Arsalan A. Suzuki's Blog

Basic Frame Relay Configuration

Arsalan A. Suzuki — Tue, 09 Aug 2011 16:18:32 +0000

This article shows how to configure basic frame relay without using inverse ARP.

We’ll be using the above topology for the configuration. The IP addresses of the routers are 192.168.1.X, where X is the router number.

Configuration Steps

Assign IP address to the serial interface
Configure frame relay encapsulation
Set frame map for each router

Configuration

Lets assign an IP address to the serial interface

R1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#interface serial 0/0
R1(config-if)#ip address 192.168.1.1 255.255.255.0

R2#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R2(config)#interface serial 0/0
R2(config-if)#ip address 192.168.1.2 255.255.255.0

R3#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R3(config)#interface serial 0/0
R3(config-if)#ip address 192.168.1.3 255.255.255.0

Now enable frame relay encapsulation on serial interface and disable inverse ARP

R1(config-if)#encapsulation frame-relay
R1(config-if)#no frame-relay inverse-arp

R2(config-if)#encapsulation frame-relay
R2(config-if)#no frame-relay inverse-arp

R3(config-if)#encapsulation frame-relay
R3(config-if)#no frame-relay inverse-arp

Configure frame relay map to associate IP addresses with proper DLCI and no shut the interface

Basic frame map syntax is

frame-relay map ip

R1(config-if)#frame-relay map ip 192.168.1.2 102
R1(config-if)#frame-relay map ip 192.168.1.3 103
R1(config-if)#frame-relay map ip 192.168.1.1 103
R1(config-if)#no shutdown

R2(config-if)#frame-relay map ip 192.168.1.1 201
R2(config-if)#frame-relay map ip 192.168.1.2 201
R2(config-if)#frame-relay map ip 192.168.1.3 201
R2(config-if)#no shutdown

R3(config-if)#frame-relay map ip 192.168.1.3 301
R3(config-if)#frame-relay map ip 192.168.1.2 301
R3(config-if)#frame-relay map ip 192.168.1.1 301
R3(config-if)#no shutdown

Here we are adding IP addresses and the DLCI to reach remote routers. Note that spoke routers (R2 and R3) have 201 and 301 DLCI respectively. Hub router (R1) is using 102 and 103 to reach R2 and R3.

By default, frame relay interface cannot ping itself, so we added local IP address to the frame map as well. For example, when R1 pings itself, the router will send ICMP out DLCI 103 and then R3 will send it back to R1.

Verfication

To display frame map

R1#show frame-relay map
Serial0/0 (up): ip 192.168.1.2 dlci 102(0x66,0x1860), static,
              CISCO, status defined, active
Serial0/0 (up): ip 192.168.1.1 dlci 103(0x67,0x1870), static,
              CISCO, status defined, active
Serial0/0 (up): ip 192.168.1.3 dlci 103(0x67,0x1870), static,
              CISCO, status defined, active

Checking end to end connectivity. Lets check R2 to R3

R2#ping 192.168.1.3

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/28/76 ms
R2#trace
R2#traceroute 192.168.1.3

Type escape sequence to abort.
Tracing the route to 192.168.1.3

  1 192.168.1.1 60 msec 40 msec 52 msec
  2 192.168.1.3 68 msec *  72 msec

The trace route shows that the packet goes from R2 > R1 > R3

That’s it for this tutorial. You can also trace route local address to get similar output.

Ping Multiple Addresses Using TCL Script Part 2

Arsalan A. Suzuki — Sat, 18 Jun 2011 06:08:44 +0000

Part 1 of this tutorial showed how to ping multiple IP addresses using TCL script. This tutorial will further refine the script which was in Part 1. Instead of foreach loop, we will be using for loop to make the script shorter.

TCL Script

Here is the sample script

for { set i 1 } { $i <= 10 } { incr i } {
ping 192.168.1.$i re 2
}

When the loop is run for the first time, the variable i=1. The value of i will be incremented until i=10, then the loop will exit.
The above script will ping IP addresses 192.168.1.1 through 192.168.1.10

Executing the Script

Router#tclsh
Router(tcl)#for { set i 1 } { $i <= 10 } { incr i } {
+>(tcl)#ping 192.168.1.$i re 2
+>(tcl)#}

Sample output

Type escape sequence to abort.
Sending 2, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!
Success rate is 100 percent (2/2), round-trip min/avg/max = 4/4/4 ms
Type escape sequence to abort.
Sending 2, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!
Success rate is 100 percent (2/2), round-trip min/avg/max = 4/4/4 ms
Type escape sequence to abort.
Sending 2, 100-byte ICMP Echos to 192.168.1.3, timeout is 2 seconds:
!!
Success rate is 100 percent (2/2), round-trip min/avg/max = 1/1/1 ms
Type escape sequence to abort.
Sending 2, 100-byte ICMP Echos to 192.168.1.4, timeout is 2 seconds:
!!
Success rate is 100 percent (2/2), round-trip min/avg/max = 1/2/4 ms
Type escape sequence to abort.
Sending 2, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:
!!
Success rate is 100 percent (2/2), round-trip min/avg/max = 1/1/1 ms
Type escape sequence to abort.
Sending 2, 100-byte ICMP Echos to 192.168.1.6, timeout is 2 seconds:
!!
Success rate is 100 percent (2/2), round-trip min/avg/max = 1/1/1 ms
Type escape sequence to abort.
Sending 2, 100-byte ICMP Echos to 192.168.1.7, timeout is 2 seconds:
!!
Success rate is 100 percent (2/2), round-trip min/avg/max = 4/4/4 ms
Type escape sequence to abort.
Sending 2, 100-byte ICMP Echos to 192.168.1.8, timeout is 2 seconds:
!!
Success rate is 100 percent (2/2), round-trip min/avg/max = 1/2/4 ms
Type escape sequence to abort.
Sending 2, 100-byte ICMP Echos to 192.168.1.9, timeout is 2 seconds:
!!
Success rate is 100 percent (2/2), round-trip min/avg/max = 1/1/1 ms
Type escape sequence to abort.
Sending 2, 100-byte ICMP Echos to 192.168.1.10, timeout is 2 seconds:
!!

That's it for this tutorial. The variable can also be tweaked to ping the whole subnet.

Ping Multiple Addresses Using TCL Script Part 1

Arsalan A. Suzuki — Tue, 14 Jun 2011 00:45:45 +0000

There might be situation where you might need to ping multiple IP addresses to check the full connectivity between devices.

This tutorial shows you exactly how to do that using TCL script.
I’ll be explaining how it works in details so you don’t need to have any programming or scripting experience.

TCL Script

Below is the sample script TCL script to ping multiple IP addresses.

foreach ip {
192.168.1.1
192.168.1.2
192.168.1.3
192.168.1.4
192.168.1.5
192.168.1.6
192.168.1.7
192.168.1.8
192.168.1.9
192.168.1.10
} { ping $ip }

What the above script is doing is that, when foreach loop is run for the first time, it populates the variable $ip with first IP address (192.168.1.1). The second time the loop runs, $ip becomes 192.168.1.2.

The loop will keep running until it reaches the last ip address (i.e 192.168.1.10)
The last part of the script would be { ping $ip }. This will ping the IP address by substituting variable $ip with the listed values one at a time. As the loop have 10 IP addresses, the ping command will run 10 times with different IP addresses.

Executing the Script

First get into TCL scripting shell/mode

Router>enable
Router#tclsh
Router(tcl)#

Copy the above TCL script.

Router(tcl)#foreach ip {
+>192.168.1.1
+>192.168.1.2
+>192.168.1.3
+>192.168.1.4
+>192.168.1.5
+>192.168.1.6
+>192.168.1.7
+>192.168.1.8
+>192.168.1.9
+>192.168.1.10
+>} { ping $ip re 5 }

If you press enter, the script will be executed. The following is the output of the above script

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.3, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.6, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.7, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.9, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

This tutorial showed very basic TCL script. You can modify or tweak this script to do lot of things, like pinging the whole subnets, etc.
Check out the Part 2 of this tutorial

Lookeen Backup Manager for Microsoft Office Outlook

Arsalan A. Suzuki — Fri, 10 Jun 2011 00:23:35 +0000

Download Free Trial of Lookeen Backup Manager

Lookeen Backup Manager

With Lookeen Backup Manager©, created by Axonic, it is possible to create backups for Emails, contacts, calendar entries, and even the settings and options in Microsoft® Office Outlook. The full version has been available since March 2011 in the company’s online shop.

Outlook in your daily work – impossible to do without

The majority of daily business communication is done today by e-mail. In addition, there are saved addresses in Outlook and the administration of appointments in the Outlook calendar. The loss of this data can have disastrous results, not only for freelancers, but also for entire companies. Worst-case scenario is the loss of sensitive information found in e-mails, contacts or calendar entries.

Protect yourself beforehand with Lookeen Backup Manager
It is even more important to protect yourself beforehand with appropriate software. By backing up with the Lookeen Backup Manager© from Axonic you can save, aside from e-mails, contacts and calendar entries, whole data files, notes, tasks and your entire settings and options in Outlook. The Backup Manager compresses all individually chosen pieces of information into one single file, which can be unzipped again on every Windows system and with every Outlook version.

Fully automated backups increase security – easy and reliable
If you want total security, you should perform regular backups. Lookeen Backup Manager relieves stress by offering the option to create automatic backups. If you link your Backup settings to a Windows task, then backups will be regularly and reliably created without causing extra work.

Create individual settings
Lookeen Backup Manager allows you to save limitless amounts of data and to back up settings separately. In doing so, the user defines what information is important to him. The program works with all Windows versions, from 2000 to Windows 7, and is compatible with all established Outlook versions. A trial version of this program is available on the homepage for download; the license can be purchased at the site shop.
http://www.outlook-backup.com

About Axonic
Axonic Informationssysteme GmbH is a young company with a high focus on information, communication and recognition technologies. The company is based in Karlsruhe and was founded in 2003 by Martin Welker. Axonic has researched and developed very intensely for several years now within the domain of “Communication Intelligence”, the target-orientated display and analysis of communications.

Spokesperson:
Stephanie Zimmermann
Axonic Informationssysteme GmbH
Kaiserstraße 241 – 76133 Karlsruhe – Germany
E-Mail: stephanie.zimmermann@axonic.net
Phone: +49 (721) 352 83 75

Enable Telnet Access on Cisco Router

Arsalan A. Suzuki — Mon, 16 May 2011 19:10:37 +0000

This short tutorial shows how to enable telnet access on the router.

Configuration

Use the following commands to enable telnet access to the router.

First check how many virtual terminal router supports.
(Depending on the router model, the output might be different)

Router#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#line vty 0 ?
  <1-4>  Last Line number

Enable access to virtual terminals and set the “cisco” as the password

Router(config)#line vty 0 4
Router(config-line)#password cisco
Router(config-line)#login

Verification

To verify use the following command

Router#show line
   Tty Typ     Tx/Rx    A Modem  Roty AccO AccI   Uses   Noise  Overruns   Int
*     0 CTY              -    -      -    -    -      0       0     0/0       -
     97 AUX   9600/9600  -    -      -    -    -      0       0     0/0       -
     98 VTY              -    -      -    -    -      1       0     0/0       -
     99 VTY              -    -      -    -    -      0       0     0/0       -
    100 VTY              -    -      -    -    -      0       0     0/0       -
    101 VTY              -    -      -    -    -      0       0     0/0       -
    102 VTY              -    -      -    -    -      0       0     0/0       -

Line(s) not in async mode -or- with no hardware support:
1-96

Router#

Thats it. Now you can access the router remotely using telnet

Adding Users in Linux

Arsalan A. Suzuki — Sat, 14 May 2011 21:20:02 +0000

This short tutorial shows you how to add Linux user using CLI.

useradd Command Syntax

You can add users using useradd command.

Usage: useradd [options] LOGIN

Options:
  -b, --base-dir BASE_DIR       base directory for the home directory of the
                                new account
  -c, --comment COMMENT         GECOS field of the new account
  -d, --home-dir HOME_DIR       home directory of the new account
  -D, --defaults                print or change default useradd configuration
  -e, --expiredate EXPIRE_DATE  expiration date of the new account
  -f, --inactive INACTIVE       password inactivity period of the new account
  -g, --gid GROUP               name or ID of the primary group of the new
                                account
  -G, --groups GROUPS           list of supplementary groups of the new
                                account
  -h, --help                    display this help message and exit
  -k, --skel SKEL_DIR           use this alternative skeleton directory
  -K, --key KEY=VALUE           override /etc/login.defs defaults
  -l, --no-log-init             do not add the user to the lastlog and
                                faillog databases
  -m, --create-home             create the user's home directory
  -M, --no-create-home          do not create the user's home directory
  -N, --no-user-group           do not create a group with the same name as
                                the user
  -o, --non-unique              allow to create users with duplicate
                                (non-unique) UID
  -p, --password PASSWORD       encrypted password of the new account
  -r, --system                  create a system account
  -s, --shell SHELL             login shell of the new account
  -u, --uid UID                 user ID of the new account
  -U, --user-group              create a group with the same name as the user
  -Z, --selinux-user SEUSER     use a specific SEUSER for the SELinux user mapping

Command Usage

To add an user account use the command below.
Note : You must be logged in as root user (or use “sudo su” command)

Add user named testuser01 with “Test User 1″ as its “Display Name”
-m switch will create user’s home directory

root@ubuntu:~# useradd -c "Test User 1" -m testuser01

Now set the password for user account

root@ubuntu:~# passwd testuser01
Enter new UNIX password:
Retype new UNIX password:
passwd: password updated successfully
root@ubuntu:~#

Verification

Check if the newly created user is in the passwd file

root@ubuntu:~# tail -n 1 /etc/passwd
testuser01:x:1001:1001:Test User 1:/home/testuser01:/bin/sh

The password is stored as SHA512 format in shadow file

root@ubuntu:~# tail -n 1 /etc/shadow
testuser01:$6$9R0tTLo7$ZD32rIGGbUTac0Ump7JL.O18tUIoNRtvSYTuwao0Pe7ZFqiKwk3nnbR5PWU4w1an7MgCdmVouHkj.d0soyYka1:15108:0:99999:7:::

Verify that the home directory exists

root@ubuntu:~# ls /home
test  testuser01

Summary

This tutorial covered basics of user creation in Linux with appropriate home directory. I have used Ubuntu for this demo, but this same commands can be used in any other distributions.

Cisco ūmi Home Telepresence on Your TV Set

Arsalan A. Suzuki — Thu, 07 Oct 2010 08:26:22 +0000

Cisco announced Umi, a video conferencing appliance for typical consumers.

Umi consists of camera mounted to the top of the screen which can capture Full HD 1080p video at 30 frames per second. The camera is connected to a device which act as a internet gateway for the TV.

Umi which is scheduled to be available by November and is expected to cost around $599 with $24.99 monthly service charge for unlimited video calling.

Detailed specs of Umi

Video Resolution

Full HD 1080p video calling (1920×1080 pixels) and 720p recording at 30 frames per second.
Dynamic resolution scaling based on available bandwidth (1080p, 720p, and 480p supported)

Camera Optics and Mechanics

Optical zoom
Multi glass lens
Auto focus, auto exposure and auto white balance
Motorized aim –pan, tilt, and zoom
Motorized shutter for privacy control

Microphone and Speaker

Built-in microphone array with software beamforming
Embedded speaker for incoming call ringing

TV Compatibility

Compatible with high-definition widescreen TVs capable of 1080p or 720p with available HDMI port.

Networking

Wi-Fi (802.11 b/g/n )
10/100 Ethernet (RJ-45)

Video Input and Outputs

HDMI Out: ūmi console to TV, HDMI In: media passthrough supported with select set top boxes and BluRay equipment.

Audio Output

Digital audio over HDMI or optical audio

Infrared

Built-in IR receiver for ūmi remote

Source : Cisco Umi Products

Configuring Port Aggregation with EtherChannel

Arsalan A. Suzuki — Mon, 04 Oct 2010 16:28:50 +0000

What is EtherChannel?

EtherChannel is a link aggregation technology used primarily on Cisco switches. It can bundle two to eight physical port of the same Ethernet media type and speed. All bundled ports must have similar configuration.
EtherChannel can be used to increase bandwidth, provide redundancy and load balance traffic

EtherChannel Negotiation Protocols

Cisco supports two EtherChannel negotiation protocols. They are used to provide automatic EtherChannel configuration and negotiation between switches.

Port Aggregation Protocol (PAgP) – Cisco proprietary negotiation protocol
Link Aggregation Control Protocol (LACP) – standard based alternative to PagP defined in IEEE 802.3ad

Scenario

Suppose Switch SW1 and SW2 are connected to each other via

SW1 fa1/1 to SW2 fa1/1
SW1 fa1/2 to SW2 fa1/2
SW1 fa1/3 to SW2 fa1/3

We are required to make an EtherChannel using port fa1/1, fa1/2 and fa1/3

Configuring EtherChannel using LACP

In the configuration example we will be using Link Aggregation Control Protocol (LACP) for negotiation protocol

Because the ports used in both switches are identical, same configuration can be used on switch SW1 and SW2.
Configure ports on SW1 with LACP as negotiation protocol

SW1(config)#interface range fastEthernet 1/1 - 3
SW1(config-if-range)#no shutdown
SW1(config-if-range)# channel-protocol lacp
SW1(config-if-range)# channel-group 1 mode active
Creating a port-channel interface Port-channel 1

Configure ports on SW2

SW2(config)#interface range fastEthernet 1/1 - 3
SW2(config-if-range)#no shutdown
SW2(config-if-range)#channel-protocol lacp
SW2(config-if-range)#channel-group 1 mode active
Creating a port-channel interface Port-channel 1

Now if we check the interfaces, there should be a new interface called Port-channel1

SW1#show ip interface brief
...
FastEthernet1/11           unassigned      YES unset  up                    down
FastEthernet1/12           unassigned      YES unset  up                    down
FastEthernet1/13           unassigned      YES unset  up                    down
FastEthernet1/14           unassigned      YES unset  up                    down
FastEthernet1/15           unassigned      YES unset  up                    down
Port-channel1              unassigned      YES unset  up                    up
...

Thats it for the configuration part

Verifying EtherChannel Configuration

Use the following command to verify EtherChannel status

SW1# show etherchannel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        H - Hot-standby (LACP only)
        R - Layer3      S - Layer2
        U - in use      f - failed to allocate aggregator

M - not in use, minimum links not met
        u - unsuitable for bundling
        w - waiting to be aggregated
        d - default port

Number of channel-groups in use: 1
Number of aggregators:           1

Group  Port-channel  Protocol    Ports
------+-------------+-----------+---------------------------------
1      Po1(SU)         LACP      Fa1/1(P)   Fa1/2(P)   Fa1/3(P)

Interesting Fact

EtherChannel technology was invented by Kalpana in the early 1990s and was later acquired by Cisco Systems in 1994. In 2000 the IEEE passed 802.3ad, an open standard of EtherChannel (LACP).

Configuring VLAN Access Control Lists (VACL)

Arsalan A. Suzuki — Mon, 27 Sep 2010 14:10:27 +0000

What is VLAN Access Control Lists (VACL) used for?

VLAN Access Control Lists (VACL) can be used to filter traffic within the same vlan

Scenario

Suppose a host is connected to VLAN 2 and we are required to drop all telnet traffic within VLAN 2.

Configuration

Make an access list to match telnet traffic

Router(config)#access-list 101 permit tcp any any eq telnet

Create VACL using the above ACL.
Drop telnet traffic and forward all other traffic

Router(config)#vlan access-map VACL_ACL 10
Router(config-access-map)#match ip address 101
Router(config-access-map)#action drop
Router(config-access-map)#exit
Router(config)#vlan access-map VACL_ACL 20
Router(config-access-map)#action forward
Router(config-access-map)#exit
Router(config)#

Apply VACL to VLAN 2.

Router(config)#vlan filter VACL_ACL vlan-list 2

Thats it for the configuration. If everything is configured properly, telnet traffic should be dropped within VLAN 2

Configuring DHCP Snooping

Arsalan A. Suzuki — Thu, 09 Sep 2010 13:34:34 +0000

What is DHCP Snooping

DHCP snooping is a security feature inteneded to prevent rogue DHCP server from sending malicious DHCP replies.
When DHCP snooping is enabled, the switch intercept all the DHCP requests, and discards DHCP replies coming from “untrusted” ports. The offending switch ports are automatically shut down and put in errdisable state.
DHCP snooping also has a database containing client MAC address, IP address offered, lease
time, and so on for all the completed DHCP bindings.

Configuring DHCP Snooping

Enable DHCP snooping globally on a switch

Switch(config)# ip dhcp snooping

Identify VLANs for DHCP snooping. In this case VLAN 10 to 15

Switch(config)# ip dhcp snooping vlan number 10-15

By default all ports are “untrusted”, so we have to add trusted ports
Here we are adding fa1/1 as trusted port

Switch(config)# interface type fa1/1
Switch(config-if)# ip dhcp snooping trust

(Optional) Rate limiting untrusted port.
Here we are rate limiting interface fa0/1

Switch(config)# interface fa0/1
Switch(config-if)# ip dhcp snooping limit rate 10

The rate can be 1 to 2048 DHCP packets per second.

Verifying Configuration

Show DHCP snooping status

Switch# show ip dhcp snooping

Summary

DHCP snooping is useful for mitigating malicious DHCP replies. However there are times when users connect their own DHCP server (for example wireless Linksys router having its own DHCP). DHCP snooping can be used effectively to remedy these kind of situations.