WirelessPhreak.com

I have searched high and low for a decent low-priced alternative for Visio on the Mac, and I think I have finally found one.

yEd Graph Editor is a powerful desktop application that can be used to quickly and effectively generate high-quality diagrams. Create diagrams manually, or import your external data for analysis. Thier automatic layout algorithms arrange even large data sets with just the press of a button.


The install is strait forward and works great, but us network guys want cisco icons.  The network icons that come with are a little weak.  So I found a German website that had the Cisco default icons as .svg files.  Here is the link to the download cisco_svg_icons.

Next how to install the icons.

1. Open yEd Editor Go to Edit --> Pallte Manager
2. Create a new Click New Section (name it)
3. Highlight newly created Section and click import symbols
4. Select .svg symbols and import them.

That's it... You should have a diagram tool that will let you make professional looking network diagrams.

Let me know if you have any better alternatives.

# Geo-IP_Network_Whitelist_acl_rule
#
# v2.0 - May 9 2014
#
# BIG-IP versions 11.x (tested on 11.3.8)
#
# Purpose:
#   This rule should be added to a network virtual server to catch all requests
#   which  don't match an allowed GeoIP country code or IP network/host.  This
#   creates a white list of networks and hosts that are allowed to connect to
#   the virtual server. By default, log entries are written to /var/log/ltm.
#
#   The rule expects the following two data groups to define which allowed country
#   codes (example: ca, us), or defined allowed networks (example: 10.0.0.0/8)
#   are allowed to connect to the virtual server.
#
#   Clients that match on either the Network or GeoIP data group will be allowed
#   to connect to the default pool. Clients that do not match will be rejected and
#   see a web page not available.
#
#   The data group names should be:
#
#   geo_allowed_country (string Data Group List)
#   geo_allowed_network (network Data Group List)
#
#
#
#
# This event is triggered when a client - BIG-IP TCP connection is established
when CLIENT_ACCEPTED {
 if { [class match [whereis [IP::client_addr] country] equals geo_allowed_country] } {
    # do nothing
         log local0. "Geo-IP Code accepted from client: \
         [IP::client_addr]:[TCP::client_port] -> [IP::local_addr]:[TCP::local_port]"
 } elseif { [class match [IP::client_addr] equals geo_allowed_network] } {
    # do nothing
         log local0. "Network accepted from client: \
         [IP::client_addr]:[TCP::client_port] -> [IP::local_addr]:[TCP::local_port]"
  } else {
  reject
  log local0. "Client request rejected: \
         [IP::client_addr]:[TCP::client_port] -> [IP::local_addr]:[TCP::local_port]"
 }
}

*Update* Cisco has posted their Security Advisory for the Heartbeat vulnerability http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed

It is curious to see how different company choose to incorporate and document opensource software in their products. But that is a different rant for a different time.

Today is the day engineers around the world hit the internet looking through pages and pages of documentation.  I have done some research and wanted to add what I found to hopefully shorten someones search.

Cisco ASA 8.4 code is running openssl 0.9.8f Safe

•  (http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/license/open_source/opensrce.pdf)

F5 LTM 11.3, and 11.4 are running openssl 0.9.8y Safe

• To view for your self SSH to your LTM log in as root and run "openssl version"

F5 LTM 11.5 is running openssl 1.0.1e-fips Vulnerable

• SANS ISC
• HeartBleed.com
• F5 HeartBleed Forum Post

when RULE_INIT {
# This is the max requests allowed during "interval" specified below.
set static::maxRate 125;
# Below is the lifetime of the subtable record in seconds.
# This defines the interval during which requests are tallied. Example: Rate=10 and Timeout=3, allows 10 requests in 3 seconds
# Note: do not use very high timeout because it increases memory utilization especially under high load.
# Note: A rate of 100 in 50 seconds is the same is a rate of 20 in 1 second. But 1 second is a lot easier on memory,
# Because the records expire more quickly and the table does become too large.
set static::timeout 3;}
when HTTP_REQUEST {
set getCount [table lookup -notouch -subtable requests [IP::client_addr]]
    if { $getCount equals "" } {
       # log local0. "New one:  getCount=$getCount [IP::client_addr] [clock seconds]"
       table set -subtable requests [IP::client_addr] "1" $static::timeout $static::timeout
       } else {
    if { $getCount < $static::maxRate } {
       table incr -notouch -subtable requests [IP::client_addr]
       } else {
    if {$getCount == $static::maxRate } {
       log local0. "User @ [IP::client_addr] [clock seconds] has reached $getCount requests in $static::timeout seconds."
       table incr -notouch -subtable requests [IP::client_addr]
       }
   HTTP::respond 501 content "We apologize but your request/sec limit has exceeded the set threshold.  Please wait 30 seconds and refresh the page."
   #drop
   #return