1

I have inherited a Cisco 887VA with a Wifi module which acts as our gateway and firewall.

Yesterday I ran some scans against the external interface [XX.XX.XX.XXX in the below config] and found a number of unexpectedly open ports.

I found the following, they are allowing telnet access to our network gear. specifically:

2002  Telnet access to Wireless AP on Cisco 800  
4002  Telnet to something Cisco but times out before I can get a login. Suspect the Wireless AP again.  
6002  Telnet to the wireless AP
9002  Telnet to the wireless AP

The Wireless AP is a module in the router and is bridged to the main network. Config at the bottom.

I can't see in the configuration of either the AP or the Router what is allowing this access.

I am also unsure how Telnet is successfully connecting to the AP as it looks like only SSH is configured transport input ssh?

As a separate question, port 2220 is configured to allow SSH to our router. Given we're just using local passwords, is this a terrible idea?

Router Config:

version 15.4
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime
service timestamps log datetime msec localtime
service password-encryption
service linenumber
!
hostname COMPANY
!
boot-start-marker
boot system flash flash:/c800-universalk9-mz.SPA.154-3.M7.bin
warm-reboot
boot-end-marker
!
!
logging buffered 51200
enable secret 5 $xxxxxxxxxxxxxxxxxxxxxxxxx$
!
aaa new-model
!
!
aaa authentication banner C
*******************************************************************************
*******************************************************************************

aaa authentication login default local
aaa authentication login NO_AUTHEN none
aaa authentication login SSLVPN local
aaa authorization exec default local 
aaa authorization network groupauthor local 
!
!
!
!
!
aaa session-id common
clock timezone BST 0 0
clock summer-time BST recurring last Sun Mar 1:00 last Sun Oct 2:00
service-module wlan-ap 0 bootimage autonomous
!
crypto pki trustpoint TRUSTPOINT
 enrollment selfsigned
 ip-address XX.XX.XX.XXX
 subject-name CN=remote.COMPANY.com
 revocation-check crl
 rsakeypair SSLVPN_KEYPAIR
!
!
crypto pki certificate chain TRUSTPOINT
 certificate self-signed 01
  308203A2  7B64
    quit
!
!
!
!
!
!
!
!


!
!
!
!
ip flow-cache timeout active 1
ip domain name COMPANY.LOCAL
ip name-server 8.8.8.8
ip name-server 8.8.4.4
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
cts logging verbose
license udi pid C887VA-W-E-K9 sn XXXXXXXXX
!
!
username COMPANY password 7 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
!
crypto vpn anyconnect flash:/webvpn/anyconnect-win-4.4.00243-webdeploy-k9.pkg sequence 1
!
crypto vpn anyconnect flash:/webvpn/anyconnect-macosx-i386-4.2.02075-k9.pkg sequence 2
!
!
!
!
!
controller VDSL 0
!
! 
!
crypto isakmp policy 50
 encr 3des
 hash md5
 authentication pre-share
 group 14
!
crypto isakmp policy 55
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX address 190.160.120.90 
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 20
!
crypto isakmp client configuration group COMPANY
 key XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 dns 192.168.50.2
 wins 192.168.50.2
 domain COMPANY.local
 pool VPN_CLIENTS
 acl 109
crypto isakmp profile VPNCLIENT
   match identity group VPN_CLIENTS
   client authentication list local
   isakmp authorization list groupauthor
   client configuration address respond
!
!
crypto ipsec transform-set 3DES esp-3des esp-sha-hmac 
 mode tunnel
crypto ipsec df-bit clear
!
crypto ipsec profile VTI
 set transform-set 3DES 
!
!
!
crypto dynamic-map DYNAMIC_MAP 10
 set transform-set 3DES 
 set isakmp-profile VPNCLIENT
!
!
crypto map COMPANY_RAS_VPN 10 ipsec-isakmp dynamic DYNAMIC_MAP 
!
!
!
!
!
!
interface Loopback0
 no ip address
!
interface Tunnel65535
 description COMPANY to MSP256_VPNCORE TunnelTunnel65535
 ip address 10.99.199.2 255.255.255.252
 ip mtu 1374
 ip flow ingress
 ip nat outside
 ip virtual-reassembly in
 ip load-sharing per-packet
 ip tcp adjust-mss 1334
 tunnel source XX.XX.XX.XXX
 tunnel mode ipsec ipv4
 tunnel destination 190.160.120.90
 tunnel sequence-datagrams
 tunnel checksum
 tunnel path-mtu-discovery
 tunnel protection ipsec profile VTI
!
interface ATM0
 description 01883 349484 #23 Line 1
 no ip address
 shutdown
 no atm ilmi-keepalive
 hold-queue 224 in
 pvc 0/38 
  encapsulation aal5mux ppp dialer
  dialer pool-member 1
 !
!
interface Ethernet0
 no ip address
 shutdown
!
interface FastEthernet0
 switchport access vlan 50
 no ip address
 duplex full
 speed 100
!
interface FastEthernet1
 switchport access vlan 82
 no ip address
 duplex full
 speed 100
!
interface FastEthernet2
 switchport access vlan 50
 no ip address
 duplex full
 speed 100
!
interface FastEthernet3
 switchport access vlan 50
 no ip address
 duplex full
 speed 100
!
interface Wlan-GigabitEthernet0
 switchport access vlan 50
 no ip address
!
interface wlan-ap0
 ip unnumbered Vlan50
!
interface Vlan1
 no ip address
 ip virtual-reassembly in
!
interface Vlan50
 ip address 192.168.50.1 255.255.255.0
 ip helper-address 192.168.50.2
 ip flow ingress
 ip flow egress
 ip nat inside
 ip virtual-reassembly in
!
interface Vlan82
 ip address XX.XX.XX.XXX 255.255.255.248
 ip flow ingress
 ip flow egress
 ip nat outside
 ip virtual-reassembly in
 crypto map COMPANY_RAS_VPN
!
interface Dialer1
 description ADSL dialer PLusnet Dialer1
 ip address negotiated
 ip access-group ACL_Outside_In in
 ip flow ingress
 ip flow egress
 ip nat outside
 ip virtual-reassembly in
 encapsulation ppp
 dialer pool 1
 dialer-group 1
!
!
router eigrp 65535
 traffic-share min across-interfaces
 network 10.99.199.0 0.0.0.3
 network 10.168.50.0 0.0.0.255
 network 192.168.50.0
 passive-interface default
 no passive-interface Tunnel65535
 no passive-interface Vlan50
 no eigrp log-neighbor-changes
!
ip local pool NAT_POOL 10.168.50.0 10.168.50.255
ip local pool VPN_CLIENTS 192.168.50.220 192.168.50.229
ip local pool WEBVPN-POOL 192.168.50.230 192.168.50.234
ip forward-protocol nd
no ip http server
ip http port 8080
ip http authentication local
no ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip flow-export source Vlan82
ip flow-export version 9
ip flow-export destination 192.168.50.12 12245
ip flow-export destination 192.168.50.12 12246
ip flow-top-talkers
 top 20
 sort-by bytes
 cache-timeout 360
 match destination address 0.0.0.0 0.0.0.0
!
no ip nat service sip udp port 5060
ip nat pool COMPANY 10.168.50.0 10.168.50.255 prefix-length 24 type match-host
ip nat inside source list 101 interface Vlan82 overload
ip nat inside source static tcp 192.168.50.2 3389 interface Vlan82 3389
ip nat inside source static tcp 192.168.50.2 80 interface Vlan82 80
ip nat inside source static tcp 192.168.50.2 443 interface Vlan82 443
ip nat inside source static tcp 192.168.50.2 1723 interface Vlan82 1723
ip nat inside source static tcp 192.168.50.2 987 interface Vlan82 987
ip nat inside source static tcp 192.168.50.2 4125 interface Vlan82 4125
ip nat inside source static tcp 192.168.50.2 25 interface Vlan82 25
ip nat inside source static tcp 192.168.50.50 990 interface Vlan82 990
ip nat inside source static udp 192.168.50.50 990 interface Vlan82 990
ip nat inside source static tcp 192.168.50.50 50000 interface Vlan82 50000
ip nat inside source static udp 192.168.50.50 50000 interface Vlan82 50000
ip nat inside source static tcp 192.168.50.50 50001 interface Vlan82 50001
ip nat inside source static udp 192.168.50.50 50001 interface Vlan82 50001
ip nat inside source static tcp 192.168.50.50 50002 interface Vlan82 50002
ip nat inside source static udp 192.168.50.50 50002 interface Vlan82 50002
ip nat inside source static tcp 192.168.50.50 50003 interface Vlan82 50003
ip nat inside source static udp 192.168.50.50 50003 interface Vlan82 50003
ip nat inside source static tcp 192.168.50.50 50004 interface Vlan82 50004
ip nat inside source static udp 192.168.50.50 50004 interface Vlan82 50004
ip nat inside source static tcp 192.168.50.50 50005 interface Vlan82 50005
ip nat inside source static udp 192.168.50.50 50005 interface Vlan82 50005
ip nat inside source static tcp 192.168.50.50 50006 interface Vlan82 50006
ip nat inside source static udp 192.168.50.50 50006 interface Vlan82 50006
ip nat inside source static tcp 192.168.50.50 50007 interface Vlan82 50007
ip nat inside source static udp 192.168.50.50 50007 interface Vlan82 50007
ip nat inside source static tcp 192.168.50.50 50008 interface Vlan82 50008
ip nat inside source static udp 192.168.50.50 50008 interface Vlan82 50008
ip nat inside source static tcp 192.168.50.50 50009 interface Vlan82 50009
ip nat inside source static udp 192.168.50.50 50009 interface Vlan82 50009
ip nat inside source static tcp 192.168.50.50 50010 interface Vlan82 50010
ip nat inside source static udp 192.168.50.50 50010 interface Vlan82 50010
ip nat inside source static tcp 192.168.50.7 22 interface Vlan82 22
ip nat inside source static tcp 192.168.50.7 9090 interface Vlan82 9090
ip nat inside source static 192.168.50.1 10.168.50.1 route-map MSP256 extendable
ip nat inside source static 192.168.50.2 10.168.50.2 route-map MSP256 extendable
ip nat inside source static 192.168.50.3 10.168.50.3 route-map MSP256 extendable
ip nat inside source static 192.168.50.10 10.168.50.10 route-map MSP256 extendable
ip route 0.0.0.0 0.0.0.0 80.70.60.142
ip route 190.160.120.90 255.255.255.255 80.70.60.142
ip ssh port 2220 rotary 1
ip ssh source-interface Vlan50
ip ssh rsa keypair-name COMPANY.com
ip ssh version 2
!
ip access-list standard ACL_SPLIT_TUNNEL
!
ip access-list extended ACL_Outside_In
 deny   ip 192.168.0.0 0.0.255.255 any
 deny   ip 172.16.0.0 0.15.255.255 any
 deny   ip 10.0.0.0 0.255.255.255 any
 deny   ip 127.0.0.0 0.255.255.255 any
 deny   ip 255.0.0.0 0.255.255.255 any
 deny   ip 224.0.0.0 31.255.255.255 any
 deny   ip host 0.0.0.0 any
 deny   ip host 255.255.255.255 any
 permit tcp any any established
 permit udp any eq domain any
 permit udp any eq ntp any
 permit icmp any any unreachable
 permit icmp any any echo-reply
 permit icmp any any packet-too-big
 permit icmp any any time-exceeded
 permit icmp any any traceroute
 permit icmp any any administratively-prohibited
 permit icmp any any echo
 permit esp host 89.160.170.68 any
 permit udp host 89.160.170.68 any eq isakmp
 permit udp host 89.160.170.68 any eq non500-isakmp
 permit esp host 213.10.28.11 any
 permit udp host 213.10.28.11 any eq isakmp
 permit udp host 213.10.28.11 any eq non500-isakmp
 permit udp host 176.25.205.15 any eq 3700
 permit udp host 176.25.205.15 eq 3700 any
 permit udp host 80.238.12.230 eq 3700 any
 permit udp any any gt 1023
 remark permit udp any any
 deny   icmp any any
 deny   udp any any log
 deny   tcp any any log
 deny   ip any any log
ip access-list extended RAS_VPN_CLIENTS
 permit ip any host 192.168.50.220
 permit ip any host 192.168.50.221
 permit ip any host 192.168.50.222
 permit ip any host 192.168.50.223
 permit ip any host 192.168.50.224
 permit ip any host 192.168.50.225
 permit ip any host 192.168.50.226
 permit ip any host 192.168.50.227
 permit ip any host 192.168.50.228
 permit ip any host 192.168.50.229
!
logging trap debugging
logging source-interface Loopback0
dialer-list 1 protocol ip permit
!
route-map MSP256 permit 10
 match ip address 199
 match interface Tunnel65535
!
snmp-server community $$public$$ RO
snmp-server enable traps vrfmib vrf-up vrf-down
!
access-list 101 deny   ip 192.168.50.0 0.0.0.255 10.0.0.0 0.255.255.255
access-list 101 deny   ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
access-list 101 permit ip 192.168.50.0 0.0.0.255 any
access-list 102 permit ip 192.168.50.0 0.0.0.255 any
access-list 103 permit ip 192.168.50.0 0.0.0.255 10.99.1.0 0.0.0.255
access-list 103 permit ip 192.168.50.0 0.0.0.255 10.240.168.128 0.0.0.31
access-list 103 permit ip 192.168.50.0 0.0.0.255 10.240.140.0 0.0.0.31
access-list 103 permit ip 192.168.50.0 0.0.0.255 10.99.15.0 0.0.0.255
access-list 104 permit ip host 192.168.50.201 192.168.50.0 0.0.0.255
access-list 104 permit ip host 192.168.50.202 192.168.50.0 0.0.0.255
access-list 104 permit ip host 192.168.50.203 192.168.50.0 0.0.0.255
access-list 104 permit ip host 192.168.50.204 192.168.50.0 0.0.0.255
access-list 104 permit ip host 192.168.50.205 192.168.50.0 0.0.0.255
access-list 109 permit ip any host 192.168.50.220
access-list 109 permit ip any host 192.168.50.221
access-list 109 permit ip any host 192.168.50.222
access-list 109 permit ip any host 192.168.50.223
access-list 109 permit ip any host 192.168.50.224
access-list 109 permit ip any host 192.168.50.225
access-list 109 permit ip any host 192.168.50.226
access-list 109 permit ip any host 192.168.50.227
access-list 109 permit ip any host 192.168.50.228
access-list 109 permit ip any host 192.168.50.229
access-list 199 permit ip 192.168.50.0 0.0.0.255 10.99.0.0 0.0.255.255
!
!
!
control-plane
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
!
alias exec ap service-module wlan-ap0 session
!
line con 0
 exec-timeout 0 0
 no modem enable
line aux 0
line 2
 no activation-character
 no exec
 transport preferred none
 transport input all
 stopbits 1
line vty 0 4
 exec-timeout 0 0
 rotary 1
 transport input ssh
!
scheduler allocate 20000 1000
ntp source Vlan50
ntp server 3.uk.pool.ntp.org
ntp server 2.uk.pool.ntp.org
ntp server 1.uk.pool.ntp.org
ntp server 0.uk.pool.ntp.org minpoll 10
onep
!
!
!
!
webvpn gateway WEBVPN-GATEWAY
 ip address XX.XX.XX.XXX port 9443  
 ssl encryption aes256-sha1
 ssl trustpoint TRUSTPOINT
 logging enable
 inservice
 !
webvpn context WEBVPN-CONTEXT
 title "COMPANY VPN"
 !
 acl "SSL-ACL"
   permit ip any 192.168.50.0 255.255.255.0
 login-message "COMPANY WebVPN"
 aaa authentication list SSLVPN
 gateway WEBVPN-GATEWAY
 max-users 8
 !
 ssl authenticate verify all
 !
 url-list "rewrite"
 inservice
 !
 policy group WEBVPNPOLICY
   functions svc-enabled
   filter tunnel SSL-ACL
   svc address-pool "WEBVPN-POOL" netmask 255.255.255.0
   svc default-domain "COMPANY.local"
   svc rekey method new-tunnel
   svc split include 192.168.50.0 255.255.255.0
   svc dns-server primary 192.168.50.2
   svc wins-server primary 192.168.50.2
 default-group-policy WEBVPNPOLICY
!
end

AP Config:

!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname COMPANY_AP
!
logging rate-limit console 9
enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
!
no aaa new-model
!
!
dot11 syslog
!
dot11 ssid COMPANY
   authentication open
   authentication key-management wpa version 2
   guest-mode
   wpa-psk ascii 0 password1234
!
!
!
username patrick privilege 15 secret 5 XXXXXXXXXXXXXXXXXXXX
!
!
ip ssh rsa keypair-name COMPANY.com
ip ssh version 2
bridge irb
!
!
interface Dot11Radio0
 no ip address
 no ip route-cache
 !
 encryption mode ciphers aes-ccm
 !
 ssid COMPANY
 !
 antenna gain 0
 station-role root
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface GigabitEthernet0
 description the embedded AP GigabitEthernet 0 is an internal interface connecting AP with the host router
 no ip address
 no ip route-cache
 bridge-group 1
 no bridge-group 1 source-learning
 bridge-group 1 spanning-disabled
!
interface BVI1
 ip address 192.168.50.10 255.255.255.0
 no ip route-cache
!
ip default-gateway 192.168.50.1
no ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
bridge 1 route ip
!
!
banner exec ^CC
-----------------------------------------------------------------------

-----------------------------------------------------------------------
^C
!
line con 0
 privilege level 15
 login local
 no activation-character
line vty 0 4
 login local
 transport input ssh
line vty 5 15
 login
 transport input ssh
!
cns dhcp
end
4
  • 1
    If that is your actual external IP address i do suggest you hide it in the configurations and question for the benefit of security. Your username is also showing in the Router configuration. :-)
    – user36472
    Jul 26 '17 at 12:23
  • That isn't my actual external IP, I've been through and anonymised everything. That would have been a bit of a foolish mistake wouldn't it 'my router is insecure, here is how to get to it and here is my username too' edit : I see you've gone an further anonymised everything for me too. Thanks for the concern :)
    – Patrick
    Jul 27 '17 at 9:36
  • 1
    Well i changed it just in case, because you didn't reply yesterday, but thanks for clarifying. :-)
    – user36472
    Jul 27 '17 at 11:08
  • 1
    Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Feb 19 '18 at 17:02
1

I think telnet is open in router because line 2 is not configured to transport to ssh :

line 2
 no activation-character
 no exec
 transport preferred none
 transport input all
 stopbits 1  

i will back to you again, i suggest to remove configuration just we need ssh and acl configuration

2
  • I'm not sure I understand this still. I cannot login to the router with telnet, I can login to the AP with telnet. I see what you are saying with regards to the router configuration but I don't understand how the router configuration you highlight could be allowing telnet to successfully connect to the AP.
    – Patrick
    Jul 27 '17 at 14:44
  • 15 line VTY are configured in the router line 2 is not required SSH. just type show line in the router and check which line VTY you login. Aug 5 '17 at 12:03
0

For the sake of clearing this off the unanswered list.

The solution, after finding that this was only one, and a relatively minor one, of a fairly long list of problems with the configuration of this device, and given that was was approaching end of life, was to configure a pfSense box on some spare hardware we had and get rid of the Cisco entirely.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.