Linking Active Directory to Palo Alto

 ###First you need to create a server profile under the LDAP section.

DEVICE>Server Profiles>LDAP then click on the Add down at the bottom of the page.

Fill in the required information:

Profile Name ###the name of this LDAP object your creating

Server List ###This is inputting the DNS name, LDAP server IPs, and the port number information

##For port info, 389 and 636

Server Settings:

Type: active-directory

Base DN: DC=LAB,DC=LOCAL (stands for lab.local, or whatever your domain is)

Bind DN: svc.acct@lab.local (whatever your service account name is)

Password: Service account password

Confirm Password: confirm it

Bind Timeout: 30

Seach Timeout: 30

Retry Interval: 60

If you click on "Require SSL/TLS secured connection" it will try and force encryption when available

###Next, you can create an Authentication Profile to associate with user accounts.

DEVICE>Authentication Profiles>then click Add at the bottom of the page.

Authentication Profile Settings:

Under Authentication, fill out the following:

Type: LDAP

Server Profile: YOUR_SERVER-PROFILE

Login Attribute: sAMAccountName

Password Expiry Warning: 7

User Domain: lab.local

Username Modifier: %USERINPUT%

Leave Factors tab alone

Then for to Advanced Tab

Allow List: Click Add

Select all to ensure all users are applied

###Now you can go to Administrators and add admins and associate them to the Authentication Profile

DEVICE>Administrators>Add or click on a user you want to work with

On Authentication Profile, click the drop down and then select the profile you setup from the previous step.

This user can now use their AD account to login.

Renew Default Security Keyring Cisco UCS

Step 1: UCS-A# scope security

Step 2: UCS-A /security # scope keyring default

Step 3: UCS-A /security/keyring # set regenerate yes

Step 4: UCS-A /security/keyring # commit-buffer

Factory Reset Cisco UCS 4.1 CLI

 ####You must use the local admin account in order for the option to be listed.

####Login through SSH to the FI VIP (or the current primary FI).

####Next connect to the local management CLI then execute the rease conifig command.

FI-A#local-mgmt

FI-A(local-mgmt)erase configuration

All UCS configurations will be erased and system will reboot. Are you sure? (yes/no):yes

####Make sure to do the same process on the other FI if you have a secondary.

####The configurations will be erased and the FIs will reboot.

RSPAN Configuration

 ###First, create the Remote SPAN (RSPAN) VLAN. You must do this on both switches

SW1#configuration terminal

SW1(config)#vlan 999

SW1(config-vlan)#name RSPAN-VLAN

SW1(config-vlan)#remote-span

SW1(config-vlan)#exit

SW2#configuration terminal

SW2(config)#vlan 999

SW2(config-vlan)#name RSPAN-VLAN

SW2(config-vlan)#remote-span

SW2(config-vlan)#exit

###Next, create your monitor session for your source ports you are mirroring

SW1#configuration terminal

SW1(config)#monitor session 1 source interface gi 1/0/2 both ###This enables both transmit and receive to be recorded

###Now you can add the RSPAN VLAN to your monitor session as a destination to drop the data into the RSPAN VLAN:

SW1#configure terminal

SW1(config)#monitor session 1 destination remote vlan 999

###Now, go to your next switch in the destination and create a monitor session pulling from the RSPAN VLAN

SW2#configuration terminal

SW2(config)#monitor session 1 source remote vlan 999

###Finally, create a destination monitor session to dump the RSPAN VLAN traffic to your system analyzing the traffic

SW2#configuration terminal

SW2(config)#monitor session 1 destination interface gi 1/0/2

Setup DHCP Relay VyOS

#set service dhcp-relay interface YOUR_INTERFACE
Or,
#set service dhcp-relay server YOUR_SERVER_IP
#commit
#save

Reference:
https://docs.vyos.io/en/equuleus/configuration/service/dhcp-relay.html

Set an IP on an Interface in VyOS

#set interfaces ethernet YOUR_INTERFACE address YOUR_IP|dhcp|dhcpv6
#set interfaces ethernet YOUR_INTERFACE description DESCRIPTION_FOR_INTERFACE
#set interfaces ethernet YOUR_INTERFACE disable
#set interfaces ethernet YOUR_INTERFACE enable
#commit
#save

Reference:
https://docs.vyos.io/en/equuleus/configuration/interfaces/ethernet.html

Setting Passwords Cisco Router/Switch

Set a password for Console login

RTR-01#config t

RTR-01(config)#line console 0

RTR-01(config-line)#login (turns on login enable ability. Otherwise will not prompt)

RTR-01(config-line)#password cisco123

RTR-01(config-line)#end

Set an enable secret password

RTR-01#config t

RTR-01(config)#enable secret cisco123

RTR-01(config)#exit

RTR-01#disable (takes you back to user mode)

RTR-01>enable

Enter password: YOUR_PASSWORD_NOW

Set VTY password

RTR-01#config t

RTR-01(config)#line vty 0 15

RTR-01(config-line)#login (enables the login feature to the VTY line)

RTR-01(config-line)#password cisco123 (sets the password for the line login)

RTR-01(config-line)#end

Enable Global Password Encryption

RTR-01#config t

RTR-01(config)#service password-encryption

Open Port on Linux Firewalld

 1. First you need to add the rule:

a. user@test>firewalld-cmd --add-port=YOUR_PORT_#/udp-or-tcp --permanent

2. Restart the firewall:

a. user@test>firewall-cmd --reload

3. Check the firewall list:

a. user@test>firewall-cmd --list-all

Kubernetes Cheat Sheet

 • Check Status of Pods

o kubectl get pods (quick detail)

o kubectl get pods -A (more details)

• Check the logs on a pod

o kubectl logs POD_NAME

o kubectl logs POD_NAME CONTAINER_NAM (For pods with multiple containers)

• Delete one pod, or selected ones:

o kubectl delete pod YOUR_POD, NEXT_POD

• Delete All Pods

o kubectl delete pod --all

• Pull evicted pods and then Delete them

o kubectl get pod | grep Evicted | awk '{print $1}' | xargs kubectl delete pod

• Get services for each pod (service is the gateway into the pod)

o kubectl get endpoints

• Get service endpoints for specific pod:

o kubectl get endpoints YOUR_POD_NAME

• Get service cluster IPs for Pods

o kubectl get services

• Check the logs for the Kubernetes Startup/Shutdown

o journalctl -u kubelet

• Get service information for a specific pod

o kubectl describe service YOUR_SERVICE/POD

• Get pod information for specific pod

o kubectl describe YOUR_POD

• Find information on your nodes

o kubectl get nodes

• get pods under a specific namespace

o kubectl get pods --namespace YOUR_NAMESPACE -A

Update Time and Date Linux

• First verify your time by typing in:

o #timedatectl

• Set NTP or Disable

o #timedatectl set-ntp yes

o #timedatectl set-ntp no

• Set Timezones

o #timedatectl set-timezone UTC

o #timedatectl set-local-rtc 1(YOUR_LOCAL_TIMEZONE)

• Change the Clock

o #timedatectl set-time HH:MM:SS

o #timedatectl set-time YYYY-MM-DD

• List Timezones

o #timedatectl list-timezones

o #timedatectl list-timezones | grep keyword(Time-Zone)

• Set Hardware Clock to Sync with UTC

o #timdatectl set-local-rtc 0

• Display the Hardware Clock (Older Ubuntu Versions)

o #sudo hwclock -r

o #sudo hwclock --show

o #sudo hwclock --show --verbose

• Display the date and change the date/time (Older Ubuntu Versions)

o #date (display)

o #sudo date -s YY-MM-DD HH:MM:SS

Delete Normal VLANs

• First off, VLANs are sorted through identifiers. Regular VLANs are identified with 1-4096. 

• There are actually VLANs 1-1001 which are called normal VLANs and they are stored in the vlan.dat file. These cannot be deleted by deleting the config or running file. They are stored in flash. Every once in a while, you might have to delete them completely though.

• The only way to delete them is by deleting this vlan.dat file and then reloading the switch.

• You can delete these by doing the following steps:

o SW-01>enable

o SW-01#delete vlan.dat

 Delete filename [vlan.dat]?

• This displays the vlan.dat filename, press ENTER to confirm.

 Delete flash:/vlan.dat? [confirm]

• This asks again that you are about to delete the vlan.dat file from system flash, press ENTER to confirm again.

o SW-01#reload

• Once you reload your switch you can check your VLANs with:

o SW-01#show vlan brief

• Verify the VLANs are fully cleared out.

Basic Palo Alto FW Commands

• Show VLANs on a Palo Alto

o uname@FW-Name(active)# show network interface vlan

• Show Interfaces on Palo Alto

o uname@FW-Name(active)# show network interface Ethernet

• Basic show logging of traffic on PA

o uname@FW-Name(active)# show log traffic src in x.x.x.x receive_time in last-hour dport equal 443

• Show NAT policies on a PA

o >show running nat-policy

• Show DHCP configuration info for PA

o >conf t

o #show network dhcp interface vlan.your-vlan relay

• PA privilege mode is with the > sign.

• Config mode for a PA is with the # sign

Disable Telnet on Cisco Switch and Router

 1.    You must disable Telnet on your Cisco switch/router since it will be enabled by default and will not disable until you manually disable it.

2.    RTR-01>enable

3.    RTR-01#conf t

4.    RTR-01 (config) #line vty 0 15

5.    RTR-01 (config-line) #transport input ssh
    a.    This transport command is telling the switch/router to only accept SSH connections

6.    RTR-01 (config-line) #end

7.    RTR-01#write

Change SSH Version

1.    When you enable SSH, it might default to a version number that you are not running or do not wish to run. Make sure to enable the correct version.

2.    First, you can find out which version you are running by doing the following:
    a.    RTR-01>enable
    b.    RTR-01#show run | include ssh version
        i.    Here it will show you which version of SSH you are running
        ii.    You can also just type RTR-01#show ip ssh

3.    Next, you can change your version of SSH
    a.    RTR-01>enable
    b.    RTR-01#conf t
    c.    RTR-01 (config) #ip ssh version YOUR_DESIRED_VERSION
    d.    RTR-01 (config) #end
    e.    RTR-01#write
        i.    Or copy-running-config startup-config

4.    Now, verify your version number:
    a.    RTR-01#show ip ssh
    b.    Orr you can type: RTR-01#show run | include ssh version

Create User and Password for Cisco Device

1.    First, you will need to determine if you want a normal user, or an admin user. The following is for a normal user:
    a.    >enable
    b.    #conf t (configure terminal)
    c.    (config) #username YOUR_USER_NAME secret USER_PASSWORD

2.    If you wish to create an admin user, the following can be done”
    a.    >enable
    b.    #conf t
    c.    (config) #username YOUR_USER_NAME privilege 15 secret USER_PASSWORD

3.    Finally, you will need to enable logins into the switch/router by doing the following:
    a.    >enable
    b.    #conf t
    c.    (config) #enable secret DESIRED_PASSWORD_HERE
        i.    This will start requiring you to utilize logins into the switch and also with a default password
        into the switch too.

4.    You have now created a basic lockdown on your Cisco device. Again, this is just super basic utilizing the Cisco built in login local database.

5.    Which you can enable (if you have not already) this way:
    a.    For the console line:
    b.    >enable
    c.    #conf t
    d.    (config) #int line con 0
    e.    (config-line) #login local
    
    f.    And finally for your VTY lines:
    g.    >enable
    h.    #conf t
    i.    (config) #line vty 0 15
    j.    (config-line) #login local

6.    The main thing you need here is the login local command. This tells the switch/router to use the local user database to login.

Password Recovery for Old/Used Cisco Switch or Router

Sometimes you will obtain an old or used Cisco Switch or Router which has configurations on the device. You can still access the device if you don’t know the password. You can perform the following steps to recover the device all the while saving configurations too.

1.    Connect to the console port.
    a.    Ensure you have a console cable with the prolific device driver. Some cheaper console cables will not allow you to send the break signal during the router/switch boot process.

2.    Reboot the device and send a break signal within the first 30 seconds.
    a.    During reboot you have 30 seconds to send the break signal and interrupt the boot process. This is why you need a higher quality cable with the prolific device driver for break signals.
    b.    You are doing this to enter Rommon boot mode. To change were it looks for the startup configuration.
    c.    You have the following options for sending the break command since laptops and computers are all different:
        i.    Pause/Break key or Ctrl+Pause/Break on keyboard (This is usually the standard for regular keyboards)
        ii.    #Ctrl+Fn+F11
        iii.    #Fn+B
        iv.    #Ctrl+B
        v.    #Ctrl+Fn+B
    d.    Finally, PuTTY has an option to send the break command through the menus:
        i.    Under the PuTTY menu, hover over “Special Command”
        ii.    Then select the “Break” option there.

3.    Modify the Configuration register.
    a.    You are doing this in order to keep it from loading the previous configuration into the running-config. This allows us to bypass the password from the currently installed configuration.
    b.    In Rommon state, there is no OS loaded. It is for recovery purposes. We want to change the “confreg” setting. Type this in:
        i.    #confreg 0x2142
            1.    0x2142 puts it in a state of ignoring the VNRAM contents/startup configuration. But this keeps the old configuration in the system.
            2.    0X2102 is the normal state of boot. Makes it operate normally.
    c.    Next we reset the device to reboot with the new confreg code.
        i.    #reset

4.    Now you can recover your configuration in the router or switch and reset the passwords.
    a.    After reboot, you say “NO” to initial configuration dialog.
    b.    You are now in the router/switch without a configuration.
    c.    Your old configuration is in the startup-config. You can even do a:
        i.    #show startup-config
        ii.    And you can see your old configuration on the router/switch.
    d.    Now we can copy the startup-config into our running-config and we maintain admin rights without the old passwords blocking us:
        i.    #copy startup-config running-config
    e.    Also you can now reset your passwords in global config mode:
        i.    #conf t
        ii.    #enabled secret cisco
        iii.    #line con 0 password cisco
        iv.    And continue with others you wish to reset.
    f.    Make sure to save the configuration:
        i.    #write/#copy run start

5.    Revert the configuration register to the original boot so now you can load your configurations with the new password.
    a.    We have a final step to do. We will need to change that boot process again since that 0x2142 is not the normal boot state. We need to change it back to 0x2102.
        i.    #show version (shows the router/switch status and what the boot reg is set to)
        ii.    #conf t
        iii.    #config-register 0x2102
        iv.    #write
    b.    Now you can reboot with new passwords and your original configuration.

Wipe and Clear Configuration on Cisco Catalyst Router/Switch

This one is a simple one. We will be clearing out the configurations on Catalyst equipment. If you have a bunch of configurations you just want to clear so you can start from scratch, do the following:
1. Go to Privilege Mode
a. #enable
2. Erase the configuration:
a. #write erase
3. Restart the system:
a. #reload
b. #confirm (just hit enter here)

Reset the Password on Router without Losing the Old Configuration File

• Console cable needed on router
• Power off router
• Turn on router and issue the break command through Putty
• In rommon, hit question mark to see your options
o You should see confreg
• Change confreg to 0x2142
o >confreg 0x2142
• Reset the router
o >reset
• Once the router reboots, cancel the initial setup dialog. You just need the old startup-config
o >show startup-config
• Once you verify you see your old file, copy the old file to the running-config
o #copy startup-config running-config
• You are now in your old config file without the passwords. Now you can reset your password:
o #conf t
o #enable secret cisco
o #exit
o #copy run start
• Next, you need to change the configreg entry from when we changed it in ROMMON.
o #conf t
o #config-register 0x2102
o #exit
o #write
• Finally, you want to ensure your interfaces are all up since sometimes they go into admin down state and need to be brought up manually. You can reboot if necessary, but now you have access back into the router.

To Log into a Switch from Current Switch

1. You can perform this either from user mode or privileged mode:
a. SW1>ssh -l user_name ip_address
b. SW1#ssh -l user_name ip_address
2. After you pivot into the system from either of the above commands, type in the user’s password (the user you are using to log into the distant switch).

Configure Default Gateway on Cisco Switch

1. First, escalate into global configuration mode:
a. SW1(config)#Config Terminal
2. In global configuration mode you can now make a global setting indicating your default gateway for the switch:
a. SW1(config)#ip default-gateway ip_address