alcatron.net

Well well, it seems cisco has updated their Cisco 877 IOS with version 15!!

Latest IOSes on their site:
ADVANCED ENTERPRISE SERVICES
c870-adventerprisek9-mz.150-1.XA.bin
Release Date: 27/Oct/2009
Size: 23984.26 KB (24559880 bytes)
Minimum Memory: DRAM:128 MB Flash:28 MB

ADVANCED IP SERVICES
c870-advipservicesk9-mz.150-1.XA.bin
Release Date: 27/Oct/2009
Size: 23680.82 KB (24249152 bytes)
Minimum Memory: DRAM:128 MB Flash:28 MB

ADVANCED SECURITY
c870-advsecurityk9-mz.150-1.XA.bin
Release Date: 27/Oct/2009
Size: 20300.32 KB (20787520 bytes)
Minimum Memory: DRAM:128 MB Flash:24 MB

Just beware when you load these on, to watch out for the memory/flash requirements!

Also along with the new IOS versions, they have also released a recent DSL controller firmware, however no readme file yet for it!

Latest firmware:
adsl_alc_20190_4.0.018.bin
Description ADSL firmware version 4.0.18
Size 977.49 KB (1000952 bytes)

Will attempt to test the IOS/Firmware and see how they go, if anyone else has tested these please comment, and let us know how they are

Cisco 877

I researched some more information how to tighten the 877 against security attacks, and usually on your dialer interface you might have this..

ip access-group 101 in

then a access list for incoming traffic via access-group 101 might look like this..

access-list 101 permit ip any any

However with having this set, means icmp, port attacks, or any other type of probing could be spoofed to gain access to your network. I have implemented the following access list filter to stop that from occuring, by blocking any internal LAN ranges from the wan side coming in via the dialer interface, and other type of bogus attacks.

access-list 101 deny   icmp any any echo                (blocks wan pings)
access-list 101 deny   tcp any any eq 139     (blocks port 139 netbios attacks used for ms fileshares)
access-list 101 deny   ip 10.0.0.0 0.255.255.255 any  (blocks internal lan range)
access-list 101 deny   ip 172.16.0.0 0.15.255.255 any (blocks internal lan range)
access-list 101 deny   ip 192.168.0.0 0.0.255.255 any (blocks internal lan range)
access-list 101 deny   ip 127.0.0.0 0.255.255.255 any  (blocks localhost spoofs)
access-list 101 deny   ip 50.0.0.0 0.255.255.255 any   (blocks unused 50.* address space which attackers may spoof)
access-list 101 deny   ip 100.0.0.0 0.255.255.255 any   (blocks unused 100.* address space which attackers may spoof)
access-list 101 deny   ip 101.0.0.0 0.255.255.255 any (blocks unused 101.* address space which attackers may spoof)
access-list 101 deny   ip host 255.255.255.255 any (blocks spoofing from this address)
access-list 101 deny   ip host 0.0.0.0 any (blocks spoofing from this address)
access-list 101 permit ip any any  (permits all other traffic)

Now once you have this in place, how do you know if you are actually getting hits from any of these rules, and if the 877 is dropping the packets if the acl matches?

There is one nice command to show that data…(need to be in priviliged mode)

cisco877#show access-lists
Extended IP access list 101
10 deny icmp any any echo (30 matches)  <30 hits on blocking wan ping from outside sources
20 deny tcp any any eq 139 log
30 deny ip 10.0.0.0 0.255.255.255 any
40 deny ip 172.16.0.0 0.15.255.255 any
50 deny ip 192.168.0.0 0.0.255.255 any
60 deny ip 127.0.0.0 0.255.255.255 any
70 deny ip 50.0.0.0 0.255.255.255 any log
80 deny ip 100.0.0.0 0.255.255.255 any log
90 deny ip 101.0.0.0 0.255.255.255 any log
100 deny ip host 255.255.255.255 any
110 deny ip host 0.0.0.0 any
120 permit ip any any (2954091 matches) <<lots of hits being allowed in from other sources not in access list (normal ip traffic flow)

Hopefully this is useful to someone wishing to implement a bit more security to their 877 setup

Any questions post your comments.

Cisco 877

Need to setup a 877 with an external ADSL modem in bridged mode? Maybe you have another modem which can sync/be more stable than the cisco and you wish to purely use the 877 as a router.

Following commands should help set it up..

Assign an ethernet interface to where it will use pppoe from, and assign it vlan2

interface FastEthernet3
description External DSL PPPoE
switchport access vlan 2

interface Vlan2
description External DSL PPPoE
no ip address
pppoe enable group global
pppoe-client dial-pool-number 2

setup a Dialer2 interface..

!
interface Dialer2
description connection to External DSL modem
ip address negotiated
ip access-group 101 in
no ip unreachables
ip nat outside
no ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1410
dialer pool 2
dialer idle-timeout 0
dialer-group 2
no cdp enable
ppp authentication chap callin
ppp chap hostname something@something
ppp chap password something

ip route 0.0.0.0 0.0.0.0 Dialer2

ip nat inside source list 102 interface Dialer2 overload

Cisco 877

c870-advipservicesk9-mz.124-24.T1.bin
Release Date: 23/Jun/2009

c870-advsecurityk9-mz.124-24.T1.bin
Release Date: 23/Jun/2009

Just released from cisco…the T1 might solve the router from crashing and creating a dump file as it did in the T version.

Cisco 877

With my current Cisco 877 configuration running in PPPoA configuration, I noticed that my international file transfer/download performance wasnt up to scratch. Everything locally was quite fast, but when it came to download files from overseas I noticed transfer speeds would go up and down constantly without any consistency in speed. This was the same case with video streaming and constant buffering. At the same time I had a Draytek 2710 and the performance on that was better compared to the Cisco.

I spent a few hours trying to tweak various MTU/TCP MSS ADJUST settings to optimize international bandwidth performance on the Cisco. The Draytek MTU default was 1442, so I figured something on the cisco within the MTU is causing these performance issues. So I investigated and tried so many various settings and in the end, I switched to PPPoE on the Cisco. What I then discovered is, that I do not need the MTU configured on the Cisco at all, and the 877 performs better without the MTU set. All that I changed in my new configuration is adding the command “ip tcp adjust-mss 1405″ on the Dialer1 interface. After this was applied I noticed a dramatic improvement on TCP/FTP transfers from overseas destinations. As well as having  “ip virtual-reassembly” on the vlan1 interface.

I did also try adjusting the mss value to 1442 same as the draytek, however it didnt perform as well, so then i tried decrementing values to try to see what kind of performance it made, and in the end 1405 came out to be very good.

So if you are in the same scenario, and wanting to improve TCP transfers on your cisco, the MSS adjust setting could come in very handy.

When a host (usually a PC) initiates a TCP session with a server, it negotiates the IP segment size by using the MSS option field in the TCP SYN packet. The value of the MSS field is determined by the maximum transmission unit (MTU) configuration on the host. The default MSS value for a PC is 1500 bytes.

The PPP over Ethernet (PPPoE) standard supports a MTU of only 1492 bytes. The disparity between the host and PPPoE MTU size can cause the router in between the host and the server to drop 1500-byte packets and terminate TCP sessions over the PPPoE network. Even if the path MTU (which detects the correct MTU across the path) is enabled on the host, sessions may be dropped because system administrators sometimes disable the ICMP error messages that must be relayed from the host in order for path MTU to work.

The ip tcp adjust-mss command helps prevent TCP sessions from being dropped by adjusting the MSS value of the TCP SYN packets.

The ip tcp adjust-mss command is effective only for TCP connections passing through the router.

(Taken from the Cisco website…http://www.cisco.com/en/US/docs/ios/12_2t/12_2t4/feature/guide/ft_admss.html)

Here is my current PPPoE config, with the optimizations:
(Items in bold are the changes)

version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec show-timezone
service timestamps log uptime
service password-encryption
service internal
!
hostname cisco877
!
boot-start-marker
boot-end-marker
!
logging buffered 16000
logging console critical
enable secret yoursecretpassword
!
no aaa new-model
clock timezone ACST 9 30
clock summer-time ACST recurring last Sun Oct 2:00 1 Sun Apr 3:00
!
!
dot11 syslog
no ip source-route
ip cef
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
no ip bootp server
ip name-server 192.231.203.132
ip name-server 192.231.203.3
!
!
!
username root privilege 15 password yourpasswordhere
!
!
archive
log config
hidekeys
!
!
!
!
!
interface ATM0
description — Internode ADSL —
no ip address
no atm ilmi-keepalive
pvc 8/35
pppoe-client dial-pool-number 1
!
dsl operating-mode auto
dsl bitswap both
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Vlan1
ip address 10.108.1.2 255.255.255.224
ip nat inside
ip virtual-reassembly
!
interface Dialer1
description connection to ISP PPPoE 8/35 MUX
ip address negotiated
ip access-group 101 in
no ip unreachables
ip nat outside
no ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1405
dialer pool 1
dialer idle-timeout 0
dialer-group 1
no cdp enable
ppp authentication chap callin
ppp chap hostname username@something.net
ppp chap password yourpasshere

interface Dialer0
no ip address
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer1

access-list 1 permit 10.108.1.0 0.0.0.31
access-list 1 deny   any
access-list 101 deny   icmp any any echo
access-list 101 permit ip any any
access-list 102 permit ip 10.108.1.0 0.0.0.31 any
dialer-list 1 protocol ip permit
snmp-server community public RO 1
!
!

line con 0
password youreconsolepassword
login
no modem enable
transport preferred none
stopbits 1
line aux 0
line vty 0 4
session-timeout 240
access-class 102 in
password yourtelnetpassword
login
transport preferred none
!
scheduler max-task-time 5000
sntp server 129.127.40.3
end

Cisco 877

Cisco recently released new version of its IOS for the 877 router:

c870-advipservicesk9-mz.124-24.T.bin
c870-advsecurityk9-mz.124-24.T.bin

Giving advsecurity ios a test, and seems to work really well, also this IOS works with the various DSL firmware releases eg.adsl_alc_20190.bin.4.0.15 etc, unlike where -22 did not work! Cisco finally fixed it it in this new release

UPDATE: It seems this IOS is a bit buggy, can crash at times and create a crash dump file
Work harder cisco

Cisco 877

Well i thought id post a Cisco877W wireless config, configured only as a access point. So..you can cut bits here and there and fit it into your existing 877 configuration. Bold indicates what you may need to change..

Cisco uses the Centre Frequency MHz to configure its wireless channel. So in our example below 2442 is used, which means that is actually Channel Identifier 7.

For more info on this you can see go here http://www.cisco.com/en/US/docs/routers/access/1800/wireless/configuration/guide/s37chan.html

version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
no service dhcp
!
hostname yourhostname
!
boot-start-marker
boot-end-marker
!
enable secret yoursecretpass
!
no aaa new-model
!
resource policy
!
ip subnet-zero
ip cef
bridge irb
!
!
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
dsl operating-mode auto
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface Dot11Radio0
no ip address
!
encryption mode ciphers tkip
!
ssid YourAPssidhere
authentication open
authentication key-management wpa
guest-mode
wpa-psk ascii yourwirelesskeyhere
!

speed basic-1.0 basic-2.0 basic-5.5 basic-6.0 basic-9.0 basic-11.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0
channel 2442
station-role root
no cdp enable
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Vlan1
no ip address
bridge-group 1
bridge-group 1 spanning-disabled
!
interface BVI1
ip address 192.168.1.3 255.255.255.0
ip access-group 102 in
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1452
!
ip classless
!
no ip http server
no ip http secure-server
!
!
control-plane
!
bridge 1 route ip
!
!
line con 0
password yourconsolepass
login
no modem enable
transport preferred none
stopbits 1
line aux 0
line vty 0 4
session-timeout 240
access-class 2 in
password yourtelnetpass
login
transport preferred none
!
scheduler max-task-time 5000
end

Cisco 877

Here is a sample 877 config for ISP Internode in Australia which I use. It may work with other providers as well, the only items you need to modify is the hostname, password sections, timezone, and possible your IP addressing/subnets etc

version 12.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec show-timezone
service timestamps log uptime
service password-encryption
service internal
!
hostname cisco877
!
boot-start-marker
boot-end-marker
!
logging message-counter syslog
logging buffered 16000
logging console critical
enable secret yourpasswordhere
!
!setup timezone below default set to South Australia
no aaa new-model
clock timezone ACST 9 30
clock summer-time ACST recurring last Sun Oct 2:00 1 Sun Apr 3:00
!
!
dot11 syslog
no ip source-route
!
!
ip cef
no ip bootp server
ip name-server 192.231.203.132
ip name-server 192.231.203.3
!
!
!
!
!sets up a username of root with a password
username root privilege 15 password yourrouterpasswordhere
!
!
!
archive
log config
hidekeys
!
!
interface ATM0
description — Internode ADSL —
no ip address
no atm ilmi-keepalive
pvc 8/35
tx-ring-limit 3
encapsulation aal5snap
protocol ppp dialer
dialer pool-member 1
!
dsl operating-mode auto
dsl bitswap both
!
interface FastEthernet0
no shut
!
interface FastEthernet1
no shut
!
interface FastEthernet2
no shut
!
interface FastEthernet3
no shut
!
interface Vlan1
ip address 192.168.1.1 255.255.255.0
ip nat inside
ip virtual-reassembly
ip tcp adjust-mss 1420
hold-queue 100 out
!
interface Dialer1
description connection to ISP PPPoE 8/35 MUX
ip address negotiated
ip access-group 101 in
no ip unreachables
ip mtu 1492
ip nat outside
ip virtual-reassembly max-reassemblies 64
encapsulation ppp
dialer pool 1
dialer idle-timeout 0
dialer-group 1
no cdp enable
ppp chap hostname something@internode.on.net
ppp chap password (yourpassword)
!
interface Dialer0
no ip address
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer1
no ip http server
no ip http secure-server
!
ip dns server
ip nat inside source list 102 interface Dialer1 overload
!
access-list 1 remark Permit our private network through the list
access-list 1 permit 192.168.1.0 0.0.0.255
access-list 1 remark Just deny everything else
access-list 1 deny   any
access-list 101 deny   icmp any any echo
access-list 101 permit ip any any
access-list 102 permit ip 192.168.1.0 0.0.0.255 any
dialer-list 1 protocol ip permit
!allow snmp below if required
snmp-server community public RO 1
!
!
!
!
control-plane
!
!
line con 0
password yourconsolepasshere
login
no modem enable
transport preferred none
stopbits 1
line aux 0
line vty 0 4
session-timeout 240
access-class 102 in
password yourtelnetpasswordhere
login
transport preferred none
!
scheduler max-task-time 5000
sntp server 129.127.40.3
end

Cisco 877

So you got your cisco device, but what if you want to quickly find the right IOS, and other software releases for features you want to run on your network. There are many different versions of the cisco IOS for each device. I came accross this handy cisco website which you can use to research software releases by searching by image name, platform, product code etc. Once you select what you want, it will give you more information about the particular IOS for your device, and what it can run.

So checkout:

http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp

I believe it will come in quite handy!

Cisco 877, News

Need to know what your dsl sync stats are and more details about the link?

cisco877>sh dsl int

Or as in my case improving the attenuation on the upstream by 3dB..we can modify the gain tx-offset value to 3

Enter exec mode:

cisco877#conf t
cisco877(config)#int atm0
cisco877(config-if)#dsl gain-setting tx-offset 3

To show ppooe uptime on the session:

Look at the active time column

cisco877#sh caller

To show logs on the modem to see activity:

cisco877#sh log

Need to troubleshoot pppoe events, atm, errors, and see more detail, simply issue..

cisco877#debug pppoe events
cisco877#debug pppoe errors
cisco877#debug atm events
cisco877#debug atm errors

These details will then be logged into the log file as above. To remove the debugging simply issue the no statement at the front.

If you have any more tips,hints, recommendations, please comment below

Cisco 877, Tech