Peter's CCIE Musings and Rants (now in colour!)

I don't often do this...

2012-02-04T04:59:00.001-08:00

So I don't often do this, but this video was so good It combined both my passion for the Formula 1 and for music, if you have any interest in either of these, I strongly recommend you check this video out:

http://www.lotusf1team.com/

Cheers :)

How to setup the ironport to do HTTPS interception with a valid certificate

2012-01-23T18:39:00.001-08:00

The name in the subject says it all guys! Check it out

http://blog.samkendall.net/2010/05/12/how-to-make-your-computers-trust-your-cisco-ironport-https-proxy-in-an-active-directory-environment/

Office Extend (found on another blog)

2012-01-02T22:28:00.000-08:00

Hi Guys!

I found this blog on Office Extend for WLC's and I thought it was EXCELLENT so I thought I would share it here :)

http://blakekrone.com/2011/03/10/cisco-officeextend-always-connected

Cisco ISR G2 Video Conferencing Configuration

2011-12-28T05:43:00.000-08:00

Hi Guys

As promised a second blog post is here!

In this blog post, I am going to discuss a feature that when i first heard about it, i thought was the best thing since sliced bread.

Cisco Video Conferencing On ISR G2 PVDM3 or ISR G2 Video Conferencing Services
Basically what this feature allows you to do is use your ISR G2 PVDM3's as Video Conferencing Resources there are several modes supported and quite a few restrictions you should know about, First let's get down to pro's and con's

I searched out all over the internet, for a Step by step guide on how to configure this service, and the internet came up extremely lacking, so I am going to fill that gap!

First of all, here is what you will need

You must be running at Least Version 8.6 of CUCM (or CME)
You must be running IOS 15.1(4)M or later
You must have video capable phones (duh)
You must be using PVDM3's

Pro's:

Uses existing ISR G2 PVDM3 modules, you just enable the service
In Homogenous mode (more on that later) you can support video conferences with very little PVDMs!
Supports transcoding (Video Mixing) if you have enough PDVM3's

Con's:

Only mode of video layout supported is loudest speaker (CME does also have lecture mode, but that can be more pain than it is worth)
Can't seem to get it to work with E20 Handsets (internet, if you want to help I am all ears!)

So, let's get started!

In my configuration example, I have three 9951 handsets with some Video Cameras, a few VT Advantage users and an E20 that I was unable to get working with this :(.

Let's concentrate first on making sure your video is going to work 100 percent.

So the first thing you need to do, is ensure that you have a seperate Device Pool for your video devices that uses a seperate region and seperate location.

In your region you need to make sure you have this set:

So as you can see, make sure you have your region set to allow max video call bit rate, I specified an insanely high bit rate, you can specify whatever it is you prefer, but for your initial testing I recommend setting it quite high.

Next, you need to do something similiar for the location:

So make sure your location is set to allow unlimited video too (well, whatever you want to do over your WAN link really, but for me this was all local, so I chose to make it unlimited, but please flavour to taste)

OK, done

So, at this point you just need to add in your phones, make sure that you have video enabled for each of the endpoints:

For 9951 you must say cisco camera enabled and video capabilities enabled, but for most other handsets you just need video capabilities enabled.

At this point, you should be able to make a very high quality call between your handsets and get some video,

DO THIS FIRST before proceeding any further and make sure it all works, if it does not, double/triple check that you have put the camera in right, double check that you can see local video, double check your region and location configurations are correctly applied to the phone etc. etc.

Don't bother going any further until you can confirm that your endpoints can call each other.

The 9971 phones are painfully difficult to work out what video codec there using, the only advice I can give is try and use the web interface on the phone and go to "Stream" during a call to have a guesstimate as to what video codec they are using.

So now we know our video is working and we are ready for the conferencing. As I mentioned previously, there are two types of video conferencing available

-> Homogeneous, which means that all the video endpoints must use the exact same codec, and your conferencing resource will only support that single codec you select

-> Heterogeneous, which means that multiple codecs and multiple bit rates are supported

It is important to note that you need a _lot_ of DSP's to do Heterogeneous, you need at least 2 x 128 PVDM3's, in my case I just did not have access to that kind of equipment, so this explanation is only for Homogeneous, sorry guys! But to be fair, you should just be able to replace the word Homogeneous with Heterogeneous and you should be laughing .Just remember to specify multiple codecs in your dspfarm profile

Ok, So first go to CUCM - > Media Resources - > Conference Bridge, add in a conference bridge with a name of your choosing,

BE SURE TO PLACE IT IN THE DEVICE POOL WITH THE VIDEO REGION YOU CREATED EARLIER AND THE LOCATION YOU CREATED EARLIER

if you forget this step, you will have problems :).

Next, login to your router that has PVDM3's and configure the following, replacing 1.1.1.1 and 2.2.2.2 with the IP addresses of your CUCM servers, and the VIDEOCONFRESOURCE with the name of the video conference bridge you specified in the above step.

voice-card 0
voice-service dsp-reservation 50
!
!
This step specifies how many DSP resources you wish to dedicate entirely to voice services, since in my case I had a router spare with a PVDM3 I specified 0 percent, but in the example above to be safe I have said 50 percent, you will need to calculate how much percentage of your PVDM's you need for normal voice when doing this calculation.

sccp local GigabitEthernet0/0
sccp ccm 1.1.1.1 identifier 2 version 7.0
sccp ccm 2.2.2.2 identifier 1 version 7.0
sccp
!
sccp ccm group 1
associate ccm 2 priority 1
associate ccm 1 priority 2
associate profile 1 register VIDEOCONFRESOURCES
!
dspfarm profile 1 conference video homogeneous
codec g722-64
codec g711ulaw
codec g711alaw
codec g729ar8
codec g729abr8
codec g729r8
codec g729br8
codec h264 w360p frame-rate 30 bitrate 1mbps
maximum sessions
associate application SCCP
no shut
!

make sure you specify a maximum number of sessions, the codec (h264) that you should use depends on what endpoints your using, it can be quite difficult to work out what codec your endpoints support, here is a little trick I did to make it easier for me to work out what codecs my endpoints supported, I setup a meetme number and then had my endpoint set up the conference, if video showed up, that meant that the endpoint would support the codec (easier way to troubleshoot than setting up conferences again and again)

Do a show sccp to make sure your conference bridge has registered to your CUCM, then order your MRGL's in such a way that the Video Conference Resource is picked first by your video conferencing endpoints. If your not sure if this is happening, for example, maybe all your conferences end up as audio only, go to your device with your PVDM3's and do a show voip rtp connection and see if your endpoint addresses are listed, this will tell you if it is being selected as a conference bridge

If you try a multiparty conference now (either ad-hoc or meetme) you should be able to get a three way conference going, remember that the layout is loudest speaker, so only one person will show on the screen at any one time (the person speaking the loudest)

Finally, you might find the following URL with some FAQ's etc. very helpful in working all this out :)

http://www.cisco.com/en/US/prod/collateral/voicesw/ps6790/gatecont/ps4952/qa_c67-649850.html

I had no luck getting my E20 to join in on this conference, it would join the conference but would hang up straight away, i tried a variety of codecs to no avail, and tried lots of other tricks to try and get it working but was unable to achieve it. If anyone knows the trick on how to get the E20 to join these conferences (as according to Cisco, it is supported) I am all ears!

I hope this helps someone out there

Cisco IOS 15 Licensing (Count Based) for CME and SRST

2011-12-28T05:18:00.000-08:00

Hi Guys

Your up for two blog posts in one day today! You lucky guys! (Cough)

So first thing, I wanted to briefly talk about the new licensing again in IOS 15, by now you probably know that you have four basic licenses:

Base
Security
Voice
Data

You get base for free, you add on the other ones, pretty simple right?

What has not always been mentioned and covered off very well is COUNTED licenses, the fact that licenses such as CME and SRST, which used to be honour based, as of the IOS I am looking at (Version 15.2(2)T) are now counted, check out the output of a show license:

Index 1 Feature: ipbasek9
        Period left: Life time
        License Type: Permanent
        License State: Active, In Use
        License Count: Non-Counted
        License Priority: Medium
Index 2 Feature: securityk9
        Period left: Not Activated
        Period Used: 0 minute 0 second
        License Type: EvalRightToUse
        License State: Not in Use, EULA not accepted
        License Count: Non-Counted
        License Priority: None
Index 3 Feature: uck9
        Period left: Life time
        License Type: Permanent
        License State: Active, In Use
        License Count: Non-Counted
        License Priority: Medium
Index 4 Feature: datak9
        Period left: Not Activated
        Period Used: 0 minute 0 second
        License Type: EvalRightToUse
        License State: Not in Use, EULA not accepted
        License Count: Non-Counted
        License Priority: None
Index 5 Feature: gatekeeper
        Period left: Not Activated
        Period Used: 0 minute 0 second
        License Type: EvalRightToUse
        License State: Not in Use, EULA not accepted
        License Count: Non-Counted
        License Priority: None
Index 6 Feature: LI
Index 7 Feature: SSL_VPN
        Period left: Not Activated
        Period Used: 0 minute 0 second
        License Type: EvalRightToUse
        License State: Not in Use, EULA not accepted
        License Count: 0/0 (In-use/Violation)
        License Priority: None
Index 8 Feature: ios-ips-update
        Period left: Not Activated
        Period Used: 0 minute 0 second
        License Type: EvalRightToUse
        License State: Not in Use, EULA not accepted
        License Count: Non-Counted
        License Priority: None
Index 9 Feature: SNASw
        Period left: Not Activated
        Period Used: 0 minute 0 second
        License Type: EvalRightToUse
        License State: Not in Use, EULA not accepted
        License Count: Non-Counted
        License Priority: None
Index 10 Feature: hseck9
Index 11 Feature: cme-srst
        Period left: 8 weeks 3 days
        Period Used: 4 hours 56 minutes
        License Type: EvalRightToUse
        License State: Active, In Use
        License Count: 265/0 (In-use/Violation)
        License Priority: Low
Index 12 Feature: WAAS_Express
        Period left: Not Activated
        Period Used: 0 minute 0 second
        License Type: EvalRightToUse
        License State: Not in Use, EULA not accepted
        License Count: Non-Counted
        License Priority: None
Index 13 Feature: UCVideo
        Period left: 8 weeks 3 days
        Period Used: 4 hours 28 minutes
        License Type: EvalRightToUse
        License State: Active, In Use
        License Count: Non-Counted
        License Priority: Low
From here you can see that I have set a license count for my CME/SRST, for 265 users, but chances are from a counted perspective I probably don't have that many licenses!

I can't help but notice too that even though technically for CME your meant to buy handset licenses.. don't actually see it listed there...

UCVideo is a feature im using that i will cover off in another blog post, WAAS Express is exactly as written. It's WAAS express and finally IOS-IPS and SSL_VPN counts for security are in their too.

This shows briefly my IOS 15 counted licenses tutorial, I hope it helps someone out there work out what they will need to license :)

How to use individual E1 channels for certain purposes on voice routers

2011-12-23T22:00:00.000-08:00

Hi Guys

Quick voice update here, I have been doing a lot more voice work recently, which is good for me. Obviously as a CCIE in Voice I need to keep the voice stuff up :p, but recently I had been doing more routing and switching.

Anyway, I came across something that I have always heard about, but never actually understood how to do, and It never came up in my CCIE Voice studies, so i thought I would post it here for all of you

Let's go through two scenarios, let's say you have a customer who has a 30 channel E1, and says i must ALWAYS be able to dial this number, even if all the channels are busy, there should be 1 channel free for emergency calls (in australia, 000 is our emergency number)

Here is how you would do it:

first, create two trunk groups

trunk group ISDN_OUT

trunk group EMER_OUT

then go to your E1 card and specify the timeslots:

controller E1 0/0/0

pri-group timeslots 1-31

trunk-group EMER_OUT timeslots 31

trunk-group ISDN_OUT timeslots 1-30

Walla! You now have two trunk groups, each with a seperate amount of channels, then you would just have some dial-peers (roughly) configured like this:

dial-peer voice 100 pots

pref 1

destination-pattern 000

trunk-group EMER_OUT

Then a normal dial-peer for all other calls, the great thing about voice router dial-peer matching is that, if the above is busy (so someone is already on an emergency call to triple 0), the voice router wont give up, it will fall to the next available dialpeer shown below (even though it does not strictly match), so that means you always have the ability to dial 000 and have more than one call, but at LEAST one call to 000 will always get through

dial-peer voice 1002 pots

destination-pattern 0T

trunk-group ISDN_OUT

You could use this same trunkgroup concept to take a failed channel out of service (i think there is an easier way to do it though)

I hope this helps someone out there

Excellent UCS article

2011-12-23T06:26:00.000-08:00

Hi Guys

I found this article on UCS, i was so impressed i felt compelled to share it
http://www.networkworld.com/reviews/2011/121911-cisco-ucs-test-253603.html?page=1

VERY good explanation of what UCS is and why you might want it

WAN Acceleration: It Does Work, even for Teleworkers (An introduction to Cisco WAAS Mobile)

2011-12-03T03:20:00.000-08:00

Hi Guys

So this video blog post is yet more evidence (as if there was not enough overwhelming evidence already) that YES, WAN acceleration _really_ does work, and it can give huge benefits to your end users.

This particular blog post though deals with a product called Cisco WAAS Mobile.

So WAN acceleration has typically been targeted at the branch: You put a WAN accelerator out at the branch office(s), you have a WAN accelerator at your head office, and therefore everyone at the branch office(s) accessing resources at your head office gets a great experience. Easy right?

Ok, so what about your teleworkers, people connected over the internet maybe with 3G or 4G cellular networks, and they have a VPN client and they need access to CIFS just like you, they need to get to the intranet, etc. etc.

This is the area for Cisco WAAS Mobile, Cisco WAAS mobile consists of a client and a server application, the server application sits on your LAN, while you install the client on your teleworker PC's. The client connects up to the server and then acts as a WAN accelerator for all the users traffic. It works _EXTREMELY_ well, as you will witness in my video

Video is located here:
http://www.youtube.com/watch?v=wHOw1E8Npmo

CIFS file copying goes from maybe 300k a second over a 2 megabit link (showing how damn badly written CIFS is) to 1.8 megabits, objects are cached (including pictures) which makes downloading similai documents that much faster, and the end user is happy as he gets a LAN like experience over the WAN.

Cisco WAAS Mobile is available as a 30 day trial! anyone struggling with remote teleworkers having a bad experience I strongly encourage you to give it a 30 day Trial and see how you like it!

I hope this helps someone out there

asa/pix pre-shared-key is ****

2011-11-28T04:34:00.000-08:00

Hi Guys

So if your anything like me, you've logged onto an ASA or pix trying to troubleshoot VPN connectivity.. you go to check the preshared key and all you see is:

preshared-key ***

damnit!

If your anything like you assumed it was hidden and could not be recovered.. Wrong!

simply do a:

more system:running-config

and you will be provided with the pre-shared-key in all its unencrypted glory!

Enjoy!

Toll Fraud in IOS 15.1

2011-11-22T00:13:00.000-08:00

Hi Guys

Came across this link and thought i would share:
https://supportforums.cisco.com/docs/DOC-12228

It's cisco discussing the toll fraud prevention feature in the latest IOS. One of the more interesting things I found out from this document is that any dial-peer session target addresses are automagically (love that word) added to the list of trusted sources, but still worth understanding this tech and how it works.

I hope this helps someone out there!

Hello Jaluri!

2011-11-18T22:17:00.000-08:00

Hey guys, this is just a test post to make sure I am being fed into jaluri.com, i really like it and wanna make sure i am listed on it, plus here is some free advertising for all you readers of my blog (all 3 of you!) for jaluri.com, awesome networking blog aggregator.

Guys on jaluri you may have missed my last post (which has my first video post!) on Cisco Unified Provisioning Manager, a way to easily add phones to your CUCM, 90 day trial available, check out more at:

http://www.ccierants.com/2011/11/cisco-unified-provisioning-manager.html

Cheers!

Cisco Unified Provisioning Manager

2011-11-08T01:04:00.000-08:00

Hi Guys
(People using aggregates please see; http://www.ccierants.com/2011/11/cisco-unified-provisioning-manager.html)

So, this is the first time I have ever done a Video blog post, so if it feels rushed and unscripted.. that is because it is! Sorry! I did it as a Video because only a Video could really show how easy Cisco Unified Provisioning Manager can make adding new phones/users/enabling "services" for users with CUCM.

Here are some quick facts:
What: Cisco Unified Provisioning Manager 8.6 is a tool that integrates with your existing CUCM, CUC and CUPs servers to provide a single management pane to easily add users to all three and ensure they are added consistently and accurately.

Essentially it provides templates for line and phone settings to add users to CUCM. So for example, you can create a template called SiteA (As I do in the video) that contains all the settings for SiteA users telephones, lines, voicemail, remote destination profiles and extension mobility profiles and easily add new users with just a few clicks, making changes if you need to.

The provisioning tool takes care of all the little details such as associating the users with their phones, associating the user to the line, updating the primary extension etc. etc. and means you can _very_ rapidly deploy new phones.

It even looks after your number blocks, so you can specify directory numbers for particular sites and it will manage their allocation for you, ensuring they don't overlap, allowing you to reserve some numbers and also showing you an inventory of which are available.

Here is a video showing more:

Higher quality video: http://youtu.be/c6LL-4rZf_4

How: A 90 day trial license is available to make sure it is for you, it's got a list price of 12k for 500 users, so you should half that to get an idea of how much it might cost. I would say it is targeted at quite large organizations who make a lot of add's moves and changes or who have a very complicated CUCM setup.

Caveats: It has a few limitations that I came across such as you cannot use keywords everywhere (keywords like ${FIRSTNAME} and ${EXTENSION} allow you to specify

More Information: I still have not fully explored options such as what about removing services from a user, (i.e. decommissioning a users phone) as I imagine that is quite common task.

If you have had some of your own experience with Cisco Unified Provisioning Manager I would love to hear about it! Leave a comment below

YACFCMEHCUCMD or Yet Another Cool Feature CME has CUCM does not

2011-11-01T03:31:00.000-07:00

HI Guys

(People visiting from Aggregators please visit: http://www.ccierants.com/2011/11/yacfcmehcucmd-or-yet-another-cool.html)

Introducing Unlocked MeetMe Conferences.

Like my very Long acronym in the title? Yes it's time for yet another great feature that CCME has that CUCM does not, the list just keeps getting longer and longer, I am a Cisco fan boy through and through but it boggles my mind that CME gets features that CUCM does not, CUCM is meant to be the flagship.

Plus if you believe the rumors, the plan is to remove CUE running on modules and instead have SRE running Unity Connection, so if that is there plan long term for unity connection, you have to wonder if the next logical step is to do the same for CUCM (you can already do it too, CUCM will run on SRE modules as far as I know)

So anyway, on to the feature

So we all know and love Meet me conference on CCME and CUCM i assume, it is a pretty funky feature where you can setup a conference by pressing the meetme button, dialling the number of the conference 'Room" and then having your participants dial the meeting number (either externally or internally) This means you as the conference organiser don't have to dial everyone in, you can just say

Ring me at 5:00pm on this number to join the conference, deal with it.

Your participants then just dial in, pretty simple and effective hey.

But it has a few small limitations, for some it is a hassle to have to press the meetme soft key, they forget to do it. To me though one of the main limitations is that you actually have to be infront of a Cisco Handset in order to start the conference off, what if you want a conference but your away from your desk when the conference starts, maybe an important customer wants to talk business so you hop into your car to go see him before realising, DAMN, i forgot about my conference, and i can't even start the conference now because I am on the road.

Well, conference meetme unlocked is what your after in this situation.

With Conference Meetme unlocked, you can have a meetme number that is always ready to go, simply dial in and the conference starts, even if your the first one to start the conference!

It is super easy to configure as well, here is a quick example configuration:

ephone-dn 6 octo-line
number 3000
conference meetme unlocked
!

Easy as that guys, just that simple keyword at the end of conference meetme "unlocked" and walla your ready to go.

Let's use a show command to get a bit more info:

PeterCCIE18371#show ephone-dn conference meetme
type active inactive numbers
=======================================
Meetme 1 7 3000
DN tags: 6
All DN tags unlocked.

now for those of you who have never even setup a normal meet me conference I have included all my configuration for you just to give you a bit more to work with :)

Just quickly, 10.0.0.3 is my local CCME, (which is Fa0/1 IP address)

sccp local FastEthernet0/1
sccp ccm 10.0.0.3 identifier 1 version 7.0
sccp
sccp ccm group 1
associate ccm 1 priority 1
associate profile 1 register CONFHQ
dspfarm profile 1 conference
codec g711ulaw
codec g711alaw
codec g729ar8
codec g729abr8
codec g729r8
codec g729br8
maximum sessions 1
associate application SCCP
telephony-service
sdspfarm units 1
sdspfarm tag 1 CONFHQ
conference hardware
ephone-dn 6 octo-line
number 3000
conference meetme unlocked
!

Of course you must be careful from a security perspective to ensure that only people within your organization can dial this number, this can be accomplished with COR's (incoming COR's and Outgoing COR"S) I have even seen some smart cookies out there on internet land who have setup AA scripts so there meet me's have a PIN!

I hope this helps someone out there!

Mad shout out to my good friends blog

2011-10-26T20:47:00.001-07:00

Hi Guys

A very good friend of mine has started a Web Hack Blog detailing common (and not so common) exploits that people are using to hack websites and most importantly how to protect yourself from them. Be sure to check it out and let him know that Peter from CCIE Rants sent you :p

The address is: h ttp://www.webhackblog.com/

Cisco WAAS Directed mode, bypass any firewall Including Watchguard, Checkpoint or ASA

2011-10-11T19:11:00.000-07:00

Hi Guys

So I am a huge fan of the Cisco WAAS, I think that as a WAN accelerator it works extremely well and I especially like that you can get it as:

A Module in the router
Software-only solution on the router
WAE Appliance
WAE Server

Anyway, enough talking about how awesome Cisco WAAS is, on to the technical stuff!

So, a Cisco WAAS works by peering with another Cisco WAAS and doing very funky things to the TCP packets, including messing with the sequence numbers and the Syn/Syn-Ack headers, here's more detail straight from the Cisco Documentation:

"WAE devices automatically discover one another during the TCP three-way-handshake that occurs when two nodes establish a TCP connection. This discovery is accomplished by adding a small amount of data to the TCP options field (0x21) in the SYN, SYN/ACK, and ACK messages. This TCP option allows WAE devices to understand which WAE is on the other end of the link and allows the two to describe which optimization policies they would like to employ for the flow. If intermediate WAEs exist in the network path, they simply pass through flows that are being optimized by other WAEs. At the end of the auto-discovery process, the WAEs shift the sequence numbers in the TCP packets between the participating WAEs by increasing them to more than 2 billion, to mark the optimized segment of the connection. "

Source: http://docwiki.cisco.com/wiki/Cisco_WAAS_Troubleshooting_Guide_for_Release_4.1.3_and_Later_--_Understanding_the_WAAS_Architecture_and_Traffic_Flow

So what does this mean? It means that many firewalls such as checkpoint, ASA, Watchguard etc. etc. see these very strange TCP Packets and sequence numbers and think "this must be malicious so i should block the traffic" this can lead to major problems including the traffic simply not flowing.

Now, the solution on a cisco ASA Is to simply add:

inspect waas

to your global service policy, but the Watchguard, has no such option as far as I can tell (Do you know that it does? Leave a comment below!) The checkpoint apparently has a similiar way of avoiding this problem but it is a bit more complicated than the single line of config required for the ASA

So at this Point I am stuck.

I mention all of this to my friend Paul Tursan who points out that he seems to recall the cisco WAAS has a mode of operation where it encapsulates the traffic so you don't have to worry about these header modifications.

After some digging I discovered the mode is called Directed mode, and it works GREAT! Here is the details straight from the Cisco Documentation:

By default, WAAS transparently sets up new TCP connections to peer WAEs, which can cause firewall traversal issues when a WAAS device tries to optimize the traffic. If a WAE device is behind a firewall that prevents traffic optimization, you can use the directed mode of communicating to a peer WAE. In directed mode, all TCP traffic that is sent to a peer WAE is encapsulated in UDP, which allows a firewall to either bypass the traffic or inspect the traffic (by adding a UDP inspection rule).

The great thing about directed mode too is it is one of those protocols that as long as both ends support it only one end needs it enabled!

If a WAE at either end of a peer WAE connection specifies directed mode, and both WAEs support directed mode, then both WAEs use directed mode, even if one is not explicitly configured for directed mode. If a peer WAE does not support directed mode, then the peers pass through traffic unoptimized and each WAE creates a transaction log entry that notes the failed directed mode attempt.

Brilliant, Totally brilliant, now we can use our WAAS behind any firewall including ones we don't have direct control over as long as they allow through a certain UDP port that we specify

To configure directed mode, you can use the GUI (boo!) or login to the CLI and issue the following command:

directed-mode enable

Great stuff!

http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v411/configuration/guide/network.html#Configuring_Directed_Mode

The new video conferencing in CUCM 8.6

2011-09-22T02:10:00.000-07:00

Hi Guys

As some of you may know from my previous blog post, the new version of CUCM 8.6 now supports Video Conferencing using just the PVDM3 DSP modules you have in your ISR G2 router! No need for an expensive MCU anymore, obviously there are some limitations but all in all it looks pretty nice.

When you go to add a new Conference Bridge, you will see some new options you might not have seen before! Here is details as to what they actually do:

Conferencing with Cisco Integrated Services Routers Generation 2

Cisco Integrated Services Routers Generation 2 (ISR G2) can be enabled to act as an IOS-based conference bridge that supports ad hoc and meet-me audio and video conferencing. DSP modules must be installed on the router to enable the router as a conference bridge.

Within Cisco Unified Communications Manger, the ISR G2 can be configured as one of three Conference Bridge Types:

•Cisco IOS Homogeneous Video Conference Bridge—This conference bridge type supports homogeneous video conferences. A homogeneous video conference is a video conference in which all participants connect to the conference bridge using the same video format attributes. The conference bridge sends the same data stream format to all the video participants.

•Cisco IOS Heterogeneous Video Conference Bridge—This conference bridge type supports heterogeneous video conferences. In a heterogeneous video conference, conference participants connect to the conference bridge with phones that use different video format attributes. The DSP provides transcoding and transsizing features to convert the signal between the various formats.

•Cisco IOS Guaranteed Audio Video Conference Bridge—This conference bridge type reserves DSP resources for audio conferencing, but does not reserve DSP resources for video conferencing. Callers on video phones may have video service if DSP resources are available at the start of the conference. Otherwise, the callers connect to the conference as audio participants.

(Source; http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/rel_notes/8_6_1/delta/delta.html#wp1601391)

Cheers!

Peter Revill, Dual CCIE #18371 Routing and Switching, Voice

http://ccierants.blogspot.com

Just a quick update on a previous post

2011-09-01T23:36:00.000-07:00

Hey Guys

you may have seen my previous post, how to copy a image to an IOS router without having to actually have FTP access found here:

http://ccierants.blogspot.com/2011/06/great-way-to-copy-files-on-cisco.html

Just a super quick follow up, to enable this same feature to work on the ASA you just need this command here:

ssh scopy enable

Happy copying!

Peter Revill
Dual CCIE #18371 Routing and Switching, Voice

Cisco Identity Firewall ASA intergration with AD for firewall rules

2011-08-26T02:45:00.001-07:00

Hey Guys

So this feature is pretty damn cool in my opinion, this feature is called Cisco ASA identity firewall

This feature is available in ASA Firmware 8.4.2, is part of the base License and looks great

Basically what it allows you to do is configure firewall rules not based on IP address but based on username or group membership in AD! The user doesn't need to login or anything complicated for this to work.

what happens is, The Cisco ASA talks to a piece of free software available from Cisco (no license required) that connects to AD and maps logged in users to IP addresses, in the background this is what the ASA Is looking at when it is evaluating access rules, but when your configuring it, you just say "block all Internet Traffic for users belonging to this group"

To quote Cisco:

"The key benefits of the Identity Firewall include:
• Decoupling network topology from security policies
• Simplifying the creation of security policies
• Providing the ability to easily identify user activities on network resources
• Simplify user activity monitoring
"

So, just to run you through the scenario

Let's say you have a user, User X who is a very important executive, this Very important executive travels all over to diffirent sites on your WAN, so his IP might be totally different each time, he also loves to VPN into your network all the time.

He INSISTS that he is able to run Bit Torrent when he is plugged into the network, but of course you ban it for everyone else.

So, what do you do in a normal situation? Put his Office in a separate VLAN and assign him a separate IP? Yep that could work for his office, but what about when he travels to different sites, what about when he connects over the VPN?

With Identity Firewall, you just specify an access-list that looks something like this:

access-list internetOut permit ip user DCDOMAIN\ImportantExecutive any any

You can see from the above, basically you just reference it as the Windows Domain ID then the userID

You could also specify a group

hostname(config)# access-list aclname extended
permit ip user-group SAMPLE\\group.marketing any any

What happens is, when the ASA is evaluating the rules, it queries the AD Connect Agent that you installed on a windows server, which keeps a mapping of the IP address to windows login details (it gets this info from Microsoft AD) the AD connect agent is constantly updating as users log in and out, it also receives information from the ASA whenever a user log's in to the VPN and makes sure it gets their IP address details too!

You can see how this could greatly simplify your firewall configuration and allow rapid changes. It is a powerful tool and I can't wait to get my hands on ASA running 8.4.2 to try it out and show you all how to configure it! (Donations of ASA's kindly welcomed :p)

Debugging crypto properly, getting all those lovely attributes you dont normally get

2011-08-24T20:44:00.000-07:00

hi Guys

I am not sure how many of you have dealt with IPSEC and VRF, but its quite complicated, what makes it even more complicated is trying to troubleshoot it, it can be a VERY difficult process. Below are some commands I learnt about recently that provide a HUGE level of debugging:

#show debug

Cryptographic Subsystem:
Crypto ISAKMP debugging is on (actual command is debug crypto isakmp)
Crypto ISAKMP Error debugging is on (actual command is debug crypto isakmp error)

IKEV2:
IKEV2 error debugging is on (actual command is debug crypto ikev2 event)
IKEV2 terse debugging is on
IKEV2 event debugging is on
PKI:
verbose debug output debugging is on (this is the _KEY_ command, debug crypto verbose)

The last one is the most important one, as with it you get beautiful debug output that shows you things like, was the keychain actually hit, if it was where the attributes acceptable, what attributes did the other end send etc

A voice post! How to take an ISDN channel out service for E1

2011-08-22T19:17:00.001-07:00

Hi Guys

Finally I found a post to make about voice! I am sure we have all been in the situation where we have had to take ISDN channels out of service to help diagnose a problem (Some customers for example, seem to have one way voice issues on single channels, or other such problems) and it is helpful when you can confirm what the heck the issue is by taking out an ISDN channel, or just as a quick stop gap measure while you wait for new DSP's or the telco to fix the issue

Here is how to do it on an E1:

Router(config)#interface serial 0:15

Router(config-if)#isdn service b_channel X state 2

I found this at:

https://supportforums.cisco.com/docs/DOC-4989

This works for SIP and H.323 gateways, for MGCP you need to set the enterprise parameter.

Very good IT Related article

2011-08-16T05:41:00.000-07:00

I don't often do this, but This is the best bit of IT hiring advice I have ever heard/read:
http://www.networkworld.com/news/2011/081511-recruiting-atrophy.html?page=2

Configuring Stack Power, what they DON'T tell you

2011-08-15T21:18:00.000-07:00

Hi Guys

So their is a guide to configuring Stack Power for 3750x's available at:
http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/12.2_58_se/configuration/guide/swstkpwr.html#wp1015591

However, to say it is incomplete would be an understatement. If you just read this document, it appears all you have to do is plug the power cables in and away it goes, this however is not accurate, and sometimes it can be a little flakely, so without further ado, please enjoy my guide on getting stack power configured:

Step 1.
Get all your switches powered up using their own power, stack them together as a data stack, The directions change a little bit if your not using a stack OR if you don't have enough power cables and want to just get a few switches up using only one power cable, Your directions are a little diffirent. Leave a comment if you need help.

Step 2.
So, first of all you need to issue a command like such:

show stack-power

Power stack name: Powerstack-1
Stack mode: Power sharing strict
Stack topology: Standalone
Switch 3:
Power budget: 1063
Low port priority value: 22
High port priority value: 13
Switch priority value: 4
Port 1 status: Shut
Port 2 status: Shut
Neighbor on port 1: 0000.0000.0000
Neighbor on port 2: 0000.0000.0000

If you look at this output, the key words are Port 1 Status: Shut and Port 2 Status: Shut

This means that the stack power is not turned on yet on those ports, to turn it on issue this command:

switch1#stack-power switch 1 port 1 enable
switch1#stack-power switch 1 port 2 enable

This will enable stack power across the ports, you need to do this on every switch in your stack, so for example:

switch1#stack-power switch 2 port 1 enable
switch1#stack-power switch 2 port 2 enable

and so on and so forth for each switch, now you should also ensure all your switches are part of the same Power Stack (each switch can belong to one power stack group)

#show stack-power

Power stack name: Powerstack-1
Stack mode: Power sharing strict
Stack topology: Ring
Switch 1:
Power budget: 343
Low port priority value: 21
High port priority value: 12
Switch priority value: 3
Port 1 status: Connected
Port 2 status: Connected
Neighbor on port 1: 44d3.ca71.1c00
Neighbor on port 2: 44d3.ca70.0e00

Switch 2:
Power budget: 373
Low port priority value: 20
High port priority value: 11
Switch priority value: 2
Port 1 status: Connected
Port 2 status: Connected
Neighbor on port 1: 44d3.ca71.1b80
Neighbor on port 2: 44d3.ca71.1c00

Switch 3:
Power budget: 343
Low port priority value: 22
High port priority value: 13
Switch priority value: 4
Port 1 status: Connected
Port 2 status: Connected
Neighbor on port 1: 44d3.ca70.0e00
Neighbor on port 2: 44d3.ca71.1b80

the configuration to place them all in the same group like this is shown below:

stack-power stack Powerstack-1
stack-power switch 1
stack Powerstack-1
stack-power switch 2
stack Powerstack-1
stack-power switch 3
stack Powerstack-1

This will place all three switches into the same power stack.

Now finally, the next step is to configure any parameters we might want such as setting one switch to have a higher priority than the other.

So, every switch has a priority, the higher priority switches have there power shedded first (confusing i know)

within the switch, there are also high-priority POE ports and low-priority POE Ports, you set your high priority POE ports with a lower value and your low-priority ports with a higher value

Note that a switches priority must be LOWER than its own ports, you could also use these values to make it so that, lets say you had three switches, you could say if you need to shed power, shed power from the low-priority POE ports for switch 1 and 2 first, THEN if still not enough power just shut down switch 3, then if still not enough power shut down switch 2 then 1

so you can see you can really ensure that each switch has a particular priority and same for the ports

Here is an example

switch#show stack-power
Power stack name: Powerstack-1
Stack mode: Power sharing strict
Stack topology: Ring
Switch 1:
Power budget: 343
Low port priority value: 11
High port priority value: 10
Switch priority value: 1
Port 1 status: Connected
Port 2 status: Connected
Neighbor on port 1: 44d3.ca71.1c00
Neighbor on port 2: 44d3.ca70.0e00

Switch 3:
Power budget: 343
Low port priority value: 15
High port priority value: 14
Switch priority value: 3
Port 1 status: Connected
Port 2 status: Connected
Neighbor on port 1: 44d3.ca70.0e00
Neighbor on port 2: 44d3.ca71.1b80

Switch 2:
Power budget: 373
Low port priority value: 13
High port priority value: 12
Switch priority value: 2
Port 1 status: Connected
Port 2 status: Connected
Neighbor on port 1: 44d3.ca71.1b80
Neighbor on port 2: 44d3.ca71.1c00

In this example, low priority ports on switch 3 are shed first, then the high priority ports

then on switch 2, low priority ports are shed first, then high priority

then on switch 1, low priority ports are shed first, then high priority

Finally, if enough power is not available with all POE ports turned off, switch 3 is turned off first, followed by switch 2, then switch 1

However, in the example above we have enough power to power all three switches with one power supply

OTV + first hop redundancy

2011-08-15T18:01:00.001-07:00

http://www.netcraftsmen.net/component/content/article/69-data-center/905.html

Good article!

Bidirectional Forwarding Detection

2011-08-10T02:38:00.000-07:00

Hi Guys

So right now I am doing a Cisco Nexus 1000,5000,7000 Training course and during this course I came across for the first time a protocol you may or may not have heard of called Bidirectional Forwarding Detection that can be _VERY_ Useful to all you BGP guys out there, heck to anyone running a routing protocol.

When I first started looking into this protocol, it appeared it was something juniper had actually developed, I was like finally a protocol Juniper developed! But Alas, Junipers own slides refer to the fact it's a joint effort between Juniper and Cisco (Source: http://meetings.ripe.net/ripe-48/presentations/ripe48-eof-bfd.pdf Last Page) But it is great to see them working together to help us network engineers get even better protocols and products!

So, what is Bidirectional Forwarding Detection and why should I care?

So let's say you have dual homed internet connections, via BGP for example, or maybe you have two connections via OSPF for your internal network, whatever the case may be, you might have run into this problem:

Time it takes to detect a dead peer is painfully long!

Sure sure, you can tweak the timers for OSPF and to a certain extent BGP, but wouldn't it be nice if there was a way to easily add this capability without having to affect BGP/OSPF

Enter BFD, BFD provides _VERY_ fast dead peer detection, and can then feed this information into your routing protocol which can then know the peer is dead very quickly and converge

It is super easy to configure, works on all all media types, encapsulations, topologies, and routing protocols.

Let's get onto some configuration!

Here I have two routers connected via a single gigabit link running BGP and OSPF, nothing special so far:

R1#show run | sect router
router ospf 1
network 192.168.1.0 0.0.0.3 area 0
router bgp 65400
bgp log-neighbor-changes
neighbor 192.168.1.1 remote-as 65400

R2#show run | sect router
router ospf 1
network 192.168.1.0 0.0.0.3 area 0
router bgp 65400
bgp log-neighbor-changes
neighbor 192.168.1.2 remote-as 65400

They are neighbors:

R2#show ip bgp sum
BGP router identifier 192.168.1.1, local AS number 65400
BGP table version is 1, main routing table version 1

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
192.168.1.2 4 65400 52 52 1 0 0 00:43:22 0

R2#show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
192.168.1.2 1 FULL/DR 00:00:33 192.168.1.2 GigabitEthernet1/0

so far so good, next let's configure BFD

So currently the only supported BFD mode is Asynchronous mode, this means that BOTH ends must be configured to support it, so if your ISP on your BGP won't provide it at the moment your shit out of luck. But I believe there is a mode of BFD called demand mode that might address this.

So, to configure it, first we go to the interface that has our peering relationship and enter:

bfd interval <50-999> min_rx <1-999> multiplier <3-50>

So the BFD interval is how often we send BFD's, the min_rx is how often we except to receive the BFD's (it can be more frequently though that is fine, but we are basically saying if we dont receive one within this time frame consider it a timeout) and then finally we have a multiplier which is how many we can miss before we consider the interface down

Now unfortunately, and I would love to see if someone can correct me, but doing this alone is not enough to turn on BFD and actually see if the other end has it turned on, what you need to do is:

router ospf 1
bfd all-interface
!

This turns on BFD for any interface that has a BFD interval configured.

If the peer goes down, you will see a message like this:

*Aug 10 18:24:59.323: %OSPF-5-ADJCHG: Process 1, Nbr 192.168.1.1 on GigabitEthernet1/0 from FULL to DOWN, Neighbor Down: BFD node down

Pretty cool hey? And I tell you when I was testing it, it went down in absolute microseconds when I did this, so very funky little feature to help with convergence times.

Let's see how to configure it with BGP (which is probably more relevant because let's face it, OSPF convergence times can be tuned and are not that bad, BGP has the bad convergence times)

so with BGP, same again with the BFD interval:

interface GigabitEthernet1/0
ip address 192.168.1.2 255.255.255.252
negotiation auto
bfd interval 100 min_rx 100 multiplier 3
!

Then you go ahead and enable it on your BGP Peer:

router bgp 65400
neighbor 192.168.1.1 remote-as 65400
neighbor 192.168.1.1 fall-over bfd
!

Easy as that! Super easy to turn on as you can see, you can verify with:

R2#show ip bgp neighbor
BGP neighbor is 192.168.1.1, remote AS 65400, internal link
Fall over configured for session
BFD is configured.

To verify BFD itself is working, you have:

R1#show bfd neighbors

NeighAddr LD/RD RH/RS State Int
192.168.1.2 1/1 Up Up Gi1/0

Pretty cool hey!

Here are some references on how to configure it both for Juniper and Cisco

Cisco:
http://www.cisco.com/en/US/technologies/tk648/tk365/tk480/technologies_white_paper0900aecd80244005.html

Juniper:
http://www.juniper.net/techpubs/software/junos/junos94/swconfig-routing/configuring-the-bfd-protocol_3.html

New 3750X models

2011-08-02T00:05:00.000-07:00

Hi Guys

you might be as interested as me to know that their is now 12 Port and 24 Port SFP 3750X switches, finally!
http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps10745/product_bulletin_c25-675378.html