010 at 10:35 AM, Johan Bornman jo...@isc.co.za wrote: Hi, Just

[OSL | CCIE_Security] Virtual Private Dialup Network - VPDN

2010-02-17 Thread Mohamed Gazzaz
Hello, Basically, we have some external contractors/consultants who are accessing our SAP servers via VPDN. We want to limit their access to some servers so what is the best way to do that? I don't have a lot of experience with VPDN and this stuff is new to me. Here is the scenario: The

[OSL | CCIE_Security] Switch configured for trunking with IPS

2010-02-17 Thread Kingsley Charles
Hi all For IPS interface in Promisuous mode, we configure switch for monitor session. When we use remote vlans, for the destination cmd, we have the reflector-port at end end. monitor session 1 destination remote vlan 999 *reflector-port * ** ** Can someone explain, what does this do? It is not

Re: [OSL | CCIE_Security] Virtual Private Dialup Network - VPDN

2010-02-17 Thread Kingsley Charles
Hi Mohamed You can try using SSLVPN's thin client. I am not sure, how will it work with SAP. With regards Kings 2010/2/17 Mohamed Gazzaz mgaz...@hotmail.com Hello, Basically, we have some external contractors/consultants who are accessing our SAP servers via VPDN. We want to limit their

Re: [OSL | CCIE_Security] Switch configured for trunking with IPS

2010-02-17 Thread Brandon Carroll
First off The Catalyst 2970, 3560, and 3750 Switches do not require the configuration of a reflector port when you configure an RSPAN session. This is from the 3550 documentation: The reflector port is the mechanism that copies packets onto an RSPAN VLAN. The reflector port forwards only the

Re: [OSL | CCIE_Security] Generating RSA keys for IOS IPS - Sec 3.15

2010-02-17 Thread Kingsley Charles
If the pub key is used to encrypt, then we can use the private key to decrypt If the priv key is used to encrypt, then we can use the pub key to decrypt. With regards Kings On Wed, Feb 17, 2010 at 1:39 PM, Stuart Hare stu...@ipexpert.com wrote: Kings, I never tried it without generating a

Re: [OSL | CCIE_Security] WB1 Lab 3, IPS

2010-02-17 Thread Kingsley Charles
I just checked, it does work with ICMP total length but the problem is that we can't provide the range of the size. With regards Kings On Wed, Feb 17, 2010 at 4:51 PM, Kingsley Charles kingsley.char...@gmail.com wrote: Thanks Stu. For large ICMP packets, the solution tells us to use ip

[OSL | CCIE_Security] Unable to open Sec WB?

2010-02-17 Thread Simon Baumann
Hi, I got an Sec Pod @ProctorLabs at the moment and want to continue working on a lab. When I try to open the PDF file and entered my credentials, I get this error: Unable to get data [FO error #2109, OS error #404]. Strange thing. This always worked for my. Does anybody has a hint what to

Re: [OSL | CCIE_Security] Virtual Private Dialup Network - VPDN

2010-02-17 Thread Tyson Scott
Mohammed, You can use an ACL on your Virtual-Template interface to control what they gain access to if you are doing this on a router. I would have to research to know what to do on the ASA for VPDN. Regards, Tyson Scott - CCIE #13513 RS, Security, and SP Technical Instructor -

Re: [OSL | CCIE_Security] Unable to open Sec WB?

2010-02-17 Thread Tyson Scott
Simon, Please contact the support team right away. supp...@ipexpert.com, supp...@proctorlabs.com, or contact them via live chat. Regards,   Tyson Scott - CCIE #13513 RS, Security, and SP Technical Instructor - IPexpert, Inc. Mailto: tsc...@ipexpert.com Telephone: +1.810.326.1444, ext. 208 Live

[OSL | CCIE_Security] CCIE Security bootcamp in europe this spring?

2010-02-17 Thread Jimmy Larsson
Hi Does anyone know of any company that will run a CCIE bootcamp in Europe before summer? I plan to do my lab attempt in june. I have pre-paid 50 8-hour sessions from proctorlabs.com and have 44 of them left today. Right now and for the next 1-2 months I cannot do lab studies more than 1

Re: [OSL | CCIE_Security] Generating RSA keys for IOS IPS - Sec 3.15

2010-02-17 Thread Jimmy Larsson
If the pub key is used to encrypt, then we can use the private key to decrypt If the priv key is used to encrypt, then we can use the pub key to decrypt. Well. As far as I know it is more like this: I use my private key AND your public key. I put both of them into a algoritm. The output

Re: [OSL | CCIE_Security] CCIE Security bootcamp in europe this spring?

2010-02-17 Thread Marko Milivojevic
Hello Jimmy, Of course we know of a company that has security bootcamp before summer in Europe. It's called IPexpert! We have one scheduled for May 10th in Amsterdam. Take a look at our schedule here: http://www.ipexpert.com/Cisco/CCIE/Security/Lab-Boot-Camp/5-Day-Boot-Camp I will include our

Re: [OSL | CCIE_Security] CCIE Security bootcamp in europe this spring?

2010-02-17 Thread Jimmy Larsson
Thanks! I will consider to attend (or more like: I will try too convince my boss to pay for it). Sales, I would like to have more details, like pricing... ;) /J 2010/2/17 Marko Milivojevic mar...@ipexpert.com Hello Jimmy, Of course we know of a company that has security bootcamp before

Re: [OSL | CCIE_Security] CCIE Security bootcamp in europe this spring?

2010-02-17 Thread Brandon Carroll
Hi Jimmy, How about Amsterdam- May 10th to the 14th? Regards, Brandon Carroll - CCIE #23837 Senior Technical Instructor - IPexpert Mailto: bcarr...@ipexpert.com Telephone: +1.810.326.1444 Live Assistance, Please visit: www.ipexpert.com/chat eFax: +1.810.454.0130 IPexpert is a premier provider

Re: [OSL | CCIE_Security] Virtual Private Dialup Network - VPDN

2010-02-17 Thread Tyson Scott
Can't you terminate the connections on two separate interfaces? I would create two virtual-templates and have each group just terminate on the different interface. Regards, Tyson Scott - CCIE #13513 RS, Security, and SP Technical Instructor - IPexpert, Inc. Mailto:

Re: [OSL | CCIE_Security] CCIE Security bootcamp in europe this spring?

2010-02-17 Thread Jimmy Larsson
Sounds good! I will have a talk with my boss. Do you know the price? /J 2010/2/17 Brandon Carroll bcarr...@ipexpert.com Hi Jimmy, How about Amsterdam- May 10th to the 14th? Regards, Brandon Carroll - CCIE #23837 Senior Technical Instructor - IPexpert Mailto: bcarr...@ipexpert.com

Re: [OSL | CCIE_Security] CCIE Security bootcamp in europe this spring?

2010-02-17 Thread Brandon Carroll
Not sure about price. But sa...@ipexpert.com can tell you. Regards, Brandon Carroll - CCIE #23837 Senior Technical Instructor - IPexpert Mailto: bcarr...@ipexpert.com Telephone: +1.810.326.1444 Live Assistance, Please visit: www.ipexpert.com/chat eFax: +1.810.454.0130 IPexpert is a premier

Re: [OSL | CCIE_Security] CCIE Security bootcamp in europe this spring?

2010-02-17 Thread Jimmy Larsson
Ive got a quotation. Thanks! Br Jimmy 2010/2/17 Brandon Carroll bcarr...@ipexpert.com Not sure about price. But sa...@ipexpert.com can tell you. Regards, Brandon Carroll - CCIE #23837 Senior Technical Instructor - IPexpert Mailto: bcarr...@ipexpert.com Telephone: +1.810.326.1444 Live

[OSL | CCIE_Security] DOC CD

2010-02-17 Thread Johan Bornman
Hi, I have not used the DOC CD all that much, I googled cisco for most of my research/reading and was wondering if somebody has made a quick reference guide for the most important topics, as the search option is not available in the lab, or somebody with experience can give me a few pointers.

[OSL | CCIE_Security] ACS configuration for lab

2010-02-17 Thread Kingsley Charles
Hi all Can you please let me know, if the following ACS configurations are suffice to be thorough for the lab: ASA Cut-throught proxy ( authentication authorization) with Radius ASA Remote VPN - group authentication with Radius ASA Remote VPN - group configuration with Radius ASA Remote VPN -