# Caleb Sargeant's Docs

> Technical how-to guides, runbooks and study notes on networking, cloud, Linux and automation.

Canonical documentation for Caleb Sargeant's Docs, served at https://docs.calebsargeant.com/.
The full text of every page below is at `llms-full.txt`.

## Docs

- [Ansible](https://docs.calebsargeant.com/computing/ansible/): View my Ansible GitHub Repo
- [Module Examples](https://docs.calebsargeant.com/computing/ansible/module-examples/)
- [Bamboo](https://docs.calebsargeant.com/computing/bamboo/)
- [AWS](https://docs.calebsargeant.com/computing/cloud/aws/): CLF-C01
- [Azure](https://docs.calebsargeant.com/computing/cloud/azure/): - Create Storage Account - Deploy template
- [Cloudflare](https://docs.calebsargeant.com/computing/cloud/cloudflare/): Some stuff about Cloudflare
- [DigiCert](https://docs.calebsargeant.com/computing/cloud/digicert/): IP Restrictions are enabled in the DigiCert control panel under Settings \> IP Restrictions. We cannot define the IP Addresses to restrict to until we have enabled this option.
- [Duo](https://docs.calebsargeant.com/computing/cloud/duo/): Stuff about Duo & administration thereof
- [Cloud](https://docs.calebsargeant.com/computing/cloud/)
- [Openstack](https://docs.calebsargeant.com/computing/cloud/openstack/): Download the OpenStack RC File from the GUI:
- [DNS](https://docs.calebsargeant.com/computing/dns/)
- [Docker Compose](https://docs.calebsargeant.com/computing/docker/compose/): - Why: configure relationships between containes
- [Container Images](https://docs.calebsargeant.com/computing/docker/container-images/): - App binaries and dependencies - Metadata about the image and how to run the image - Official definition: "An image is an ordered collection of root filesystem changes and the corresponding execution parameters for use within a container runtime" - Not a complete OS. No kernal, kernal modules (e.g. drivers) - Small…
- [Container Lifetime & Persistent Data](https://docs.calebsargeant.com/computing/docker/container-lifetime/): - Containers are usually immuitable and ephemeral - "immutable infrastructure": Only re-deploy containers, never change - This is the ideal scenario, but what about databases or unique data? - DOcker gives us features to ensure these "seperation of concerns" - This is known as persistent data - Two ways: Volumes and…
- [Container Registries](https://docs.calebsargeant.com/computing/docker/container-registries/): - An image registry needs to be part of your container plan - More Docker Hub details including auto-build - How Docker Store (store.docker.com) is different than Hub - How Docker Cloud (cloud.docker.com) is different than Hub - Use new Swarms feature in CLoud to connect to Mac/Win Swarm - Install and use Docker…
- [Creating and Using Containers](https://docs.calebsargeant.com/computing/docker/creating-and-using-containers/): - command: docker version
- [General](https://docs.calebsargeant.com/computing/docker/general/): A docker image is like a template. A docker container is a running instance of the template. Each micro-service, or application, is placed in their own container.
- [Docker](https://docs.calebsargeant.com/computing/docker/)
- [Swarm](https://docs.calebsargeant.com/computing/docker/swarm/): - How do we automate container lifecycle? - How can we easily scale out/in/up/down? - How can we ensure our containers are recreated if they fail? - How can we replace containers without downtime (blue/green deploy)? - How can we control/track where containers get started? - How can we create cross-node virtual…
- [Getting Started](https://docs.calebsargeant.com/computing/elk-stack/getting-started/)
- [ELK Stack](https://docs.calebsargeant.com/computing/elk-stack/)
- [Automating Jobs Configured with Code](https://docs.calebsargeant.com/computing/jenkins/getting-started/automating-jobs-configured-with-code/): Pipeline config to clone repo
- [Building Applications with Freestyle Jobs](https://docs.calebsargeant.com/computing/jenkins/getting-started/building-applications-with-freestyle-jobs/): - Git repo - Compile - Test - Package - Clean - rinse & repeat
- [Colocating Jobs and Source Code with Jenkinsfile](https://docs.calebsargeant.com/computing/jenkins/getting-started/colocating-jobs-and-source-code-with-jenkinsfile/): View the Pipeline Syntax documentation online:
- [Getting Started](https://docs.calebsargeant.com/computing/jenkins/getting-started/)
- [Setting up Jenkins](https://docs.calebsargeant.com/computing/jenkins/getting-started/setting-up-jenkins/)
- [Jenkins](https://docs.calebsargeant.com/computing/jenkins/)
- [Plugins](https://docs.calebsargeant.com/computing/jenkins/plugins/)
- [Installing and Using Plugins](https://docs.calebsargeant.com/computing/jenkins/plugins/installing-and-using-plugins/)
- [Managing and Upgrading Plugins](https://docs.calebsargeant.com/computing/jenkins/plugins/managing-and-upgrading-plugins/)
- [Understanding Jenkins and the Plugin Model](https://docs.calebsargeant.com/computing/jenkins/plugins/understanding-jenkins-and-the-plugin-model/)
- [Writing Custom Plugins](https://docs.calebsargeant.com/computing/jenkins/plugins/writing-custom-plugins/)
- [Certified Kubernetes Administrator (CKA)](https://docs.calebsargeant.com/computing/kubernetes/cka/): Core Concepts 1
- [Moving to Declarative YAML](https://docs.calebsargeant.com/computing/kubernetes/declarative-yaml/): - Remember the three management approaches? - Let's skip to full Declarative objects - kubectl apply -f filename.yml - Why skip kubectl create, kubectl replace, kubectl edit? - What I recommend is not equal to all thats possible
- [Exposing Kubernetes Ports](https://docs.calebsargeant.com/computing/kubernetes/exposing-ports/): - kubectl expose creates a service for existing pods
- [General](https://docs.calebsargeant.com/computing/kubernetes/general/): A Kubernetes deployment is a tier/micro-service of an application. The deployment isn't a container. A Kubernetes pod is an atomic unit of work and everything it takes to run a deployment. It could be one or more containers per pod.
- [Kubernetes](https://docs.calebsargeant.com/computing/kubernetes/)
- [Kubernetes Install](https://docs.calebsargeant.com/computing/kubernetes/install/): - Kubernetes: the whole orchestration system
- [Kubernetes Management Techniques](https://docs.calebsargeant.com/computing/kubernetes/management-techniques/): - These commands use helper templates called "generators"
- [Future of Kubernetes](https://docs.calebsargeant.com/computing/kubernetes/next-steps/): - Storage and stateful workloads are harder in all sytems
- [Databases](https://docs.calebsargeant.com/computing/linux/databases/): The file must be in .sql format. It can not be compressed in a .zip or .tar.gz file.
- [General](https://docs.calebsargeant.com/computing/linux/general/): General, random and useful Linux-related config and things.
- [Linux](https://docs.calebsargeant.com/computing/linux/)
- [IPTables](https://docs.calebsargeant.com/computing/linux/iptables/): :~:text=To%20add%20a%20comment%20to,rule%20in%20the%20INPUT%20chain.&text=We%20can%20verify%20that%20the,running%20the%20following%20iptables%20command.
- [KVM](https://docs.calebsargeant.com/computing/linux/kvm/): Okay then a couple of things:
- [Monitoring](https://docs.calebsargeant.com/computing/linux/monitoring/): Configuring Slack
- [Nagios](https://docs.calebsargeant.com/computing/linux/nagios/): Example config file (the last service is a custom service check example):
- [Networking](https://docs.calebsargeant.com/computing/linux/networking/): Create
- [OpenVPN](https://docs.calebsargeant.com/computing/linux/openvpn/)
- [Prometheus](https://docs.calebsargeant.com/computing/linux/prometheus/)
- [Raspberry Pi](https://docs.calebsargeant.com/computing/linux/raspberry/): All Raspberry Pi-related stuff.
- [Storage](https://docs.calebsargeant.com/computing/linux/storage/): You start up CentOS and it wants to do a File System check. You do the check, reboot and it happens again. Try the following:
- [Training](https://docs.calebsargeant.com/computing/linux/training/): Syllabus
- [UFW](https://docs.calebsargeant.com/computing/linux/ufw/)
- [Backups](https://docs.calebsargeant.com/computing/microsoft/backups/)
- [Administration](https://docs.calebsargeant.com/computing/microsoft/exchange/administration/): Gives a secondary email address to the user
- [Compliance Management](https://docs.calebsargeant.com/computing/microsoft/exchange/compliance-management/): Is very important in most exchange environments. Ensuring your organisation is in sync with legal requirements with regard to eDiscovery and other key aspects to compliance is a must for Exchange administrators.
- [Configuration](https://docs.calebsargeant.com/computing/microsoft/exchange/configuration/): A glob of installation and configuration images.
- [Dynamic Access Control](https://docs.calebsargeant.com/computing/microsoft/exchange/dynamic-access-control/): Prepare the Dynamic Access Control Deployment Based on the Security and Business Requirements Prepare ADDS to support Dynamic Access Control
- [Exchange](https://docs.calebsargeant.com/computing/microsoft/exchange/)
- [General](https://docs.calebsargeant.com/computing/microsoft/general/): Check which DC authenticated with: echo %logonserver%
- [Group Policy](https://docs.calebsargeant.com/computing/microsoft/group-policy/): 1. Download BgInfo from here. 2. Do the following in Group Policy Management:
- [Hyper-V](https://docs.calebsargeant.com/computing/microsoft/hyperv/): A very duh thing to add, but anyway:
- [Microsoft](https://docs.calebsargeant.com/computing/microsoft/)
- [PowerShell](https://docs.calebsargeant.com/computing/microsoft/powershell/): Save the PSCredential in a file:
- [Robocopy](https://docs.calebsargeant.com/computing/microsoft/robocopy/)
- [Sendkeys](https://docs.calebsargeant.com/computing/microsoft/sendkeys/): Most keys can be represented by the character of the key itself. E.g, the key sequence FRED can be represented simply by "FRED". Some special keys, such as the control keys, function keys etc are encoded in a string enclosed by See the table below
- [Configuration](https://docs.calebsargeant.com/computing/microsoft/server/configuration/): A glob of installation and configuration images.
- [Server](https://docs.calebsargeant.com/computing/microsoft/server/)
- [Terminal Services](https://docs.calebsargeant.com/computing/microsoft/server/terminal-services/): )
- [Configuration](https://docs.calebsargeant.com/computing/microsoft/sharepoint/configuration/): A glob of installation and configuration images.
- [SharePoint](https://docs.calebsargeant.com/computing/microsoft/sharepoint/)
- [Configuration](https://docs.calebsargeant.com/computing/microsoft/sql-server/configuration/): A glob of installation and configuration images.
- [SQL Server](https://docs.calebsargeant.com/computing/microsoft/sql-server/)
- [Unattended Installations](https://docs.calebsargeant.com/computing/microsoft/unattended/): Brief Instructions on how to create a Windows unattended disk that allow you to:
- [Gaining Access](https://docs.calebsargeant.com/computing/pentesting/gaining-access/): Two main approaches
- [Pentesting](https://docs.calebsargeant.com/computing/pentesting/)
- [Network Hacking](https://docs.calebsargeant.com/computing/pentesting/network-hacking/): 1. Pre-connection attacks 2. gaining access 3. Post-connection attacks
- [Post Exploitation](https://docs.calebsargeant.com/computing/pentesting/post-exploitation/): - help - shows help - background - backgrounds current session - sessions -l - list all sessions - sessions -i - interact with a certain session - sysinfo - display system info - ipconfig - displays infor about interfaces - getuid - shows current user
- [Website Hacking](https://docs.calebsargeant.com/computing/pentesting/website-hacking/): - IP Address - Domain name info - Technologies used - Other websites on the same server - DNS records - Unlisted files, sub-domains, directories
- [Adding a New Provider to Your Configuration](https://docs.calebsargeant.com/computing/terraform/getting-started/adding-a-new-provider-to-configuration/): - Built-in to Terraform - Func_name(arg1, arg2, arg3, ...) - Test in terrafrom console - Several broad categories
- [Configuring a Resource After Creation](https://docs.calebsargeant.com/computing/terraform/getting-started/configuring-a-resource-after-creation/): - HashiCorp configuration language - Why not JSON? - Human readable and editable - Configuration syntax and expressions - Conditionals, functions, templates
- [Deploying Your First Terraform Configuration](https://docs.calebsargeant.com/computing/terraform/getting-started/first-terraform-configuration/): - Terraform executable - Terraform files - Terraform plugins - Terraform state
- [Getting Started](https://docs.calebsargeant.com/computing/terraform/getting-started/)
- [Infrastructure as a Code](https://docs.calebsargeant.com/computing/terraform/getting-started/infrastructure-as-a-code/): Provisioning infrastructure through software to achieve consistent and predictable environments
- [Updating Your Configuration with More Resources](https://docs.calebsargeant.com/computing/terraform/getting-started/updating-configuration-with-more-resources/): - JSON format (Do not touch!) - Resource mappings and metadata - Locking - Location - Local - Remote: AWS, Azure, NFS, Terraform Cloud - Workspaces
- [Using a Module for Common Configurations](https://docs.calebsargeant.com/computing/terraform/getting-started/using-a-module-for-common-configurations/): - Code reuse - Remote or local source - Terraform Registry - Root module - Versioning - Provider inheritance - Multiple instances (no count)
- [Using Functions and Variables](https://docs.calebsargeant.com/computing/terraform/getting-started/using-functions-and-variables/): - Name, type, default - Multiple sources - File, environment variable, var option - Overriding variables and precedence - Environment, file, command line - Select values based on environment - Split Terraform configuration file
- [Terraform](https://docs.calebsargeant.com/computing/terraform/)
- [Caleb Sargeant's Docs](https://docs.calebsargeant.com/): Technical how-to guides, runbooks, study notes and the things worth writing down once so they need not be worked out twice. Networking, cloud, Linux, containers and the automation that holds them together.
- [ACI](https://docs.calebsargeant.com/networking/cisco/aci/): - ACI is used in the Datacentre space. - It is used to configure, manage, and operate AIO packaged SDN datacentre, integration into kubernetes, load balancing, security, etc. - One could use Open Daylight with Nexus, etc., which is a smaller, more self-defined, self-crated SDN, using NXAPI, programmable…
- [ASA](https://docs.calebsargeant.com/networking/cisco/asa/): Adaptive Security Appliance
- [ASAv](https://docs.calebsargeant.com/networking/cisco/asav/): - Launching through the AWS Marketplace does not allow you to input the Day 0 Configuration, which means you will not be able to contact the device. Ensure that you create the ASAv via EC2 \> Launch Instance. - Also note that if you want to test the difference between BYOL and standard, whichever you subscribe to last…
- [Comparing WSA and Cisco Umbrella](https://docs.calebsargeant.com/networking/cisco/core-security/content-security-with-cisco-wsa-and-cisco-umbrella/1.-comparing-wsa-and-cisco-umbrella/): Both are designed to protect against threats that occur through web traffic
- [Deploying the Web Security Appliance](https://docs.calebsargeant.com/networking/cisco/core-security/content-security-with-cisco-wsa-and-cisco-umbrella/2.-deploying-the-web-security-appliance/): - Endpoint explicitly configured to use WSA - Can use PAC file to configure machine
- [Configuring the WSA as a Secure Internet Gateway](https://docs.calebsargeant.com/networking/cisco/core-security/content-security-with-cisco-wsa-and-cisco-umbrella/3.-configuring-the-wsa-as-a-secure-internet-gateway/): - Restrict URL categories - Restrict Google Maps application - Look at file types we can block - Configure antimalware settings
- [Configuring Traffic Redirection on the WSA](https://docs.calebsargeant.com/networking/cisco/core-security/content-security-with-cisco-wsa-and-cisco-umbrella/4.-configuring-traffic-redirection-on-the-wsa/): - Version 1 - HTTP only - Version 2 - HTTPs, FTP, Encryption - Service Group 0 - Web-Cache - Service Group 70 - HTTPs - Service Groups 90-97 - User Defined - Service Group 99 - Reverse Proxy
- [Deploying Cisco Umbrella](https://docs.calebsargeant.com/networking/cisco/core-security/content-security-with-cisco-wsa-and-cisco-umbrella/5.-deploying-cisco-umbrella/): - Umbrella virtual machine forwarder - DHCP - Add public IPs to Umbrella - Add internal networks to Umbrella
- [Content Security with Cisco WSA & Cisco Umbrella](https://docs.calebsargeant.com/networking/cisco/core-security/content-security-with-cisco-wsa-and-cisco-umbrella/)
- [Comparing Cryptography Components](https://docs.calebsargeant.com/networking/cisco/core-security/describing-and-configuring-vpns/1.-comparing-cryptography-components/): - Confidentiality - Integrity - Non-repudiation - Authentication
- [Comparing Cisco VPN Types](https://docs.calebsargeant.com/networking/cisco/core-security/describing-and-configuring-vpns/2.-comparing-cisco-vpn-types/): Configuring IPSec on Cisco IOS
- [Configuring DMVPN](https://docs.calebsargeant.com/networking/cisco/core-security/describing-and-configuring-vpns/3.-configuring-dmvpn/): - Configure interface tunnel 100 on HQ router - Configure spokes
- [Configuring FlexVPN](https://docs.calebsargeant.com/networking/cisco/core-security/describing-and-configuring-vpns/4.-configuring-flexvpn/): - Configurations sent during VPN setup - FlexVPN can take full advantage of Authorization Policies - IP Addresses - Server Settings - Static Routes
- [Configuring Cisco AnyConnect on the ASA](https://docs.calebsargeant.com/networking/cisco/core-security/describing-and-configuring-vpns/5.-configuring-cisco-anyconnect-on-the-asa/): - VPN Connection Profile - User Profile Policy - Dynamic Access Policy - Group Policy
- [Configuring Cisco AnyConnect on the FTD](https://docs.calebsargeant.com/networking/cisco/core-security/describing-and-configuring-vpns/6.-configuring-cisco-anyconnect-on-the-ftd/)
- [Describing and Configuring VPNs](https://docs.calebsargeant.com/networking/cisco/core-security/describing-and-configuring-vpns/)
- [Deploying the ESA and Placing It in the Email Path](https://docs.calebsargeant.com/networking/cisco/core-security/email-security-with-cisco-esa/1.-deploying-the-esa-and-placing-it-in-the-email-path/): - Placing the ESA in the Email Path - The MX record for Globomantics needs to be updated to point to the ESA’s public facing IP - Configured on-premises - Physical - Virtual - Configured in the cloud (CES) - Built using AsyncOS - Designed to block: - Malicious content - SPAM
- [Configuring the ESA to Accept Email](https://docs.calebsargeant.com/networking/cisco/core-security/email-security-with-cisco-esa/2.-configuring-the-esa-to-accept-email/): Listeners listen on the specified SMTP port for SMTP traffic
- [Configuring the Default Incoming Mail Policy](https://docs.calebsargeant.com/networking/cisco/core-security/email-security-with-cisco-esa/3.-configuring-the-default-incoming-mail-policy/): - Most spam doesn’t make it past HAT - Legit email could be black listed - Would need to create a separate policy - Two engines - Scores between 1 and 100 - Positively identified spam, suspected spam, not spam
- [Configuring the Default Outgoing Mail Policy and Verifying](https://docs.calebsargeant.com/networking/cisco/core-security/email-security-with-cisco-esa/4.-configuring-the-default-outgoing-mail-policy-and-verifying/): - Unauthorized sensitive data doesn’t leave the network - IP, personal info, financial statements - Both malicious and unintentional - Scans outbound emails - Pre-built regular expressions and keywords - Looks at contents of email - Supporting info and proximity - Scores between and 100 - Severity level - Action
- [Email Security with Cisco ESA](https://docs.calebsargeant.com/networking/cisco/core-security/email-security-with-cisco-esa/)
- [Explaining Security Concepts to Protect Endpoints](https://docs.calebsargeant.com/networking/cisco/core-security/endpoint-protection-and-detection-with-cisco-amp/1.-explaining-security-concepts-to-protect-endpoints/): - Defense in-depth - Endpoints contain sensitive information - They now leave the protected network infrastructure
- [Assessing Endpoint Posture and Managing Device Inventory](https://docs.calebsargeant.com/networking/cisco/core-security/endpoint-protection-and-detection-with-cisco-amp/2.-assessing-endpoint-posture-and-managing-device-inventory/): - Malware takes advantage of vulnerabilities - Companies issue patches - Organizations want to know the posture of their devices - Posture assessment solutions automate this process
- [Using Multi-Factor Authentication](https://docs.calebsargeant.com/networking/cisco/core-security/endpoint-protection-and-detection-with-cisco-amp/3.-using-multi-factor-authentication/): Strong passwords are essential for security, but they have their limitations.
- [Configuring Malware Protection and Outbreak Controls](https://docs.calebsargeant.com/networking/cisco/core-security/endpoint-protection-and-detection-with-cisco-amp/4.-configuring-malware-protection-and-outbreak-controls/)
- [Endpoint Protection and Detection with Cisco AMP](https://docs.calebsargeant.com/networking/cisco/core-security/endpoint-protection-and-detection-with-cisco-amp/)
- [CIA](https://docs.calebsargeant.com/networking/cisco/core-security/fundamentals-from-the-book/cia/): All three components in the triad are equally important.
- [Cloud Security Threats](https://docs.calebsargeant.com/networking/cisco/core-security/fundamentals-from-the-book/cloud/): NIST Special Publication 800-145 compares different cloud services and deployment strategies.
- [Defining Threats, Vulnerabilities, & Exploits](https://docs.calebsargeant.com/networking/cisco/core-security/fundamentals-from-the-book/definitions/): A threat is any potential danger to an asset. A threat vector/agent is the path used by the entity (person, device, etc.) to perform the attack.
- [Digital Forensics and Incident Response](https://docs.calebsargeant.com/networking/cisco/core-security/fundamentals-from-the-book/forensics/): - Many, many more diverse cybersecurity-related incidences have come about nowadays. - Disruptive & Damaging, can take down a whole company. - Must respond quickly to minimise harm & uphold laws.
- [Fundamentals from the Book](https://docs.calebsargeant.com/networking/cisco/core-security/fundamentals-from-the-book/)
- [Introduction to Cybersecurity](https://docs.calebsargeant.com/networking/cisco/core-security/fundamentals-from-the-book/introduction/): Information security programs and policies are designed to protect the confidentiality, integrity, and availability of data within an organisation. Organisations are rarely self-contained, and the price of connectivity is exposure to attack. Every organisation is a potential target.
- [IoT Security Threats](https://docs.calebsargeant.com/networking/cisco/core-security/fundamentals-from-the-book/iot/): - IoT is any computer device (mechanical & digital) that transfers data in network without requiring human-to-human or human-to-computer interaction. Sensors, home appliances, cameras, wearables, etc. are examples of IoT devices. - Fog computing is the processing of data and events from IoT devices as close to source…
- [Common Software and Hardware Vulnerabilities](https://docs.calebsargeant.com/networking/cisco/core-security/fundamentals-from-the-book/vulnerabilities/): Check the National Vulnerability Database .
- [Core Security](https://docs.calebsargeant.com/networking/cisco/core-security/)
- [Comparing Networking Security Solutions & Deployment Models](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-fundamentals/01.-comparing-networking-security-solutions-and-deployment-models/): Cisco SAFE (Security Architecture for the Enterprise)
- [Describing Components, Capabilities, & Benefits of NetFlow](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-fundamentals/02.-describing-components-capabilities-and-benefits-of-netflow/): - Information about the packets that traverse a router - Source and destination, ports, and the protocol being used
- [Securing the Management Plane](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-fundamentals/03.-securing-the-management-plane/): - One of the most important things to consider - Configurations to secure device be undone if anyone has access to device - Boot into ROMmon - Could just as easily power off device - Cut cables
- [Securing the Control Plane and Data Plane on Cisco Routers](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-fundamentals/04.-securing-the-control-plane-and-data-plane-on-cisco-routers/): Lab topology
- [Securing the Control Plane and Data Plane on Cisco Switches](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-fundamentals/05.-securing-the-control-plane-and-data-plane-on-cisco-switches/): - Frames to not contain a TTL - Switches will broadcast frames they don’t know the destination to - Can cause the original frame to be recreated millions of times
- [Configuring Wireless LAN Controller Device Hardening Methods](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-fundamentals/06.-configuring-wireless-lan-controller-device-hardening-methods/): - Malicious attacker doesn’t need physical access to cable - Can listen if they are within distance of wireless signal - Additional security measures are needed
- [Network Security Fundamentals](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-fundamentals/)
- [Securely Managing Cisco ASA Devices](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-asa/1.-securely-managing-cisco-asa-devices/): - Network dedicated for the management of network devices - Access in/out of network restricted by ACLs - Define which traffic will need to leave network - Some management networks will be completely self contained - Size of management network determined by size of the organization
- [Configuring AAA on a Cisco ASA For Use with Cisco ISE](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-asa/2.-configuring-aaa-on-a-cisco-asa-for-use-with-cisco-ise/): Enable TACACS+
- [Configuring Management Protocols on a Cisco ASA](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-asa/3.-configuring-management-protocols-on-a-cisco-asa/): - SNMP Users - Defines credentials and algorithms - SNMP Groups - Associates with SNMP Users with SNMP mode - SNMP Host - Defines the SNMP hosts that can access the ASA
- [Managing Cisco ASAs with Cisco Security Manager](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-asa/4.-managing-cisco-asas-with-cisco-security-manager/)
- [Network Security with Cisco ASA](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-asa/)
- [Securely Managing Cisco Firepower Devices](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-firepower/1.-securely-managing-cisco-firepower-devices/): - Network dedicated for the management of network devices - Access in/out of network restricted by ACLs - Define which traffic will need to leave network - Some management networks will be completely self contained - Size of management network determined by - size of the organization
- [Configuring AAA on an FTD Appliance for Use with Cisco ISE](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-firepower/2.-configuring-aaa-on-an-ftd-appliance-for-use-with-cisco-ise/): Leverage AD security groups
- [Configuring Management Protocols on a Cisco Firepower](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-firepower/3.-configuring-management-protocols-on-a-cisco-firepower/): Add a Syslog Server
- [Managing Multiple Firepowers with Cisco Firepower Management Center](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-firepower/4.-managing-multiple-firepowers-with-cisco-firepower-management-center/): sudo configure-network
- [Network Security with Cisco Firepower](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-firepower/)
- [Securely Managing Cisco IOS Devices](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-ios/1.-securely-managing-cisco-ios-devices/): - Network dedicated for the management of network devices - Access in/out of network restricted by ACLas - Define which traffic will need to leave network - Some management networks will be completely self contained - Size of management network determined by size of the organization
- [Configuring AAA on Cisco IOS Device for Use with Cisco ISE](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-ios/2.-configuring-aaa-on-cisco-ios-device-for-use-with-cisco-ise/): Enable TACACS+
- [Configuring Management Protocols on a Cisco IOS Device](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-ios/3.-configuring-management-protocols-on-a-cisco-ios-device/): - SNMP Users - Defines credentials and algorithms - SNMP Groups - Associates with SNMP Users with SNMP Views - SNMP Views - Defines the information that the SNMP user can access - All information is stored in the Management Information Base (MIB) - Object Identifiers (OID) correspond to specific information about a…
- [Managing Cisco IOS Devices with Cisco Prime Infrastructure](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-ios/4.-managing-cisco-ios-devices-with-cisco-prime-infrastructure/): Add a profile
- [Network Security with Cisco IOS](https://docs.calebsargeant.com/networking/cisco/core-security/network-security-with-cisco-ios/)
- [Describing Identity Management, CoA, and Device Compliance](https://docs.calebsargeant.com/networking/cisco/core-security/secure-network-access-using-cisco-ise/1.-describing-identity-management-coa-and-device-compliance/): - 802.1X allows for layer 2 network access control to be centrally managed.
- [Configuring Cisco ISE for 802.1X](https://docs.calebsargeant.com/networking/cisco/core-security/secure-network-access-using-cisco-ise/2.-configuring-cisco-ise-for-802.1x/): - Contain authentication and authorization policies - If-then statements
- [Configuring Cisco IOS for 802.1X and MAB](https://docs.calebsargeant.com/networking/cisco/core-security/secure-network-access-using-cisco-ise/3.-configuring-cisco-ios-for-802.1x-and-mab/): Multi-host All devices are allowed as long as the 1st MAC address Authenticated
- [Secure Network Access Using Cisco ISE](https://docs.calebsargeant.com/networking/cisco/core-security/secure-network-access-using-cisco-ise/)
- [Explaining Exfiltration Techniques](https://docs.calebsargeant.com/networking/cisco/core-security/secure-network-access-visibility-and-enforcement/1.-explaining-exfiltration-techniques/): - DNS resolves hostnames to IP addresses - Usually uses port 53 - Infect a computer - Resolve DNS for attacker’s website - Local DNS server will forward DNS queries to attacker’s DNS - DNS Queries contain sensitive data - Smaller queries in order to transport large amounts of data - Attacker now has the compromised…
- [Describing the Benefits of Network Telemetry](https://docs.calebsargeant.com/networking/cisco/core-security/secure-network-access-visibility-and-enforcement/2.-describing-the-benefits-of-network-telemetry/): The technologies that are used in order to collection information from devices and then consume that information.
- [Benefitting from Additional Cisco Security Products](https://docs.calebsargeant.com/networking/cisco/core-security/secure-network-access-visibility-and-enforcement/3.-benefitting-from-additional-cisco-security-products/): - Stealthwatch Management Console - Stealthwatch Flow Collector - Flows Per Second License - Stealthwatch Flow Sensor - UDP Director
- [Implementing Cisco Application Visibility and Control (AVC)](https://docs.calebsargeant.com/networking/cisco/core-security/secure-network-access-visibility-and-enforcement/4.-implementing-cisco-application-visibility-and-control-avc/): - Traditional networks focus on controlling traffic between layers 2-4 - QoS also relied on layers 2-4
- [Secure Network Access, Visibility, and Enforcement](https://docs.calebsargeant.com/networking/cisco/core-security/secure-network-access-visibility-and-enforcement/)
- [Comparing Common Vulnerabilities](https://docs.calebsargeant.com/networking/cisco/core-security/security-concepts/01.-comparing-common-vulnerabilities/): An attacker can write over data and can also obtain unauthorised data.
- [Explaining Common Threats & Protecting Humans from Attacks](https://docs.calebsargeant.com/networking/cisco/core-security/security-concepts/02.-explaining-common-threats-and-protecting-humans-from-attacks/): - Viruses - Trojans - Worms - Rootkits - Spyware - Adware - PUP
- [Describing Security Intelligence](https://docs.calebsargeant.com/networking/cisco/core-security/security-concepts/03.-describing-security-intelligence/): - Not a “set it and forget it” solution - Cant just sit back and monitor - Too many devices to manually update - A large amount of surface areas
- [Explaining and Interpreting APIs](https://docs.calebsargeant.com/networking/cisco/core-security/security-concepts/04.-explaining-and-interpreting-apis/): - HTTP GET (show data) - HTTP POST (create data) - HTTP PUT (modify data) - HTTP Delete (delete data)
- [Security Concepts](https://docs.calebsargeant.com/networking/cisco/core-security/security-concepts/)
- [Year 2020](https://docs.calebsargeant.com/networking/cisco/devnetday/2020/): DevNet Day 2020
- [DevNet Day](https://docs.calebsargeant.com/networking/cisco/devnetday/)
- [DNA](https://docs.calebsargeant.com/networking/cisco/dna/): - DNA is used in the Enterprise space. - APIC YEM is the old DNA Centre. - It can be defined as a campus, WAN, access, wireless (enterprise) SDN / SD WAN network controller - Makes it easier for network engineers to get done what they need to, to focus on more important things. - You can create a global logical…
- [General](https://docs.calebsargeant.com/networking/cisco/general/)
- [Genie](https://docs.calebsargeant.com/networking/cisco/genie/): Automatically parses device configuration into yaml, json, etc. to be used with python, for example.
- [Cisco](https://docs.calebsargeant.com/networking/cisco/)
- [ISE](https://docs.calebsargeant.com/networking/cisco/ise/): Identity Services Engine (ISE)
- [Configuring a Label Switched Network](https://docs.calebsargeant.com/networking/cisco/mpls/configuring-a-label-switched-network/): configure-a-label-switched-network.zip
- [MPLS](https://docs.calebsargeant.com/networking/cisco/mpls/)
- [Introduction to MPLS](https://docs.calebsargeant.com/networking/cisco/mpls/introduction-to-mpls/): - Multi-Protocol Label Switching is a new paradigm in the way routers make forwarding decisions. - Multiprotocol: MPLS is capable of transporting many L2 and L3 protocols - Label Switching: Packets are switched based on labels, not destination IP! - Labels - Ultimately determine the destiny of a packet through an MPLS…
- [MPLS Fundamentals](https://docs.calebsargeant.com/networking/cisco/mpls/mpls-fundamentals/): - LSR uses the FIB to forward unlabeled IP packets - LSR uses the LFIB to forward labeled packets - The FIB and LFIB databases are built by various control plane protocols
- [Nexus](https://docs.calebsargeant.com/networking/cisco/nexus/): - IOSxe (e.g. 3850) for campus. - NXOS (3000 & 9000) for datacentre. - IOS XR (e.g. ASR9000, Network Converging System (NCS)).
- [Implementing Access Control](https://docs.calebsargeant.com/networking/cisco/ngfw-ngips/access-control/): An ACL is a collection of security rules or policies that allows or denies packets after looking at the packet headers and other attributes. Each permit or deny statement in the ACL is referred to as an access control entry (ACE). These ACEs classify packets by inspecting Layer 2 through Layer 7 headers for a number…
- [Advanced Malware Protection (AMP)](https://docs.calebsargeant.com/networking/cisco/ngfw-ngips/amp/)
- [FirePOWER Intrusion Policies](https://docs.calebsargeant.com/networking/cisco/ngfw-ngips/firepower-ips/)
- [High Availability and Clustering](https://docs.calebsargeant.com/networking/cisco/ngfw-ngips/ha-clustering/): - HA (failover) or cluster - Identical FTD devices or identical ASA devices - State link between devices - ASA supports active-active & active-standby. FTD only supports active-standby - Only active passes traffic - Failover and stateful links are dedicated - Stateful link is used to pass connection state information.…
- [NGFW & NGIPS](https://docs.calebsargeant.com/networking/cisco/ngfw-ngips/)
- [Introduction to NGFW & NGIPS](https://docs.calebsargeant.com/networking/cisco/ngfw-ngips/introduction/): - Cisco Next Generation Security - protection throughout the attack continuum. - Advanced Malware Protection (AMP) - discover threats and enforce and harden policies. - Next-Generation IPS (NGIPs), Email Security, Web Security Appliance (WSA) with AMP - detect, block, and defend against attacks that have taken place.…
- [Networking with Firewall Capabilities](https://docs.calebsargeant.com/networking/cisco/ngfw-ngips/networking-with-firewall-capabilities/): - Zone-Based Firewall (ZBFW) is a stateful firewall in Cisco IOS devices is the successor of the Context-Based Access Control (CBAC) IOS firewall. - ZBFW Has features not available in CBAC, ie. assignment of router interfaces into different security zones to control traffic. - ZBFW is cost effective, as it is…
- [Security Intelligence, Security Updates, and Keeping Firepower Software Up to Date](https://docs.calebsargeant.com/networking/cisco/ngfw-ngips/security-intelligence/)
- [NSO](https://docs.calebsargeant.com/networking/cisco/nso/): - Cisco NSO (Network Services Orchestrator) is a network configuration management both at the device and service concept to manage networks. - This product is relevant to all sizes of networks. NSO can discover configuration in network and you can start programming your network from its current state. This is similar…
- [BGP](https://docs.calebsargeant.com/networking/cisco/routing/bgp/): - BGP is technically a distance vector, but most call it a "Path Vector" protocol. - Without tuning, BGP behaves just like RIP!
- [Network Design and Documentation](https://docs.calebsargeant.com/networking/cisco/routing/design-and-documentation/): - Planning as a personality characteristic - Find a template that works for you - CISCO Network Lifecycle (PPDIOO) - Microsoft Project / Excel Template - IT Infrastructure Library (ITIL) - Create the implementation plan - Follow the implementation plan
- [EIGRP](https://docs.calebsargeant.com/networking/cisco/routing/eigrp/): 1. Backup routes (Fast convergence / DUAL) 2. Simple configuration 3. Flexibility in summarization 4. Unequal cost load-balancing 5. combines best of distance vector and link state
- [Routing](https://docs.calebsargeant.com/networking/cisco/routing/)
- [IPv6 Routing](https://docs.calebsargeant.com/networking/cisco/routing/ipv6-routing/): - Yes there IS an IP Address shortage! - USA is still sitting pretty - Asia and Africa received single class C for entire country - Current IP Addresses poorly allocated - Agencies needing class C asked for class B - Estimates of IPv4 exhaustion largely debated (2011 - 2041) - New network devices on the rise - NAT…
- [OSPF](https://docs.calebsargeant.com/networking/cisco/routing/ospf/): - Two types
- [Path Control](https://docs.calebsargeant.com/networking/cisco/routing/path-control/): Policy Routing: The 'Programming Language' of routing tables
- [Redistribution](https://docs.calebsargeant.com/networking/cisco/routing/redistribution/): 1. The politics of networking 2. Conversion between routing protocols 3. Vendor selection 4. Application/business requirements
- [Campus Security](https://docs.calebsargeant.com/networking/cisco/switching/campus-security/): - Prevents many layer 2 attacks - Can use secure MAC Addresses - Dynamic - Static - Sticky - Limits the number of MAC Addresses per port
- [Campus VoIP](https://docs.calebsargeant.com/networking/cisco/switching/campus-voip/): Trackable Cost Savings:
- [Core Concepts and Design](https://docs.calebsargeant.com/networking/cisco/switching/core-concepts-and-design/): - Chance for failure - Broadcast traffic - Multicast issues - Security issues - MAC flooding
- [Etherchannel](https://docs.calebsargeant.com/networking/cisco/switching/etherchannel/): - Port Aggregation Protocol (PAGP) - Cisco Proprietary - Port Modes: Auto, Desirable, On - Link Aggregatrion Control Protocol (LACP) - Industry standard (802.3ad) - Port modes: passive, active, on
- [General](https://docs.calebsargeant.com/networking/cisco/switching/general/): You cannot use LDAP on a Cisco switch (at least not this one):
- [Switching](https://docs.calebsargeant.com/networking/cisco/switching/)
- [L3 Switching](https://docs.calebsargeant.com/networking/cisco/switching/l3-switching/): The Problem:
- [Monitoring](https://docs.calebsargeant.com/networking/cisco/switching/monitoring/): - Your switch can store syslog messages locally - Syslog uses UDP port 514
- [HSRP, VRRP, and GLBP](https://docs.calebsargeant.com/networking/cisco/switching/redundancy-in-the-campus/): - How fast can this happen? - How does the client know? - What about ARP cache issues? - What if just the WAN link fails?
- [STP](https://docs.calebsargeant.com/networking/cisco/switching/stp/): - Switches forward broadcast packets out all ports by design - Redundant connections are necessary in business networks - The place of spanning tree: drop trees on redundant links (until they are needed)
- [The Switch's Domain](https://docs.calebsargeant.com/networking/cisco/switching/the-switches-domain/): - Stops loops caused by unidirection link failures - Example: - A is root bridge - Link between B and C is blocked (at B) - Link between B and C goes unidirectional - B releases the block, one-way loop occurs - Loopguard should be enabled (per-port) on all switch uplinks
- [VLANs](https://docs.calebsargeant.com/networking/cisco/switching/vlans/): - Logically groups users - Segments broadcast domains - Subnet correlation - Access control - Quality of service
- [Wireless LAN](https://docs.calebsargeant.com/networking/cisco/switching/wireless-lan/): - Personal Area Network (PAN) - Local Area Network (LAN) - Metropolitan Area Network (MAN) - Wide Area Network (MAN)
- [VIRL](https://docs.calebsargeant.com/networking/cisco/virl/): GUI client for VIRL: CLI client for VIRL:
- [FortiGate](https://docs.calebsargeant.com/networking/fortigate/): In the below example, we are creating a VPN tunnel from 192.168.122.0/24 to 10.137.0.0/26 and 10.137.5.0/26.
- [HP Procurve](https://docs.calebsargeant.com/networking/hp/): Uptime: show ver Memory: show health CPU: show system processes brief
- [Juniper](https://docs.calebsargeant.com/networking/juniper/): Transform Set
- [Mikrotik](https://docs.calebsargeant.com/networking/mikrotik/): - Disable wireless if not using it - IP \> Services (disable telnet and stuff, only allow certain addresses)
- [NetDevOps Tool Chest](https://docs.calebsargeant.com/networking/netdevops-toolchest/)
- [Ubiquiti UniFi](https://docs.calebsargeant.com/networking/ubiquiti-unifi/): It's a pretty self-explanatory system, but anyway, here's some stuff on it.
- [API](https://docs.calebsargeant.com/other/api/): "Only use the CLI when you must" - use RESTCONF/NETCONF & YANG instead. You can use the API models cross-vendor, where CLI changes.
- [NETCONF](https://docs.calebsargeant.com/other/api/netconf/): NETCONF/YANG are kind of like SNMPv4 (but not really) - it's nextgen style of reading device. MIBs are too crazy to read.
- [Postman](https://docs.calebsargeant.com/other/api/postman/): Postman allows you to send RESTAPI calls to any endpoint and can save them as bookmarks (postman calls them collections).
- [RESTCONF](https://docs.calebsargeant.com/other/api/restconf/): RESTCONF is a RESTAPI protocol for the network and is a standard protocol from the IETF (natural evolution of SNMP & MIBs is where you get NETCONF & YANG from)
- [YANG](https://docs.calebsargeant.com/other/api/yang/): pyang (Python YANG) allows you to process data models in an easier to read format. pyang -f tree will show the output in a tree format.
- [Main Title](https://docs.calebsargeant.com/other/general/_docs/README/): We are doing this and that with this repo
- [Documentation](https://docs.calebsargeant.com/other/general/documentation/): README.md
- [Download Videos](https://docs.calebsargeant.com/other/general/download-videos/)
- [Host Setup](https://docs.calebsargeant.com/other/general/host-setup/): Developer tools in Chrome:
- [General](https://docs.calebsargeant.com/other/general/)
- [Printing](https://docs.calebsargeant.com/other/general/printing/)
- [Reading](https://docs.calebsargeant.com/other/general/reading/): You and Your Research.pdf
- [Hardware Troubleshooting](https://docs.calebsargeant.com/other/general/troubleshooting-hardware/): This is all sourced from and placed in this documentation, as fixingmycomputer may not be online forever, being mostly Windows XP orientated...
- [iPerf3](https://docs.calebsargeant.com/other/iperf/): brew install iperf3 brew install gnuplot brew install jq
- [Bash](https://docs.calebsargeant.com/programming/bash/): Using read
- [Comparison Operators](https://docs.calebsargeant.com/programming/python/bootcamp/comparison-operators/): - We can use logical operators to combine comparisons:
- [Bootcamp](https://docs.calebsargeant.com/programming/python/bootcamp/)
- [Object and Data Structures](https://docs.calebsargeant.com/programming/python/bootcamp/object-and-data-structures/): - Names can’t start with a number - There can be no spaces in the name, use _instead. - Can’t use any of these symbols: :'",<>/?|\()!@#$%^&*~-+ - Best practice (PEP8) that names are lowercase. - Avoid using words that have special meaning in Python like “list” and “str”
- [Statements](https://docs.calebsargeant.com/programming/python/bootcamp/statements/)
- [Scalar Types, Operators, and Control Flow](https://docs.calebsargeant.com/programming/python/core/getting-started/2-scalar-types-operators-and-control-flow/): - int (42) - arbitrary precision integer - unlimited precision signed integer
- [Introducing Strings, Collections, and Iteration](https://docs.calebsargeant.com/programming/python/core/getting-started/3-introducing-strings-collections-and-iteration/): - str - Data type for strings in Python - Sequence of Unicode code points - Immutable - Unicode - Python 3 source encoding is UTF-8
- [Modularity](https://docs.calebsargeant.com/programming/python/core/getting-started/4-modularity/): _docs/words.py
- [Objects and Types](https://docs.calebsargeant.com/programming/python/core/getting-started/5-objects-and-types/): When we pass an object reference to a function, we're essentially assigning from an actual argument reference, in this case m to the formal argument reference, in this case k. Assignment causes the reference being assigned to being referred to the same object as the reference being assigned from, which is what's going…
- [Getting Started](https://docs.calebsargeant.com/programming/python/core/getting-started/)
- [Core](https://docs.calebsargeant.com/programming/python/core/)
- [Python](https://docs.calebsargeant.com/programming/python/): The Zen of Python
- [Arguments](https://docs.calebsargeant.com/programming/python/other/args/): Gentleman's agreement: optional arguments should be flags, and required arguments should be positional.
- [Errors](https://docs.calebsargeant.com/programming/python/other/errors/): AttributeError: 'NoneType' object has no attribute 'whatever'
- [Functions](https://docs.calebsargeant.com/programming/python/other/functions/)
- [Other](https://docs.calebsargeant.com/programming/python/other/)
- [JSON](https://docs.calebsargeant.com/programming/python/other/json/)
- [Objects](https://docs.calebsargeant.com/programming/python/other/objects/)
- [Print & Open](https://docs.calebsargeant.com/programming/python/other/print-open/): :~:text=Use%20a%20for%2Dloop%20to,line%20break%20from%20each%20line.
- [Randomness](https://docs.calebsargeant.com/programming/python/other/randomness/): This basically makes your .py file a program of some sorts, hard to explain, read above link. If your script is executed on its own, program will run. If your script is executed from another script, it won't run.
- [Requests](https://docs.calebsargeant.com/programming/python/other/requests/)
- [Strings](https://docs.calebsargeant.com/programming/python/other/strings/): Notice where the spaces are being removed. lstrip removes space from right-hand-side (leading), rstrip removes space from left-hand-side (trailing), and strip from both sides (not the middle).
- [Virtualenv](https://docs.calebsargeant.com/programming/python/other/virtualenv/)