Recently I was called to adjust a firewall rule to allow access to 2 specific URL's only and nowhere else.
So I created a expression for the 2 specific URL and tested to see if it's working.
Guess what, it didn't! So further looking in to the issue I discovered that the specific developers had used more than a dozen domain to fetch images, scripts, ads, fonts, style sheets etc.
In order to test that I used the developer tools included in Firefox and Chrome, to access the tools either use the menu on each browser and locate them under tools or use Ctrl+Shift+I to open the console. Then select network and visit the page from an non restricted computer and disable any ad blockers that you might use.
Record all the domains and try to whitelist them in your rule.
It's a try and error procedure but helps especially if you are dealing with slow responding 3rd parties etc.
Thursday, 1 February 2018
ICMP DoS attack Blacknurse
Black nurse is an ICMP DoS attack witch can bring systems down with a little as 18Mbps traffic.
As they state "it CAN bring you down"
More at blacknurse.dk
As they state "it CAN bring you down"
More at blacknurse.dk
Wednesday, 31 January 2018
Cisco Voice Troubleshooting commands
Credit goes to www.uccollabing.com
Show cdp – It will show CDP Timer and Holdtime Frequency
Show cdp neighbors detail – It will show details of neighbor with an IP Address and IOS version
Show cdp neighbors – It will show details of Device ID, Local Interface, Holdtime, Capability, Platform and Port ID
Show cdp interface – It will show details of the interface if it is Up physically, Line protocol is up, Encapsulation and Holdtime.
Show cdp traffic – It will show details of the CDP counters (CDP packets sent and received)
Show voice call summary – It will show all the active calls on the Gateway, Ports, Codec, VAD (enabled or not), VTSP state and VPM state
Show voice call status – It will show only the active calls, not all the ports. It includes Port, Called Number, and Dial Peer
Show call history voice record – It will show information about calls made to and from the voice router
Show voice port summary – It will show a detailed information on Ports, Channel, Signalling Type, Port Status, In Operation Status, Out Status and EC. It basically shows FXO/FXS/PRI ports in use.
Show gateway – It will show the state and version is H.323
Show dialplan number 1000 – It will show you what happens when the specified number is dialed
Show dial-peer voice summary – It will show you what all dial-peers that are currently working. Summary of dial-peers/destination.
Show voip rtp connections – It will show all the current RTP connections which will have Local and Remote IP Address, Port Numbers, Call IDs.
show controllers T1 or show controllers E1 – It will show the status of a controller if it is up or down
show call active voice brief – It will show the active call information which includes Call ID, Peer IP Address and Codecs
Show mgcp – It will show mgcp settings on the gateway
Show dial-peer voice – It will show how voice dial peers are configured.
Show mgcp statistics – It will show mgcp statistics relationship between the devices which will have stats for CRCX, DLCX, MDCX and RSIP, IP addresses of Call Agents etc
Show mgcp endpoint – It will show information related to MGCP endpoints
Show mgcp connection – It will show information about the current mgcp connections
show sip-ua register status – It will show SIP Registration information
show voice dsp – It will show the status of all the DSPs on the Gateway
show ccm-manager – It will show information about the active and redundant configured Cisco Unified Communications Manager. This command also indicates if the gateway is currently registered with Cisco Unified Communications Manager.
Show isdn active – It will show if a call is in progress and which number is being dialed.
Show isdn status – It will show statistics of an ISDN connection and show if your PRI is up/established correctly
show ccm-manager fallback – It will show whether MGCP fallback is enabled or disabled, if enabled, whether it is currently active or not.
Show sip service – It will help to display the status of SIP call service in a SIP gateway
show sip-ua status – It will help to display status for the SIP user agent (UA), including whether call redirection is enabled or disabled
cdp enable – It will enabled CDP on an interface
no cdp enable – It will disable CDP on an interface
Test voice translation-rule – It will allow you to test a translation rule configured on the gateway.
Csim start XXXXX – It is a hidden command which helps to generate calls
Debug voice ccapi inout – It will show calls in and out of ports on the gateway
Debug mgcp packet – It will monitor the packets exchanged between CUCM and router.
Debug isdn q921 – It will help to verify if you have a connection to the ISDN switch.
Debug isdn q931 – It will monitor information about call setup and tear down of ISDN network connections (layer 3) between local router (user side) and the network
Debug h225 – It will display additional information about the contents of H.225 Registration, Admission, and Status Protocol (RAS) messages.
Debug vtsp tone – It will help to view tone generated by the router which could be fast busy or dial tone or busy signal etc.
Debug voip ccapi inout – It will trace the execution path through the call control API, which serves as the interface between the call session application and the underlying network-specific software.
Debug vpm signal – It will help to view to view the on−hook and off−hook signaling for the voice ports.
Debug vtsp dsp – It will help to view digits collection performed on the router
Debug ccsip calls – It will help to show all SIP call details as they are updated in the SIP call control block. This debug command can be used to monitor call records for suspicious clearing causes.
Debug ccsip messages – It will help you to enable all SIP message tracing, such as those that are exchanged between the SIP user-agent client (UAC) and the access server
Debug isdn event – It will show events occurring on the user side (on the router) of the ISDN interface. The ISDN events that can be displayed are Q.931 events (call setup and teardown of ISDN network connections)
Show cdp – It will show CDP Timer and Holdtime Frequency
Show cdp neighbors detail – It will show details of neighbor with an IP Address and IOS version
Show cdp neighbors – It will show details of Device ID, Local Interface, Holdtime, Capability, Platform and Port ID
Show cdp interface – It will show details of the interface if it is Up physically, Line protocol is up, Encapsulation and Holdtime.
Show cdp traffic – It will show details of the CDP counters (CDP packets sent and received)
Show voice call summary – It will show all the active calls on the Gateway, Ports, Codec, VAD (enabled or not), VTSP state and VPM state
Show voice call status – It will show only the active calls, not all the ports. It includes Port, Called Number, and Dial Peer
Show call history voice record – It will show information about calls made to and from the voice router
Show voice port summary – It will show a detailed information on Ports, Channel, Signalling Type, Port Status, In Operation Status, Out Status and EC. It basically shows FXO/FXS/PRI ports in use.
Show gateway – It will show the state and version is H.323
Show dialplan number 1000 – It will show you what happens when the specified number is dialed
Show dial-peer voice summary – It will show you what all dial-peers that are currently working. Summary of dial-peers/destination.
Show voip rtp connections – It will show all the current RTP connections which will have Local and Remote IP Address, Port Numbers, Call IDs.
show controllers T1 or show controllers E1 – It will show the status of a controller if it is up or down
show call active voice brief – It will show the active call information which includes Call ID, Peer IP Address and Codecs
Show mgcp – It will show mgcp settings on the gateway
Show dial-peer voice – It will show how voice dial peers are configured.
Show mgcp statistics – It will show mgcp statistics relationship between the devices which will have stats for CRCX, DLCX, MDCX and RSIP, IP addresses of Call Agents etc
Show mgcp endpoint – It will show information related to MGCP endpoints
Show mgcp connection – It will show information about the current mgcp connections
show sip-ua register status – It will show SIP Registration information
show voice dsp – It will show the status of all the DSPs on the Gateway
show ccm-manager – It will show information about the active and redundant configured Cisco Unified Communications Manager. This command also indicates if the gateway is currently registered with Cisco Unified Communications Manager.
Show isdn active – It will show if a call is in progress and which number is being dialed.
Show isdn status – It will show statistics of an ISDN connection and show if your PRI is up/established correctly
show ccm-manager fallback – It will show whether MGCP fallback is enabled or disabled, if enabled, whether it is currently active or not.
Show sip service – It will help to display the status of SIP call service in a SIP gateway
show sip-ua status – It will help to display status for the SIP user agent (UA), including whether call redirection is enabled or disabled
cdp enable – It will enabled CDP on an interface
no cdp enable – It will disable CDP on an interface
Test voice translation-rule – It will allow you to test a translation rule configured on the gateway.
Csim start XXXXX – It is a hidden command which helps to generate calls
Debug voice ccapi inout – It will show calls in and out of ports on the gateway
Debug mgcp packet – It will monitor the packets exchanged between CUCM and router.
Debug isdn q921 – It will help to verify if you have a connection to the ISDN switch.
Debug isdn q931 – It will monitor information about call setup and tear down of ISDN network connections (layer 3) between local router (user side) and the network
Debug h225 – It will display additional information about the contents of H.225 Registration, Admission, and Status Protocol (RAS) messages.
Debug vtsp tone – It will help to view tone generated by the router which could be fast busy or dial tone or busy signal etc.
Debug voip ccapi inout – It will trace the execution path through the call control API, which serves as the interface between the call session application and the underlying network-specific software.
Debug vpm signal – It will help to view to view the on−hook and off−hook signaling for the voice ports.
Debug vtsp dsp – It will help to view digits collection performed on the router
Debug ccsip calls – It will help to show all SIP call details as they are updated in the SIP call control block. This debug command can be used to monitor call records for suspicious clearing causes.
Debug ccsip messages – It will help you to enable all SIP message tracing, such as those that are exchanged between the SIP user-agent client (UAC) and the access server
Debug isdn event – It will show events occurring on the user side (on the router) of the ISDN interface. The ISDN events that can be displayed are Q.931 events (call setup and teardown of ISDN network connections)
Q.931 Call Disconnection Causes
These are cause codes from the debug voip ccapi inout command.| Call Disconnection Cause Value (in Hex) | Meaning and Number (in Decimal) |
|---|---|
| CC_CAUSE_UANUM = 0x1 | Unassigned number (1) |
| CC_CAUSE_NO_ROUTE = 0x3 | No route to destination (3) |
| CC_CAUSE_NORM = 0x10 | Normal call clearing (16) |
| CC_CAUSE_BUSY = 0x11 | User busy (17) |
| CC_CAUSE_NORS = 0x12 | No user response (18) |
| CC_CAUSE_NOAN = 0x13 | No user answer (19) |
| CC_CAUSE_REJECT = 0x15 | Call rejected (21) |
| CC_CAUSE_INVALID_NUMBER = 0x1C | Invalid number (28) |
| CC_CAUSE_UNSP = 0x1F | Normal, unspecified (31) |
| CC_CAUSE_NO_CIRCUIT = 0x22 | No circuit (34) |
| CC_CAUSE_NO_REQ_CIRCUIT = 0x2C | No requested circuit (44) |
| CC_CAUSE_NO_RESOURCE = 0x2F | No resource (47) |
| CC_CAUSE_NOSV = 0x3F | Service or option not available, or unspecified (63) |
Codec Negotiation Values
These codec negotiation values are from the debug voip ccapi inout command.| Negotiation Value | Meaning |
|---|---|
| codec=0x00000001 | G711 ULAW 64K PCM |
| codec=0x00000002 | G711 ALAW 64K PCM |
| codec=0x00000004 | G729 |
| codec=0x00000004 | G729IETF |
| codec=0x00000008 | G729a |
| codec=0x00000010 | G726r16 |
| codec=0x00000020 | G726r24 |
| codec=0x00000040 | G726r32 |
| codec=0x00000080 | G728 |
| codec=0x00000100 | G723r63 |
| codec=0x00000200 | G723r53 |
| codec=0x00000400 | GSMFR |
| codec=0x00000800 | G729b |
| codec=0x00001000 | G729ab |
| codec=0x00002000 | G723ar63 |
| codec=0x00004000 | G723ar53 |
| codec=0x00008000 | CLEAR_CHANNEL |
Tone Types
| Tone Types | Meaning |
|---|---|
| CC_TONE_RINGBACK 0x1 | Ring tone |
| CC_TONE_FAX 0x2 | Fax tone |
| CC_TONE_BUSY 0x4 | Busy tone |
| CC_TONE_DIALTONE 0x8 | Dial tone |
| CC_TONE_OOS 0x10 | Out of service tone |
| CC_TONE_ADDR_ACK 0x20 | Address acknowledgement tone |
| CC_TONE_DISCONNECT 0x40 | Disconnect tone |
| CC_TONE_OFF_HOOK_NOTICE 0x80 | Tone indicating that the phone is off-hook |
| CC_TONE_OFF_HOOK_ALERT 0x100 | A more urgent version of CC_TONE_OFF_HOOK_NOTICE |
| CC_TONE_CUSTOM 0x200 | Custom tone-used when you are specifying a custom tone |
| CC_TONE_NULL 0x0 | Null tone |
FAX-Rate and VAD Capabilities Values
| Values | Meaning |
|---|---|
| CC_CAP_FAX_NONE 0x1 | Fax disabled or not available |
| CC_CAP_FAX_VOICE 0x2 | Voice call |
| CC_CAP_FAX_144 0x4 | 14,400 baud |
| CC_CAP_FAX_96 0x8 | 9,600 baud |
| CC_CAP_FAX_72 0x10 | 7,200 baud |
| CC_CAP_FAX_48 0x20 | 4,800 baud |
| CC_CAP_FAX_24 0x40 | 2,400 baud |
| CC_CAP_VAD_OFF 0x1 | VAD disabled |
| CC_CAP_VAD_ON 0x2 | VAD enabled |
Monday, 29 January 2018
CUCM Remove prefix from call presentation
Hi,
If you have a translate rule in your gateway that adds 9 to the caller number for incoming calls, for call history, redial etc. Then you are facing an issue where your Jabber will not do Caller ID based on your contacts.
To override this behavior you can do the following:
If you have a translate rule in your gateway that adds 9 to the caller number for incoming calls, for call history, redial etc. Then you are facing an issue where your Jabber will not do Caller ID based on your contacts.
To override this behavior you can do the following:
- Create a new partition not used anywhere else. e.g. Transform_PT
- Create a new Calling Party Transformation Pattern
- Pattern 9.!
- Partition Transform_PT
- Discard Digits PreDot
- Create a CSS e.g. Transform_CSS
- Assign the Transform_PT partition to the CSS
- Go to a test device and assign the Transform_CSS
- under "Number Presentation Transformation"
- un-check "Use Device Pool Calling Party Transformation CSS"
- Assign the created CSS Transform_CSS
- Apply & Reset
- Test and if happy apply that to the Trunk for all users using step 4 guide.
Thursday, 11 January 2018
Cisco Show dialplan command
Hi,
If you ever wonder which dial-peer matches on specific destinations (called numbers), use the
Show dialplan number 1234 timeout
Where 1234 is the called number and timeout is needed for matching on variable-length destination patterns.
If you ever wonder which dial-peer matches on specific destinations (called numbers), use the
Show dialplan number 1234 timeout
Where 1234 is the called number and timeout is needed for matching on variable-length destination patterns.
Tuesday, 5 December 2017
Call Manager Secure LDAP (LDAPS) integration
In order to proceed the following must be met
- DNS servers configured on all CUCM servers
- Export Certificates from all Domain Controllers
- Check who Domain Controllers have the Global Catalog role installed
- Upload DC certificates on all CUCM and Presence servers using "tomcat-trust" for versions 8.x and newer.
- Restart Tomcat service from CLI/SSH using utils service restart Cisco Tomcat
- Declare your LDAP servers with SSL and use port 3269 for GC enabled DCs and port 636 for non-GC servers.
- DNS servers configured on all CUCM servers
- Export Certificates from all Domain Controllers
- Check who Domain Controllers have the Global Catalog role installed
- Upload DC certificates on all CUCM and Presence servers using "tomcat-trust" for versions 8.x and newer.
- Restart Tomcat service from CLI/SSH using utils service restart Cisco Tomcat
- Declare your LDAP servers with SSL and use port 3269 for GC enabled DCs and port 636 for non-GC servers.
Cisco Call Manager Certificates with Microsoft CA
Hi, in order to renew the certificates you must create a Certificate CSR, in this CSR you MUST include the server FQDN in subject name and in SAN also.
You must also note the old certificate attributes such extended key usage e.g.
Then you must create the certificate sign template on Microsoft CA. You must use the desktop application to do this.
Open Certificate Authority and then Certificate templates -> manage.
Find the Web server template and copy that on to a new.
Change the Name in General and then add the correct settings based on the previous step.
Check encryption for modulus not more than 4096.
Before you close the application add the Template in the template shortcuts.
Now open a browser and point to your CA
Open the CSR file and copy all the contents to your CA request website, generate the certificate and download in base64 format.
Then upload the certificate, along with the Root CA and any Intermediate CA (Full Chain) to CUCM and restart the appropriate service e.g. tomcat.
If the CA is trusted by your browser / application, then you will see no warnings when you visit the page.
Subscribe to:
Posts (Atom)