Tag: asa

Cisco ASA – jak wgrać ponownie plik z Image jak właściwy jest uszkodzony

Posted on 30 marca, 2016 in Cisco

Ostatnio aktualizowałem Cisco ASA i po wgraniu nowego pliku z softem i zmianie parametry boot w konfiguracji zrobiłem reload i lipa urządzenie nie wstaje.

w konsoli widzę:


Booting system, please wait... 
 

CISCO SYSTEMS 
Embedded BIOS Version 1.0(11)5 08/28/08 15:11:51.82

Low Memory: 631 KB
High Memory: 1024 MB
PCI Device Table.
Bus Dev Func VendID DevID Class              Irq
 00  00  00   8086   2578  Host Bridge        
 00  01  00   8086   2579  PCI-to-PCI Bridge  
 00  03  00   8086   257B  PCI-to-PCI Bridge  
 00  1C  00   8086   25AE  PCI-to-PCI Bridge  
 00  1D  00   8086   25A9  Serial Bus         11
 00  1D  01   8086   25AA  Serial Bus         10
 00  1D  04   8086   25AB  System             
 00  1D  05   8086   25AC  IRQ Controller     
 00  1D  07   8086   25AD  Serial Bus         9
 00  1E  00   8086   244E  PCI-to-PCI Bridge  
 00  1F  00   8086   25A1  ISA Bridge         
 00  1F  02   8086   25A3  IDE Controller     11
 00  1F  03   8086   25A4  Serial Bus         5
 00  1F  05   8086   25A6  Audio              5
 02  01  00   8086   1075  Ethernet           11
 03  01  00   177D   0003  Encrypt/Decrypt    9
 03  02  00   8086   1079  Ethernet           9
 03  02  01   8086   1079  Ethernet           9
 03  03  00   8086   1079  Ethernet           9
 03  03  01   8086   1079  Ethernet           9
 04  02  00   8086   1209  Ethernet           11
 04  03  00   8086   1209  Ethernet           5

Evaluating BIOS Options ...
Launch BIOS Extension to setup ROMMON

Cisco Systems ROMMON Version (1.0(11)5) #0: Thu Aug 28 15:23:50 PDT 2008

Platform ASA5510

Use BREAK or ESC to interrupt boot.
Use SPACE to begin boot immediately.
                                                
Launching BootLoader...
Boot configuration file contains 1 entry.


Loading disk0:/asa916-11-k8.bin... Booting...
Platform ASA5510

Loading...
IO memory blocks requested from bigphys 32bit: 13805


Booting system, please wait... 
 
// NASTĘPUJE SAMOCZYNNY REBOOT
CISCO SYSTEMS 
Embedded BIOS Version 1.0(11)5 08/28/08 15:11:51.82

Booting system, please wait...

CISCO SYSTEMS

Embedded BIOS Version 1.0(11)5 08/28/08 15:11:51.82

Low Memory: 631 KB

High Memory: 1024 MB

PCI Device Table.

Bus Dev Func VendID DevID Class Irq

00 00 00 8086 2578 Host Bridge

00 01 00 8086 2579 PCI-to-PCI Bridge

00 03 00 8086 257B PCI-to-PCI Bridge

00 1C 00 8086 25AE PCI-to-PCI Bridge

00 1D 00 8086 25A9 Serial Bus 11

00 1D 01 8086 25AA Serial Bus 10

00 1D 04 8086 25AB System

00 1D 05 8086 25AC IRQ Controller

00 1D 07 8086 25AD Serial Bus 9

00 1E 00 8086 244E PCI-to-PCI Bridge

00 1F 00 8086 25A1 ISA Bridge

00 1F 02 8086 25A3 IDE Controller 11

00 1F 03 8086 25A4 Serial Bus 5

00 1F 05 8086 25A6 Audio 5

02 01 00 8086 1075 Ethernet 11

03 01 00 177D 0003 Encrypt/Decrypt 9

03 02 00 8086 1079 Ethernet 9

03 02 01 8086 1079 Ethernet 9

03 03 00 8086 1079 Ethernet 9

03 03 01 8086 1079 Ethernet 9

04 02 00 8086 1209 Ethernet 11

04 03 00 8086 1209 Ethernet 5

Evaluating BIOS Options ...

Launch BIOS Extension to setup ROMMON

Cisco Systems ROMMON Version (1.0(11)5) #0: Thu Aug 28 15:23:50 PDT 2008

Platform ASA5510

Use BREAK or ESC to interrupt boot.

Use SPACE to begin boot immediately.

Launching BootLoader...

Boot configuration file contains 1 entry.

Loading disk0:/asa916-11-k8.bin... Booting...

Platform ASA5510

IO memory blocks requested from bigphys 32bit: 13805

Booting system, please wait...

// NASTĘPUJE SAMOCZYNNY REBOOT

CISCO SYSTEMS

Embedded BIOS Version 1.0(11)5 08/28/08 15:11:51.82

przychodzi nam z pomocą ROMMON

co nam będzie potrzebne:

pc/laptop z tftp
dostęp fizyczny do urządzenia
połączenie ethernet ASA – PC/LAPTOP

ASAv – Active/Standby konfiguracja – minimalna

Posted on 9 marca, 2016 in Cisco, Lab

Witam, wcześniej napisałem jak w labie postawić Cisco ASAv, dziś pokażę jak szybko i bez problemów skonfigurować dwie wirtualki w trybie failover A/P – jedyny tryb który obsługuje na chwilę obecną.

Rysunek poglądowy:

Założenia konfiguracyjne:

Interfejs	Praimary	Secondary	zona
GigabitEthernet 0/0	192.168.1.80	192.168.1.81	NET_LAB
GigabitEthernet 0/1	172.16.1.1	172.16.1.2	LAN
GigabitEthernet 0/8	10.255.255.1	10.255.255.2	Sync

ASAv – pierwsze uruchomienie w labie

Posted on 6 marca, 2016 in Cisco, Lab

Dzięki uprzejmości człowieka z Cisco Polska dostałem dostęp do Cisco ASA w wersji wirtualnej. Postanowiłem ją odpalić w labie. Poniżej przedstawię krok po kroku jak to zrobić.

Ściągamy nasze pliki maszyny.
Rozpakowujemy plik zip
Importujemy naszą wirtualną maszynę do Workstation

wybieramy wersję dla esxi:

nadajemy nazwę dla maszyny oraz lokalizację gdzie będzie przetrzymywana maszyna.

akceptujemy regulamin:

po zaimportowaniu sprawdzamy wersję oraz sprawdzamy licencję:


ciscoasa# show ver

Cisco Adaptive Security Appliance Software Version 9.5(2)203 
Device Manager Version 7.5(2)

Compiled on Wed 27-Jan-16 13:47 PST by builders
System image file is "boot:/asa952-203-smp-k8.bin"
Config file at boot was "startup-config"

ciscoasa up 18 mins 41 secs

Hardware:   ASAv, 1024 MB RAM, CPU Xeon 5500 series 2494 MHz,
Model Id:   ASAv5
Internal ATA Compact Flash, 512MB
Slot 1: ATA Compact Flash, 8192MB
BIOS Flash Firmware Hub @ 0x0, 0KB


 0: Ext: Management0/0       : address is 000c.2927.c98d, irq 10
 1: Ext: GigabitEthernet0/0  : address is 000c.2927.c997, irq 5
 2: Ext: GigabitEthernet0/1  : address is 000c.2927.c9a1, irq 9
 3: Ext: GigabitEthernet0/2  : address is 000c.2927.c9ab, irq 11
 4: Ext: GigabitEthernet0/3  : address is 000c.2927.c9b5, irq 10
 5: Ext: GigabitEthernet0/4  : address is 000c.2927.c9bf, irq 5
 6: Ext: GigabitEthernet0/5  : address is 000c.2927.c9c9, irq 9
 7: Ext: GigabitEthernet0/6  : address is 000c.2927.c9d3, irq 11
 8: Ext: GigabitEthernet0/7  : address is 000c.2927.c9dd, irq 10
 9: Ext: GigabitEthernet0/8  : address is 000c.2927.c9e7, irq 5

License mode: Smart Licensing
ASAv Platform License State: Unlicensed
No active entitlement: no feature tier and no throughput level configured
*Memory resource allocation is more than the permitted limit.

Licensed features for this platform:
Maximum Physical Interfaces       : 10             
Maximum VLANs                     : 25             
Inside Hosts                      : Unlimited      
Failover                          : Active/Standby 
Encryption-DES                    : Enabled        
Encryption-3DES-AES               : Enabled        
Security Contexts                 : 0              
Carrier                           : Disabled       
AnyConnect Premium Peers          : 2              
AnyConnect Essentials             : Disabled       
Other VPN Peers                   : 50             
Total VPN Peers                   : 50             
AnyConnect for Mobile             : Disabled       
AnyConnect for Cisco VPN Phone    : Disabled       
Advanced Endpoint Assessment      : Disabled       
Shared License                    : Disabled       
Total UC Proxy Sessions           : 2              
Botnet Traffic Filter             : Enabled        
Cluster                           : Disabled       

Serial Number: 9AT6U3XC6HH

Image type          : Release
Key version         : A

ciscoasa# show ver

Cisco Adaptive Security Appliance Software Version 9.5(2)203

Device Manager Version 7.5(2)

Compiled on Wed 27-Jan-16 13:47 PST by builders

System image file is "boot:/asa952-203-smp-k8.bin"

Config file at boot was "startup-config"

ciscoasa up 18 mins 41 secs

Hardware: ASAv, 1024 MB RAM, CPU Xeon 5500 series 2494 MHz,

Model Id: ASAv5

Internal ATA Compact Flash, 512MB

Slot 1: ATA Compact Flash, 8192MB

BIOS Flash Firmware Hub @ 0x0, 0KB

0: Ext: Management0/0 : address is 000c.2927.c98d, irq 10

1: Ext: GigabitEthernet0/0 : address is 000c.2927.c997, irq 5

2: Ext: GigabitEthernet0/1 : address is 000c.2927.c9a1, irq 9

3: Ext: GigabitEthernet0/2 : address is 000c.2927.c9ab, irq 11

4: Ext: GigabitEthernet0/3 : address is 000c.2927.c9b5, irq 10

5: Ext: GigabitEthernet0/4 : address is 000c.2927.c9bf, irq 5

6: Ext: GigabitEthernet0/5 : address is 000c.2927.c9c9, irq 9

7: Ext: GigabitEthernet0/6 : address is 000c.2927.c9d3, irq 11

8: Ext: GigabitEthernet0/7 : address is 000c.2927.c9dd, irq 10

9: Ext: GigabitEthernet0/8 : address is 000c.2927.c9e7, irq 5

License mode: Smart Licensing

ASAv Platform License State: Unlicensed

No active entitlement: no feature tier and no throughput level configured

*Memory resource allocation is more than the permitted limit.

Licensed features for this platform:

Maximum Physical Interfaces : 10

Maximum VLANs : 25

Inside Hosts : Unlimited

Failover : Active/Standby

Encryption-DES : Enabled

Encryption-3DES-AES : Enabled

Security Contexts : 0

Carrier : Disabled

AnyConnect Premium Peers : 2

AnyConnect Essentials : Disabled

Other VPN Peers : 50

Total VPN Peers : 50

AnyConnect for Mobile : Disabled

AnyConnect for Cisco VPN Phone : Disabled

Advanced Endpoint Assessment : Disabled

Shared License : Disabled

Total UC Proxy Sessions : 2

Botnet Traffic Filter : Enabled

Cluster : Disabled

Serial Number: 9AT6U3XC6HH

Image type : Release

Key version : A

Musimy odpowiednio edytować interfejsy sieciowe aby mieć do niej dostęp, wykorzystujemy do tego MAC adresy interfejsów które mamy wyżej. I edytujemy w Workstation przypisania Interfejsów:

Konfiguracja Interfejsu sieciowego aby mieć dostęp do wirtualki.


interface GigabitEthernet0/0
 nameif NET_LAB
 security-level 0
 ip address 192.168.1.80 255.255.255.0

interface GigabitEthernet0/0

nameif NET_LAB

security-level 0

ip address 192.168.1.80 255.255.255.0

Konfigurujemy ssh tak aby było można dostać się po interfejsie wcześniej skonfigurowanym NET_LAB


ssh 192.168.1.0 255.255.255.0 NET_LAB

ssh 192.168.1.0 255.255.255.0 NET_LAB

Konfigurujemy Usera który będzie mógł się logować po ssh


username michal password Qwert6 privilege 15

username michal password Qwert6 privilege 15

Konfigurujemy aaa dla ssh, enable oraz http:


aaa authentication enable console LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL

aaa authentication enable console LOCAL

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

Włączamy ASDM


http server enable

http server enable

tak jak dla ssh musimy pozwolić na dostęp do ASDM przez interfejs NET_LAB


http 192.168.1.0 255.255.255.0 NET_LAB

http 192.168.1.0 255.255.255.0 NET_LAB

Zmieniamy hostname:


hostname asav01

hostname asav01

po wykonaniu powyższych działań będziemy mogli zalogować się po ssh oraz przez ADSM do naszej maszynki.


asav01# show ssh sessions detail 

SSH Session ID          : 0
 Client IP              : 192.168.1.14
 Username               : michal
 SSH Version            : 2.0
 State                  : SessionStarted
 Inbound Statistics
  Encryption            : aes256-ctr
  HMAC                  : sha1
  Bytes Received        : 2028
 Outbound Statistics
  Encryption            : aes256-ctr
  HMAC                  : sha1
  Bytes Transmitted     : 3380
 Rekey Information
  Time Remaining (sec)  : 3291
  Data Remaining (bytes): 996144832
  Last Rekey            : 15:18:37.323 UTC Sun Mar 6 2016
  Data-Based Rekeys     : 0
  Time-Based Rekeys     : 0

asav01# show ssh sessions detail

SSH Session ID : 0

Client IP : 192.168.1.14

Username : michal

SSH Version : 2.0

State : SessionStarted

Inbound Statistics

Encryption : aes256-ctr

HMAC : sha1

Bytes Received : 2028

Outbound Statistics

Encryption : aes256-ctr

HMAC : sha1

Bytes Transmitted : 3380

Rekey Information

Time Remaining (sec) : 3291

Data Remaining (bytes): 996144832

Last Rekey : 15:18:37.323 UTC Sun Mar 6 2016

Data-Based Rekeys : 0

Time-Based Rekeys : 0

Tags: aaa, asa, asa pierwsze uruchomienie, asav, asdm, cisco, cisco adaptive security virtual appliance asav workstation, cisco asa, cisco asav, http server enable, ssh

Cisco ASA – Ograniczenie dostępu do SSL VPN oraz IKE

Posted on 30 grudnia, 2015 in Cisco

Dla szukających jak ograniczyć dostęp do usług uruchamianych na Cisco ASA, mam na myśli SSL VPN, czy IKE na samy dole jest aktualizacja jak to zrobić dla IKE przy podatności CVE-2016-1287

Poniżej przedstawię jak ograniczyć dostęp do SSL VPN dla określonych ip lub sieci.

definiujemy Grupę w która będzie zawierać listę hostów lub sieci które będą miały dostęp do SSL VPN


ASA(config)# object-group network access_ssl_vpn
ASA(config-network-object-group)# network-object host ip_które_wpóścimy
ASA(config-network-object-group)# network-object adres_sieci 255.255.255.0

ASA(config)# object-group network access_ssl_vpn

ASA(config-network-object-group)# network-object host ip_które_wpóścimy

ASA(config-network-object-group)# network-object adres_sieci 255.255.255.0

Definiujemy ACL’kę z użyciem wcześniej zdefiniowanej grupy

Shell

ASA(config)# access-list internet extended permit tcp object-group access_ssl_vpn any eq 443

1
2
3

ASA(config)# access-list internet extended permit tcp object-group access_ssl_vpn any eq 443
Dodajemy drugi wpis blokujący resztę świata

Shell

ASA(config)# access-list internet extended deny tcp any any eq 443

1
2
3

ASA(config)# access-list internet extended deny tcp any any eq 443
przypinamy ACL’kę do Interfejsu który jest wystawiony na świat, w mym przypadku jest to outside z zaznaczeniem dostępu do control-planu

Shell

ASA(config)# access-group internet in interface outside control-plane

1
2
3

ASA(config)# access-group internet in interface outside control-plane

Mam nadzieję że komuś się przyda moja notatka

Aktualizacja:

W taki sposób również możemy ograniczyć dostęp do IKE aby kupić sobie czas na podatność Cisco ASA Software IKEv1 and IKEv2 Buffer Overflow Vulnerability (CVE-2016-1287)

wystarczy dodać do access listy internet:

tworzymy obiekt access_to_ike gdzie umieszczamy wszystkie adresy naszych peerów z którymi zestawiamy VPN

oraz dodajemy wpis do ACL’ki


access-list internet extended permit udp object-group access_to_ike any eq isakmp
access-list internet extended deny udp any4 any eq isakmp

access-list internet extended permit udp object-group access_to_ike any eq isakmp

access-list internet extended deny udp any4 any eq isakmp

Tags: acl, asa, cisco, Cisco ASA Software IKEv1 and IKEv2 Buffer Overflow Vulnerability, cisco-sa-20160210-asa-ike, control plane, CVE-2016-1287, https, ike, isakmp, ssl vpn, vpn

Konfiguracja synchronizacji czasu z NTP na urządzeniach Cisco

Posted on 5 maja, 2015 in Cisco

Konfiguracja NTP na urządzeniach Cisco, na samym dole jest tabelka ze strefami czasowymi.

Switch catalyst 2960

Config


#clock timezone CEST +2 // ustawiamy strefę czasowej dla Polski

#clock timezone CEST +2 // ustawiamy strefę czasowej dla Polski


#ntp server 10.XxX.YyY.101 prefer // Ustawiamy serwer czasu NTP

#ntp server 10.XxX.YyY.101 prefer // Ustawiamy serwer czasu NTP

sprawdzenie:


 #show ntp status
 Clock is synchronized, stratum 2, reference is 10.XxX.YyY.101
 nominal freq is 286.1023 Hz, actual freq is 286.0868 Hz, precision is 2**21
 ntp uptime is 334718600 (1/100 of seconds), resolution is 3496
 reference time is D8F31637.DE5891AD (12:13:11.868 CEST Tue May 5 2015)
 clock offset is -1.9457 msec, root delay is 17.10 msec
 root dispersion is 19.63 msec, peer dispersion is 0.12 msec
 loopfilter state is 'CTRL' (Normal Controlled Loop), drift is 0.000053953 s/s
 system poll interval is 512, last update was 1019 sec ago.

#show ntp status

Clock is synchronized, stratum 2, reference is 10.XxX.YyY.101

nominal freq is 286.1023 Hz, actual freq is 286.0868 Hz, precision is 2**21

ntp uptime is 334718600 (1/100 of seconds), resolution is 3496

reference time is D8F31637.DE5891AD (12:13:11.868 CEST Tue May 5 2015)

clock offset is -1.9457 msec, root delay is 17.10 msec

root dispersion is 19.63 msec, peer dispersion is 0.12 msec

loopfilter state is 'CTRL' (Normal Controlled Loop), drift is 0.000053953 s/s

system poll interval is 512, last update was 1019 sec ago.


#show clock detail 
18:34:57.719 cest Tue May 5 2015 
Time source is NTP

#show clock detail

18:34:57.719 cest Tue May 5 2015

Time source is NTP

Nexus

Config


# ntp server 10.XxX.YyY.101 prefer use-vrf management // ustawiamy serwer NTP oraz jaki vrf ma zostać użyty do komunikacji z NTP
# clock timezone cest 2 0 //Ustawiamy strefę czasową dla Polski

# ntp server 10.XxX.YyY.101 prefer use-vrf management // ustawiamy serwer NTP oraz jaki vrf ma zostać użyty do komunikacji z NTP

# clock timezone cest 2 0 //Ustawiamy strefę czasową dla Polski

sprawdzenie


# show ntp peer-status
 Total peers : 2
 * - selected for sync, + - peer mode(active),
 - - peer mode(passive), = - polled in client mode
 remote local st poll reach delay vrf
 -------------------------------------------------------------------------------
 *10.XxX.YyY.101 0.0.0.0 1 16 377 0.00067 management
# show ntp peers
 --------------------------------------------------
 Peer IP Address Serv/Peer
 --------------------------------------------------
10.XxX.YyY.101 Server (configured)

# show ntp peer-status

Total peers : 2

* - selected for sync, + - peer mode(active),

- - peer mode(passive), = - polled in client mode

remote local st poll reach delay vrf

-------------------------------------------------------------------------------

*10.XxX.YyY.101 0.0.0.0 1 16 377 0.00067 management

# show ntp peers

--------------------------------------------------

Peer IP Address Serv/Peer

--------------------------------------------------

10.XxX.YyY.101 Server (configured)

Cisco Cat 4500-x

Config


#ntp server vrf mgmtVrf 10.XxX.YyY.101 prefer

#ntp server vrf mgmtVrf 10.XxX.YyY.101 prefer


#clock timezone cest 2

#clock timezone cest 2

Sprawdzenie:


#show clock detail
18:43:07.566 cest Tue May 5 2015
Time source is NTP

#show clock detail

18:43:07.566 cest Tue May 5 2015

Time source is NTP


#show ntp associations
address          ref clock st when poll reach delay offset disp
*~10.XxX.YyY.101 .PPSa.     1  621 1024 377   1.852 3.391  1.074
 * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured

#show ntp associations

address ref clock st when poll reach delay offset disp

*~10.XxX.YyY.101 .PPSa. 1 621 1024 377 1.852 3.391 1.074

* sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured


#show ntp status
Clock is synchronized, stratum 2, reference is 10.XxX.YyY.101
nominal freq is 250.0000 Hz, actual freq is 249.9999 Hz, precision is 2**10
ntp uptime is 2146500 (1/100 of seconds), resolution is 4016
reference time is D8F36F35.5F3B6560 (18:32:53.372 cest Tue May 5 2015)
clock offset is 3.3910 msec, root delay is 1.85 msec
root dispersion is 15.82 msec, peer dispersion is 1.07 msec
loopfilter state is 'CTRL' (Normal Controlled Loop), drift is 0.000000160 s/s
system poll interval is 1024, last update was 626 sec ago.

#show ntp status

Clock is synchronized, stratum 2, reference is 10.XxX.YyY.101

nominal freq is 250.0000 Hz, actual freq is 249.9999 Hz, precision is 2**10

ntp uptime is 2146500 (1/100 of seconds), resolution is 4016

reference time is D8F36F35.5F3B6560 (18:32:53.372 cest Tue May 5 2015)

clock offset is 3.3910 msec, root delay is 1.85 msec

root dispersion is 15.82 msec, peer dispersion is 1.07 msec

loopfilter state is 'CTRL' (Normal Controlled Loop), drift is 0.000000160 s/s

system poll interval is 1024, last update was 626 sec ago.

Cisco ASA

Config:


#ntp server 10.XxX.YyY.101 source vlan242 prefer // gdzie vlan242 to interfejs którym  ma odbywać się komunikacja z NTP.

#ntp server 10.XxX.YyY.101 source vlan242 prefer // gdzie vlan242 to interfejs którym ma odbywać się komunikacja z NTP.


#clock timezone CEST 1
#clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00

#clock timezone CEST 1

#clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00


# show ntp status
Clock is synchronized, stratum 2, reference is 10.XxX.YyY.101
nominal freq is 99.9984 Hz, actual freq is 99.9889 Hz, precision is 2**6
reference time is d8f37cb6.5e32efba (19:30:30.367 CEDT Tue May 5 2015)
clock offset is 14.7114 msec, root delay is 0.53 msec
root dispersion is 32.18 msec, peer dispersion is 17.18 msec
t# show ntp associations
 address              ref clock st  when poll reach delay offset disp
*~10.176.22.101      .PPSa.     1   748  1024 377   0.5   14.71  17.2
 * master (synced), # master (unsynced), + selected, - candidate, ~ configured

# show ntp status

Clock is synchronized, stratum 2, reference is 10.XxX.YyY.101

nominal freq is 99.9984 Hz, actual freq is 99.9889 Hz, precision is 2**6

reference time is d8f37cb6.5e32efba (19:30:30.367 CEDT Tue May 5 2015)

clock offset is 14.7114 msec, root delay is 0.53 msec

root dispersion is 32.18 msec, peer dispersion is 17.18 msec

t# show ntp associations

address ref clock st when poll reach delay offset disp

*~10.176.22.101 .PPSa. 1 748 1024 377 0.5 14.71 17.2

* master (synced), # master (unsynced), + selected, - candidate, ~ configured

Strefy czasowe Cisco

Common Time Zone Acronyms
Acronym	Time Zone Name and UTC Offset
Europe
GMT	Greenwich Mean Time, as UTC
BST	British Summer Time, as UTC + 1 hour
IST	Irish Summer Time, as UTC + 1 hour
WET	Western Europe Time, as UTC
WEST	Western Europe Summer Time, as UTC + 1 hour
CET	Central Europe Time, as UTC + 1
CEST	Central Europe Summer Time, as UTC + 2
EET	Eastern Europe Time, as UTC + 2
EEST	Eastern Europe Summer Time, as UTC + 3
MSK	Moscow Time, as UTC + 3
MSD	Moscow Summer Time, as UTC + 4
United States and Canada
AST	Atlantic Standard Time, as UTC -4 hours
ADT	Atlantic Daylight Time, as UTC -3 hours
ET	Eastern Time, either as EST or EDT, depending on place and time of year
EST	Eastern Standard Time, as UTC -5 hours
EDT	Eastern Daylight Saving Time, as UTC -4 hours
CT	Central Time, either as CST or CDT, depending on place and time of year
CST	Central Standard Time, as UTC -6 hours
CDT	Central Daylight Saving Time, as UTC -5 hours
MT	Mountain Time, either as MST or MDT, depending on place and time of year
MST	Mountain Standard Time, as UTC -7 hours
MDT	Mountain Daylight Saving Time, as UTC -6 hours
PT	Pacific Time, either as PST or PDT, depending on place and time of year
PST	Pacific Standard Time, as UTC -8 hours
PDT	Pacific Daylight Saving Time, as UTC -7 hours
AKST	Alaska Standard Time, as UTC -9 hours
AKDT	Alaska Standard Daylight Saving Time, as UTC -8 hours
HST	Hawaiian Standard Time, as UTC -10 hours
Australia
WST	Western Standard Time, as UTC + 8 hours
CST	Central Standard Time, as UTC + 9.5 hours
EST	Eastern Standard/Summer Time, as UTC + 10 hours (+11 hours during summer time)

Tags: asa, cisco, clock, nexues, NTP, switch

SafeKom Blog

Notatki konsultanta IT

Tag: asa

Cisco ASA – jak wgrać ponownie plik z Image jak właściwy jest uszkodzony

ASAv – Active/Standby konfiguracja – minimalna

ASAv – pierwsze uruchomienie w labie

Cisco ASA – Ograniczenie dostępu do SSL VPN oraz IKE

Konfiguracja synchronizacji czasu z NTP na urządzeniach Cisco