Network on Blog - uTIcARdI

openwrt DDNS, acme commands

Wed, 15 Sep 2021 00:00:00 +0000

I’m using OpenWrt R21.8.6 by compile it from coolsnowwolf/lede.

1. Install softwares on Openwrt

acme
ddns-scripts (This originally built when compile the firmware)

2. DDNS configuration

DNS System

Creating a dynamic DNS record on your DNS service provider (Mine is running over dns.he.net)

Dynamic DNS A Record - New

Generate password for DDNS

Run Arista VM 4.2.2 and later version on EVE(UNL)

Sun, 08 Dec 2019 00:00:00 +0000

One of my friends did his VXLAN practices, he came to me for help because he was unable to start the Arista instance on EVE-NG.

The Arista vm can be started and stuck at:

Issue

I did a search and found a clue in the Arista forum, the instance began to work after changed the CPU number to 2:

IOS command:IP classless

Sat, 09 Feb 2019 00:00:00 +0000

I wrote down this article in 2009-03-13 when I was looking for my first job. Taking this again today as preparation for CCNP.

Topology:

Topology

Configuration

Configured IP addresses on the routers
Note: The subnets of R1’s Loopback1 and R2’s Loopback1 belong to the class A address.
Execute command “ip classless” on both R1 and R2 (The command has been the default since IOS 11.3)

Run ASA9.1 on EVE(UNL)

Fri, 21 Dec 2018 00:00:00 +0000

This blog discusses ASA, not ASAv. Refer to

It’s possible to run ASA9.1 on EVE-NG (UNL, unified network lab), so I did a try:

Image preparation

No, I can’t provide the image to anyone, and I won’t respond to any question about it. Please Refer to following posts for the image file:
Refer to http://www.eve-ng.net/index.php/documentation/images-table, EVE only support hda.qcow2 format disk. Covert your image to qcow2 format before the next step.

IPSec Over Palo Alto FW Static NAT

Wed, 19 Dec 2018 00:00:00 +0000

It took me about 2 hours on the following scenario and the root cause was located: lacking a static route on Palo Alto, so I decided to summarize every step here for further reference. Here is the topology on EVE-NG:

Topology

The left part is the office, and the right part is Internet
10.0.56.5 of R6 was NATed to IP: 10.0.17.3 by Palo Alto which establishes IPSec tunnel with R8: 10.0.78.8
Traffic from 5.5.5.0/24 to 8.8.8.0/24 will be forward over the #1 IPSec
All device in ‘LAN’ could access ‘Internet’ via Port Translation

1. Initial Palo Alto

Console access Palo Alto with username/password: admin/admin, and configure MGMT IP 172.16.185.132 (I have bridged the MGMT interface of Palo Alto to my laptop). Here are the commands for the initialization:

MAC OS-Wireshark/VNC与EVE-NG(UNL)的集成

Mon, 17 Dec 2018 00:00:00 +0000

版权声明：以下链接是本文的原文，对本文及原文任何内容、链接的转发、引用请务必标注以下链接:

解决思路：

MAC OX上没有为URL中’capture://’前缀协议关联程序，我们可以编辑系统中已经存在的条目，但按需添加并不简单。

所以需要创建一个关联程序，并由它调用WireShark。此功能可以通过AppleScript实现，并实现关联’capture://’及调用Wireshark.

Ansible-Access Network via Netconf

Thu, 11 Oct 2018 00:00:00 +0000

Continue to try ansible with the device which was configure in netconf feature on Cisco IOS/IOSXE.

Ansible Inventory:

---
netconf:
hosts:
 netconfIos:
 ansible_host: "172.16.254.100"
 ansible_network_os: "ios"
 ansible_ssh_port: 22
 netconfJunos:
 ansible_host: "172.16.254.9"
 ansible_network_os: "junos"
 ansible_ssh_port: 830
vars:
 ansible_connection: "netconf"
 ansible_ssh_user: test
 ansible_ssh_pass: test123

Note:

ansible_connnection should be ‘netconf’
Be careful on the netconf port, it should be 22 if you enable netconf over SSH (the default port is 830)

PlayBook:

- name: IOS
hosts: netconfIos
gather_facts: false
tasks:
 - name: Get config for IOS devices
 netconf_get:
 source: running
 register: iosnetconf

 - name: Display output
 debug:
 msg: "{{ iosnetconf.stdout }}"

Note:

Netconf feature on Cisco IOS/IOSXE

Sun, 07 Oct 2018 00:00:00 +0000

I tried to see how Ansible works with the netconf feature on Cisco and Juniper in past days: Juniper’s official document is clear and easy to follow. but for Cisco, I followed NETCONF over SSHv2, unfortunately, I was stuck on it for 6 days.

OS Version

Cisco IOS XE Software, Version 16.04.01
Cisco IOS Software, Linux Software (I86BI_LINUXL2-IPBASEK9-M), Experimental Version 15.2(20170809:194209) [dstivers-aug9_]

NetConf Requests

Tried many requests, all failed:

The hello (works) request:

Monitor network connections based on Process

Fri, 21 Sep 2018 00:00:00 +0000

Wireshark is widely used in packets capturing with flexible filters, but for some particular cases, end users care about the network sessions which established by a specific application.

I will show how to check the sessions of ‘Microsoft OneNote’.

Windows

Microsoft provides its own product for packets capturing: Microsoft Network Monitor.

Lunch ‘Microsoft Network Monitor’ before you run OneNote:

nm-1

You will see the processes from the left panel, All related network sessions will shown in the ‘frame summary’ window once OneNote lunched:

Ansible-Access Network via SSH

Tue, 04 Sep 2018 00:00:00 +0000

After Telnet, continue to discuss how to access network device via SSH with Ansible.

For SSH access, we should consider 3 methods:

Username/password
Username/Public-Key without password
Username/Public-Key with password

Same EVE lab as the Telnet one: The Cisco IOS Router-192.168.1.99 is for SSH

Topo

Enable SSH on the router

Jump #1 username/password part to public key configuration, I discussed how to configure public key on IOS router with Putty before, instead of windows/putty, openssh is useful for generating keys on MAC OS.

Ansible-Access Network via Telnet

Tue, 04 Sep 2018 00:00:00 +0000

I’m learning Ansible by reading the official document and some books like Ansible入门. Most of the instructions show you how to deploy or maintain the services on Linux, or file operations. But what I do is trying to explore its capability on network device management automation.

The most important thing to practice routers/switches/routing protocol is accessing the device and configure it via CLI when I started to learn network, so I start my ansible tour by accessing the network device from CLI too.

Run PaloAlto VM on EVE(UNL)/virtualbox/OSX

Thu, 25 Jan 2018 00:00:00 +0000

I tried to run Palo Alto on EVE/Virtualbox/Apple MAC OS and found it fails to start the Palo Alto Firewall. So I decided to find the root cause. (EVE suggests the users use VMware, I used VirtualBox instead because I don’t have a VMware Fusion license)

I went through EVE logs 1st.

System -> System logs -> unl_wrapper.txt

Log

and found the log:

tc-How it work on different IPs

Fri, 22 Sep 2017 00:00:00 +0000

#!/bin/bash
interface=eth0
ip1=192.168.1.1
ip2=172.16.1.1
delay1=100ms
delay2=200ms
tc qdisc add dev $interface root handle 1: prio
tc qdisc add dev $interface parent 1:1 netem delay $delay1 10ms 25%
tc filter add dev $interface parent 1: protocol ip prio 1 u32 match ip dst $ip1 flowid 1:1
tc qdisc add dev $interface parent 1:2 netem delay $delay2 10ms 25%
tc filter add dev $interface parent 1: protocol ip prio 2 u32 match ip dst $ip2 flowid 1:2

Cisco IPS–Inline VLAN Pair mode

Fri, 24 Mar 2017 00:00:00 +0000

Setup Cisco IPS on EVE

I failed to setup Cisco IPS on EVE(ver 2.0.3-53). I Downloaded Cisco IPS ova file via certcollection (mega)

Followed the [instructions](http://certcollection.org/forum/topic/266792-emulating-ips-on-unl/ http://www.cznetlab.cz/index.php?cat=cciesec&subcat=unlips) for IPS Interfaces.

and met the issue:

Cisco IPS failed to ping anything out of it, I run traffic capture on IPS’s interface, no packet out when I execute the ping command.

Related post on EVE official forum, and the official answer is: This image is corrupted and not working neither on UNL nor EVE

Run NX-OSv 9000 on EVE(UNL)

Sun, 08 Jan 2017 00:00:00 +0000

Refer to how to add NX-OXv 9000 to GNS3

1. Download image files

Here is the NX-OSv9k image file from Cisco (nxosv-final.7.0.3.I5.1.qcow2). Please note that you must have a service contract with Cisco in order to download it.

No I can’t provide the image to anyone.

2. Copy image to eve(UNL)

change file name to ‘hda.qcow2’

copy source file to ‘/opt/unetlab/addons/qemu/nxosv9k-7.0.3.I5.1’

run

/opt/unetlab/wrappers/unl_wrapper -a fixpermissions

3. Add a New node for nxosv9k

Copy the php file to ‘/opt/unetlab/html/templates/’

VSphere6, VCenter6 Installation

Fri, 08 Jan 2016 00:00:00 +0000

Crash happened when I install Vsphere on my PC

Solution: Disable option “Limit Maximum CPUID” in Bios
VCenter appliance deployment

Vmware doesn’t provide vcenter appliance in ova/ovf format anymore, follow the instruction to deploy it.
Inventory is empty in the VCenter webpage

The most important thing: Don’t login vcenter by the account ‘root’, instead of it using SSO account. the account in the format: ‘administrator@domain-name’

Also, Vmware has a KB about this issue:

Dynagen/Dynamips error: netio_desc_create_udp: unable to connect to

Fri, 20 Dec 2013 00:00:00 +0000

OS: CentOS 6.5 x86_64 installed on vmware
Dynamips 0.2.10

There is an error when loading a .net file named as test.net with 100 devices in Dynagen.0.11.0:

netio_desc_create_udp: unable to connect to

I searched on the Internet about this error msg, most of posts shared a method: specified UDP port of dynamips instance in .net file. But it doesn’t work for me.

As I found a Dynagen description in GNS3 website: however Dynagen is still updated and developed for GNS3, this means you can download GNS3 sources, find Dynagen in it.

SNMP simulator installation guide

Wed, 13 Nov 2013 00:00:00 +0000

About SNMP Simulator

The the SNMP Simulator software is intended for testing SNMP Managers against a large number of SNMP Agents that represent a potentially very large network populated with different kinds of SNMP-capable devices.

Refers to its project page for more info.

Why?

With SNMP simulator you can simulate a device by the output of SNMPwalk without considering MIB files.

This article is about how to install SNMP Simulator.

Install Python

Trouble shooting: Cisco router DHCP No option 125

Wed, 13 Nov 2013 00:00:00 +0000

Topology:

Topo

Configure DHCP on Cisco router 2811 to assign a static IP to the italkBB: Cisco SPA 1202.

start DHCP service by command:
```
service dhcp
```

debug on Cisco router to check DHCP request by the commands:

debug ip dhcp server packet
terminal monitor

Debug info :

DHCPD: DHCPREQUEST received from client 0100.1c23.3541.98

configure DHCP

Configuring SSH public key authentication on Cisco IOS Device

Fri, 08 Nov 2013 00:00:00 +0000

SSH public Key types:

RSA key use with SSH1 and SSH2 protocol
DSA key use with SSH2 protocol

Note: DSA is weak than RSA

The Key pairs:

Public key: SSH.com使用的RFC 4716指定的公钥格式，而OpenSSH使用了另外的格式
Private Key: SSH v1私钥只有一种标准格式，但SSH v2私钥格式很多，OpenSSH、ssh.com、puty、winscp格式不同且不兼容

Generate the Key

SecureCRT

SecureCRT-PublicKey-1

SecureCRT-PublicKey-2

SecureCRT-PublicKey-3

密钥类型有两种: DSA、RSA. Secure CRT提示多种服务器不支持RSA, Cisco IOS supports RSA only.

SecureCRT-PublicKey-4

通行短语为对私钥加密的密码，注释为提示输入密码时的提示，两项均为可为空

SecureCRT-PublicKey-5

SecureCRT-PublicKey-6

SecureCRT-PublicKey-7

为了更好的兼容性和适用性，OpenSSH format is prefered，Choose the location to save the key files：

SecureCRT-PublicKey-8

点击’Finish’后会弹出对话框：

SecureCRT-PublicKey-9

如果选择’Yes’,会影响’快速连接’中的公钥指向保存的文件:

SecureCRT-PublicKey-10

Open LDAP and SSH Public key

Fri, 08 Nov 2013 00:00:00 +0000

The article is about how I setup Open LDAP on CentOS6 for SSH public key authentication.

1.Download and install CentOS6.2

CentOS-6.xx-i366-minimal.iso

2. CentOS configuration

Network: IP address, DNS, and restart network service

vi /etc/resolv.conf/DNS
vi /etc/sysconfig/network-scripts/ifcfg-eth0/NIC IP
vi /etc/networks//Route
/etc/init.d/network restart

configure host file
```
vi /etc/hosts
```
Modify 127.0.0.1 item to FQDN format because openldap get dc from the item automatically.
```
127.0.0.1 ldap.kzblog.com
```
Stop security services
```
setenforce permissive
getenforce
service iptables stop
```
Note: This only for the testing environment.