Infobhatt

F5 Pacfiles R Us Part Duex

2012-02-20T09:16:00.001-08:00

In my previous article I explained how pac files can be consolidated by using an F5 Load Balancer eliminating a web server in the process. The pac file for the most part was very static. What if you want to make it dynamic – such that you have many different proxy systems and you want to serve a different version of the pacfile based on client’s source address.

In this article I am going to show you a way to make it dynamic in 2 steps

1. First you need to create a data group contain the IP address of the clients associated to the proxy systems that you want to use.

Name: regions_proxy

Type: Address

"10.10.10.0/255.255.255.0" := "proxy-a.domain.com:8080"

"10.10.0.0/255.255.0.0" := "proxy-b.domain.com:8080"

"10.0.0.0/255.0.0.0" := "proxy-c.domain.com:8080"

...Etc

2.    Then you need the iRule itself. This time you are going to use Datagroups and variables

when RULE_INIT {
        # Set the contents of the PAC file to be delivered within static::pacfile. While
        # specific logic here is fine, the "localized" proxy
        # should be returned using the $selected_proxy variable... this
        # variable will be filled in when the file delivered
        # with the value learned from the DataGroup.

   set static::pacfile {
     function FindProxyForURL(url, host) {

         if (isPlainHostName(host))
         return "DIRECT";

         if (shExpMatch(url, "http://10.*")||
         shExpMatch(url, "https://10.*")||
         shExpMatch(url, "ftp://10.*")||
         shExpMatch(url, "http://localhost*")||
         shExpMatch(url, "https://localhost*")||
         shExpMatch(url, "http://127.0.0.1*")||
         shExpMatch(url, "https://127.0.0.1*")||
         shExpMatch(url, "http://172.*")||
         shExpMatch(url, "https://172.*")||
         shExpMatch(url, "ftp://172.*"))
         return "DIRECT";

      if (dnsDomainIs(host, ".extranet.com")||
         dnsDomainIs(host, ".extranet2.com"))
         return "Proxy $proxyselect";

         if (dnsDomainIs(host, ".intrant.com")||
         dnsDomainIs(host, ".intranet2.com"))
         return "DIRECT";

      return "PROXY $proxyselect";
      }
   }
}

when CLIENT_ACCEPTED {

        # Create a DataGroup class called "proxy_regions" and populate it with
        # the IP networks and their proxy value assignments:
        #
        # "10.0.0.0/8" := "proxya.domain.com:8080"

        if { [class match [IP::client_addr] eq regions_proxy] } {
                set proxyselect "[class match -value [IP::client_addr] eq regions_proxy]"
        } else {
                set proxyselect "DIRECT"
        }
}

when HTTP_REQUEST {
   # Returns pacfile via "proxy.pac" as part of the HTTP Request
   # with specific proxy Content-type
   switch [HTTP::uri] {
      "/proxy.pac" {
         HTTP::respond 200 content [subst $static::pacfile] "Content-Type" "application/x-ns-proxy-autoconfig" "pragma" "no-cache"
      }
   }
}

As you can see with datagroups and variables. You can control how the pacfile is structured and customized without create different file versions.

F5 Pacfiles R Us

2012-02-20T08:52:00.001-08:00

As some of my friends would agree I am an F5 evangelist. The reason why I am such a fan is because it continues to eliminate or lesson some of the biggest head-aches that I experience at work. One of those pain points that it helps lesson is managing and using pac files.

Pac Files are used throughout various companies to direct traffic out proxy systems but is not wel understood by most and how it relates to F5 ADCs. Hopefully this article can clear it up for you and give you a better how idea of how to use it with the ADC.

What are pac file? A pac file is a text file containing JavaScript code. It is commonly called proxy.pac, but it can be named differently. It’s mostly used for 2 primary reasons:

Companies have multiple proxies where traffic is directed through, either for redundancy or access to networks that are normally closed off.
Split domain, where a single domain (i.e., domain.com ) is hosted both internally and externally.

A very basic pac file contains a single function. It’s function is to direct users through a proxy or proxies based on a URL or website request. A more advanced pacfile script can direct users out through a proxy or proxies based on user’s IP address or subnet.

The pac file settings are usually the following link http://pac.webserver.com/proxy.pac. Pac files can also be hosted on different ports where the links for eample port 7070 (i.e., http://pac.webserver.com:7070/proxy.pac)

The pac file setting is configured in the browsers option or preference settings. Most cases they are labeled clearly.

The pac file can be hosted on the user’s PC or it can be hosted on a web server (i.e. Apache or IIS). Most companies host in a web server, for centralized control. It’s important to remember that, so far no browser supports more then one pacfile at the user browser level. However, there are certain 3rd party extensions that can be used to get around this limitation. However, it’s usually designed for a specific browser rather then a universal version.

So now you understand what a pac file is, what does a standard syntax look like?

  1: function FindProxyForURL(url, host) {
  2:     
  3:     
  4:     if (shExpMatch(url, "http://10.*")||
  5:     shExpMatch(url, "https://10.*")||
  6:     shExpMatch(url, "ftp://10.*")||
  7:     shExpMatch(url, "http://localhost*")||
  8:     shExpMatch(url, "https://localhost*")||
  9:     shExpMatch(url, "http://127.0.0.1*")||
 10:     shExpMatch(url, "https://127.0.0.1*")||
 11:     shExpMatch(url, "http://172.*")||
 12:     shExpMatch(url, "https://172.*")||
 13:     shExpMatch(url, "ftp://172.*"))
 14:     return "DIRECT";
 15:         
 16: 
 17:     if (dnsDomainIs(host, "insidesite.com")||
 18:     dnsDomainIs(host, "servername.google.com"))
 19:     return "DIRECT";
 20: 
 21:   return "PROXY proxy.internaldomain.com:8080";
 22:   }
 23: }

Simple? It’s actually simple once you know what each lines are doing. Let me explain: Lines 4 to 14 state that if a user entered a HTTP request that’s a private address or a localhost or loopback, should go direct and not use a proxy. Lines 17 to 19 state that if a user entered a HTTP request where the hostname matches either those 2 entries - should go direct and not use a proxy. Line 21 is the catch all – if the user’s HTTP request does not match any of the IF conditional statements, the script forces a request to go to proxy.internaldomain.com on port 8080. It’s important to note that the pacfile scripts are processed at the client and NOT on the server that is delivering the pacfile.

Now that you the basic idea of pac file syntax, the next step is to know how it works with respect to user, proxy and a web server holding a webpage.

Let’s say the Pac file is hosted on a proxy server also running a web server. Let’s assume that the user already has the proxy pac file settings already configured in their browser.

Step 1: When the user starts the internet browser, browser retrieves the pac file .

Step 2: The pacfile is downloaded to the browser’s cache and process any URL requests (For example the user’s browser could have home page going to www.cnn.com) before it let’s the user enter information in the URL

Step 3: The user then enters in the URL http://www.google.com

Step 4: The browser runs through the pacfile script like the one above, attempting to match to a IF conditional statement. In our example it won’t match any IF statement statement – thus by default is sent to “PROXY proxy.internaldomain.com:8080”

Step 5: Proxy makes a request to the internet web server and requests for www.google.com page on behalf of the user.

Step 6: The page is returned to the proxy.

Step 7: As a final step, the proxy sends the request web page to user.

Okay this is great. What does this have to do with ADCs? As it turns out there is one disadvantage for pacfiles – hosting a pacfile. It requires a web server. While the thought of hosting a web page might not be earth shattering it does become a problem when you run into the following scenario.

Your IT organization might mandate a reduction in the amount of web servers in the environment.
Your IT organization could contain a mixture of Squid, Bluecoat, and/or Ironport proxy systems. Each proxy has their own distinctive method to deliver a pac file, some might provide you flexibility to control your pac file deliver and some might not.
Your IT organization wants to deliver different pac files based on users location or type of browser or IP addresses.

What if you can host the pac file in an iRule? A centralized and consistent approach to deliver a pac file(s) to a user without requiring a web server OR relying on proxy vendors.

The iRule

IMPORTANT NOTE: From this point the iRule is written to conform with v10

So how do we get an iRule to deliver a pacfile?

At this point we know the following:

Pac file is a JavaScript code that the browsers understands
Pac file is delivered via HTTP REQUEST and RESPONSE

function FindProxyForURL(url, host) {
	if (isPlainHostName(host))
	return "DIRECT";



	if (shExpMatch(url, "http://10.*")||
	shExpMatch(url, "https://10.*")||
	shExpMatch(url, "ftp://10.*")||
	shExpMatch(url, "http://localhost*")||
	shExpMatch(url, "https://localhost*")||
	shExpMatch(url, "http://127.0.0.1*")||
	shExpMatch(url, "https://127.0.0.1*")||
	shExpMatch(url, "http://172.*")||
	shExpMatch(url, "https://172.*")||
	shExpMatch(url, "ftp://172.*"))
	return "DIRECT";		
	if (dnsDomainIs(host, "inside.com")||
	dnsDomainIs(host, "inside.net")||
	dnsDomainIs(host, "outside.net"))
	return "DIRECT";
 
     return "PROXY proxy.internaldomain.com:8080";

	}

}

What’s the first step? Since the script needs to be human readable with indents and spaces we need to set the entire Pac file script into a global variable for example “pacfile”

  1: 	set static::pacfile {
  2: 	function FindProxyForURL(url, host) {
  3: 		
  4: 		if (isPlainHostName(host))
  5: 		return "DIRECT";
  6: 	  
  7: 		if (shExpMatch(url, "http://10.*")||
  8: 		shExpMatch(url, "https://10.*")||
  9: 		shExpMatch(url, "ftp://10.*")||
 10: 		shExpMatch(url, "http://localhost*")||
 11: 		shExpMatch(url, "https://localhost*")||
 12: 		shExpMatch(url, "http://127.0.0.1*")||
 13: 		shExpMatch(url, "https://127.0.0.1*")||
 14: 		shExpMatch(url, "http://172.*")||
 15: 		shExpMatch(url, "https://172.*")||
 16: 		shExpMatch(url, "ftp://172.*"))
 17: 		return "DIRECT";
 18: 				
 19: 
 20: 		if (dnsDomainIs(host, "inside.com")||
 21: 		dnsDomainIs(host, "inside.net")||
 22: 		dnsDomainIs(host, "outside.net"))
 23: 		return "DIRECT";
 24: 
 25: 	return "PROXY proxy.internaldomain.com:8080";
 26: 	}
 27: }
 28:

The event to use is when RULE_INIT since we are setting the script into a global variable. Your code looks like the following

  1: when RULE_INIT {
  2: 	set static::pacfile {
  3: 	function FindProxyForURL(url, host) {
  4: 		
  5: 		if (isPlainHostName(host))
  6: 		return "DIRECT";
  7: 	  
  8: 		if (shExpMatch(url, "http://10.*")||
  9: 		shExpMatch(url, "https://10.*")||
 10: 		shExpMatch(url, "ftp://10.*")||
 11: 		shExpMatch(url, "http://localhost*")||
 12: 		shExpMatch(url, "https://localhost*")||
 13: 		shExpMatch(url, "http://127.0.0.1*")||
 14: 		shExpMatch(url, "https://127.0.0.1*")||
 15: 		shExpMatch(url, "http://172.*")||
 16: 		shExpMatch(url, "https://172.*")||
 17: 		shExpMatch(url, "ftp://172.*"))
 18: 		return "DIRECT";
 19: 				
 20: 
 21: 		if (dnsDomainIs(host, "inside.com")||
 22: 		dnsDomainIs(host, "inside.net")||
 23: 		dnsDomainIs(host, "outside.net"))
 24: 		return "DIRECT";
 25: 
 26: 	return "PROXY proxy.internaldomain.com:8080";
 27: 	}
 28: 	}
 29: }

The next step is to use HTTP_REQUEST event as the trigger for the request and use HTTP::response command to send the the contents of the pacfile back to the requestor. We also need to include a MIME type so the browser knows that proxy pac file is being send. This is a requirement. We also need to make sure that requestor’s browser does not cache the file for any length of time. This is because we want to make updates and get immediate changes to the requestor.

Based on this the code should look something like the following

  1: when HTTP_REQUEST {
  2: 	switch -glob [HTTP::uri] {
  3: 	  "/proxy.pac" {
  4: 		HTTP::respond 200 content $static::pacfile "Content-Type" "application/x-ns-proxy-autoconfig" "pragma" "no-cache"
  5: 		return
  6: 	               }
  7: 	}
  8: }

Putting it all together the entire code should look like the following

  1: when RULE_INIT {
  2:   set static::pacfile {
  3:   function FindProxyForURL(url, host) {
  4:     
  5:     if (isPlainHostName(host))
  6:     return "DIRECT";
  7:     
  8:     if (shExpMatch(url, "http://10.*")||
  9:     shExpMatch(url, "https://10.*")||
 10:     shExpMatch(url, "ftp://10.*")||
 11:     shExpMatch(url, "http://localhost*")||
 12:     shExpMatch(url, "https://localhost*")||
 13:     shExpMatch(url, "http://127.0.0.1*")||
 14:     shExpMatch(url, "https://127.0.0.1*")||
 15:     shExpMatch(url, "http://172.*")||
 16:     shExpMatch(url, "https://172.*")||
 17:     shExpMatch(url, "ftp://172.*"))
 18:     return "DIRECT";
 19:         
 20:     if (dnsDomainIs(host, "inside.com")||
 21:     dnsDomainIs(host, "inside.net")||
 22:     dnsDomainIs(host, "outside.net"))
 23:     return "DIRECT";
 24: 
 25:   return "PROXY proxy.internaldomain.com:8080";
 26:   }
 27:   }
 28: }
 29: 
 30: when HTTP_REQUEST {
 31:   switch -glob [HTTP::uri] {
 32:     "/proxy.pac" {
 33:       HTTP::respond 200 content $static::pacfile "Content-Type" "application/x-ns-proxy-autoconfig" "pragma" "no-cache"
 34:       return
 35:     }
 36:   }
 37: }

As you can see you now have the ability to deliver a pac file without using a web server

Custom Commercial Home Video Streaming

2012-01-17T15:23:00.000-08:00

A colleague of mine came to me and asked me "How can I stream my home videos or any digital video I have to the big screen in a way that doesn't require me to be an expert on computers." So I wanted to share with a simple setup outline that I have tried as well who have tested this and worked for them.

Here is what you need at the minimum:
Hardware
- HDTV (Any will do)
- Apple TV 2 (IOS 4.3 or above)
- iPod or iPAD or iPhone (IOS v4.3 and up).
- PC / MAC with at least 200GB of storage with decent processor (a good comparison is 2011 Mac Book Pro which has enough computing power)

**Software
- Air Video Server
- Air Video Mobile (For the iPod/iPAD/iPhone)

With these components you can stream pretty much any video to the big screen.

Here is the basic setup:

Assumption: You need a home wifi that is supporting 802.11n (5Ghz) . You will need dual band wifi (802.11g/n) if your iPod or iPhone only supports 802.11g

1. Setup your AppleTV hooked up to your home Wifi on 802.11n and AirPlay turned on.
2. Next you will need a PC/MAC where you store your video. You download AirVideo server (http://www.inmethod.com/air-video/download.html). You install, run the software and point to the directory where you store you video.
3. You download Air Video Mobile on your iPod. (You can download this http://www.inmethod.com/air-video/index.html)
NOTE: Your iPOD will use the 2Ghz frequency for wireless hookup. Why?

From this point on you can view the video on the iPod through Air Video App. When you want to view this on your HDTV then you use Airplay to point the stream to the Apple TV (You can view use or Airplay here http://support.apple.com/kb/HT4437).

A couple of things you need to keep in mind:
- You can also control forwarding, skip, rewind through your iPod which essentially services as your remote control for streaming your video.
- Transcoding is done at the PC/MAC that contains the AirVideo server

This is it in a nutshell. I haven't seen any of my other collegues really have issues with this setup. In most cast they already had the hardware, but only needed the Air Video software.

I hope this little outline helps

REFERENCES: F5 TCPDUMP for Dummies

2012-01-16T13:40:00.001-08:00

This month I received about 2 or 3 requests from my clients to educate them on TCPDUMP with respect to the F5. There are plenty of TCPDUMP HOW-TO's (a popular one can be found here). This is slightly the same concept as a Dummies book, but more or less a FAQ.
I hope you like the article

What is TCPDUMP?

The tcpdump utility is a command line packet sniffer with many features and options. For a full description, refer to the tcpdump man pages by typing the following command:

man tcpdump

Q: What devices use TCPDUMP?

A: It is available on the F5 BIGIP Devices as well Linux devices.

Q: Selecting an interface or VLAN?

A: The tcpdump utility is able to sniff for packets on only one interface or VLAN. By default, it will select the lowest numbered interface.

To select an interface, use the -i flag as follows:

tcpdump -i <interface>

Examples:

tcpdump -i exp1

tcpdump -i 1.10

tcpdump -i internal

Q: How do you disable name resolution?

A:By default, tcpdump will attempt to look up IP addresses and use names, rather than numbers, in the output. BIG-IP must wait for a response from the DNS server, so the lookups can be time consuming and the output may be confusing.

To disable name resolution, use the -n flag as in the following examples:

tcpdump -n

tcpdump -ni internal

Q: How do you save TCPDUMP output to a file?

You can save the tcpdump data to one of the following file formats:

A binary file that contains all the information collected by the tcpdump and is readable by the tcpdump utility as well as many other traffic analysis packages.
A text file that contains a subset of the full tcpdump data, but is readable only as plain text.

Binary file

To save the tcpdump output to a binary file, type the following command:

tcpdump -w <filename>

For example:

tcpdump -w dump1.bin

Note: The tcpdump utility will not print data to the screen while it is capturing to a file. To stop the capture, press CTRL-C.

Text file

To save the tcpdump output to a text file, type the following command:

tcpdump > filename.txt

For example:

tcpdump > dump1.txt

Q: How do you read binary file output?

A:To read data from a binary tcpdump file (that you saved by using the tcpdump -w command), type the following command:

tcpdump -r <filename>

For example:

tcpdump -r dump1.bin

In this mode, the tcpdump utility reads stored packets from the file, but otherwise operates just as it would reading from the network interface. As a result, you can use formatting commands and filters.

Q: How do I do filtering?

A:The tcpdump utility allows you to use filters to, among other things, restrict the output to specified addresses and ports and specified tcp flags.

Filtering on a host address

To view all packets that are traveling to or from a specific IP address, type the following command:

tcpdump host IP_ADDRESS

For example:

tcpdump host 10.90.100.1

To view all packets that are traveling from a specific IP address, type the following command:

tcpdump src host IP_ADDRESS

For example:

tcpdump src host 10.90.100.1

To view all packets that are traveling to a particular IP address, type the following command:

tcpdump dst host IP_ADDRESS

For example:

tcpdump dst host 10.90.100.1

Filtering on a port

To view all packets that are traveling through the BIG-IP system and are either sourced from or destined to a specific port, type the following command:

tcpdump port PORT_NUM

For example:

tcpdump port 80

To view all packets that are traveling through the BIG-IP system and sourced from a specific port, type the following command:

tcpdump src port PORT_NUM

For example:

tcpdump src port 80

To view all packets that are traveling through the BIG-IP system and destined to a specific port, type the following command:

tcpdump dst port PORT_NUM

For example:

tcpdump dst port 80

Filtering on a tcp flag

To view all packets that are traveling through the BIG-IP system that contain the SYN flag, type the following command:

tcpdump 'tcp[tcpflags] & (tcp-syn) != 0'

To view all packets that are traveling through the BIG-IP system that contain the RST flag, type the following command:

tcpdump 'tcp[tcpflags] & (tcp-rst) != 0'

Combining filters with the and operator

You can use the and operator to filter for a mixture of output.

Following are some examples of useful combinations:

tcpdump host 10.90.100.1 and port 80

tcpdump src host 172.16.101.20 and dst port 80

tcpdump src host 172.16.101.20 and dst host 10.90.100.

Q: How do I combine TCPDUMP options?

A: This Solution contains the most essential tcpdump options. You will generally need to use most of the options in combination.

Following are examples of how to combine the tcpdump options to provide the most meaningful output:

tcpdump -ni internal -w dump1.bin

tcpdump -ni internal -r dump1.bin host 10.90.100.1

tcpdump -ni exp1 host 10.90.100.1 and port 80

tcpdump -ni 1.10 src host 172.16.101.20 and dst port 80 >dump1.txt

COMMANDS: SSH, not so obvious uses

2012-01-16T12:30:00.001-08:00

SSH is used practically every day by various types of administrators and applications. SSH is one of the the most documented commands. So what I have done is looked for commands that use SSH for some not so obvious uses. Hopefully this help or inspire you to use it for whatever solution you want to provide

1) Copy ssh keys to user@host to enable password-less ssh logins.

ssh-copy-id user@host

To generate the keys use the command ssh-keygen

2) Start a tunnel from some machine’s port 80 to your local post 2001

ssh -N -L2001:localhost:80 somemachine

Now you can acces the website by going to http://localhost:2001/

3) Output your microphone to a remote computer’s speaker

dd if=/dev/dsp | ssh -c arcfour -C username@host dd of=/dev/dsp

This will output the sound from your microphone port to the ssh target computer’s speaker port. The sound quality is very bad, so you will hear a lot of hissing.

4) Compare a remote file with a local file

ssh user@host cat /path/to/remotefile | diff /path/to/localfile

Useful for checking if there are differences between local and remote files.

5) Mount folder/filesystem through SSH

sshfs name@server:/path/to/folder /path/to/mount/point

Install SSHFS from http://fuse.sourceforge.net/sshfs.html
Will allow you to mount a folder security over a network.

6) SSH connection through host in the middle

ssh -t reachable_host ssh unreachable_host

Unreachable_host is unavailable from local network, but it’s available from reachable_host’s network. This command creates a connection to unreachable_host through “hidden” connection to reachable_host.

7) Copy from host1 to host2, through your host

ssh root@host1 “cd /somedir/tocopy/ && tar -cf – .” | ssh root@host2 “cd /samedir/tocopyto/ && tar -xf -”

Good if only you have access to host1 and host2, but they have no access to your host (so ncat won’t work) and they have no direct access to each other.

8) Run any GUI program remotely

ssh -fX <user>@<host> <program>

The SSH server configuration requires:

X11Forwarding yes # this is default in Debian

And it’s convenient too:

Compression delayed

9) Create a persistent connection to a machine

ssh -MNf <user>@<host>

Create a persistent SSH connection to the host in the background. Combine this with settings in your ~/.ssh/config:
Host host
ControlPath ~/.ssh/master-%r@%h:%p
ControlMaster no
All the SSH connections to the machine will then go through the persisten SSH socket. This is very useful if you are using SSH to synchronize files (using rsync/sftp/cvs/svn) on a regular basis because it won’t create a new socket each time to open an ssh connection.

10) Attach screen over ssh

ssh -t remote_host screen -r

Directly attach a remote screen session (saves a useless parent bash process)

11) Port Knocking!

knock <host> 3000 4000 5000 && ssh -p <port> user@host && knock <host> 5000 4000 3000

Knock on ports to open a port to a service (ssh for example) and knock again to close the port. You have to install knockd.
See example config file below.
[options]
logfile = /var/log/knockd.log
[openSSH]
sequence = 3000,4000,5000
seq_timeout = 5
command = /sbin/iptables -A INPUT -i eth0 -s %IP% -p tcp –dport 22 -j ACCEPT
tcpflags = syn
[closeSSH]
sequence = 5000,4000,3000
seq_timeout = 5
command = /sbin/iptables -D INPUT -i eth0 -s %IP% -p tcp –dport 22 -j ACCEPT
tcpflags = syn

12) Remove a line in a text file. Useful to fix

ssh-keygen -R <the_offending_host>

In this case it’s better do to use the dedicated tool

13) Run complex remote shell cmds over ssh, without escaping quotes

ssh host -l user $(<cmd.txt)

Much simpler method. More portable version: ssh host -l user “`cat cmd.txt`”

14) Copy a MySQL Database to a new Server via SSH with one command

mysqldump –add-drop-table –extended-insert –force –log-error=error.log -uUSER -pPASS OLD_DB_NAME | ssh -C user@newhost “mysql -uUSER -pPASS NEW_DB_NAME”

Dumps a MySQL database over a compressed SSH tunnel and uses it as input to mysql – i think that is the fastest and best way to migrate a DB to a new server!

15) Remove a line in a text file. Useful to fix “ssh host key change” warnings

sed -i 8d ~/.ssh/known_hosts

16) Copy your ssh public key to a server from a machine that doesn’t have ssh-copy-id

cat ~/.ssh/id_rsa.pub | ssh user@machine “mkdir ~/.ssh; cat >> ~/.ssh/authorized_keys”

If you use Mac OS X or some other *nix variant that doesn’t come with ssh-copy-id, this one-liner will allow you to add your public key to a remote machine so you can subsequently ssh to that machine without a password.

17) Live ssh network throughput test

yes | pv | ssh $host “cat > /dev/null”

connects to host via ssh and displays the live transfer speed, directing all transferred data to /dev/null
needs pv installed
Debian: ‘apt-get install pv’
Fedora: ‘yum install pv’ (may need the ‘extras’ repository enabled)

18) How to establish a remote Gnu screen session that you can re-connect to

ssh -t user@some.domain.com /usr/bin/screen -xRR

Long before tabbed terminals existed, people have been using Gnu screen to open many shells- a single text terminal. Combined with ssh, it gives you the ability to have many open shells with a single remote connection using the above options. If you detach with “Ctrl-a d” or if the ssh session is accidentally terminated, all processes running in your remote shells remain undisturbed, ready for you to reconnect. Other useful screen commands are “Ctrl-a c” (open new shell) and “Ctrl-a a” (alternate between shells). Read this quick reference for more screen commands: http://aperiodic.net/screen/quick_reference

19) Resume scp of a big file

rsync –partial –progress –rsh=ssh $file_source $user@$host:$destination_file

It can resume a failed secure copy ( usefull when you transfer big files like db dumps through vpn ) using rsync.
It requires rsync installed in both hosts.
rsync –partial –progress –rsh=ssh $file_source $user@$host:$destination_file local -> remote
or
rsync –partial –progress –rsh=ssh $user@$host:$remote_file $destination_file remote -> local

20) Analyze traffic remotely over ssh w/ wireshark

ssh root@server.com ‘tshark -f “port !22″ -w -’ | wireshark -k -i

This captures traffic on a remote machine with tshark, sends the raw pcap data over the ssh link, and displays it in wireshark. Hitting ctrl+C will stop the capture and unfortunately close your wireshark window. This can be worked-around by passing -c # to tshark to only capture a certain # of packets, or redirecting the data through a named pipe rather than piping directly from ssh to wireshark. I recommend filtering as much as you can in the tshark command to conserve bandwidth. tshark can be replaced with tcpdump thusly:
ssh root@example.com tcpdump -w – ‘port !22′ | wireshark -k -i

21) Have an ssh session open forever

autossh -M50000 -t server.example.com ‘screen -raAd mysession’

Open a ssh session opened forever, great on laptops losing Internet connectivity when switching WIFI spots.

22) Harder, Faster, Stronger SSH clients

ssh -4 -C -c blowfish-cbc

We force IPv4, compress the stream, specify the cypher stream to be Blowfish. I suppose you could use aes256-ctr as well for cypher spec. I’m of course leaving out things like master control sessions and such as that may not be available on your shell although that would speed things up as well.

23) Throttle bandwidth with cstream

tar -cj /backup | cstream -t 777k | ssh host ‘tar -xj -C /backup’

this bzips a folder and transfers it over the network to “host” at 777k bit/s.
cstream can do a lot more, have a look http://www.cons.org/cracauer/cstream.html#usage
for example:
echo w00t, i’m 733+ | cstream -b1 -t2

24) Transfer SSH public key to another machine in one step

ssh-keygen; ssh-copy-id user@host; ssh user@host

This command sequence allows simple setup of (gasp!) password-less SSH logins. Be careful, as if you already have an SSH keypair in your ~/.ssh directory on the local machine, there is a possibility ssh-keygen may overwrite them. ssh-copy-id copies the public key to the remote host and appends it to the remote account’s ~/.ssh/authorized_keys file. When trying ssh, if you used no passphrase for your key, the remote shell appears soon after invoking ssh user@host.

25) Copy stdin to your X11 buffer

ssh user@host cat /path/to/some/file | xclip

Have you ever had to scp a file to your work machine in order to copy its contents to a mail? xclip can help you with that. It copies its stdin to the X11 buffer, so all you have to do is middle-click to paste the content of that looong file :)

COMMANDS: A Primer on Some of the Differences Between IOS and NX-OS

2012-01-16T08:45:00.000-08:00

NX-OS is starting to be my favorite OS from Cisco. However, dealing with IOS for so long I find myself typing the wrong commands in NX-OS and IOS. So I thought of posting up the NX-OS v4.x commands with the IOS counterpart commands for all to see.

NX-OS Smart Call-Home	IOS Smart Call-Home	Command Description
show callhome	show call-home	Displays global Call-Home configuration
show callhome destination-profile	show call-home profile	Displays Call-Home profiles
show callhome transport-email	show call-home mail-server	Displays destination Call-Home mail server
show callhome user-def-cmds	N/A	Displays user defined "show" commands for output

NX-OS Cisco Discovery Protocol (CDP)	IOS Cisco Discovery Protocol (CDP)	Command Description
show cdp all	N/A	Displays all interfaces with CDP enabled
show cdp entry all	show cdp entry *	Displays the CDP database entries
show cdp global	show cdp	Displays Global Parameters (Enabled, Timers, etc…)
show cdp interface	show cdp interface	Displays interface specific information
show cdp neighbors	show cdp neighbors	Displays a summer list of neighbors
show cdp neighbors detail	show cdp neighbors detail	Displays detailed information per neighbor
show cdp neighbors interface	show cdp neighbors interface-type	Displays CDP neighbor for a specified interface
show cdp traffic interface	N/A - "show cdp traffic" is only global	Provides statistics on a per interface basis

NX-OS Command Scheduler	IOS Command Scheduler	Command Description
show scheduler config	N/A	Displays the scheduler configuration
show scheduler job	N/A	Displays the Jobs configured in the scheduler
show scheduler logfile	N/A	Displays the contents of the execution log file
show scheduler name	N/A	Displays the schedules configured

NX-OS Embedded Event Manager (EEM)	IOS Embedded Event Manager (EEM)	Command Description
show event manager environment	show event manager environment	Displays EEM environment variables
show event manager event-type	N/A	Displays registered event types
show event manager history	show event manager history	Displays information on history and past events
show event manager policy	N/A	Displays applets or script policies
show event manager policy-state	N/A	Displays the state of a policy
show event manager script	N/A	Displays information about a script
show event manager system-policy	show event manager policy	Displays information on system default entries

NX-OS Generic Online Diagnostics (GOLD)	IOS Generic Online Diagnostics (GOLD)	Command Description
show diagnostics bootup level	show diagnostics bootup level	Displays current bootup level
show diagnostics content module	show diagnostics content module	Displays test contents for a specified module
show diagnostics description module	show diagnostics description module	Displays description for a specified diagnostic test
show diagnostic results module	show diagnostic results module	Displays information and result of a diagnostic
show diagnostic status module	show diagnostic status	Displays test status for all tests on a module

NX-OS Netflow	IOS Netflow	Command Description
show flow exporter	show mls nde	Displays information about configured exporter maps
show flow interface	N/A	Displays interfaces configured for Netflow
show flow monitor	N/A	Displays information about monitor maps
show flow record	N/A	Displays information about record maps
show flow timeout	N/A	Displays the Netflow timeout value
show hardware flow aging	show mls netflow aging	Displays the Netflow table aging timeout value
show hardware flow entry	show mls netflow ip flow	Displays flow specific information
show hardware flow ip	show mls netflow ip	Displays the IP Netflow Table
show hardware flow sampler	show mls sampling	Displays the Netflow Sampling Configuration
show hardware flow utilization module	show mls netflow table summary	Displays Netflow table utilization per module
show sampler	show flow-sampler	Displays information about sampler maps

NX-OS Onboard Fault Logging (OBFL)	IOS Onboard Fault Logging (OBFL)	Command Description
show logging onboard module # boot-uptime	show logging onboard module # uptime	Displays OBFL boot and uptime information per module
show logging onboard module # counter-stats	N/A	Displays OBFL counter statistics per module
show logging onboard module # device-version	N/A	Displays OBFL device version information per module
show logging onboard module # endtime	show logging onboard module # end	Displays OBFL logs till end time mm/dd/yy-HH:MM:SS per module
show logging onboard module # environmental-history	show logging onboard module # temperature	Displays OBFL environmental history per module
show logging onboard module # error-stats	N/A	Displays OBFL error statistics per module
show logging onboard module # exception-log	N/A	Displays OBFL exception log per module
show logging onboard module # interrupt-stats	show logging onboard module # interrupt	Displays OBFL interrupt statistics per module
show logging onboard module # kernel-trace	N/A	Displays OBFL Kernel Trace per module
show logging onboard module # module	N/A	Displays OBFL information for Module per module
show logging onboard module # obfl-history	N/A	Displays OBFL history information per module
show logging onboard module # stack-trace	N/A	Displays OBFL kernel stack trace per module
show logging onboard module # starttime	show logging onboard module # start	Displays OBFL logs from start time mm/dd/yy-HH:MM:SS per module
show logging onboard module # status	show logging onboard module # status	Displays OBFL status enable/disable per module

NX-OS RMON	IOS RMON	Command Description
show rmon alarms	show rmon alarms	Displays configured RMON alarms
show rmon events	show rmon events	Displays configured RMON Events
show rmon hcalarms	N/A	Displays information for 64 bit alarms
show rmon logs	show rmon history	Displays RMON log messages

NX-OS SNMP	IOS SNMP	Command Description
show snmp	show snmp	Displays SNMP Counters, Users, Community Strings, etc...
show snmp community	show snmp community	Displays the SNMP community strings
show snmp context	show snmp context	Displays the SNMP Context mapping
show snmp engineID	show snmp engineID	Displays Hex and Decimal SNMP Engine ID
show snmp group	show snmp group	Displays configured SNMP groups/roles
show snmp host	show snmp host	Displays Host specific information
show snmp sessions	show snmp sessions	Displays active SNMP sessions
show snmp trap	N/A	Displays what traps are enabled
show snmp user	show snmp user	Displays SNMP users and notification targets (v3)

NX-OS Switch Port Analyzer (SPAN)	IOS Switch Port Analyzer (SPAN)	Command Description
show monitor session #	show monitor session #	Displays a specific sSPAN session
show monitor session all	show monitor session all	Displays all SPAN sessions
show monitor range #-#	show monitor range #-#	Displays a range of specified SPAN sessions

NX-OS Logging (Syslog)	IOS Logging (Syslog)	Command Description
show logging	show logging	Displays how logging is configured with log
show logging info	N/A	Displays how logging is configured without log
show logging last #	N/A	Displays the last "#" of log messages
show logging level	N/A	Displays the Facility, Default Severity, and Configured Severity
show logging logfile	N/A	Displays all of the Syslog information
show logging module	N/A	Displays the module logging configuration
show logging monitor	N/A	Displays the monitor logging configuration
show logging nvram	N/A	Displays the Severity 0, 1, and 2 message stored in NVRAM
show logging server	N/A	Displays information for each configured syslog server
show logging timestamp	N/A	Displays the configured timestamp for log messages

NX-OS NTP	IOS NTP	Command Description
show ntp peers	show ntp associations	Displays what NTP peers are configured
show ntp peer-status	show ntp status (not on a peer basis)	Shows the status of each NTP peer
show ntp source	N/A	Displays the source IP address for the NTP service
show ntp statistics peer ipaddr x.x.x.x	N/A	Show statistics for each NTP peer
show ntp timestamp-status	N/A	Displays if the timestamp check is enabled

NX-OS XML	IOS XML	Command Description
show xml server logging	N/A	Displays XML Logging
show xml server status	N/A	Displays XML Server Status

You can also find the same kind of material on the following link
http://docwiki.cisco.com/wiki/Cisco_Nexus_7000_NX-OS/IOS_Comparison_Tech_Notes

COMMANDS: CISCO IOS Enabling Top N Utility Report Creation

2012-01-16T00:31:00.000-08:00

One of the hardest things to remember is using the TOP N uility on some IOS based devices. The following are some commands that help me.

Enabling Top N Utility Report Creation

This examples shows how to enable Top N Utility report creation for an interval of 76 seconds for the four ports with the highest utilization:

collect top 4 counters interface all sort-by utilization interval 76

collect top counters interface all sort-by utilization interval 76

collect top counters interface all interface 76

Displaying all the Top N Utility Reports
show top counters interface report

This example shows how to display a specific Top N Utility report
show top counters interface report 1

Clearing Top N Utility Reports (All)
clear top counters interface report

Clearing Top N Utility Report 4
clear top counters interface report 4

CONFIGURATION: CISCO NETFLOW

2012-01-16T00:08:00.000-08:00

After going through a sea of documentation regarding Netflow, I wanted to come up with the basic guide of how to turn it on and apply it.

The first rule of netflow is that you can ONLY collect information on a routed interface

! Lock the SNMP ifIndex - prevents ifIndex drift after router reboot
snmp-server ifindex persist

! Make sure you have the correct community string
! This is mostly a NetQoS requirement; but it's usually required
! by any NetFlow collecting device that needs to verify the device
! it's collecting from.
snmp-server community community_name RO

! Enable NetFlow export globally
! Using loopback
ip flow-export version 5
ip flow-export source lo0
ip flow-cache timeout active 1

! Set export destination and port to closest Netflow Collector. The port
! listed below is based on NetQOS product
! other Netflow collectors might use a different port
ip flow-export destination IP_ADDRESS 9995

! MLS commands are required for Sup720 running Native IOS ONLY
mls nde sender version 5
mls flow ip interface-full
mls nde interface
mls aging long 64
mls aging fast threshold 1 time 64

Now that Netflow is turned on we need to apply the commands to a routed interface. The following are examples of interfaces where netflow is applied on:

int fa3/1

ip route-cache flow

int s2/0/0

ip route-cache flow

int gig4/0

ip route-cache flow

int vlan123
ip route-cache flow

COMMAND REFERENCE: CISCO IOS FTP and TFTP

2012-01-15T11:17:00.000-08:00

I don't know how many times someone has forgotten the following set of commands.

------------------------------

FTP

config t
ip ftp username
ip ftp password
ip ftp source-interface loopback0

# You need to run this the first time if the command has never been used. Performing the statements below insures that passive is turned off.

ip ftp passive
no ip ftp passive

Examples of commands:
copy ftp://ip_address_of_ftp_server/filename.bin bootflash:filename.bin

copy ftp://ip_address_of_ftp_server/filename.bin sup-bootflash:filename.bin

----------------
TFTP

config t
ip ftp source-interface loopback0

Examples of commands:
copy tftp://ip_address_of_tftp_server/filename.bin bootflash:filename.bin
copy tftp://ip_address_of_tftp_server/filename.bin sup-bootflash:filename.bin

COMMAND REFERENCE: CISCO PIX

2012-01-15T10:26:00.000-08:00

From time to time I kick myself for not knowing certain commands that I take for granted. Here they are

Description: Sometimes PIX PDM is inaccessible because the SSL key is corrupted or you setting up the PDF for the first time. I found these sequence of commands useful

ca zero rsa
Hostname devicename
domain-name dot.com
ca gen rsa key 2048
ca save all
show ca mypubkey rsa

Various other useful commands

show object-group service - Lists the servicesshow object-group - Lists all groups including services
show failover - shows the failover information
show version - shows the version including serial number of the PIX
show access-list – shows all access list even shows details within a groups
show access-list | inc TEXT – shows specific filtered results
show access-list | beg TEXT - Shows the start of content beginning with what is contain in TEXT
sho config – shows the entire config
show config | inc TEXT – shows a filtered config
show config | beg TEXT - Shows the start of content beginning with what is contain in TEXT
show nat – lists NAT access-list

Troubleshooting commands

show arp – shows the arp table (Layer 4)
ping IP_ADDRESS – pings the ip addresses
show cpu usage – show cpu utilization for 5 seconds, 1 minute and 5 minutes
show conn – shows the connections table at the given time
show memory – shows memory block
show xlate – shows translation address (NAT) in memory
show processes – shows different firewall processes
show static – Shows static address
show route – shows routing information
show logging – Shows all the alerts stored on the PIX (disappears when rebooted)

COMMAND REFERENCE: F5

2012-01-15T08:54:00.000-08:00

F5 is a vendor that provides various types of traffic engineering productions such as Application Load Balancing, DNS Load balancing, SSL VPN, etc. etc.

One of the things I find useful is keeping reference of certain commands that help me with my day to day adminstration.

Here are some helpful commands:

v9 and v10 Bigpipe

b summary - Get's all kinds of information regarding the Load balancer,

b conn dump - Shows connections...this can be used with Excel to sort the connections.

b conn | grep IP_ADDRESS | awk '{print $1 }' | cut -d : -f 1 | uniq -c | sort - Shows all connections based on IP_ADDRESS

Shell

qkview - Get's a diagnostics view of the entire load balancers - used for Troubleshooting

bigtop -n All vips and nodes and to see which traffic is going where

top - Shows the highest order of processes

cpu bigip - Shows CPU (only for v4)

lsof –n Lists all open files in Linux

watch –n1 b virtual - This will display the outputs in realtime

watch –n1 b pool - This will display the outputs in realtime

cat /var/log/ltm | grep 'Node' |grep '' | sort -t . -k 3,3n -k 4,4n

awk 'BEGIN {RS="}";FS=RS} /PATTERN/ {print $1"}";} ' /config/bigip.conf - ALLOWS you to go through bigip.conf and look for all virtuals that contain the PATTERN you defined.

Packet Analysis

tcpdump ni host - This is to view on the console

tcpdump ni -s1600 host -w /var/tmp/test.cap - This is to capture to a file

tcpdump ni 0.0 host - This views the aggregate traffic of all interfaces

tcpdump –ni 0.0 –s1600 host -w /var/tmp/test.cap - This captures to a file looking at the aggregate interface

tcpdump ni ‘host (host )’ – This captures host for multiple hosts

tcpdump ni -1600 ‘host or (host )’ –w /var/tmp/test.cap

tcpdump ni 0.0 ‘host (host )’

tcpdump -ni -s 0 'tcp[tcpflags] & (tcp-syn) != 0' – this capture traffic without SYN

TMSH v10 or up

You need to enter tmsh at the CLI to get into TMSH shell

show sys version detail – view system version and hotfix detailed information

show sys version – view system version and hotfix summary information

show sys – General system configuration

show sys cpu - CPU statistics of system overall performance and on management hosts.

show sys hardware - View hardware information

show sys ha-status - Displays the settings and status for high availability on a system.

show sys host-info - Host statistics, including system memory, CPU, and processor

show sys ip-address - View configured IP addresses

show sys log - View system log files

show sys mac-address - View MAC addresses attached to the system

show sys console - Configure the serial console

show sys license - View license information

show sys service - Controls the BIG-IP system services

show sys connection - Displays or deletes active connections on the BIG-IP system

show config-sync - Redundant system configuration synchronization

show config-diff - Displays differences between two SCF files or between a SCF and the running system.

show ltm – Local Traffic Manager

show cli – local user settings and configuration transaction

show net route – routing tables and configuration

show net interface – shows the interface

show net arp – shows the F5s arp table

SUPPORT COMMANDS

SCP to transfer a file, perform the following steps:

Use the following command syntax to execute SCP:
scp -p local_filename username@server:remote_filename

where :

local_filename is the name of the file you want to transfer.
username is is the name of a valid user account on the server to which you want to transfer the file.
server is theis the IP address of the server to which you want to transfer the file.
remote_filename is the full pathname that you want to name the file on the system to which you are transferring the file.

Example

scp -p myfile.bin root@10.90.101.50:/var/tmp/myfile.bin

 --------------------

SNMP

How to look at each Virtual IP address's Maximum Connection

snmpwalk -c l0cal 127.0.0.1 F5-BIGIP-LOCAL-MIB::ltmVirtualAddrStatClientMaxConns|awk -F: '$4 > 2000'

Show all VIP addresses with MAX Conns greater than 200

snmpwalk -c l0cal 127.0.0.1 F5-BIGIP-LOCAL-MIB::ltmVirtualAddrStatClientMaxConns|awk -F: '{if($4 > 200) print }'

Show all VIP addresses with Curr Conns greater than 200

snmpwalk -c l0cal 127.0.0.1 F5-BIGIP-LOCAL-MIB::ltmVirtualAddrStatClientCurConns|awk -F: '{if($4 > 200) print }'

Leave out the awk -F: '{if($4 > 200) print }' to see all VIP addresses

NOTE: Make sure that the F5 can accept SNMP requests from the local loopback.

Cisco Ironport Squid Log Format Broken Down

2012-01-14T22:54:00.000-08:00

One of the most interesting things about proxy log files that the syntax is a cryptic. Some companies have internally purchased off-the-self packages so they can be used to generate quick and meaningful data. However, I always found it useful to know these log files mean. So without much do here is a reference that may be helpful to you. I have color coded so it's easier to follow:

1215535247.487 123 172.20.11.222 TCP_MISS/200 14148 GET HTTP://www.cisco.com/
DIRECT/www.cisco.com text/html

1215535247.487 = %t Time stamp in Unix time (You can convert this by going to the following link (http://tinyurl.com/72sbp3o)

123 = %e elapsed time

172.20.11.222 = %a Client IP address

TCP_MISS = %w Transactional result code

NONE – Neither a hit nor a miss, indicates an error in the transaction
TCP_MEM_HIT – Object was cached in memory
TCP_DENIED – Access Denied
TCP_HIT - A valid copy of the requested object was in the cache.
TCP_MISS - The requested object was not in the cache.
TCP_REFRESH_HIT - An expired copy of the requested object was in the cache.
Squid made an If-Modified-Since request and the response was "Not Modified."
TCP_REFRESH_FAIL_HIT An expired copy of the requested object was in the
cache. Squid attempted to make an If-Modified-Since request, but it failed.
The old (stale) object was delivered to the client.
TCP_REFRESH_MISS - An expired copy of the requested object was in the cache.
Squid made an If-Modified-Since request and received a new, different
object. TCP_CLIENT_REFRESH The client issued a request with the "no-cache"
pragma. ("reload" - handled as MISS)
TCP_IMS_HIT - An If-Modified-Since GET request was received from the client.
A valid copy of the object was in the cache (fresh).
TCP_IMS_MISS - An If-Modified-Since GET request was received from the
client. The requested object was not in the cache (stale).
TCP_SWAPFAIL - The object was believed to be in the cache, but could not be
accessed. TCP_DENIED Access was denied for this request.

200 = %h HTTP Response Code

200 - OK
204 - No Content
206 - Partial content
301 - Moved Permanenatly
302 - Found (over there)
304 - Not modified
305 - Use Proxy
307 - Temporary Redirect
401 - Unauthorized
403 - Forbidden
404 - Not Found
405 - Method not allowed
407 - Proxy Authorization Required
503 - Service Unavailable
504 - Gateway timeout

14148 = %s Total bytes transferred

GET HTTP://www.cisco.com/ = %r Request method URI

DIRECT/www.cisco.com = %H – Cache hierchy retrieval

NONE – No request made
DIRECT – request went directly to server
DEFAULT_PARENT – Single upstream proxy or failover
LEASTBUSY_PARENT – Fewest Connections
HASHBASED_PARENT – Hash based load balancing
LEASTRECENT_PARENT – Least recently used
ROUNDROBIN_PARENT – Round robin load balancing

text/html = %c – MIME content type/subtype

text/plain – simple text

Cisco NX VLAN to VLAN F5 Bypass

2012-01-14T22:24:00.000-08:00

If you recall in my previous blog "Cisco IOS VLAN to VLAN F5 Bypass" we dealt with a specific scenario between F5 and Cisco IOS. In this new scenerio we are now dealing with Cisco NX operating system.

“I have a pair of F5 ADC in an Internet DMZ, where nodes behind the load balancer need to access NAS system(s) on a VLAN located on a separate VLAN that is not behind the load balancer. The problem is that in my current design I have to route through the F5 Load balancer to access the NAS system(s). Unfortunately the amount of bandwidth it takes supersedes the F5 ADC’s total throughput. I would like to bypass this without adding extra network cards or recreating a new VLAN and would like preserve the IP addresses as much as possible. Also the F5 ADC is sitting on a network design that participates in vPC within Cisco Nexus Data center gear"

Based on this description above you extrapolate a high-level logical network design as shown in Figure 1 ( I have removed vPC design for now as you read on you will see it introduced into the article


Figure 1

In the figure 1, we VIP VLAN which is a routable VLAN. Node VLAN is a non-routable VLAN, which is strictly Layer 2. Since the VLAN is non-routable no external devices except the F5 can access the Nodes directly. Finally we have Server VLAN Z which is where the NAS system is connected to. In order to have communication between Server VLAN Z and Node VLAN, the traffic must route through the F5 via VIP VLAN. This is done by a static route pointing to .11 on VIP VLAN which is the F5 floating address on VIP VLAN to reach node VLAN address block. In figure 1 you also have all servers in Node VLAN pointing to .1 as their default gateway which is the floating address of the F5. The F5’s default gateway is .1 on VIP VLAN. Now that we have described the current behavior of Figure 1, we can start looking at making some changes.
So how do we change the network to accommodate the result that is being looked for? It is actually much easier then you might think.
The first item you want to remove is the static route on the switch pointing to point to .11 on VIP VLAN to access NODE VLAN. You will not need this since the end result is to allow SERVER VLAN and NODE VLAN to communicate directly via the Cisco Nexus Switch router.

Next you will need to change NODE VLAN from a non-routable network to a routable network. Thus, NODE VLAN will have a gateway of .1 on the switch router. The F5 will then change its own floating address to say .11 and subsequently change the self-addresses to .12 and .13. All the servers in NODE VLAN will continue to use .1 as the default gateway.


Figure 2

At this point, you are thinking how is the traffic going to return to F5 load balancer when it’s traffic via VIP. The easy way is to apply SNAT Automap. Which works, but then you run into another problem where you lose the client IP address. Normally this might be work, but will make tracking clients more difficult especially around traffic that is not HTTP based.
The short answer to this is utilizing a Cisco’s Policy Based Route. How does that work?
On a Cisco switch router, you can do the following configuration (NX OS Syntax)

ip access-list from_node_vlan_deny

10 permit ip y.y.y.0/24 z.z.z.0/24

ip access-list from_node_vlan_allow

10 permit ip y.y.y.0/24 any

route map to_node_vlan deny 10

match ip address from_node_vlan_deny

route map to_node_vlan permit 10

match ip address from_node_vlan_allow

set ip next-hop y.y.y.11

interface VIP_VLAN

ip policy route-map to_node_vlan

NOTE: You must have feature pbr enabled.

If you are a student of Cisco IOS you might notice that IP access-list does not contain deny statements. This is because PBR statements in the Nexus OS was designed to ignore the deny statements within IP access-lists. I haven’t received an official reason of why this happened, but the best case was that they wanted to make the ultimate PERMIT/DENY decision at the route map level. The good news is that this new behavior only exists when applied to the pBR. Meaning Deny statements within an IP access-list will not be ignored when applying as a standard ACL for security access. Also you can use the same access-list for security access and route-maps so just keep in mind that that DENY statements will be ignored by the route-maps ONLY.
Looking at the configuration above, the behavior is that if the NODE VLAN traffic is destined to the SERVER VLAN, skip the route-map statement and use the internal routing table of the switch. This allows NODE VLAN to communicate directly to SERVER VLAN and vice versa. Subsequently, if traffic from NODE VLAN is attempting to reach to the internet then it will match the IP access-list “from_node_vlan_allow” within route map “to_node_vlan permit 10”. Once that is done it will process the next command, which is sending the traffic to the next hop of y.y.y.11 (Floating address of the F5) within NODE VLAN.

If we left everything alone, this story would be complete. Unfortunately, the network example I used is also using vPC, which adds another layer of complexity, which needs to be accounted for in our Cisco configuration. Figure 3 shows us what a vPC topology would look like with an F5 attached.


Figure 3

You see F5 along with other vendors decided to optimize the packets by ignoring the arp reply given by the HSRP primary and instead forwards Ethernet frames to whichever MAC address it receives frames from the result is a faster response time. Unfortunately, this is a nonstandard behavior. If you are well versed enough on the F5 you would immediately think to turn off the auto Last hop feature would counteract this behavior. Unfortunately, this does not work in Cisco Nexus OS world. Cisco recognized that many vendors had this same issue so they introduced the command “peer-gateway” command. This command in affect disabled the optimization.

Therefore, you would introduce the command in the following configuration example, in our diagram it would be on Nexus 7010 MDF A and MDF B

vpc domain 1

role priority 10

peer-keepalive destination 10.1.1.2 source 10.1.1.1 vrf VPC-KeepAlive

peer-gateway

Of course, this is still not end of the story because peer-gateway has a caveat as stated in the Nexus OS Layer 2 guide

Packets arriving at the peer-gateway vPC device will have their TTL decremented, so packets carrying TTL = 1 may be dropped in transit due to TTL expire. This needs to be taken into account when the peer-gateway feature is enabled and particular network protocols sourcing packets with TTL = 1 operate on a vPC VLAN.

This means that the traffic will be treated like a layer 3 hop which means we need to make small adjustment in our access list

From

ip access-list from_node_vlan_deny

10 permit ip y.y.y.0/24 z.z.z.0/24

ip access-list from_node_vlan_allow

10 permit ip y.y.y.0/24 any

route map to_node_vlan deny 10

match ip address from_node_vlan_deny

route map to_node_vlan permit 10

match ip address from_node_vlan_allow

set ip next-hop y.y.y.11

interface VIP_VLAN

ip policy route-map to_node_vlan

ip access-list from_node_vlan_deny

5 permit ip y.y.y.0/24 y.y.y.0/24

10 permit ip y.y.y.0/24 z.z.z.0/24

ip access-list from_node_vlan_allow

10 permit ip y.y.y.0/24 any

route map to_node_vlan deny 10

match ip address from_node_vlan_deny

route map to_node_vlan permit 10

match ip address from_node_vlan_allow

set ip next-hop y.y.y.11

interface VIP_VLAN

ip policy route-map to_node_vlan

If you have been following closely on the difference you might be wondering, why should you have a permit for traffic between NODE VLAN to NODE VLAN? After all the access-list looks at Layer 3, not Layer 2 traffic. As I mentioned above “Packets arriving at the peer-gateway vPC device will have their TTL decremented…” Which means that Layer 2 traffic under vPC Peer Gateway will treat any traffic within that VLAN as a layer 3 hop and it will be processed within the access-list.

Conclusion
If you are running a F5 ADC which routes through F5 Nexus devices, then you don’t need peer-gateway , but you will if you are directly attached to a Nexus Device that is configured to use vPC.

I have yet to face any issues with this configuration so it might be a good idea to add Peer-gateway into your vPC configuration as a default.

Cisco IOS VLAN to VLAN F5 Bypass

2012-01-14T18:20:00.000-08:00

From time to time, I usually receive a request that goes something like this.

“I have a pair of F5 ADC in an Internet DMZ, where the servers behind the load balancer need to access NAS system(s) on a VLAN located in the same network on another VLAN that is not behind the load balancer.
The problem is that in my current design I have to route through the F5 Load balancer to access the NAS system(s). Unfortunately the amount of bandwidth it takes supersedes the F5 ADC’s total throughput. I would like to by pass this without adding extra network cards or recreating a new VLAN and would like preserve the IP addresses as much as possible.”

For the purposes of the blog we will call the person requesting this Keyser Söze. Yes I have to call him Keyser.

Based on this description above you can extrapolate a high-level logical network design as shown in Figure 1.

Figure 1

In the figure 1, we have the following VLANS

VLAN 10 - Which is for VIPs (Virtual IP addresses). The VLAN is routable via Cisco HSRP. Gateway is .1. The F5's floating address will be .11. The floating address is used as the NEXT HOP to get to VLAN 11.
VLAN 11 - Where the Servers that will be load balanced - is a non Cisco routable VLAN. From Cisco's perspective it's simply a VLAN without HSRP. The gateway for this segment is on the F5 which is .1
VLAN 12 - This is a routable VLAN similar to VLAN 10, except there are physical servers on this segment. In our case this is where the NAS will sit. The gateway is .1 for the NAS.

Here are some facts we know about this design

VLAN 12 is accessible by any part of this network
VLAN 10 has a floating IP address which is the shared address between F5. It is used in scenario to be the gateway to the segment in VLAN 11
In order for a Web server in VLAN 11 to access the NAS server in VLAN12 and vice versa, the F5 is the router.

There is nothing entirely wrong with this done and it most cases this works. However, Keyser is worried that multiple web servers in VLAN 11 will request so much content from the NAS server in VLAN 12 that there is a throughput concern.

So how do we change the network to accommodate the result that Kyser is looking for?

It is actually much easier then you might think.

For the purposes of this explanation, let us assume the switches are connected on Cisco Switch routers

The first item you want to remove is the the static route on the switch pointing to point to .11 on VLAN10 to access VLAN12. You will not need this since the end result is to allow VLAN 12 and VLAN 11 to communicate directly via the Cisco Switch router.
Next you will need to change VLAN11 from a non-routable network to a routable network. Thus, VLAN 11 will have a gateway of .1 on the switch router. The F5 will then change its own floating address to say .11 and subsequently change the self-addresses. All the servers will continue to use .1 on VLAN11 as their default gateway.

Thus the network will now look more like Figure 2
Figure 2

At this point, you are thinking well if that is the case then how do we get traffic back to the F5 for Load balancing traffic. Well the easy way is to apply SNAT Automap across all the Virtual addresses. Which works, but then you run into another problem where you lose the client IP address. Normally this might be work, BUT if you are tracking clients for statistical purposes, this is not going to work.
The short answer to this is utilizing a Cisco’s Policy Based Route. How does that work?
On a Cisco switch you can do the following configuration (IOS Syntax):

ip access-list extended from_vlan11
Deny y.y.y.0 0.0.0.255 z.z.z.0 0.0.0.255
Permit y.y.y.0 0.0.0.255 any
route map to_lb_vlan11
Match ip address from_vlan11
ip default next-hop y.y.y.11
interface Vlan11
ip policy route-map to_lb_vlan11

What these statements mean is that any traffic from VLAN11 is destined to addresses on VLAN12, skip the route-map statement and use the internal routing table of the switch. Thus allowing VLAN11 to communicate directly to VLAN12 and vice-versa.

Subsequently, if traffic from VLAN11 is attempting to talk to the internet then it will match the permit statement in the IP access list “from_vlan11” then apply the route map statement and thus your next hope is .11, which is hosted on VLAN11.
That pretty much sums up how to use the switches throughput for VLAN-to-VLAN traffic and the F5 ADC continues to do what it does best while Kyser can go home happy.