Get the Flash Player to see this player.

In schimb, Windows 2008 Server + Hyper-v chiar m-au impresionat. Sunt fan Linux, dar unele feature-uri din Win2008 merita incercate. Intre VMware ESXi si Hyper-v, diferenta principala e data de capabilitatea ESXi de a clona o masina fizica Windows/Linux intr-una virtuala live. Si Hyper-v se lauda cu asa ceva, dar stie numai OS-uri M$. Interfata grafica in schimb (asa cum era de asteptat) e mult mai ergonomica la Hyper-v.

Sa ajung si la titlul postului: la sfarsitul prezentarii a avut loc o tombola unde se puteau castiga un htc HD2, un LG cu touchscreen si WinMobile 6.5, un HDD de 2TB, traininguri micrsoft, carti, etc. In timp ce erau prezentate telefoanele, i-am zis colegului Luci ca eu nu vreau LG-ul, numai htc-ul imi place. El a raspuns ca s-ar multumi si cu un LG. La tragerea la sorti, eu am castigat htc-ul, iar el LG-ul…

Cateva din caracteristicile telefonului:

• Procesor la 1GHz (!)
• Ecran 4.3″
• 3G, EDGE, etc…
• Camera 5Mpix
• Accelerometru
• Receptor GPS
• Internet sharing prin USB, Bluetooth si WiFi (are incorporat un WiFi router)

P.S. – in rRomania o sa se vanda doar de saptamana viitoare

First, reboot the machine. When it starts choose the normal boot menu from the list, and in the Boot options type:

init=/bin/bash

It will start in a privileged mode, where you can change the password:

(none):/> passwd
Changing password for root.
New Password:
Reenter New Password:
Password changed.
(none):/>

Presto, you’re done!

ip nat inside source static tcp 192.168.1.10 80 212.3.4.5 80 route-map nonat extendable

If you have two or more webservers, you need to assign different port numbers to each port forwarding. It’s good practice to assign a port other than 80 there is no express need for using implicit ports.

ip nat inside source static tcp 192.168.1.10 80 212.3.4.5 1880 route-map nonat extendable
ip nat inside source static tcp 192.168.1.11 80 212.3.4.5 2880 route-map nonat extendable

I the above case, you will access the 192.168.1.10 serer by pointing your browser at http://212.3.4.5:1880 and the 192.168.1.11 by pointing your browser at http://212.3.4.5:2880

The next step is to create a rule to permit access to your server(s). I prefer using a Zone-based Firewall, so my acl-s have sugestive names. I will create an acl that permits access from the intrenet (outside) to the server from the intranet (inside):

ip access-list extended internet-to-intranet-acl
permit ip any host 192.168.1.10 eq 80

The above acl can be translated as: permit access using IP protocol from any source to host 192.168.1.10 on port 80.

The steps are:

1. Define class-maps that describe the traffic that you want to permit between zones
2. Configure policy-maps to inspect traffic on the class-maps you just defined
3. Configure the clients and servers zones and assign router interfaces to their respective zones
4. Configure the zone-pair and apply the appropriate policy-map
5. Configure access-lists for strengthening the firewall

Note: This is a basic firewall setup. It is for demonstration purposes only, you should build a stronger one!

1. Defining class maps. From the intranet to the internet and vice versa we will allow all traffic types, and impose rules using acl-s.

class-map type inspect match-any intranet-internet-traffic
 match protocol tcp
 match protocol udp
 match protocol icmp
class-map type inspect match-any internet-intranet-traffic
 match protocol tcp
 match protocol udp
 match protocol icmp

We’ll allow SSH, FTP, POP3, IMAP and HTTP from the intranet to the DMZ and no access from DMZ to the intranet:

class-map type inspect match-any intranet-dmz-traffic
match protocol icmp
match protocol ssh
match protocol ftp
match protocol pop3
match protocol imap
match protocol http

The DMZ will be accessed from the internet only using FTP, HTTP, HTTPS, IMPAS, POP3S. From the DMZ to the internet we’ll allow all traffic.

class-map type inspect match-any internet-dmz-traffic
 match protocol ftp
 match protocol pop3s
 match protocol imaps
 match protocol http
 match protocol https
class-map type inspect match-any dmz-internet-traffic
 match protocol icmp
 match protocol tcp
 match protocol udp

2. Configuring policy maps: we will need as many policy-maps as class-maps:

policy-map type inspect internet-to-intranet-policy
 class type inspect internet-intranet-traffic
  inspect
 class class-default
  drop
policy-map type inspect intranet-to-internet-policy
 class type inspect intranet-internet-traffic
  inspect
 class class-default
  drop
policy-map type inspect intranet-to-dmz-policy
 class type inspect intranet-dmz-traffic
  inspect
 class class-default
  drop
policy-map type inspect dmz-to-internet-policy
 class type inspect dmz-internet-traffic
  inspect
 class class-default
  drop
policy-map type inspect internet-to-dmz-policy
 class type inspect internet-dmz-traffic
  inspect
 class class-default
  drop

3. Configuring zone names and assigning them to interfaces:

zone security internet
zone security intranet
zone security dmz
interface FastEthernet0
 zone-member security internet
interface FastEthernet1
 zone-member security dmz
interface FastEthernet2
 zone-member security intranet

4. Configuring zone pairs to permit traffic between zones:

zone-pair security intranet-internet source intranet destination internet
 service-policy type inspect intranet-to-internet-policy
zone-pair security internet-intranet source internet destination intranet
 service-policy type inspect internet-to-intranet-policy
zone-pair security intranet-dmz source intranet destination dmz
 service-policy type inspect intranet-to-dmz-policy
zone-pair security internet-dmz source internet destination dmz
 service-policy type inspect internet-to-dmz-policy
zone-pair security dmz-internet source dmz destination internet
 service-policy type inspect dmz-to-internet-policy

5. Configuring access lists: For now we don’t want to allow any connections from the internet to the intranet, so we will use a rule that allows only icmp messages. This rule will be matched in the internet-intranet class map.

ip access-list extended internet-to-intranet-alc
 allow icmp any 192.168.1.0 0.0.0.255
 deny ip any any
class-map type inspect match-any internet-intranet-traffic
 match access-group name internet-to-intranet-acl

Note that the mask is written in reverse, so the mask in the acl is actually 255.255.255.0

De la Paul.