A slew of new threats revealed in Cisco products

A number of Cisco vulnerabilities have recently been made more dangerous by the public release of proof-of-concept code, which can be utilized to exploit these vulnerabilities. Anyone using one of the many vulnerable products needs to take immediate steps to fix the vulnerabilities or confirm that the vulnerabilities have already been fixed or mitigated.

There are also two recently announced vulnerabilities that require attention, but no published exploits have been released for these flaws.

Details
Older threats that now have public exploits
A number of exploits for known Cisco vulnerabilities have recently been published. Here is the list as taken from a Cisco Security Notice:

Cisco 677/678 Telnet Buffer Overflow Vulnerability DoS
Cisco IOS Router DoS Vulnerability, Cisco IOS HTTP Server
Cisco IOS HTTP Auth Vulnerability
Cisco IOS HTTP Configuration Arbitrary Administrative Access Vulnerability, IOS HTTP Authorization Vulnerability
Cisco Catalyst SSH Protocol Mismatch DoS Vulnerability
Cisco 675 Web Administration DoS Vulnerability (“Cisco is currently researching this vulnerability further. Mitigation methods have been available for some time such as setting the Web server to listen on a different port.”)
Cisco Catalyst 3500 XL Remote Arbitrary Command Vulnerability
Cisco IOS Software HTTP Request DoS Vulnerability
Cisco 514 UDP Flood DoS Vulnerability, a vulnerability in the IOS Firewall feature set CiscoSecure ACS for Windows NT Server DoS Vulnerability

New threats
One of the new flaws to look out for is a Cisco Content Service Switch Management Port UDP remotely exploitable DoS vulnerability, which has been flagged by SecurityFocus. The relevant Cisco Security Bulletin contains more details.

Applicability (new threats only)
Cisco Content Service Switch Management Port UDP
Cisco CSS11000
Cisco CSS11050
Cisco CSS11150
Cisco CSS11800
Cisco CSS11100 (added in the Cisco Security Advisory revision)

OpenSSL vulnerability (taken from the Cisco Bulletin)
Cisco IOS 12.2ZA
Cisco IOS 12.2SY
Cisco IOS 12.1E
Cisco PIX Firewall
Cisco Firewall Services Module for Cisco Catalyst 6500 Series and Cisco 7600 Series routers
Cisco MDS 9000 Series Multilayer Switch
Cisco Content Service Switch 11000 and 11500 series
Cisco Global Site Selector 4480 and 4490
Cisco Content Service Switch Secure Content Accelerator versions 1 and 2
CiscoWorks Common Services 2.2 and CiscoWorks Common Management Foundation 2.1
Cisco Access Registrar
Cisco Call Manager
Cisco Okena Stormwatch 3.2
Cisco Application and Content Networking Software (ACNS)
Cisco Threat Response

Cisco 2800 ISR configuration for SIP voice with NAT and Firewall

I had the enjoyable opportunity over the last few weeks to jump in and do a basic Cisco voice install. It was about 110 phones, with the Cisco Unified Communications Manager Business Edition. This is a single box that includes Call Manager 6.1.3, and Unity Connection 2.1. It had to be done fast, and it had to be done right, so I stuck to mostly tried and true configurations.

Since this was a price sensitive design, we used the 2800 router to its maximum potential. The 2800 is an amazingly flexible piece of equipment; it can be configured to do large variety of things. Sometimes known as the Integrated Services Router, or ISR, it can be set up as a router, firewall, VPN, Voice Gateway, SIP session border controller, transoder, conference bridge, and survivable remote gateway, all at the same time, on the same box!

The call manager and unity connection install was straightforward, like punching out license plates. Set up media, device pools, partitions, calling search spaces, translation patterns, gateways, route filters, route patterns, etc. Scan then batch add the phones, set up voicemail and autoattendant call handlers, create expections, deal with the special people, and that’s it. Enough said about that.

The Cisco 2800 Integrated Services Router is used in this example to terminate a Multilink PPP bundle of four Internet T1’s, act as a firewall, provide media services to the Cisco call manager, act as an MGCP controlled analog gateway, and use Cisco Survivable Remote Site Telephony (SRST) to be the backup call processor to the main Cisco Call Manager.

SIP is ok with Network Address Translation as long as the firewall is capable of doing deep packet inspection and NAT’s all references to IP addresses. When I tried to NAT the inside interface of the firewall…it did not work so well. The remote SIP service provider was seeing private IP addresses in the SIP text, which does not make for good two way communications.

The Quality of Service setup on this example is fairly straightforward. Outbound is the standard Cisco MQS low-latency queuing setup, with a priority queue for voice and class based weighted fair queuing for the rest. Even though the service provider has said they prioritize inbound voice, I still set up inbound policing. Non-voice is limited to 4 Mbps, and anything greater than that will be dropped. Voice can use all of the bandwidth, so essentially there is 2 Mbps reserved for inbound voice. This is based on a calculation of 80 kbps for one G.711 call, so 2000 kbps gives us 25 concurrent voice calls, which should be plenty for 110 phones.

Object groups are used, which is new to IOS version 12.4.20T. As a side note, I recommend strongly against using 12.4.22T1 for NAT or SCCP media like MTP’s, since those feature are broken in that version.

version 12.4

no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname PriorityQueueRouter
!
boot-start-marker
warm-reboot
boot-end-marker
!
card type t1 0 0
card type t1 0 1
security authentication failure rate 3 log
security passwords min-length 6
logging message-counter syslog
logging buffered 100000 warnings
no logging console
enable secret 5 0000000000000000000
!
aaa new-model
!
aaa authentication login default local
aaa authorization console
aaa authorization exec default local
!
!
aaa session-id common
clock timezone EST -5
clock summer-time EDT recurring
network-clock-participate wic 0
network-clock-participate wic 1
network-clock-select 1 T1 0/0/0
network-clock-select 2 T1 0/0/1
network-clock-select 3 T1 0/1/0
network-clock-select 4 T1 0/1/1
!
dot11 syslog
no ip source-route
!
!
ip cef
!
!
no ip domain lookup
ip domain name MAINSITE.local

ip inspect max-incomplete high 5000
ip inspect max-incomplete low 4500
ip inspect one-minute high 5000
ip inspect one-minute low 4500
ip inspect tcp idle-time 300
ip inspect tcp finwait-time 10
ip inspect tcp max-incomplete host 1000 block-time 0
ip inspect tcp reassembly queue length 1024
ip inspect tcp reassembly timeout 60
ip inspect tcp reassembly memory limit 256000
ip inspect name EXT_FW ssh
ip inspect name EXT_FW https
ip inspect name EXT_FW ntp
ip inspect name EXT_FW tcp
ip inspect name EXT_FW dns
ip inspect name EXT_FW smtp
ip inspect name EXT_FW udp
ip inspect name EXT_FW icmp
ip inspect name EXT_FW ftp timeout 1200
ip inspect name EXT_FW http
ip inspect name EXT_FW sip
ip inspect name EXT_FW appleqtc
ip inspect name EXT_FW l2tp
ip inspect name EXT_FW pptp
no ipv6 cef
!
multilink bundle-name authenticated
!
!
trunk group FXOPORTS
hunt-scheme sequential both up
!
!
voice service voip
address-hiding
allow-connections h323 to h323
allow-connections h323 to sip
allow-connections sip to h323
allow-connections sip to sip
no supplementary-service sip moved-temporarily
no supplementary-service sip refer
redirect ip2ip
fax protocol pass-through g711ulaw
modem passthrough nse codec g711ulaw
sip
bind control source-interface Loopback0
bind media source-interface Loopback0
header-passing
registrar server expires max 3600 min 3600
no update-callerid
early-offer forced
!
!
voice class media 1
media flow-through
!
!
voice class codec 1
codec preference 1 g711ulaw
codec preference 2 g729r8
!
!
voice translation-rule 1
rule 1 /^\(2…\)/ /770555\1/
!
voice translation-rule 2
rule 1 /^9/ //
!
!
voice translation-profile OUTBOUND
translate calling 1
translate called 2
!
!
voice-card 0
no dspfarm
dsp services dspfarm
!
!
object-group network EXTERNAL_SIP_SERVERS
host 247.10.98.2
!
object-group network INSIDE_NETWORKS
10.108.0.0 255.255.0.0
!
object-group network INTERNAL_SIP_SERVERS
host 251.222.32.206
host 251.222.32.205

object-group network OUTSIDE_INTERFACE
host 250.1.26.7
!
object-group service PING_SERVICE
icmp echo-reply
icmp unreachable
icmp redirect
icmp echo
udp eq ntp
udp eq domain
!
object-group network PRIVATE_NAT_SERVERS
host 10.108.80.5
host 10.108.60.6
host 10.108.60.7
host 10.108.60.10
host 10.108.60.12
!
object-group network PUBLIC_NAT_SERVERS
host 251.222.32.205
host 251.222.32.195
host 251.222.32.197
host 251.222.32.199
host 251.222.32.201
!
object-group network SERVER_NETWORKS
10.108.60.0 255.255.255.0
10.108.80.0 255.255.255.0
!
object-group network SIP_NETWORKS
host 251.222.32.206
host 251.222.32.205
!
object-group service SIP_SERVICE
udp eq 5060
tcp eq 5060
!
!
controller T1 0/0/0
framing esf
linecode b8zs
cablelength long 0db
channel-group 0 timeslots 1-24
!
controller T1 0/0/1
framing esf
linecode b8zs
cablelength long 0db
channel-group 1 timeslots 1-24
!
controller T1 0/1/0
framing esf
linecode b8zs
cablelength long 0db
channel-group 0 timeslots 1-24
!
controller T1 0/1/1
framing esf
linecode b8zs
cablelength long 0db
channel-group 1 timeslots 1-24
!
ip tcp synwait-time 60
ip tcp path-mtu-discovery
ip ssh time-out 60
ip ssh version 2
!
class-map match-any VOICE_CLASS
match ip dscp ef
match access-group name VOICEPACKETS_ACL
class-map match-any CALLCONTROL_CLASS
match ip dscp af31
match ip dscp cs3
match ip dscp af21
class-map match-any CONTROL_CLASS
match access-group name NETWORKCONTROL_ACL
match ip dscp af11
class-map match-any FROM_ISP_CLASS
match access-group name FROM_ISP_ACL
!
!
policy-map DROP_NON_VOICE_POLICY
class FROM_ISP_CLASS
police rate 2000000
conform-action set-dscp-transmit ef
exceed-action set-dscp-transmit ef
violate-action set-dscp-transmit ef
class class-default
police rate 4000000
conform-action transmit
exceed-action drop
violate-action drop
policy-map VOICEFIRST_POLICY
class CALLCONTROL_CLASS
bandwidth percent 5
set dscp af21
class CONTROL_CLASS
bandwidth percent 5
set dscp af11
class VOICE_CLASS
priority percent 65 200000
set dscp ef
class class-default
fair-queue
random-detect
!
!
interface Loopback0
ip address 251.222.32.206 255.255.255.255
!
interface Multilink1
ip address 250.1.26.7 255.255.255.252
ip access-group OUTSIDE_IN in
ip verify unicast reverse-path
ip flow ingress
ip nat outside
ip inspect EXT_FW out
ip virtual-reassembly
snmp trap ip verify drop-rate
no cdp enable
ppp multilink
ppp multilink group 1
ppp multilink fragment disable
service-policy input DROP_NON_VOICE_POLICY
service-policy output VOICEFIRST_POLICY

!
interface GigabitEthernet0/0
ip address 10.108.100.254 255.255.255.0
ip flow ingress
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
!
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
!
interface Serial0/0/0:0
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
!
interface Serial0/0/1:1
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
!
interface Serial0/1/0:0
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
!
interface Serial0/1/1:1
no ip address
encapsulation ppp
ppp multilink
ppp multilink group 1
!
ip local pool VPNPOOL 192.168.50.200 192.168.50.250
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Multilink1
ip route 10.108.0.0 255.255.0.0 10.108.100.1
no ip http server
ip http authentication aaa
ip http secure-server
!
!
ip nat inside source route-map DYNAMIC_RMAP interface Multilink1 overload
ip nat inside source static 10.108.60.6 64.206.208.195 route-map STATIC_RMAP
ip nat inside source static 10.108.60.8 64.206.208.197 route-map STATIC_RMAP
ip nat inside source static 10.108.60.10 64.206.208.199 route-map STATIC_RMAP
ip nat inside source static 10.108.60.12 64.206.208.201 route-map STATIC_RMAP
ip nat inside source static 10.108.80.5 64.206.208.205 route-map STATIC_RMAP
!
ip access-list extended DYNAMIC_NAT_ACL
deny ip object-group PRIVATE_NAT_SERVERS any
permit ip 10.108.0.0 0.0.255.255 any
!
ip access-list extended FROM_ISP_ACL
permit ip object-group EXTERNAL_SIP_SERVERS object-group INTERNAL_SIP_SERVERS
!
ip access-list extended OUTSIDE_IN
permit object-group PING_SERVICE any object-group OUTSIDE_INTERFACE
permit object-group PING_SERVICE any object-group INTERNAL_SIP_SERVERS
permit object-group PING_SERVICE any object-group PUBLIC_NAT_SERVERS
permit object-group SIP_SERVICE object-group EXTERNAL_SIP_SERVERS object-group INTERNAL_SIP_SERVERS
permit object-group MGMT_SERVICE object-group MGMT_NETWORKS object-group OUTSIDE_INTERFACE
!
ip access-list extended STATIC_NAT_ACL
permit ip 10.108.0.0 0.0.255.255 any
!
!
route-map DYNAMIC_RMAP permit 1
match ip address DYNAMIC_NAT_ACL
!
route-map STATIC_RMAP permit 1
match ip address STATIC_NAT_ACL
!

control-plane
!
voice-port 2/0/0
!
voice-port 2/0/1
!
voice-port 2/0/2
!
voice-port 2/0/3
!
voice-port 2/0/4
!
voice-port 2/0/5
!
voice-port 2/0/6
!
voice-port 2/0/7
!
voice-port 2/0/8
trunk-group FXOPORTS 6
timing hookflash-out 50
connection plar 2700
!
voice-port 2/0/9
trunk-group FXOPORTS 5
timing hookflash-out 50
connection plar 2700
!
voice-port 2/0/10
connection plar 2700
!
voice-port 2/0/11
connection plar 2700
!
voice-port 2/0/12
connection plar 2700
!
voice-port 2/0/13
connection plar 2700
!
ccm-manager fallback-mgcp
ccm-manager mgcp
ccm-manager music-on-hold
ccm-manager config server 10.108.80.5
ccm-manager config
!
mgcp
mgcp call-agent ucserver 2427 service-type mgcp version 0.1
mgcp dtmf-relay voip codec all mode out-of-band
mgcp rtp unreachable timeout 1000 action notify
mgcp modem passthrough voip mode nse
mgcp package-capability rtp-package
mgcp package-capability sst-package
mgcp package-capability pre-package
no mgcp package-capability res-package
no mgcp package-capability fxr-package
no mgcp timer receive-rtcp
mgcp sdp simple
mgcp fax t38 inhibit
mgcp rtp payload-type g726r16 static
mgcp bind control source-interface GigabitEthernet0/0
mgcp bind media source-interface GigabitEthernet0/0
!
mgcp profile default
!
sccp local Loopback0
sccp ccm 10.108.80.5 identifier 1 priority 1 version 6.0
sccp
!
sccp ccm group 1
associate ccm 1 priority 1
associate profile 4 register MTP2851-729
associate profile 3 register MTP2851
associate profile 2 register CFB2851
associate profile 1 register XCD2851
!
dspfarm profile 1 transcode
codec g711ulaw
codec g729r8
maximum sessions 2
associate application SCCP
!
dspfarm profile 2 conference
codec g711ulaw
codec g729r8
maximum sessions 2
associate application SCCP
!
dspfarm profile 3 mtp
codec g711ulaw
maximum sessions software 50
associate application SCCP
!
dspfarm profile 4 mtp
codec g729r8
maximum sessions software 50
associate application SCCP
shutdown
!
!
dial-peer voice 999200 pots
service mgcpapp
port 2/0/0
!
dial-peer voice 999208 pots
service mgcpapp
port 2/0/8
!
dial-peer voice 1 pots
description Incoming called numbers from FXO or FXS or ccm
incoming called-number .
direct-inward-dial
!
dial-peer voice 59111 pots
trunkgroup FXOPORTS
description 911 service with a leading 9
translation-profile outgoing OUTBOUND
preference 5
destination-pattern 9[49]11
!
dial-peer voice 59112 pots
trunkgroup FXOPORTS
description 911 service without a leading 9
preference 5
destination-pattern [49]11
!
dial-peer voice 5202 pots
trunkgroup FXOPORTS
description International calling with FXOPORTS
translation-profile outgoing OUTBOUND
preference 5
destination-pattern 9011T
!
dial-peer voice 19111 voip
description 911 service with a leading 9 to ISP
translation-profile outgoing OUTBOUND
preference 6
destination-pattern 9[49]11
session protocol sipv2
session target ipv4:247.10.98.2
session transport udp
dtmf-relay rtp-nte
codec g711ulaw
fax-relay ecm disable
fax-relay sg3-to-g3
fax rate 14400
fax protocol pass-through g711ulaw
!
dial-peer voice 1200 voip
description local with a leading 9 to ISP
translation-profile outgoing OUTBOUND
preference 1
destination-pattern 9[2-9]..[2-9]……
session protocol sipv2
session target ipv4:247.10.98.2
session transport udp
dtmf-relay rtp-nte
codec g711ulaw
fax-relay ecm disable
fax-relay sg3-to-g3
fax rate 14400
fax protocol pass-through g711ulaw
ip qos dscp cs3 signaling
no vad
!
dial-peer voice 1201 voip
description long distance with a leading 9 to ISP
translation-profile outgoing OUTBOUND
preference 1
destination-pattern 91[2-9]..[2-9]……
session protocol sipv2
session target ipv4:247.10.98.2
session transport udp
dtmf-relay rtp-nte
codec g711ulaw
fax-relay ecm disable
fax-relay sg3-to-g3
fax rate 14400
fax protocol pass-through g711ulaw
ip qos dscp cs3 signaling
no vad
!
dial-peer voice 1202 voip
description international with a leading 9 to ISP
translation-profile outgoing OUTBOUND
preference 1
destination-pattern 9011T
session protocol sipv2
session target ipv4:247.10.98.2
session transport udp
dtmf-relay rtp-nte
codec g711ulaw
fax-relay ecm disable
fax-relay sg3-to-g3
fax rate 14400
fax protocol pass-through g711ulaw
ip qos dscp cs3 signaling
no vad
!
dial-peer voice 999209 pots
service mgcpapp
port 2/0/9
!
dial-peer voice 5200 pots
trunkgroup FXOPORTS
description Local calling with FXOPORTS
translation-profile outgoing OUTBOUND
preference 5
destination-pattern 9[2-9]..[2-9]……
!
dial-peer voice 5201 pots
trunkgroup FXOPORTS
description Long distance calling with FXOPORTS
translation-profile outgoing OUTBOUND
preference 5
destination-pattern 91[2-9]..[2-9]……
!
dial-peer voice 1100 voip
description ** Incoming call from SIP trunk **
translation-profile incoming INBOUND
voice-class codec 1
voice-class sip dtmf-relay force rtp-nte
session protocol sipv2
session transport udp
incoming called-number 770…….
dtmf-relay rtp-nte
fax protocol pass-through g711ulaw
ip qos dscp cs3 signaling
no vad
!
!
sip-ua
nat symmetric role active
retry invite 3
retry response 3
retry bye 3
retry cancel 3
retry rel1xx 3
timers connect 100
timers connection aging 30
!
!
!
call-manager-fallback
secondary-dialtone 9
max-conferences 8 gain -6
transfer-system full-consult
limit-dn 7961 6
timeouts interdigit 5
ip source-address 10.108.100.254 port 2000
max-ephones 110
max-dn 200 dual-line
dialplan-pattern 1 770555 extension-length 4
transfer-pattern 9……….
keepalive 10
default-destination 2700
no huntstop
time-zone 13
!
banner login ^CC
*******************************************************************************
Unauthorized access and improper use are prohibited. Any activity on the system
is subject to monitoring by the company at any time. Anyone who uses the system
consents to such monitoring and agrees that the company may use the results of
such monitoring without limitation.
*******************************************************************************
^C
!
line con 0
exec-timeout 60 0
logging synchronous
line aux 0
line vty 0 4
exec-timeout 60 0
logging synchronous
line vty 5 15
exec-timeout 60 0
logging synchronous
!
scheduler allocate 20000 1000
ntp server 131.144.4.9
ntp server 198.72.72.10
end

Cisco’s Media-Enabled Home Experience Comes Alive in Malaysia

Cisco today showcased the Media-Enabled Home living concept that is designed to deliver a new class of compelling communication and entertainment experience. Set to take digital lifestyle to the next level, the concept extends and simplifies user’s reach to multimedia content such as photos, music, videos and files on multiple devices wherever they are at home.

Leveraging on the combined capabilities of latest Linksys by Cisco wireless and media offerings, users can live a truly connected life that pushes the boundaries of home networking, which today is often limited to just sharing broadband Internet. The newly launched products include Linksys by Cisco WRT610N Dual-Band Wireless-N Router, WUSB600N Wireless-N USB Network Adapter with Dual Band, NMH300 Media Hub and WVC54GCA Wireless-G Internet Home Monitoring Camera.

· Started as a vision, the Media-Enabled Home is now made possible with Cisco’s superior networking technology that does more than connecting devices – it connects people to an entertainment experience like no other. No wires, no being constrained to one location within home and no strenuous process of managing separate tools. Instead, home users can now experience the freedom of true wireless entertainment with high-quality audio and visuals that can be accessed quickly and easily.

Beware of Cisco refurbished equipment

Cisco Systems was the darling of the IT industry and the stock market in the 1990s, as it enjoyed phenomenal growth (50 percent or more, year after year) throughout the decade. During this period, Cisco was, at times, hiring upward of 1,000 new employees per month. Then came the dot-com bomb and economic slowdown of 2001. Cisco took a record $2.25 billion inventory charge, laid off 8,000 people, and watched its stock take a nosedive. Now, Cisco has sharpened its teeth and is trying desperately to make a comeback.

With the economic downturn and the particular weakness in the telecom and IT industries, the demand for new network equipment has ground to a halt. Even worse, the bankruptcies of so many companies have not just created a lack of demand; they have also created a tremendous surplus of used and unused new equipment on the open market. This surplus is one of the things that is hampering Cisco’s comeback.

By “open market,” I mean any source that doesn’t come from Cisco’s manufacturing plant or inventory of new equipment. Some examples of the open market are:

Individuals and organizations that sell routers on eBay in the Cisco category.
IT Parade, where dealers join together to sell their products. A search on IT Parade at the time of this writing found 1,886 Cisco items for sale.
The very active ISP-Planet: ISP-Equipment discussion list, where visitors can post that they want to buy or sell network equipment with no commission fee for connecting the two.
Hordes of used equipment vendors like Asset Recovery Center (as mentioned in the Fortune article “Cisco’s Worst Nightmare”).
An individual, like you, wanting to sell your router privately to another individual, like me.

While these options can offer practical solutions for both the buyer and seller of Cisco equipment, any organization that is considering the purchase and implementation of used Cisco equipment needs to know that Cisco is doing everything it can to undermine these sales and make it difficult for companies that purchase used equipment, as I recently discovered.

My company has been looking to replace our aging (and discontinued) 3Com network equipment with current technology that can be serviced and supported by its vendor. We have a wide area network (WAN) made up of about 60 locations. We would prefer to do this upgrade with Cisco equipment. Last year, I quoted new Cisco equipment to do this. The cost was going to be about $500,000.

We decided to start this rollout midyear 2002 and, due to the high cost involved, we planned to have to spread it out over three years. I also looked at Cisco’s “refurbished” equipment offering and decided to go with that instead of new equipment. The refurbished equipment would save me significant dollars, and I could get it through the same channel as my new equipment. The only problem is that many Cisco refurbished parts are often unavailable, so I looked into the possibility of getting used equipment from the open market. I found that I could save my company a few hundred thousand dollars and would be able to complete the project in a year and a half (because of the lower cost) instead of the original three years—a tremendous benefit to myself, my IT group, and my company as a whole.

Although I had read the Fortune article on usedCisco equipment, I never expected that Cisco would treat me as it treated the prospective buyers in that article. After telling my Cisco sales representative that I wanted to buy used equipment, I expected him to try to talk me out of it, but I was naïve and didn’t expect what happened next. He told me the following:

Cisco has taken a hard line on “noncertified” (used) equipment.
Cisco will absolutely not uphold the support and/or warranty that came with the equipment or that was purchased by the previous owner of the equipment.
Noncertified equipment cannot be covered under Cisco SMARTnet maintenance unless my company pays to send it to Cisco, pays an inspection fee, and pays to have the equipment sent back.
Cisco will require my company’s legal team to sign a form releasing Cisco from all legal claims against them in relation to use of used equipment.
If my company does not buy an IOS license for every piece of used equipment I purchase, Cisco will “explore legal action based on nonauthorized use of our IOS software.” (I take this to mean it will sue my company.)

After getting over my outrage, I did some research on this. An equipment vendor requiring a company to have used equipment “certified” before allowing it under maintenance is nothing new. Vendors like IBM have been doing this for years, but it is typically done on a large and expensive piece of equipment—not a router that costs $1,500.

What is unique and not very well known is that Cisco licenses its IOS (the operating system of the router or switch) per company/user, and that license is nontransferable. That means that if you buy a router and sell it to me, I can’t use the software that runs the router, which makes the router worthless unless I buy the operating system from Cisco.

This would be similar to my buying a PC from a retail store, selling it to my brother, and having Microsoft tell me that I can’t sell or give him the Windows software (or any other software on the computer) even though I bought it and have the license, CD, and manual for it.

Let’s take a look at the following example to see how Cisco’s policy affects the price of buying a Cisco 2610 router. Note that the prices are approximated from the time I looked them up and include a basic corporate discount.

Option 1: A new router
New Cisco 2610 router with IP-only IOS license $1,487

One year of Smartnet Maintenance on that router (8x5xnext business day) $390

Total: $1,877

Option 2: A refurbished router
Refurbished Cisco 2610 router with IP-only IOS license $1,126

One year of Smartnet Maintenance on that router (8x5xnext business day) $390

Total: $1,516

Option 3: A used router
Used Cisco 2610 router (“noncertified”) $650

One year of Smartnet Maintenance on that router (8x5xnext business day) $390

Cisco inspection fee for router (not including shipping and handling both ways) $750

IOS IP-only license for the router $400

Total: $2,190

Final analysis

In my opinion, Cisco’s tactics amount to an attempt to put vendors selling used Cisco equipment out of business and to keep companies from being able to buy and sell used Cisco equipment.

With Cisco’s “inspection fee” and the nontransferability of the IOS license, Cisco nullifies the price savings of buying used equipment. Why is this important to network managers, IT directors, and other IT professionals? Because Cisco is trying to take away our freedom to leverage supply and demand. Cisco is trying to take away our freedom to get a good deal when the market makes it available.

This isn’t right, and I believe this strategy will only hurt Cisco in the long run. If and when IT professionals become aware of Cisco’s unfair business practices, customer satisfaction and sales will decline despite the fact that Cisco may have a superior product. My recommendation to Cisco would be to simply focus on creating great products that customers will want to buy rather than try to control the open market.

In the meantime, any organization that thinks it’s going to save some money by purchasing used Cisco equipment should think again. Cisco’s tactics could make it difficult and financially unwise unless you are buying higher-dollar equipment.

Cisco NAC Appliance

The single most popular piece of the Cisco NAC solution has been the Cisco NAC Appliance. As evident from the name itself, Cisco NAC Appliance is an appliance-based solution that offers fast deployment, policy management, and enforcement of security policies.

With the Cisco NAC Appliance, you can opt for an in-band or out-of-band solution. The in-band solution is for smaller deployments. As your network grows into a more campus environment, you may not be able to keep in the in-band design. In that case, you can move to the out-of-band deployment scenario.

Here are some advantages of the Cisco NAC Appliance:

Identity: At the point of authentication, the Cisco NAC Appliance recognizes users, as well as their devices and their responsibility in the network.
Compliance: Cisco NAC Appliance also takes into account whether machines are compliant with security policies or not. This includes enforcing operating system updates, antivirus definitions, firewall settings, and antispyware software definitions.
Quarantine: If the machines attempting to gain access don’t meet the policies of the network, the Cisco NAC Appliance can quarantine these machines and bring them into compliance (by applying patches or changing settings), before releasing them onto the network.