DD-WRT Netgear WNDR3300

Just a quick post to help those trying to get the WNDR3300 to use the custom firmware DD-WRT.

1) Upgrade your WNDR3300 to the latest version of its firmware from Netgears website

2) Upgrade the firmware using this file:
http://rapidshare.com/files/256826846/dd-wrt.v24_std-wndr3300.chk

3) Then upgrade using this file:
http://rapidshare.com/files/256826847/dd-wrt.v24_std_generic.bin

4) Once booted reset it to defaults.


If you have any problems try the 30/30/30 hard reset:
Hard Reset (aka 30/30/30 reset):

The following procedure will clear out the NVRAM and set dd-wrt back to default values:

* With the unit powered on, press and hold the reset button on back of unit for 30 seconds
* Without releasing the reset button, unplug the unit and hold reset for another 30 seconds
* Plug the unit back in STILL holding the reset button a final 30 seconds



Good Luck

MD5 Authentication for RIPV2

Wow I think today has been by far the most active on my blog, trying to make up for lost time I guess :)

Anyway RIP authentication is perhaps the easiest of all to get going, however during setting up the lab it gave me the most trouble.

Cisco lists 3 requirements for getting RIP authentication working they are:

* Key-string
* Key number
* Authentication mode

However I would like to add a fourth (at least for my IOS) and that is that the key chain needed to be defined before being included in the "ip rip authentication key-chain RIP_KEY"

So there is the config R1:
1) Key Chain

key chain RIP_KEY
key 1
key-string ripme


2) RIP Authentication on the Interface:

ip rip authentication mode md5
ip rip authentication key-chain RIP_KEY


R5
1) Key Chain

key chain RIP_KEY
key 1
key-string ripme


2) RIP Authentication on the Interface:


ip rip authentication mode md5
ip rip authentication key-chain RIP_KEY


Router to Cisco VPN Client

Fairly similar to the Router to Router, but it does have some key differences.


1) As we are using ACS we need to set that up:


aaa new-model
!
!
aaa authentication login USERAUTH group radius
aaa authorization network GROUPAUTH local
!
!
radius-server host 192.168.0.45 auth-port 1645 acct-port 1646 key cisco123


2) Define ISAKMP policy

crypto isakmp policy 110
encr 3des
authentication pre-share
group 2


3) Set up group configuration:

crypto isakmp client configuration group VPNGROUP
key letmeinvpngroup
dns 192.168.0.3
domain cisco.local
pool IPPOOL
acl SPLIT_TUNNEL


4) Define IPPOOL

ip local pool IPPOOL 10.8.0.2 10.8.0.20


5) Define SPLIT_TUNNEL

ip access-list extended SPLIT_TUNNEL
permit ip 192.168.15.0 0.0.0.255 10.8.0.0 0.0.0.255
permit ip 192.168.13.0 0.0.0.255 10.8.0.0 0.0.0.255
permit ip 16.0.0.0 3.255.255.255 10.8.0.0 0.0.0.255
permit ip 192.168.23.0 0.0.0.255 10.8.0.0 0.0.0.255
permit ip 192.168.34.0 0.0.0.255 10.8.0.0 0.0.0.255
permit ip 192.168.12.0 0.0.0.255 10.8.0.0 0.0.0.255
permit ip host 1.1.1.1 10.8.0.0 0.0.0.255
permit ip host 2.2.2.2 10.8.0.0 0.0.0.255
permit ip host 3.3.3.3 10.8.0.0 0.0.0.255
permit ip host 4.4.4.4 10.8.0.0 0.0.0.255


6)Set up Transform Set:

crypto ipsec transform-set USER_TRANSFORM esp-3des esp-sha-hmac


7)Set up Dynamic Map:

crypto dynamic-map DYNAMAP 10
set transform-set USER_TRANSFORM


8) Bring it all together with a Crypto Map:

crypto map CLIENTMAP client authentication list USERAUTH
crypto map CLIENTMAP isakmp authorization list GROUPAUTH
crypto map CLIENTMAP client configuration address respond
crypto map CLIENTMAP 10 ipsec-isakmp dynamic DYNAMAP


9) Finally Apply it to the interface:

interface FastEthernet0/1
ip address dhcp
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
crypto map CLIENTMAP


10) Set up VPN client:
Group name is from this line above:
crypto isakmp client configuration group VPNGROUP
and the password is from this line:
key letmeinvpngroup



11) Set up ACS:


12) Adding a user to ACS is too easy for a picture, you will have to work that one out yourself :)

Router to Router IPSec Tunnel

IPSec has two Phases, which is important to rememeber when setting up the router as Phase 1 (ISAKMP) and Phase 2 (IPSec) have to be configured.

There is an IPSec Tunnel Inbetween R1 and R5 - Here's the config:


R1

1) Define ISAKMP Policy:
Phase 1:

crypto isakmp policy 100
encr aes 256
authentication pre-share
group 5


2) Set ISAKMP key and link it to the peer router

crypto isakmp key letmer1r5 address 192.168.15.5


Phase 2:
3) Set up IPSec transform set

crypto ipsec transform-set R5_TRANSFORM ah-sha-hmac



4) Define which traffic should be encrypted when going out:

access-list 110 permit ip host 192.168.15.1 host 192.168.15.5

NB: Traffic which falls into the deny implict or explict is simply not encrypted, it is not dropped

5) Define Crypto Map:

crypto map R1_2_R5 10 ipsec-isakmp
set peer 192.168.15.5
set transform-set R5_TRANSFORM
match address 110



6) Apply the Crypto Map to the interface:

interface FastEthernet0/0
ip address 192.168.15.1 255.255.255.0
crypto map R1_2_R5





Then for R5

1) Define ISAKMP Policy:

crypto isakmp policy 100
encr aes 256
authentication pre-share
group 5


2) Set ISAKMP key and link it to the peer router

crypto isakmp key letmer1r5 address 192.168.15.1



3) Set up IPSec transform set

crypto ipsec transform-set R1_TRANSFORM ah-sha-hmac



4) Define which traffic should be encrypted when going out:

access-list 110 permit ip host 192.168.15.5 host 192.168.15.1



5) Define Crypto Map:

crypto map R5_2_R1 10 ipsec-isakmp
set peer 192.168.15.1
set transform-set R1_TRANSFORM
match address 110



6) Apply the Crypto Map to the interface:

interface FastEthernet0/0
ip address 192.168.15.5 255.255.255.0
crypto map R5_2_R1


MD5 Authentication for OSPF Virtual Links

Virtual Links are links through transit areas back to Area 0
Therefore once MD5 authentication has been configured on Area 0 the virtual links require setting up for MD5.

NB:Done under the "router ospf" instance

R1

router ospf 1
router-id 1.1.1.1
log-adjacency-changes
area 12 virtual-link 2.2.2.2 authentication
area 12 virtual-link 2.2.2.2 message-digest-key 1 md5 letme0


R2

area 12 virtual-link 1.1.1.1 authentication
area 12 virtual-link 1.1.1.1 message-digest-key 1 md5 letme0
area 23 virtual-link 3.3.3.3 authentication
area 23 virtual-link 3.3.3.3 message-digest-key 1 md5 letme0



R3

area 23 virtual-link 2.2.2.2 authentication
area 23 virtual-link 2.2.2.2 message-digest-key 1 md5 letme0


MD5 Authentication for OSPF Areas

MD5 Authentication for OSPF areas is done on the interface.

Here are a couple of examples:


Area 34 - Between R3 and R4

R3

interface Serial1
ip address 192.168.34.3 255.255.255.0
encapsulation ppp
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 letme34


Then to match that on R4

interface Serial0
ip address 192.168.34.4 255.255.255.0
encapsulation ppp
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 letme34
clock rate 4000000
no fair-queue


For ISDN it is done on the Dialer:

R1

ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 letme12
! Suppress the "hello"s to stop the line coming up
ip ospf demand-circuit


R2

ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 letme12
! Suppress the "hello"s to stop the line coming up
ip ospf demand-circuit


Area 0 (Frame Relay)
R1

interface Virtual-Template1
ip unnumbered Serial0/0.123
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 letme0


R3

interface Virtual-Template1
ip unnumbered Serial0/0.321
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 letme0


PPP Over ISDN

More of a typical use for PPP - ISDN.

R1

1) Define User accounts:

username R1 password 0 CCNP
username R2 password 0 CCNP


2) Set ISDN Switch type:

isdn switch-type basic-ni


3) Define Pool Member on BRI (The Number here links it to the Dialer)

interface BRI0/0
no ip address
dialer pool-member 1


4) Configure the Dialer

interface Dialer0
ip address 192.168.12.1 255.255.255.0
encapsulation ppp
! Links with "dialer pool-member 1"
dialer pool 1
!Optional
dialer idle-timeout 30
! Here is the Telephone number of the remote router
dialer string 21
! Links to Dialer-list
dialer-group 1
!Stops line being activated needlessly
no peer neighbor-route
! CHAP password
ppp chap password 0 CCNP


5) Define Interesting Traffic (dialer-list) - This is the traffic that when detected will trigger a dial

dialer-list 1 protocol ip permit



R2

1) Define User accounts:

username R1 password 0 CCNP
username R2 password 0 CCNP


2) Set ISDN Switch type:

isdn switch-type basic-ni


3) Define Pool Member on BRI (The Number here links it to the Dialer)

interface BRI0/0
no ip address
dialer pool-member 1


4) Configure the Dialer

interface Dialer0
ip address 192.168.12.2 255.255.255.0
encapsulation ppp
! Links with "dialer pool-member 1"
dialer pool 1
!Optional
dialer idle-timeout 30
! Here is the Telephone number of the remote router
dialer string 11
! Links to Dialer-list
dialer-group 1
!Stops line being activated needlessly
no peer neighbor-route
! CHAP password
ppp chap password 0 CCNP


5) Define Interesting Traffic (dialer-list) - This is the traffic that when detected will trigger a dial

dialer-list 1 protocol ip permit