-
Cisco Anomaly Guard Module Configuration Guide (Software Version 4.0)
-
Index
-
Preface
-
Introduction
-
Configuring the Guard Module on the Supervisor Engine Module
-
Initializing the Guard Module
-
Configuring the Guard Module
-
Configuring Zone Traffic Diversion
-
Configuring Zones
-
Configuring Zone Filters
-
Configuring Policy Templates and Policies
-
Interactive Protect Mode
-
Attack Reports
-
Guard Module Diagnostics and Maintenance
-
Analyzing Guard Module Mitigation
-
Glossary
-
Table Of Contents
Guard Module Diagnostics and Maintenance
Copying Guard Module Configuration
Importing and Updating Configuration
Displaying General Diagnostics Data
Displaying the Memory Consumption
Displaying the CPU Utilization
Upgrading the Guard Module Version
Guard Module Diagnostics and Maintenance
This chapter describes how to perform tasks used for general care and upkeep of the Guard module and how to display statistics and diagnostics on the Cisco Anomaly Guard Module (Guard module). It includes the following sections:
•
Copying Guard Module Configuration
•
Viewing the Zones
You can display an overview of the zones in the Guard to see which zones are active and what their current status is. Use the show command in global mode to display a list of zones. Table 11-1 describes the different zone statuses.
For example:
admin@GUARD# showViewing the Guard Module Logs
The Guard module automatically logs system activity and events. You can display the Guard module logs to review and track the Guard module activity.
Table 11-2 displays the event log levels.
The log file displays all log levels (emergencies, alerts, critical, errors, warnings, notification, informational, debugging). The Guard module log file includes zone events with severity levels: emergencies, alerts, critical, errors, warnings and notification.
You can view the event log locally or from a remote server:
•
•
Displaying On-line Event Logs
You can activate the Guard module monitoring mechanism and view a real time event log. This enables you to view the online logging of the Guard module events. Enter the following command:
event monitor
For example:
admin@GUARD# event monitorThe screen constantly updates with events.
Note
Exporting On-line Event Logs
You can export the Guard module online event logs in order to view the Guard module operations that are registered in the log file. You can view the Guard module events from a remote host as they are registered, online, in the Guard module log file. The Guard module log file is exported using the syslog mechanism. You can export the Guard module log file to several syslog servers. You can specify additional servers so that should one go offline, another will be available to receive messages.
Note
The format of the syslog message is as follows:
<event date> <event time> <Guard module IP address> <protection module> <zone name><event severity level> <event type> <event description>
An example of an event log is:
Sep 11 16:34:40 10.4.4.4 cm: scannet, 5 threshold-tuning-start: Zone activation completed successfully.
To export online event logs, perform the following steps:
Step 1
logging {facility | trap}Table 11-3 provides the keywords for the logging command.
Note
Step 2
logging host remote-syslog-server-ipOR
export log remote-syslog-server-ipThe remote-syslog-server-ip argument specifies the remote syslog server IP address.
To build a list of syslog servers that receive logging messages, enter this command more than once.
The following example show how to configure the Guard module to traps from severity level notification, using the facility local3, to a syslog server with IP address 10.0.0.191.
admin@GUARD-conf# logging facility local3admin@GUARD-conf# logging trap notificationsadmin@GUARD-conf# logging host 10.0.0.191To view the export online event logs configuration, use the show logging command or the show log export-ip command.
Displaying the Log File
You can display the Guard module log for diagnostic or monitoring purposes. The Guard module log file includes zone events with severity levels: emergencies, alerts, critical, errors, warnings and notification.
To display the Guard module log, enter the following command:
show log
You can display a zone log to view events that relate only to the specified zone.
For example:
admin@GUARD# show logExporting the Log-file
You can export the Guard module log file to an FTP server for monitoring or diagnostic purposes. Enter the following command:
copy [zone zone-name] log ftp server full-file-name [login] [password]
Table 11-4 provides the arguments and keywords for the copy log ftp command.
For example:
admin@GUARD# copy log ftp 10.0.0.191 log.txt <user> <password>Clearing the Log-file
You can clear the Guard module or zone log file of all entries.
Tip
Enter the following command:
clear [zone zone-name] log
The zone-name argument specifies the zone name. The default is to clear the Guard module log file.
Copying Guard Module Configuration
You can export the Guard module configuration file to an FTP server. Exporting the Guard module or zone configuration file (running-config) to a remote FTP server enables you to:
•
•
Exporting Configuration
To export the Guard module configuration file, enter the following command:
copy [zone zone-name] running-config ftp server full-file-name [login] [password]
Table 11-5 provides the arguments for the copy running-config ftp command.
For example:
admin@GUARD# copy running-config ftp 10.0.0.191 run-conf.txt <user> <password>Importing and Updating Configuration
You can import a Guard module or zone configuration file from an FTP server and reconfigure the Guard module according to the newly transferred file. Import configuration to:
•
•
The new configuration overrides the existing one. For the new configuration to take effect, you must reload the Guard module.
Note
To import a Guard module configuration file, enter the following command:
copy ftp running-config server full-file-name [login] [password]
Table 11-6 provides the arguments for the copy ftp running-config command.
For example:
admin@GUARD# copy ftp running-config 10.0.0.191 scannet-confGuard Module Diagnostics
This section describes a group of commands designed to help in Guard module diagnostics. These commands consist of the following:
•
•
•
•
Displaying General Diagnostics Data
You can view general Guard module diagnostics data. To view a general display of the diagnostics data, enter the following command:
show diagnostic-info
The diagnostics data consists of the following:
•
•
•
•
•
•
•
•
•
•
Note
Displaying the Memory Consumption
You can view the Guard module memory consumption. The Guard module displays the memory usage in kilobytes. In addition, the Guard module displays the percentage of memory that the Recognition protection module uses. The Recognition protection module memory usage is affected by the number of active zones and the number of services each of the zones monitors.
If the Recognition protection module memory usage is higher than 90%, we recommend that you lower the number of active zones.
Enter the following command:
show memory
For example:
admin@GUARD# show memorytotal used free shared buffers cachedIn KBytes: 2065188 146260 1918928 0 2360 69232Recognition Used Memory: 0.3%
Note
Displaying the CPU Utilization
You can display the current percentage of CPU utilization. The Guard module displays the percentage of CPU time in user mode, system mode, niced tasks, and idle. Niced tasks are also counted in system and user time, thus the total CPU utilization can be more than 100%.
Enter the following command:
show cpu
For example:
admin@GUARD# show cpuHost CPU: 0.0% user, 0.1% system, 0.0% nice, 99.0% idleManipulating the ARP Cache
You can view or manipulate the ARP cache to clear an address mapping entry or to manually define one. Enter one of the following commands:
arp [-evn] [-H type] [-i if] -a [hostname]
arp [-v] [-i if] -d hostname [pub]
arp [-v] [-H type] [-i if] -s hostname hw_addr [temp]
arp [-v] [-H type] [-i if] -s hostname hw_addr [netmask nm] pub
arp [-v] [-H type] [-i if] -Ds hostname ifa [netmask nm] pub
arp [-vnD] [-H type] [-i if] -f [filename]
Table 11-7 provides arguments and keywords for the arp command.
Caution
For example:
admin@GUARD# arp -eAddress HWtype HWaddress Flags Mask Iface10.10.1.254 ether 00:02:B3:C0:61:67 C eth110.10.8.11 ether 00:02:B3:45:B9:F1 C eth110.10.8.253 ether 00:D0:B7:46:72:37 C eth110.10.10.54 ether 00:03:47:A6:44:CA C eth1Netstat
You can display the network connections, routing tables, interface statistics, masquerade connections and multicast memberships to dubug network problems. Enter one the following commands:
netstat [address_family_options] [--tcp|-t] [--udp|-u] [--raw|-w] [--listening|-l] [--all|-a] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--symbolic|-N] [--extend|-e[--extend|-e]][--timers|-o] [--program|-p] [--verbose|-v] [--continuous|-c] [delay]
netstat {--route|-r} [address_family_options] [--extend|-e[--extend|-e]] [--verbose|-v] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]
netstat {--interfaces|-i} [iface] [--all|-a] [--extend|-e[--extend|-e]] [--verbose|-v] [--program|-p] [--numeric|-n] [--numeric-hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]
netstat {--groups|-g} [--numeric|-n] [--numeric-hosts][--numeric- ports][--numeric-ports] [--continuous|-c] [delay]
netstat {--masquerade|-M} [--extend|-e] [--numeric|-n] [--numeric- hosts][--numeric-ports][--numeric-ports] [--continuous|-c] [delay]
netstat {--statistics|-s} [--tcp|-t] [--udp|-u] [--raw|-w] [delay]
netstat {--version|-V}
netstat {--help|-h}
Note
Table 11-8 provides arguments and keywords for the netstat command
You can enter up to 13 arguments and keywords in one command.
For example:
admin@GUARD# netstat -vActive Internet connections (w/o servers)Proto Recv-Q Send-Q Local Address Foreign Address Statetcp 0 0 localhost:1111 localhost:32777 ESTABLISHEDtcp 0 0 localhost:8200 localhost:32772 ESTABLISHED...tcp 0 0 localhost:33464 localhost:8200 TIME_WAITtcp 1 0 localhost:1113 localhost:33194 CLOSE_WAIT...Active UNIX domain sockets (w/o servers)unix 2 [ ] STREAM CONNECTED 928unix 3 [ ] STREAM CONNECTED 890 /tmp/.zserv...admin@GUARD#Traceroute
You can print the route packets take to a network host to debug network problems. Enter the following command:
traceroute ip-address [-F] [-f first_ttl] [-g gateway] [-i iface]
[-m max_ttl] [-p port] [-q nqueries] [-s src_addr] [-t tos] [-w waittime] [packetlen]
Note
Table 11-9 provides the arguments and keywords for the traceroute command.
For example:
admin@GUARD# traceroute 10.10.10.34traceroute to 10.10.10.34 (10.10.10.34), 30 hops max, 38 byte packets1 10.10.10.34 (10.10.10.34) 0.577 ms 0.203 ms 0.149 msPing
You can send ICMP ECHO_REQUEST packets to network hosts and verify connectivity. Enter the following command:
ping ip-address [-c count] [-i interval] [-l preload] [-s packetsize] [-t ttl] [-w deadline] [-F flowlabel] [-I interface]
[-Q tos] [-T timestamp option] [-W timeout]Table 11-10 provides arguments and keywords for the ping command
You can enter up to ten arguments and keywords in one command.
For example:
admin@GUARD# ping 10.10.10.30 -n 1Monitoring Network Traffic
You can capture and observe network traffic patterns and problems. You can filter the information and capture and view only relevant traffic.
The Guard module captures the traffic in PCAP format.
A new capture replaces the previous one. To save the captured traffic, export it to an FTP server before you initiate a new capture. See the "Exporting Captured Traffic" section for further details.
Use the packet-dump command to monitor network traffic. This command provides the following options:
•
•
Note
Table 11-11 provides the arguments and keywords for the packet-dump command.
Table 11-11 Arguments and Keywords for the packet-dump Command
View the captured traffic.
Capture traffic destined to the specific zone. Specify the name of an existing zone.
An integer from 1 that specifies the capture rate. The Guard module captures 1 out of every sample-rate packets.
Note
An integer from 1 to 5000 that specifies the number of packets to capture.
Captures all traffic.
Captures only traffic that the Guard module dropped.
Captures only legitimate traffic that the Guard module forwarded on to the zone.
Captures only the traffic that the Guard module anti-spoofing and anti-zombie mechanisms sent back to the source in a verification attempt.
Captures only traffic that complies with the filter expression. The expression rules are identical to the Flex filter expression rules. See the "Configuring the Flex Filter" section for further details.
For example:
admin@GUARD# packet-dump capture view scannet 10 1000 all
Exporting Captured Traffic
You can capture and observe network traffic patterns and problems. A new capture replaces the older one. To save the captured traffic, export it to an FTP server before you initiate a new capture.
To export a capture to an FTP server, enter the following command:
copy packet-dump ftp server full-file-name [login] [password]
Table 11-12 provides arguments for the copy packet-dump command.
For example:
admin@GUARD# copy packet-dump ftp 10.0.0.191 dump <user> <password>
Obtaining Debug Information
In case of an operational problem in the Guard module, Cisco Technical Support can require you to send internal debug information. The debug core file contains information for troubleshooting system malfunctions. The file output is encrypted and intended for use by Cisco TAC personnel only.
The debug core file contains information for troubleshooting system malfunctions that occured during the specified time. To extract the debug information to an FTP server, perform the following steps:
Step 1
Step 2
Step 3
copy debug-core time ftp server full-file-name [login] [password]Table 11-13 provides the arguments for the copy debug-core command.
For example:
admin@GUARD# copy debug-core 11090645 ftp 10.0.0.191 /home/debug/debug-file <user> <password>Upgrading the Guard Module Version
The Guard module requires two software components for its operation:
•
•
Note
Supervisor 2 or Supervisor 720 IOS Software Image
The first software component is the Cisco IOS image on the Catalyst 6500 Supervisor 2 engine or the Supervisor 720 engine (supervisor). This image on the Supervisor module recognizes and initializes the Guard module and its processors. You must use a Cisco IOS image that supports the Guard module.
Guard Module Software
The Guard module software resides on a compact flash (CF) card that is integrated with the processor control complex. The compact flash has two partitions for software images, each with its own operating system (image):
•
•
You can upgrade the Guard module software on the compact flash card through the supervisor console. The upgrade process involves downloading the latest versions of the AP and MP images from the Cisco Software Center to an FTP or a TFTP server and installing them to the compact flash card.
The standard upgrade procedures involve upgrading the AP and MP images on the compact flash of the Guard module from the supervisor.
The following upgrade procedures are available for the Guard module:
•
•
•
Upgrading Operation Notes
This section provides guidelines for upgrading the AP and MP versions.
•
•
•
•
•
•
•
•
Note
AP Upgrade Procedure
To upgrade the application image, perform the following steps:
Step 1
http://www.cisco.com/public/sw-center/.
Copy the software image to a directory accessible to FTP or TFTP.
Step 2
Enter the following command on the supervisor:
hw-module module slot_number reset cf:1The slot_number argument is the number of slot in which the module is inserted in the chassis.
Step 3
show module slot_numberStep 4
copy tftp://path/filename pclc#slot_number-fs:The path/filename argument specifies the FTP location and the name of the image file. If the FTP server does not allow anonymous users, use the following syntax for the ftp-url value: ftp://user@host/absolute-path/filename. Enter your password when prompted.
Alternatively, you can download the version from an FTP server.
It can take up to 30 minutes to download an application image depending on the connection speed.
Caution
You can now reset the module
Resetting the module before this message is displayed will cause the upgrade to fail.
Step 5
hw-module module slot_number reset cf:4Step 6
show module slot_number
Note
Bad CFE version (X). This version requires version YSee the "Burning a New Flash Version" section for further details.
The following example shows how to upgrade the AP image:
Sup# hw-module module 8 reset cf:1Device BOOT variable for reset = <cf:1>Warning:Device list is not verified. <<< This message is informationalProceed with reload of module? [confirm]% reset issued for module 8Sup# copy tftp:images/ap/AGM-APUpgrade-4.0.0.x.bin pclc#8-fs:Address or name of remote host [10.56.36.2]?Source filename [images/ap/AGM-APUpgrade-4.0.0.x.bin]?Destination filename [AGM-APUpgrade-4.0.0.x.bin]?...19:50:06: %SVCLC-SP-5-STRRECVD: mod 8: <Application upgrade has started>19:50:06: %SVCLC-SP-5-STRRECVD: mod 8: <Do not reset the module till upgrade completes!!>......<<< Wait19:59:58: %SVCLC-SP-5-STRRECVD: mod 8: <Application upgrade has succeeded>19:59:58: %SVCLC-SP-5-STRRECVD: mod 8: <You can now reset the module>Sup# hw-module module 8 reset cf:4 <<<<< Resets Guard module to APDevice BOOT variable for reset = <cf:4>Proceed with reload of module? [confirm]...%OIR-SP-6-INSCARD:Card inserted in slot 8, interfaces are now onlineMP Upgrade Procedure
The MP image rarely requires upgrading. If you are instructed to update the MP image in the Release Note that accompanies the version release, perform the following steps:
Step 1
http://www.cisco.com/public/sw-center/.
Copy the software image to a directory accessible to FTP or TFTP.
Step 2
Enter the following command on the supervisor:
hw-module module slot_number reset cf:1The slot_number argument is the number of slot in which the module is inserted in the chassis.
Step 3
show module slot_numberStep 4
Enter the following command on the supervisor:
copy tftp://path/filename pclc#slot_number-fs:
The path/filename argument specifies the FTP location and name of the image file.
If the FTP server does not allow anonymous users, use the following syntax for the ftp-url value: ftp://user@host/absolute-path/filename. Enter your password when prompted.
It can take up to 30 minutes to download an application image depending on the connection speed.
Caution
You can now reset the module
Resetting the module before this message is displayed will cause the upgrade to fail.
Alternatively, you can download the version from an FTP server.
See the "MP Commands" section for further details on the MP commands.
Step 5
show module slot_numberStep 6
hw-module module slot_number reset cf:4The following example shows how to upgrade the MP image:
Sup# hw-module module 8 reset cf:1Device BOOT variable for reset = <cf:1>Warning:Device list is not verified. <<< This message is informationalProceed with reload of module? [confirm]% reset issued for module 8Sup# copy tftp:images/mp/MPUpgrade-4.0.0.0.bin pclc#8-fs:Address or name of remote host [10.56.36.2]?Source filename [images/ap/MPUpgrade-4.0.0.0.bin]?Destination filename [MPUpgrade-4.0.0.0.bin]?...3d19h:%SVCLC-SP-5-STRRECVD:mod 8:<Upgrade of MP was successful.>3d19h:%SVCLC-SP-5-STRRECVD:mod 8:<You can now reset the module>Sup# show module 8.The Following output shows MP image name because Guard module is reset to MP (cf:1).Mod MAC addresses Hw Fw Sw Status--- -------------------------------- ----- ------- ----------- -------8 000f.348d.d7f0 to 000f.348d.d7f7 0.301 7.2(1) 4.0(0.0)m Other...Sup# hw-module module 8 reset cf:4 <<< Resets Guard module to AP (normal operation)Device BOOT variable for reset = <cf:4>Proceed with reload of module? [confirm]...%OIR-SP-6-INSCARD:Card inserted in slot 8, interfaces are now onlineInline Upgrade Procedure
The inline image upgrade procedure provides an alternative method to upgrading the AP and MP images.
To upgrade the image, perform the following steps:
Step 1
http://www.cisco.com/public/sw-center/.
Copy the software image to a directory accessible to FTP.
See the "Burning a New Flash Version" section for further details on the MP commands.
Step 2
Step 3
hw-module module slot_number reset cf:1The slot_number argument is the number of slot in which the module is inserted in the chassis.
Step 4
Step 5
upgrade ftp://path/filenameThe path/filename argument specifies the FTP location and name of the image file.
If the FTP server does not allow anonymous users, use the following syntax for the ftp-url value: ftp://user@host/absolute-path/filename. Enter your password when prompted.
To upgrade the AP image, enter the AP image filename. To upgrade the MP image, enter the MP image filename. See the "Upgrading Operation Notes" section for further details.
Caution
Application image upgrade complete. You can boot the image now.
Resetting the module before this message is displayed will cause the upgrade to fail.
Step 6
Step 7
hw-module module slot_number reset cf:4
Note
Bad CFE version (X). This version requires version YSee the "Burning a New Flash Version" section for further details.
Step 8
The following example shows how to upgrade the Guard module application software:
Sup# hw-module module 8 reset cf:1..Proceed with reload of module? [confirm]% reset issued for module 9..Sup# session slot 8 proc 1..login:rootPassword:..root@localhost.cisco.com# upgrade ftp://psdlab-pc1/pub/images/ap/AGM-APUpgrade-4.0.0.x.binDownloading the image. This may take several minutes.....Upgrading will wipe out the contents on the storage media.Do you want to proceed installing it [y|N]:Proceeding with upgrade. Please do not interrupt.If the upgrade is interrupted or fails, boot intoMaintenance image again and restart upgrade...Application image upgrade complete. You can boot the image now.root@hostname.cisco.com# exitlogout[ OK ][Connection to 127.0.0.91 closed by foreign host]Sup# hw-module module 8 reset cf:4Burning a New Flash Version
You can burn a new flash version only when there is a mismatch between the current common firmware environment (CFE) and the software version.
In case of a CFE mismatch, the Guard module displays the following message when you establish the first session with the Guard module after upgrading the software version:
Bad CFE version (X). This version requires version Y
Caution
To burn a new flash version, perform the following steps:
Step 1
flash-burnIf you try to burn a new flash when the CFE and the Guard module software versions match, the operation will fail.
Step 2
reloadYou must issue the reload command after burning a new flash version. The Guard will not be fully functional until the reload command is executed.
For example:admin@GUARD-conf# flash-burnPlease note: DON'T PRESS ANY KEY WHILE IN THE PROCESS!...Burned firmware successfullySYSTEM IS NOT FULLY OPERATIONAL. Type 'reload' to restart the systemMP Commands
Administrators can boot the Guard module to the MP. A set of interfaces is available on the MP to administer and diagnose the Guard module. One of the key features of the MP is to provide the ability to install a new AP image.
To boot to the MP use the hw_module module reset command. Then use the session slot command to log into the MP.
Table 11-14 summarizes the MP commands.
Recovering a Lost Password
This section describes how to recover a lost password.
To recover lost passwords, perform the following steps:
Step 1
hw-module module slot_number reset cf:1The slot_number argument is the number of slot in which the module is inserted in the chassis.
Step 2
Step 3
clear ap passwordStep 4
hw-module module slot_number reset cf:4Step 5
Tip
