AnalysisMan

Extreme Switch - How to ping IPv6 Link-Local address

2025-05-27T21:00:00.000-07:00

Introduction

IPv6 link-local addresses (fe80::/10) are valid only on the local link and require an explicit interface context when you use the ExtremeXOS ping command. Without specifying the VLAN, the switch cannot determine the egress interface and returns an error. By appending “%<vlan_name>” to the link-local address, you indicate exactly which VLAN the packet should originate from, enabling a successful ICMPv6 echo request.

Symptoms

When you try to ping a link-local IPv6 address without a scope identifier, ExtremeXOS reports:

# ping ipv6 fe80::204:96ff:fe98:9d5d
Error: The egress interface cannot be determined. The link local address must be of form LLA%<vlan_name>.

Cause

The CLI needs both the address and the VLAN context because link-local addresses are non-routable and exist on every interface simultaneously. Omitting the scope prevents the switch from knowing which interface to use for the ping.

Resolution

Use the following syntax:

ping ipv6 link-local-address%vlan_name

Steps:

Identify the VLAN you want to source the ping from.
Append “%VLAN_NAME” directly to the fe80:: address (no spaces).
Run the ping command with the full, scoped address. 1

Example

To ping fe80::204:96ff:fe98:9d5d from VLAN “Test”:

EXOS# ping ipv6 fe80::204:96ff:fe98:9d5d%Test
Ping(ICMP6) fe80::204:96ff:fe98:9d5d: 4 packets, 8 data bytes, interval 1 second(s).
16 bytes from fe80::204:96ff:fe98:9d5d: icmp_seq=0 ttl=64 time=7.398 ms
16 bytes from fe80::204:96ff:fe98:9d5d: icmp_seq=1 ttl=64 time=0.523 ms
16 bytes from fe80::204:96ff:fe98:9d5d: icmp_seq=2 ttl=64 time=5.025 ms
16 bytes from fe80::204:96ff:fe98:9d5d: icmp_seq=3 ttl=64 time=0.524 ms

--- fe80::204:96ff:fe98:9d5d ping statistics ---
4 packets transmitted, 4 packets received, 0% loss

References

Solution: Getting error when trying to ping fe80 ipv6 address | Extreme Portal

Links

Search articles with a tag ‘IPv6’

Extreme Switch - Troubleshooting BGP issue in EXOS

2025-05-22T23:05:00.000-07:00

A reliable Border Gateway Protocol (BGP) session is vital when your Extreme switch is the hand-off to an ISP or upstream peer. Below is a field-tested checklist—expanded with IPv6 examples—to help you move methodically from physical reachability to policy filters and quickly locate the root cause of missing routes or a stuck session.

Verify the BGP neighbors

Display BGP neighbor information

show bgp neighbor


```
EXOS # show bgp neighbor
===================================================================================
Peer               AS     MsgRcvd MsgSent OutQ  Up/Down          State        |  PfxRcvd  PfxSent  PfxAcct
-----------------------------------------------------------------------------------
198.51.100.1     64512     38,912  38,840     0  4d03h22m18s     Established  |   64,820      120   Enabled
2001:db8::1      64513        679     672     0     00h15m12s    Established  |    1,189       55   Enabled
===================================================================================

```

Verify that the session is really up



show bgp neighbor 198.51.100.1

Look for the line State : ESTABLISHED. If the FSM is anything else (Idle, Active, Connect, OpenSent/Confirm), focus on layer-3 reachability, TCP/179 ACLs, or authentication first. (Extreme Networks)

[!tip] Finite State Machine (FSM)

FSM stands for Finite State Machine. In BGP, the FSM models how a peering session progresses through six well-defined stages. Each transition is triggered by specific events such as successful TCP handshakes, reception of protocol messages, or timers expiring. Errors push the session back to an earlier state or terminate it.

Idle – initial state before any attempt to connect

Connect – TCP port 179 connection attempt in progress

Active – retrying or awaiting a TCP connection

OpenSent – BGP OPEN message sent, waiting for peer’s OPEN

OpenConfirm – OPENs exchanged; waiting for the first Keepalive

Established – Keepalives and Updates flow; routes are actively exchanged

Knowing the current FSM state helps you pinpoint at which step the peering process is failing, making it a fundamental tool for BGP troubleshooting.

IPv6 peer example

show bgp neighbor 2001:db8::1

The output is identical in structure; you will also see separate capability blocks for ipv6-unicast and ipv6-multicast.

Confirm the negotiated address-families

In the neighbor detail you should see Capabilities Config : ipv4-unicast, … , ipv6-unicast under each address-family section. Missing ipv6-unicast means one side never offered it (often because the right license or knob is absent). Extreme notes that IPv6 BGP requires a Premier/Core license on many Summit platforms. (Extreme Networks)

Inspect what you send to the peer

show bgp neighbor 198.51.100.1 transmitted-routes all

Check that every intended prefix appears and carries the correct Next-Hop, Local-Pref, MED and AS-Path. If something is absent:

Make sure the network is in the local routing table (RIB).
Verify any route-policy out … statements are not filtering it.
Confirm next-hop-self is set when advertising iBGP routes to eBGP peers. (Extreme Networks)



```
EXOS # show bgp neighbor 198.51.100.1 transmitted-routes  all

Advertised Routes:
     Destination                         Next-Hop        LPref Weight MED        AS-Path
----------------------------------------------------------------------------------------
 >?  17.17.17.0/24                       198.51.100.2    100          0         
 >?  24.24.24.24/32                      198.51.100.21   100          0         
 >?  198.51.100.0/24                     198.51.100.21   100          0         

Flags: (*) Preferred BGP route, (>) Active, (d) Suppressed, (h) History
       (s) Stale, (m) Multipath, (u) Unfeasible

Origin: (?) Incomplete, (e) EGP, (i) IGP

BGP Route Statistics
  Advertised Routes : 3
```

IPv6 equivalent

show bgp neighbor 2001:db8::1 transmitted-routes ipv6-unicast all

Inspect what you receive



show bgp neighbor 198.51.100.1 received-routes all


```
EXOS # show bgp neighbor 198.51.100.1 received-routes all

Routes:
     Destination         Peer            Next-Hop        LPref Weight MED        AS-Path
----------------------------------------------------------------------------------------
*>?  0.0.0.0/0           198.51.100.1    10.58.106.1     100   1      0         
*>?  1.1.1.1/32          198.51.100.1    198.51.100.1    100   1      0         
*>?  2.2.2.1/32          198.51.100.1    192.168.10.22   100   1      0         
*>?  10.58.106.0/24      198.51.100.1    198.51.100.1    100   1      0         
*>?  192.168.10.0/24     198.51.100.1    198.51.100.1    100   1      0         
*>?  192.168.53.0/24     198.51.100.1    198.51.100.1    100   1      0         
*>?  192.168.55.0/24     198.51.100.1    198.51.100.1    100   1      0         
  ?  198.51.100.0/24     198.51.100.1    198.51.100.1    100   1      0         

Flags: (*) Preferred BGP route, (>) Active, (d) Suppressed, (h) History
       (s) Stale, (m) Multipath, (u) Unfeasible

Origin: (?) Incomplete, (e) EGP, (i) IGP

BGP Route Statistics
  Total Rxed Routes : 8
  Feasible Routes   : 8
  Active Routes     : 7
  Rejected Routes   : 0
  Unfeasible Routes : 0
```

Display all routes in the RibIN.

show bgp routes all

For IPv6, simply add ipv6-unicast:

show bgp neighbor 2001:db8::1 received-routes ipv6-unicast all


```
EXOS # show bgp neighbor 2001:db8::1 ipv6-unicast received-routes all

Routes:
     Destination                                 LPref Weight MED
       Peer                                     Next-Hop
       AS-Path
-------------------------------------------------------------------------
*>i  ::/0                                        100   1      0
       2001:db8::1                      2001:db8::1
       6461

Flags: (*) Preferred BGP route, (>) Active, (d) Suppressed, (h) History
       (s) Stale, (m) Multipath, (u) Unfeasible

Origin: (?) Incomplete, (e) EGP, (i) IGP

BGP Route Statistics
  Total Rxed Routes : 1
  Feasible Routes   : 1
  Active Routes     : 1
  Rejected Routes   : 0
  Unfeasible Routes : 0
```

Check the local BGP and IP routing tables

For IPv4 BGP

show bgp routes all
show iproute

For IPv6 BGP

show bgp routes ipv6-unicast all
show iproute ipv6

Compare what BGP believes is best with what the FIB (iproute) actually programs. If the best path is missing from the FIB, you may be hitting a hardware route-table limit or an administrative distance conflict.

Typical culprits and quick fixes

Symptom	Checklist item	Likely fix
Neighbor stuck in Active	IP reachability / ACLs / auth	`enable sharing` on LAGs, allow TCP/179, verify passwords
No IPv6 routes learned	Capabilities missing	Check Premier/Core license; `show licenses` or `show licenses detail`
Intended prefix not advertised	Network not in RIB or outbound policy filters it	`configure bgp add network …`, adjust `route-policy out`
Received route visible but not active	Better path learned elsewhere or policy rejected it	Adjust `local-preference`, MED, or remove rejecting policy
Full-view floods hardware table	Platform route scale limit	Summarize, filter, or switch to partial route-reflector feed

Handy IPv6 configuration snippets

Advertise a local /48

configure bgp add network ipv6 2001:db8:100::/48

Create an IPv6 eBGP peer

create bgp neighbor 2001:db8::1 remote-AS-number 64512
configure bgp neighbor 2001:db8::1 source-interface ipaddress 2001:db8::20
enable bgp neighbor 2001:db8::1

Display IPv6 routes

show bgp routes ipv6-unicast all

References

How To: How To: Troubleshoot BGP Issues on Switch Engine (EXOS) | Extreme Portal
How To: How to see IPv6 routes transmitted or received by BGP router? | Extreme Portal
How To: How To: Configure BGP on Switch Engine (EXOS) | Extreme Portal
How To: How to add an IPv6 address to a VLAN | Extreme Portal
Q A: Does BGP work with a base license on universal EXOS switches | Extreme Portal

Links

AnalysisMan.com - Search articles with a tag ‘BGP’

IPv6 Tools Online for Network Engineers

2025-05-21T19:54:00.000-07:00

Here are some useful tools for network engineers to look up IPv6 information—all freely available online.

IPv6 Subnet Calculator

IPv6 Subnet Calculator (SubnettingPractice)

IPv6 Subnet Calculator (Zoho ManageEngine Site24x7)

IPv6 DNS Lookup

IPv6 DNS Lookup (webdnstools)

IPv6 Lookup (dnslookup.online)

DNS Lookup IPv6 (MXToolBox)

IPv6 Prefix Search in ISPs

he.net Super Looking Glass

IPv6 DNS Servers

Google

2001:4860:4860::8888
2001:4860:4860::8844

Cloudflare

2606:4700:4700::1111
2606:4700:4700::1001
Use these if you just want standard DNS resolution.

If you’d like built-in malware filtering, use the following:

2606:4700:4700::1112
2606:4700:4700::1002

For malware filtering and blocking adult content, use these:

2606:4700:4700::1113
2606:4700:4700::1003

Open DNS

2620:0:ccc::2
2620:0:ccd::2

If you want to use IPv6 DNS with filtering to help protect your devices, you’ll need to use the following:

2620:119:35::35
2620:119:53::53

IPv6 settings for your device

Configure your network settings to use Google Public DNS

Test your IPv6 connectivity

Test your IPv6.

References

IPv6 - Wikipedia
Google IPv6 adoption Statistics

Links

Online Network Tools for Network Engineers | AnalysisMan

Extreme Networks SD-WAN Appliance Models

2025-05-17T20:57:00.000-07:00

SD-WAN appliances provide a common set of software capabilities, differentiated by performance metrics and connectivity capabilities. Appliances are divided into two primary usage groups based on the designation of either Branch or Data Center.

SD-WAN Appliance Specifications

SD-WAN Appliance for Branch Offices

SD-WAN Appliance for Data Center

! NOTE:

Please refer to the Extreme Networks link on the References page below to access the most up-to-date hardware datasheets.

References

ExtremeCloud SD-WAN | Extreme Networks
Q A: What are the technical specification for each SD-WAN appliance model? | Extreme Portal

Links

SD-WAN Terminology for Extreme SD-WAN

Extreme Switch - How to check GBIC (SFP, SFP+) information in EXOS

2024-12-26T16:04:00.000-08:00

When working with Extreme EXOS switches, it’s often necessary to check the details of the optical transceivers connected to the ports. Here's how you can do it effectively.

The following command will show the optic details for all ports connected to a Summit switch:

debug hal show optic-info

For a more targeted approach within a Summit stack, specify the slot and port numbers:

Slot-1 switch-exos-stack # debug hal show optic-info slot 1 port 50
Port 50
SFP or SFP+ or SFP28: SFP+
Signal: not present
TX Fault: yes
Vendor: BROCADE
oui: 00-05-1E
Part Number: 57-0000075-01
Serial Number: AAF333380000111
Manufacture Date: 141124
Revision: A
SFP/SFP-DD/SFP+/SFP28 Type:SFP/SFP+/SFP28
Connector: LC(7)
Type: SR
Supported: no
Wavelength: 850
Options[0]: 0x00
Options[1]: 0x1a

GBIC supports DDMI. MonitorType: 68

Additional Commands

show ports configuration no-refresh port-number
show port transceiver information detail
debug hal show optic-info

References

Q A: How do we verify whether a transceiver or optic is supported or unsupported in Switch Engine (EXOS)? | Extreme Portal
Q A: What commands are used to check the the model number and serial number of a connected SFP? | Extreme Portal
Q A: Which Optics Are Supported Per Platform? | Extreme Portal

Links

Label - Extreme Switch - EXOS

SD-WAN Terminology for Extreme SD-WAN

2024-03-23T21:00:00.000-07:00

Software-Defined Wide Area Networking (SD-WAN) has emerged as a game-changer for modern enterprise networks, offering improved application performance, security, and operational efficiency. However, the terminology surrounding SD-WAN can often seem overwhelming, especially for those new to the technology. In this article, I'll demystify some of the key terms used in the context of Extreme Networks' SD-WAN solution, helping you navigate this space with confidence.

TCP/IP Packet Format

2024-03-09T21:00:00.000-08:00

Data Encapsulation

TCP data is encapsulated in an IP datagram.

TCP Header - RFC 173

UDP Header - RFC 768

IP Header - RFC 791, 1349, 2474, 3168

IPv6 Header - RFC 2460 (IPv6 Spec)

References

IPv6 packet (Wikipedia)
Packet Header Cheat Sheets
IPv6 cheat sheet
Understanding the IPv6 Header (Pearson)
How Traceroute Works (IP With Ease)
Ethernet frame (Wikipedia)

Extreme Wireless - How to console into Extreme Cloud AP using a micro-USB cable

2024-02-04T21:00:00.000-08:00

Introduction

In this guide, I'll walk you through how to connect to the Extreme Cloud AP using a micro-USB cable, including the essential step of downloading the necessary driver.

To console into an AP305C/CX, AP4xxC AP, AP5xxx, AP4xxx, AP3xxx, you need to use a micro-USB console cable because these models don’t have the RJ-45 Ethernet-type console port. The console port (5) is a micro-USB type, as shown below.

A standard micro-USB cable will not work. The cable must be a special console micro-USB cable. You can order this part/SKU #: ACC-WIFI-MICRO-USB.

Note: Micro-USB Console Cable
The best practice is to use the Extreme Networks micro USB cable (part number ACC-WIFI-MICRO-USB). When you connect to the device using the micro USB Console port, the management station from which you connect to the device must have a VT100 emulation program, such as TeraTerm Pro (a free terminal emulator) or Hilgraeve HyperTerminal.

Steps

Step 1: Gather Your Equipment

Before you start, ensure you have the following:

An Extreme Cloud AP device
A micro-USB cable
A computer with an available USB port

Step 2: Download the Required Driver

To communicate with the Extreme Cloud AP via the micro-USB port, your computer needs the correct driver installed. Here’s how to download the driver from the FTDI Chip website:

Visit FTDI Chip Drivers page.
Navigate to the USB Drivers section and look for the appropriate driver for your operating system (Windows, macOS, Linux, etc.).
※ The Windows Device Manager will identify the device as FTDI FT232R USB UART.
Click on the download link for the VCP (Virtual COM Port) drivers.
Follow the installation instructions provided on the website or within the downloaded files.

Step 3: Connect the Micro-USB Cable

Power off the Extreme Cloud AP to avoid any configuration issues.
Connect one end of the micro-USB cable to the micro-USB console port on the AP.
Connect the other end of the cable to an available USB port on your computer.
Power on the AP.

Step 4: Access the AP’s Console

After connecting the cable and powering on the AP, you’ll need to access the console through a terminal program such as PuTTY (for Windows) or Terminal (for macOS and Linux).

Open your terminal program of choice.
Configure the terminal session to match the AP’s console settings (typically 9600 baud rate, 8 data bits, no parity, 1 stop bit, and no flow control).
Select the COM port assigned to your USB connection. You can find this in your computer’s Device Manager (Windows) or System Information (macOS).
Once connected, you should see the AP’s console output.

Note: Console baud rate
The AP5010, AP5020 and AP5050 models support 115200 baud rate when using the console port to access the command line interface in IQ Engine (IQE).
All previous Cloud AP models supported 9600 baud.

If the AP is in a factory default state the username/password combination will be one of these two options:
admin/aerohive or admin/Aerohive1

Step 5: Configure Your Extreme Cloud AP

Now that you have access to the AP’s console, you can proceed with its configuration. Follow the on-screen prompts or enter the commands for your specific setup requirements. This process may involve setting up basic network settings, updating the firmware, or configuring the AP for integration into your existing network.

Conclusion

Connecting to your Extreme Cloud AP using a micro-USB cable is a straightforward process that enables direct access for configuration and troubleshooting. Remember, the key to a successful connection lies in having the correct driver installed on your computer. By following these steps, you can ensure a smooth setup experience for your Extreme Cloud AP.

For more detailed information, troubleshooting tips, and advanced configuration options, refer to the Extreme Networks documentation and support resources.

References

How To: XIQ - How to console into an Extreme Cloud (XIQ) AP using a micro USB console cable | Extreme Portal
Q A: Where can I get a console cable for a universal access point? | Extreme Portal
ExtremeWireless Indoor Access Point - Quick Reference - AP5010.pdf

Links

_Index_2_Extreme

Cisco - How to enable SSH in Cisco IOS

2024-02-02T22:00:00.000-08:00

In today’s interconnected world, securing your network infrastructure is paramount. One of the foundational steps towards securing network access is enabling Secure Shell (SSH) on your network devices. SSH provides a secure channel over an unsecured network in a client-server architecture, offering secure remote login from one computer to another. This blog article will guide you through the steps to enable SSH on a Cisco device running the Internetwork Operating System (IOS).

Prerequisites

Before you begin, ensure you have the following:

A Cisco device running IOS 12.2(25)S or later
Access to the Cisco device
Basic knowledge of Cisco IOS commands
The device must have an IP address configured
Ensure the device can resolve domain names (either through a static mapping or DNS)

Step-by-Step Guide

1. Enter Global Configuration Mode

First, access your Cisco device through the console or a Telnet/SSH session. Once you’re in, enter the Global Configuration mode by typing:

configure terminal

You’ll see the prompt change, indicating you’re in configuration mode (e.g., R1(config)#).

2. Set the Hostname and Domain Name

For SSH to function properly, your device needs a unique hostname and domain name. If you haven’t set these already, you can do so with the following commands:

R1(config)#ip domain-name lab.analysisman.com

This command sets the domain name to lab.analysisman.com. Adjust the domain name according to your network’s naming conventions.

3. Generate RSA Key Pair

SSH uses RSA keys for encryption. Generate a key pair with:

R1(config)#crypto key generate rsa

You’ll be prompted to choose the size of the key modulus. While you can select a range between 360 and 2048, a 2048-bit key is recommended for better security:

How many bits in the modulus [512]: 2048

Wait for the key generation process to complete. You’ll see a confirmation message once the keys are generated.

4. Enable SSH and Specify Its Version

After generating the RSA keys, enable SSH and set its version to 2 for enhanced security features:

R1(config)#ip ssh version 2

5. Configure the VTY Lines for SSH Access

Now, configure the Virtual Terminal (VTY) lines to only accept SSH connections:

R1(config)#line vty 0 4
R1(config-line)#transport input ssh

This configuration restricts access to the console lines to SSH only, enhancing security by blocking Telnet and other insecure protocols.

Ensure that users logging in through SSH are authenticated locally:

R1(config-line)#login local

Then, exit the VTY configuration mode:

R1(config-line)#exit

7. Create a Local User

For the login local command to work, you need at least one user account:

R1(config)#username cisco password cisco

Replace cisco with your desired username and password. It’s strongly recommended to use a stronger, unique password for security purposes.

8. Secure the Enable Mode

It’s also a good practice to secure the enable mode with a secret password:

R1(config)#enable secret cisco

Again, choose a strong, unique password instead of cisco.

9. Save the Configuration

Finally, save your configuration to ensure it persists across reboots:

R1#write memory

Or you can use:

R1#copy running-config startup-config

Here is the full configuration snapshot.

R1#configure t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#ip domain-name lab.analysisman.com
R1(config)#crypto key generate rsa
The name for the keys will be: R1.lab.analysisman.com
Choose the size of the key modulus in the range of 360 to 2048 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.

How many bits in the modulus [512]: 2048
% Generating 2048 bit RSA keys, keys will be non-exportable...[OK]

R1(config)#
*Mar  1 00:41:42.199: %SSH-5-ENABLED: SSH 1.99 has been enabled
R1(config)#ip ssh version 2
R1(config)#
R1(config)#line vty 0 4
R1(config-line)#transport input ssh
R1(config-line)#login local
R1(config-line)#exit
R1(config)#
R1(config)#username cisco password cisco
R1(config)#enable secret cisco
R1(config)#end
R1#
*Mar  1 00:43:21.107: %SYS-5-CONFIG_I: Configured from console by console
R1#wr me
Building configuration...
[OK]

Conclusion

You’ve successfully enabled SSH on your Cisco IOS device, significantly improving the security of your device management. Remember, security is an ongoing process, not a one-time setup. Regularly update your device configurations, passwords, and firmware to protect against new vulnerabilities and threats.

For further reading, Cisco provides comprehensive documentation on IOS commands and configuration guides that can delve deeper into advanced security features and best practices.

References

Configure SSH on Routers and Switches - Cisco

Links

_MOC_2_Cisco

What is Extreme Networks Instant Port Profiles (IPP)?

2024-01-28T22:00:00.000-08:00

Introduction

Extreme Networks Instant Port Profiles (IPP) is a feature of ExtremeCloud IQ (XIQ) that automates the configuration of network devices based on the type of device that is connected to the port. This can save network administrators a lot of time and effort, as they no longer need to manually configure each device.

Instant Port Profiles allows the ability to define dynamic port configuration such as VLAN assignment based on wired device types created within an Instant Port Profile. An Instant Port Profile can be assigned to a port within a switch template or device level port configuration.

※ Note: Instant Port Profiles are supported on X435 and Universal Switches running Switch Engine.

Getting started with IPP

To get started with IPP, you will need to enable it in ExtremeCloud IQ. Once IPP is enabled, you will need to create Instant Port Device Types for each type of device that you want to use IPP with. You can then configure the settings for each Instant Port Device Type.

Examples of using IPP

Here are a few examples of how you can use IPP:

Configure VoIP phones in a dedicated VLAN.
Configure guest devices in a guest VLAN.
Combine IoT devices with VoIP in a dedicated VLAN.
Automate device placement into the correct VLAN for devices with port changes.
Provision tagged VLANs for devices such as connected AP.

Some benefits of IPP are:

Reduced operational costs by automating the configuration of devices.
Improved security by ensuring that devices are placed in the correct VLANs.
Improved performance by configuring broadcast suppression for specific devices or device types.

Configurations

Create an IPP within the Switching Section of a Network Policy, assign IPP to ports within a switch template, or within the port configuration of a switch at device level configuration.

Instant Port Profile configuration comprises the following tasks:

Create an Instant Port Profile
Create Instant Port Device Type

Configure an Instant Port Profile

Add or edit an IPP for a switch on the Port Configuration tab of the switch template.

Go to Configure > Network Policies and select a device template for the switch.
On the switch template page, select Port Configuration and then choose one of the following actions:
Add a new IPP
Select + , and then go to Step 3.
Edit a new IPP
Select an existing IPP from the drop-down menu, select Edit icon and then go to Step 3.
Configure the profile settings.

IPP Configuration Settings

Reference: ExtremeCloud IQ User Guide

Create an Instant Port Device Type Profile

Configure a Network Policy with a Switch Template and an Instant Port Profile.

The Port Device Type profile is part of the Instant Port Profile. When a device connects to a switch port, ExtremeCloud IQ uses the criteria defined in this task to determine whether the device port is eligible for application of the Instant Port Profile.

From the Create Instant Port Profile dialog, select + under Device Types.
Configure the Instant Port Device Type settings as described in IPP Device Type Settings.
Select Save to commit changes, or select Cancel.

These configurations are applied automatically when a connected device matches predefined conditions in a profile. Conditions are based on:

MAC Address (partial or exact matches)
LLDP Information (system type, MAC)

IPP allows for custom definitions (device types) and match criteria, enabling automatic VLAN assignment and storm control parameters. IPP offers more granular control over the network configuration based on specific device types.

Device Types and Match Criteria

Device Types: Custom definitions for types of wired devices.
Match Criteria:

MAC Learning
LLDP Src MAC
LLDP Capability
LLDP MAC + Capability

When a match occurs, action parameters specified in the profile are automatically configured by the system, such as managing devices that move between different switch ports and switches while requiring consistent VLAN and port configurations.

[NOTE]
Tagged packets cannot be classified by IPP. For devices expected to send tagged data frames, use only LLDP (Link Layer Discovery Protocol) match configuration.

IPP Device Type Settings

Reference: ExtremeCloud IQ User Guide

Instant Port Profile (IPP) vs. Instant Secure Port Profile

Instant Port Profiles (IPP) and Instant Secure Port Profile are features that allow for automated configuration of switch ports based on the connected devices. The main difference is that Instant Secure Port Profile also offers integrated authentication and policy enforcement through ExtremeCloud Universal ZTNA, a zero-trust network access solution that provides secure connectivity for remote users and devices.

With IPP, you can define device types and match criteria based on MAC address or LLDP information, and assign VLANs and storm control settings to the ports dynamically. With Instant Secure Port Profile, you can also apply security policies and access rules to the devices based on their identity and context, and use encryption and tunneling to protect the data traffic.

Instant Port Profiles and Instant Secure Port Profile are designed to simplify the management of network-connected devices, such as access points, security cameras, and VoIP phones, and to improve the security and performance of the network.

Conclusion

Configuring Instant Port Profiles (IPP) in ExtremeCloud IQ (XIQ) is an automated approach to configuring switch ports based on the connected devices. Instant Port Profiles streamline the management of network-connected devices, such as access points (AP), security cameras, and VoIP devices by dynamically provisioning the appropriate port configuration automatically.

References

ExtremeCloud IQ User Guide
ExtremeCloud IQ Universal Switch Deployment Guide

Links

_Index_2_Extreme

How to improve Ansible YAML error output

2024-01-19T23:50:00.000-08:00

Are you struggling with deciphering errors while writing YAML in Ansible? A simple tweak in your Ansible configuration can vastly improve your error troubleshooting process. In this post, I’ll guide you through the steps to modify your Ansible configuration for better error visibility. You can see how the Before and After have changed as shown below.

Before

After

Step 1: Accessing the Ansible Configuration File

First, you need to access the Ansible configuration file. This file is typically located at /etc/ansible/ansible.cfg. To edit this file, use a text editor like vi. Here’s how you can open it:

sudo vi /etc/ansible/ansible.cfg

Using sudo is essential because the configuration file requires administrative privileges for modifications.

Step 2: Modifying the stdout_callback Option

Once you have the configuration file open in vi, you’re looking to modify the stdout_callback option. By default, this might be set to skippy. The skippy setting is useful for skipping over tasks that don’t have any changes, but it can be less informative when you’re trying to debug.

You’ll change this to debug to get more detailed output, especially useful for troubleshooting YAML syntax and runtime errors.

Locate the line that looks like this:

stdout_callback = skippy

stdout_callback = default

Change it to:

stdout_callback = debug

If you can’t find this line, you might need to add it under the [defaults] section.

Step 3: Saving the Changes

After making the change, save your modifications. In vi, you can do this by pressing Esc, typing :wq, and then pressing Enter. This command writes the changes to the file and quits the editor.

Step 4: Testing the New Configuration

To ensure your changes are effective, run an Ansible playbook. You should now see more detailed output when errors occur, making it easier to identify and fix any issues in your YAML syntax or other Ansible-related errors.

Remember, detailed debug output can be quite verbose, so it’s a good idea to use this setting primarily for debugging purposes.

Conclusion

Enhancing error visibility in Ansible is as simple as changing one line in the configuration file. This small change can save you a significant amount of time in debugging and ensure a smoother automation experience with Ansible. Happy automating!

Palo Alto firewall - How to Push and Install GlobalProtect from the Panorama CLI

2023-07-16T21:00:00.062-07:00

I recently encountered a problem when I upgraded Panorama from 10.2.4 to 11.0.2. The ‘Download’ link in Device Deployment -> GlobalProtect Client on Panorama disappeared! After some research, I found out that this is a bug that affects this version of Panorama. Unfortunately, there is no official fix for this issue yet as of July 17, 2023.

If you need to push GlobalProtect client from Panorama before Palo Alto Networks fixes this bug, you can use a workaround via CLI commands.

Issue/Symptom

You don’t see the ‘Download’ link on PANORAMA → Device Deployment → GlobalProtect Client.

Workaround

Step 1. Check available GlobalProtect client packages from PaloAlto Networks server

admin@panorama> request batch global-protect-client check

Step 2. Download GlobalProtect client packages to Panorama

admin@panorama> request batch global-protect-client download file PanGP-6.0.7

Download job enqueued with jobid 257320 257320

Step 3. Activate the version on Panorama GUI

Go to PANORAMA → Device Deployment → GlobalProtect Client and click 'Activate' and select the firewalls you want to push the new GP Client.

References

How to use Device Deployment in Panorama - Knowledge Base - Palo Alto Networks

Links

_Index_2_Firewall

A10 SLB - How to configure a Layer 4 Virtual Server

2023-01-28T22:00:00.161-08:00

Here is a step-by-step guide on how to configure a Layer 4 virtual server on an A10 Server Load Balancing (SLB) appliance using the CLI command and GUI.

Configure a Layer 4 Virtual Server

Step 1. Enter Configuration Mode

Enter configuration mode by typing the following command:
configure

Step 2. Define Real Servers (nodes/pool members)

Must include object name, IP address or DNS name & port.
A Layer 3 default Health Check will be applied to the Real Server IP addresses.
A Layer 4 default Health Check will be applied to match the ‘port 80 tcp’ command.

CLI

slb server realserver1 10.1.20.11
 port 80 tcp
slb server realserver2 10.1.20.12
 port 80 tcp
slb server realserver3 10.1.20.13
 port 80 tcp
 exit
 exit

GUI

Step 3. Create a Service Group (pool/server farm)

Group of servers that fulfill a service.
Load balancing algorithm applied here. Round Robin is used by default.

CLI

slb service-group webapp1_80 tcp
   member realserver1 80
   member realserver2 80
   member realserver3 80
   exit
   exit

GUI

Step 3-A (Optional). Change the Load Balancing algorithm

Change the Load Balancing algorithm method if needed.

CLI
Here are some of the common load balancing methods available on the A10:

Round Robin: This method distributes incoming traffic equally among all available real servers in a sequential order. It is a simple and straightforward method and is commonly used as the default method.
Least Connections: This method distributes incoming traffic to the real server with the fewest number of active connections. It is useful in scenarios where the real servers have different processing capacities.
Weighted Round Robin: This method distributes incoming traffic to the real servers based on their weight. You can assign a weight value to each real server, and the traffic will be distributed based on the ratio of their weights. This method is useful when you want to control the proportion of traffic sent to each real server.
Source IP Hash: This method distributes incoming traffic based on the source IP address of the incoming request. It ensures that the same source IP address is always sent to the same real server. This method is useful in scenarios where the client needs to maintain persistent connections to the same real server.
Destination IP Hash: This method distributes incoming traffic based on the destination IP address of the incoming request. It ensures that requests for the same destination IP address are always sent to the same real server. This method is useful in scenarios where you want to balance the load based on the destination of the incoming request.

You can specify the load balancing method by using the method or lb-method command followed by the method name. For example, to set the load balancing method to least-connection or least-connections, you would use the following command:

method round-robin
method least-connection
method weighted-rr
method dst-ip-hash
method fastest-response

slb service-group webapp1_80 tcp
	method least-connection

---
lb-method round-robin
lb-method least-connections
lb-method weighted-round-robin
lb-method source-ip-hash
lb-method destination-ip-hash

slb service-group webapp1_80 tcp
	lb-method least-connections

※ Note: The method command is typically found in newer software versions of the A10 Thunder series of load balancers, such as the TH3030S.

The lb-method command, on the other hand, is typically found in older software versions of A10 load balancers.

GUI

Step 4. Create Source NAT Pool

CLI

ip nat pool webapp_srcnat 10.1.20.240 10.1.20.241 netmask /24

GUI

Step 5. Create Virtual Server (vserver/vip/virtual address)

Must include object name, IP address and port (vport).
A virtual server is the combination of the real servers and ACOS device, which together appear as a single server to the client.

CLI

slb virtual-server webapp1 10.1.10.11
 port 80 tcp
  source-nat pool webapp_srcnat
  service-group webapp1_80
  exit
  exit
  exit

GUI

Step 6. Exit Configuration Mode and Save Configuration

To exit configuration mode, use the following command:
end

To save the configuration, use the following command:
write memory

Step 7. Check the Virtual Server status

To check the status of the virtual server, use the following command:
show slb virtual-server bind

Step 8. Test service access on a web browser

To test service access, open a web browser and enter the virtual IP address ‘10.1.10.11’ in the address bar. You should be able to access the service hosted on the real servers.

※ Note: The commands and syntax used in this guide may vary depending on the version and model of your A10 Server Load Balancer. It is recommended to consult the official documentation for the exact commands and syntax for your specific device.

References

(240) A10- Configure a Layer 4 Virtual Server in 4 Steps - YouTube

Links

_Index_2_Network

Procrastination No More - Proven Techniques to Boost Productivity and Get Things Done

2023-01-21T22:00:00.005-08:00

If you’re struggling with procrastination, you’re not alone. Many of us have trouble getting started on tasks, despite knowing we need to do them. To help you overcome this common challenge, here are 10 tips for avoiding procrastination:

Setting clear and specific goals:
Break your tasks into smaller, more manageable chunks and set clear deadlines for yourself.
Prioritizing tasks:
Identify the Most Important Tasks (MIT) and focus on them first.
Eliminating distractions:
Remove anything that might distract you while you work, such as your phone or social media.
Using a timer:
Set a timer for a specific amount of time and work on a task until the timer goes off.
Using the Pomodoro Technique:
Break your work into 25-minute intervals, with short breaks in between.
Using the Eisenhower matrix:
Prioritize your tasks by urgency and importance.
Using positive self-talk:
Encourage yourself with positive affirmations and remind yourself of the benefits of completing the task.
Using rewards:
Reward yourself for completing tasks to motivate yourself.
Using accountability:
Share your goals and progress with others to hold yourself accountable.
Taking care of yourself:
Make sure to get enough sleep, exercise, and eat well to help keep your energy levels up.

Procrastination can be a tough habit to break, but by implementing these strategies, you’ll be on your way to becoming more productive and achieving your goals. Remember, the key is to stay focused and motivated, and to not let yourself get bogged down by distractions.

References

Pomodoro Technique - Wikipedia
Eisenhower Matrix | Prioritization Framework | Definition and Examples

Links

_Index_3_Habit

Extreme Switch - How to configure NTP and SNTP in EXOS

2023-01-19T20:00:00.020-08:00

Network Time Protocol (NTP) is a widely used method for synchronizing time across devices on a network. Here are two methods for configuring time synchronization on an EXOS switch.

NTP (Network Time Protocol)

The feature of NTP was added to EXOS in version 12.7. From version 12.7 to 15.4, an additional component called NTP XMOD was needed to configure and use the feature. However, starting from EXOS version 15.5, NTP is already included in the standard EXOS image, so there is no need for the NTP XMOD component.

Step 1. Configure the following commands

configure ntp server add clock.sjc.he.net vr VR-Default
configure ntp server add time.google.com vr VR-Default
enable ntp vr VR-Default
enable ntp vlan v100

Command syntax

configure ntp [server | peer] add [ip_address | host_name] {key keyid} {option [burst | initial-burst]} 
{{vr} vr_name}

If no VR is specified, VR-Default will be used by default.

Step 2. Check NTP association with NTP servers

EXOS# show ntp association
VR Name               Remote                    Reference ID    St Poll Reach Delay   Offset   Disp
===================== ========================= =============== == ==== ===== ======= ======== =======
VR-Default            *!time.google.com         .GOOG.          1  1024 377   0.05095 -0.00021 0.12369
VR-Default            .!clock.sjc.he.net        162.159.200.123 4  1024 377   0.01360 +0.00061 0.13824

St(ratum)   : Distance from the reference clock
Disp(ersion): Maximum offset error of clock
Flags       : (*) System Peer, (.) Candidate, (#) Short List, (!) Configured

Step 3. Check current time

Check the current time with the following command.

EXOS # show time
Thu Jan 19 19:37:07 PST(UTC-480) 2023

SNTP (Simple Network Time Protocol)

SNTP (Simple Network Time Protocol) and NTP (Network Time Protocol) are both used for synchronizing time across devices on a network. NTP is a more robust and accurate protocol, while SNTP is a simplified version that is less accurate but also less resource-intensive. SNTP is typically used for devices with limited processing power, while NTP is used for more critical systems that require precise time synchronization.

Step 1. Configure the following commands

configure sntp-client primary clock.sjc.he.net vr VR-Default
configure sntp-client secondary time.google.com vr VR-Default
configure sntp-client broadcast vr VR-Default

Please change the server name or IP address if you have preferred hosts.

Command syntax

configure sntp-client [primary | secondary] host-name-or-ip {vr vr_name}

Queries are first sent to the primary server. If the primary server does not respond within 1 second, or if it is not synchronized, the switch queries the second server. If the switch cannot obtain the time, it restarts the query process. Otherwise, the switch waits for the sntp-client update-interval before querying again.

(Optional) Configure the update interval

Change the update interval with the following command if required.

EXOS # configure sntp-client update-interval ?
  <update-interval>  update interval in seconds [16-16284]. (Default 64)

The following example configures a primary NTP server:

configure sntp-client primary 216.218.254.202

The following example configures the primary NTP server to use the management virtual router VR- Mgmt:

configure sntp-client primary 216.218.254.202 vr VR-Mgmt

Step 2. Check SNTP validation with NTP servers

EXOS# show sntp-client
SNTP client is enabled
SNTP time is valid
Primary server:clock.sjc.he.net  VR-Default
Secondary server:time.google.com  VR-Default
Broadcasts: VR-Default
Query interval:64
Last valid SNTP update: From server:clock.sjc.he.net, on Thu Jan 19 19:42:38 2023

SNTPC Statistics:
 Packets transmitted:
  to primary server:            1
  to secondary server:          0
 Packets received with valid time:
  from Primary server:          1
  from Secondary server:        0
  from Broadcast server:        0
 Packets received without valid time:
  from Primary server:          0
  from Secondary server:        0
  from Broadcast server:        0
 Replies not received to requests:
  from Primary server:          0
  from Secondary server:        0

Step 3. Check current time

Check the current time with the following command.

EXOS # show time
Thu Jan 19 19:37:07 PST(UTC-480) 2023

You may use the ‘show switch’ command to check the current time.

EXOS# show switch

SysName:          X440G2-12p-10G4
SysLocation:      Address
SysContact:       support@extremenetworks.com, +1 888 257 3000
System MAC:       00:04:96:9A:12:XX
System Type:      X440G2-12p-10G4

SysHealth check:  Enabled (Normal)
Recovery Mode:    All
System Watchdog:  Enabled

Current Time:     Thu Jan 19 19:45:53 2023
Timezone:         [Auto DST Enabled] GMT Offset: -480 minutes, name is PST.
                  DST of 60 minutes is currently not in effect, name is not set.
                  DST begins every second Sunday March at 2:00
                  DST ends every first Sunday November at 2:00

Is it possible to configure NTP and SNTP simultaneously in EXOS?

No. It is not possible to configure both SNTP and NTP simultaneously on a device. To enable NTP or switch to using the device as an NTP server, it may be necessary to first disable SNTP.

EXOS# enable ntp
EXOS# enable sntp-client
Error: NTP is already enabled. To use SNTP, please disable NTP at first and then enable SNTP.

EXOS# enable sntp-client
EXOS# enable ntp
Error: SNTP is already enabled. To use NTP, please disable SNTP at first and then enable NTP.

References

Q A: How to Configure NTP on EXOS switch? | Extreme Portal

Links

_Index_2_Extreme

Abstracts written by ChatGPT, even scientists cannot distinguish

2023-01-15T13:07:00.003-08:00

My Thoughts

You cannot go against human nature.
If research institutes do not ban AI-generated papers, scientists will be tempted.
A British AI thought leader and author Nina Schick believes that by 2025 more than 90% of Internet content will be created by AI, and I agree. It’s just a matter of time.
I expect the market for tools or services to determine AI production will grow in the future.

Summary

Papers created by chatbots, even scientists cannot distinguish
Paper abstracts written by ChatGPT pass 100% plagiarism check
AI creation inspection program catches 66% machine-written
Humans mistakenly judge 32% of chatbot-generated abstracts as real abstracts
There are cases of posting ChatGPT as a co-author in papers.
There are cases in which research institutes ban papers written with ChatGPT or other AI language tools.
If quantitative evaluation of papers continues, scientists may be tempted to increase the number of AI-generated abstracts or papers.
Irren Soleiman of AI company Hugging Face says,

These models are trained on past information and social and scientific progress can often come from thinking, or being open to thinking, differently from the past.

References

Abstracts written by ChatGPT fool scientists
90% of online content could be ‘generated by AI by 2025,’ expert says

Links

_Index_2_AI

ChatGPT competitor emerges - Anthropic's Claude

2023-01-14T20:02:00.003-08:00

My Thoughts

As a competitor to ChatGPT, start-up Anthropic has launched an artificial intelligence system called Claude.
Still in closed beta, but receiving $700M in funding.
Opinions of those who tested the comparison are that Claude tries to answer in more detail than ChatGPT.
Claude was good in areas such as jokes, but overall ChatGPT still seemed to dominate.
ChatGPT’s huge popularity makes it more likely that similar competitors or services will emerge.
ChatGPT is preparing for a paid version along with the paid version Professional, and it is expected that money will flow to the AI market as competitors emerge.

Summary

Anthropic, a startup co-founded by former OpenAI employees, develops an AI system similar to OpenAI’s ChatGPT.
The system, called Claude, is currently in closed beta.
- Related Twitter thread - currently not accepting sign up
Created using a technology called Constitutional AI
- Construct AI provides a “principle-based” approach to matching AI systems with human intent, allowing ChatGPT-like AI to answer questions using a simple set of principles as a guide.
- The approximately 10 principles that shape this construct AI are based on the concepts of benevolence (maximizing positive impact), non-maliciousness (avoiding harmful advice), and autonomy (respecting freedom of choice).
Claude learned the probabilities of words occurring based on patterns, such as the semantic context of the surrounding text, from the huge number of text examples pulled from the web.
OpenAI’s ChatGPT vs. AnthropicAI’s Claude Comparison
- Asked to Compare Himself to Machines from Science Fiction ‘The Cyberiad’ Asked to Write Poetry - Related Twitter
- Comparing Stanford AI Lab PhD Students - Related Twitter
- Both are similar, but Claude tries to be more helpful, follows requests more closely, and is better at writing in English. Worst coding, worst French, longer response.
AI researcher Dan Elton’s Claude vs. ChatGPT vs. Amazon Alexa Comparison - Related Twitter
- Claude jokes better than ChatGPT.
- Claude is worse at math and coding than ChatGPT.

References

Anthropic’s Claude improves on ChatGPT but still suffers from limitations | TechCrunch

Links

_Index_2_AI

Extreme Switch - How to configure DHCP Client in EXOS

2022-12-10T22:00:00.005-08:00

Here are the commands to configure the DHCP client with a VLAN in the EXOS switch.

Option 1. enable dhcp vlan

Enable DHCP on a VLAN to obtain an IP address for the VLAN from a DHCP server.
If the IPv4/IPv6 keyword is not specified, IPv4 is taken as default for the mentioned VLAN.

Command syntax:

enable dhcp [ipv4 | ipv6] [vlan_name | all]

Example:

enable dhcp vlan Default
enable dhcp ipv6 vlan Default

You may want to enable DHCP for the Management VLAN as below.

enable dhcp vlan Mgmt
enable dhcp ipv6 vlan Mgmt

If you want to enable DHCP for all VLANs, use the following command.

enable dhcp vlan all

Option 2. enable dhcp ports vlan

Enable DHCP on a specific port or a range of ports in a VLAN.

Command syntax:

enable dhcp ports port_list vlan vlan_name

Example:

enable dhcp ports 48 vlan Default
enable dhcp ports 47-48 vlan Default

Supported EXOS version

This command was first available in ExtremeXOS 10.1.
This command was modified in ExtremeXOS 15.6 to include the ipv4 and ipv6 keywords.

References

ExtremeXOS 30.1 - Extreme Networks

Links

Index_2_Extreme
Extreme Switch - How to configure DHCP Server in EXOS | AnalysisMan

Free high quality stock images sites

2022-11-05T22:00:00.027-07:00

Here are free high-quality stock photo sites I use for my blog. Get it for free from one of these websites!

Adobe Stock

Top quality stock photos, illustrations, templates and more.
https://stock.adobe.com/free

Pixabay

The biggest collection of free stock photos and illustrations online.
https://pixabay.com/

Pexels

Good choice for web or app designers.
https://www.pexels.com/

Unsplash

Well curated collection of beautiful photos donated by skilled photographers.
https://unsplash.com/

Picjumbo

Free stock photo site created in 2013 by designer and photographer Viktor Hanacek.
https://picjumbo.com/

StockSnap

Free stock image site created by the same team behind graphic design tool Snappa.
https://stocksnap.io/

Burst

Free stock photo platform powered by Shopify.
https://burst.shopify.com/

Stockio

Stockio allows you to download not just stock photos, but also vectors, fonts, videos and icons.
https://www.stockio.com/

Canva

Canva is a platform for creating visual content. The site provides millions of high-quality free photos to create beautiful designs.
https://www.canva.com/photos/free/

Gratisography

Quirky images you won’t see anywhere else
https://gratisography.com/

Reshot

Unlike many other stock photo sites, Reshot has a wide variety of vector illustrations and icons as well.
https://www.reshot.com/

123RF

Best free stock photos site for optimizing images for social media
https://www.123rf.com/

Vecteezy

Professional quality vector art, stock photos and videos.
https://www.vecteezy.com/

References

22 Amazing Sites With Breathtaking Free Stock Photos (2022 Update)

Links

[[Index_Tags_Free]]

How to change web browser via Terminal on macOS?

2022-10-16T22:00:00.044-07:00

Step 1. Install Homebrew

Homebrew is an essential package for Mac users. Homebrew allows us to install the latest and updated version of popular applications, packages, and developer tools.

Here is a link to how to install Homebrew on macOS.

Step 2. Install defbro

Install defbro via the following brew command.

macOS:/Users/analysisman% brew install jwbargsten/misc/defbro

Running `brew update --auto-update`...
==> Auto-updated Homebrew!
Updated 2 taps (homebrew/core and homebrew/cask).
==> New Formulae
autocorrect                  fonts-encodings              iir1                         ...snipped...

==> Tapping jwbargsten/misc
Cloning into '/opt/homebrew/Library/Taps/jwbargsten/homebrew-misc'...
remote: Enumerating objects: 23, done.
remote: Counting objects: 100% (23/23), done.
remote: Compressing objects: 100% (16/16), done.
remote: Total 23 (delta 3), reused 20 (delta 3), pack-reused 0
Receiving objects: 100% (23/23), 4.70 KiB | 4.70 MiB/s, done.
Resolving deltas: 100% (3/3), done.
Tapped 1 formula (16 files, 14.2KB).
==> Downloading https://github.com/jwbargsten/defbro/archive/refs/tags/v0.0.1.tar.gz
==> Downloading from https://codeload.github.com/jwbargsten/defbro/tar.gz/refs/tags/v0.0.1
##O#-#
==> Installing defbro from jwbargsten/misc
==> swift build --disable-sandbox --configuration release
🍺  /opt/homebrew/Cellar/defbro/0.0.1: 5 files, 1.4MB, built in 42 seconds
==> Running `brew cleanup defbro`...
Disable this behaviour by setting HOMEBREW_NO_INSTALL_CLEANUP.
Hide these hints with HOMEBREW_NO_ENV_HINTS (see `man brew`).
==> `brew cleanup` has not been run in the last 30 days, running now...
Disable this behaviour by setting HOMEBREW_NO_INSTALL_CLEANUP.
Hide these hints with HOMEBREW_NO_ENV_HINTS (see `man brew`).
Removing: /Users/analysisman/Library/Caches/Homebrew/ca-certificates--2022-07-19 (125.8KB)
Removing: /Users/analysisman/Library/Caches/Homebrew/gettext--patch--35abc93c.diff... (960B)
Removing: /Users/analysisman/Library/Caches/Homebrew/gettext--0.21.tar.gz... (23MB)
Removing: /Users/analysisman/Library/Caches/Homebrew/glib--2.72.3... (6.3MB)
Removing: /Users/analysisman/Library/Caches/Homebrew/gnutls--3.7.7... (3.0MB)
Removing: /Users/analysisman/Library/Logs/Homebrew/jansson... (64B)
Removing: /Users/analysisman/Library/Logs/Homebrew/mtr... (64B)

Step 3. Check your current default web browser

macOS:/Users/analysisman% defbro
  org.torproject.torbrowser (Tor Browser)
  org.mozilla.firefox (Firefox)
  company.thebrowser.Browser (Arc)
  com.parallels.winapp.a5c41f715c1b8a880253846c025624e9.a0d8d48a6b0c5d (Microsoft Edge)
  com.parallels.winapp.76868ae832f6c6bd26cadc7d7c269986.a0d8d4eaed9a5d (Google Chrome)
  com.parallels.desktop.console (Parallels Desktop)
  com.microsoft.edgemac (Microsoft Edge)
  com.microsoft.edgemac (Microsoft Edge)
  com.microsoft.edgemac (Microsoft Edge)
  com.googlecode.iterm2 (iTerm2)
  com.google.Chrome (Google Chrome)
  com.browserosaurus (Browserosaurus)
  com.brave.Browser (Brave Browser)
* com.apple.Safari (Safari)
  com.TechSmith.Snagit2021 (Snagit 2021)

Step 4. Change your default web browser

macOS:/Users/analysisman% defbro com.google.Chrome
  org.torproject.torbrowser (Tor Browser)
  org.mozilla.firefox (Firefox)
  company.thebrowser.Browser (Arc)
  com.parallels.winapp.a5c41f715c1b8a880253846c025624e9.a0d8d4ec7d0c5d (Microsoft Edge)
  com.parallels.winapp.76868ae832f6c6bd26cadc7d7c269986.a0d8d4eae70c5d (Google Chrome)
  com.parallels.desktop.console (Parallels Desktop)
  com.microsoft.edgemac (Microsoft Edge)
  com.microsoft.edgemac (Microsoft Edge)
  com.microsoft.edgemac (Microsoft Edge)
  com.googlecode.iterm2 (iTerm2)
  com.google.Chrome (Google Chrome)
  com.browserosaurus (Browserosaurus)
  com.brave.Browser (Brave Browser)
* com.apple.Safari (Safari)
  com.TechSmith.Snagit2021 (Snagit 2021)
setting default browser to com.google.Chrome

References

macos - Set default web browser via command line? - Stack Overflow

Links

[[_Index_2_macOS]]

How to become the root user via Terminal on macOS?

2022-10-15T22:00:00.028-07:00

There are two ways of becoming the root user on the macOS terminal.

Option 1. sudo -i

Run the following commands on the Terminal.

macOS:/Users/eryu% whoami
analysisman

macOS:/Users/eryu% sudo -i
Password:

macOS:~ root# whoami
root

macOS:~ root# exit
logout

Option 2. sudo su

Run the following commands on the Terminal.

macOS:/Users/eryu% whoami
analysisman

macOS:/Users/eryu% sudo su
Password:

%m:%d%% whoami
root

%m:%d%% exit
exit

References

https://superuser.com/questions/592323/how-do-i-become-root-on-mac-os-x

Links

[[_Index_2_macOS]]

No Audio when using Plantronics (Poly) headset

2022-09-03T22:00:00.050-07:00

My headset, Plantronics (Poly) Savi 8220 Office Wireless DECT Headset worked well for more than a year. Then, out of the blue, the audio stopped working. During a conference call on Zoom, I couldn’t hear my colleague’s voice. But they could hear my voice. It worked again if I power cycled the headset base.

Symptoms

No audio is heard from the headset while you are on Zoom or Teams call.
I cannot hear the user, but the person on the other line can hear my voice.

Resolution

Update the headset firmware.

Step 1

Download the Plantronics Hub Software at poly.com Downloads & Apps site.

Step 2

Once downloaded, make sure that your USB headset is plugged into a USB port on your computer directly. You will get a warning message as below.

Step 3

Look for “Notifications” that should appear in the upper right side of the screen. Click on that.

Step 4

On the next screen, you’ll be looking for “update”. Click on the ‘Savi 8200 Series.‘ If you click ‘W8220T’, you will get ‘USB Connection Required’ warning even though you connected the USB cable directly.

Step 5

On the next screen, you should see “Updating Firmware…”. And both notifications will be disappeared after upgrading only Savi 8200 Series.

In most cases, going through this firmware upgrade will fix many issues.

Links

[[_Index_2_IT]]

My console cable didn’t work

2022-08-06T22:00:00.009-07:00

I don’t know when my console cable (Cable Matters USB C to RJ45 Console Cable) didn’t work. It is unclear whether it was after changing the MacBook to the M1 or updating the macOS. I haven’t used a console cable in a while.

I re-downloaded and installed the driver from the Cables Matters support site, but it didn’t work. However, it works well when I use the USB-C type TRENDnet TU-S9 console cable, which was used in the old MacBook, along with a USB C to USB A adapter.

I talked to the manager about buying a console cable that supports USB-C, and he mentioned a software called Serial.

Here is a solution!

The Serial offered a 7-day free trial, so I tried it right away.
When I connect the Cable Matters Console Cable, it connects immediately without driver installation!

The price is not low at $39.99, but it is good because you can connect the console cable comfortably without installing a driver. It is recommended for network engineers who have struggled with connecting the console.

Serial 2

https://www.decisivetactics.com/products/serial/

Supported Features

Hex View
SSH Support
Telnet and Raw Socket Support
Flawless Emulation
No Drivers

Additional Features

Compatibility
File Transfers
Profiles
Logging
Timestamping
Extended Baud Rates
Break Support
Bluetooth

Links

[[_Index_2_Network]]

Extreme Switch - How to verify SSH algorithms in EXOS?

2022-07-17T22:00:00.032-07:00

There are two ways to identify SSH ciphers used in EXOS.

Option 1. Using Nmap without ssh into the switch

Use the following command with Nmap in Linux, macOS, or Zenmap in Windows.
nmap -sV -p 22 --script ssh2-enum-algos 192.168.1.2

macOS:/Users/analysisman% nmap -sV -p 22 --script ssh2-enum-algos 192.168.1.2
Password:
Starting Nmap 7.80 ( https://nmap.org ) at 2020-11-04 23:16 PST
Nmap scan report for 192.168.1.2
Host is up (0.0028s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.1 (protocol 2.0)
| ssh2-enum-algos:
|   kex_algorithms: (4)
|       diffie-hellman-group14-sha1
|       diffie-hellman-group14-sha256
|       diffie-hellman-group16-sha512
|       diffie-hellman-group18-sha512
|   server_host_key_algorithms: (1)
|       ssh-rsa
|   encryption_algorithms: (4)
|       chacha20-poly1305@openssh.com
|       aes128-ctr
|       aes192-ctr
|       aes256-ctr
|   mac_algorithms: (6)
|       hmac-sha2-256-etm@openssh.com
|       hmac-sha2-512-etm@openssh.com
|       hmac-sha1-etm@openssh.com
|       hmac-sha2-256
|       hmac-sha2-512
|       hmac-sha1
|   compression_algorithms: (2)
|       none
|_      zlib@openssh.com
MAC Address: 00:04:96:9B:55:AD (Extreme Networks)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 3.2 - 4.9 (96%), Linux 3.11 (96%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 
Network Camera (Linux 2.6.17) (94%), Linux 3.10 (94%), Linux 2.6.18 (93%), Linux 3.16 (93%), Linux 3.18 (93%), Linux 2.6.32 (93%)

No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.11 seconds

Option 2. CLI command in EXOS

The “show ssh2” command will show key type, ciphers, public key algorithms, etc.
show ssh2

X440G2-12p-10G4.2 # sho ssh2
SSH module configuration details:
SSH Access            : Enabled
Key validity          : Valid
Key type              : RSA 2048
TCP port              : 22
VR                    : all
Access profile        : not set
Secure Mode           : Off
Diffie-Hellman Groups : 14 (2048 bits), 16 (4096 bits), 18 (8192 bits)
Max Auth Tries        : 3
Idle time             : 60 minutes
Rekey Interval        : 4096 MB and no time limit
Ciphers               : chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr
Macs                  : hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, 
hmac-sha1-etm@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-sha1
Public key algorithms : ssh-rsa, x509v3-sign-rsa, x509v3-sign-dss
Login grace timeout   : 120 seconds

To enable or disable Cipher, use the following command.

# configure ssh2 enable cipher {all/<cipher>}

※ NOTE: You must have version 16.2.5.4-patch1-31 or later (the previous version will not allow this command).

Links

[[_Index_of_EXOS]]
Extreme Switch - How to enable SSH in EXOS

Cisco - Identity PSK (IPSK)

2022-07-16T22:00:00.034-07:00

What is Cisco Meraki IPSK?

With the WLC 8.5 code's release, Cisco introduced Identity Pre-Shared Key (IPSK), aka iPSK. Other wireless networking vendors like Extreme Networks have a similar solution called Private Pre-Shared Key (PPSK).

IPSK creates unique pre-shared keys for individuals or groups of users on the same SSID. It allows for the flexibility of using the same SSID for everything PSK related while still having different keys and policies on the network.

Here is a simple demo that shows how to configure IPSK with RADIUS using Identity Service Engine (ISE).
https://youtu.be/deEv-aNXfL0

Why IPSK?

WPA2-Enterprise with 802.1X authentication is commonly used for many enterprises, whereas home users use WPA/WPA2 Personal (aka WPA-PSK). Not all of these devices support 802.1x supplicant, so the enterprises need an alternative solution to connect the devices, such as IoT, sensors, BYOD, guests, etc. WPA-PSK could be considered an alternative, but the pre-shared key is the same for all clients connecting to the same WLAN. However, it may result in the key being shared with unauthorized users resulting in a security breach.

IPSK resolves these issues by allowing the flexibility to assign AAA override attributes such as VLAN, QoS marking, and ACL, which are normally reserved for 802.1X WLANs.

How to configure IPSK?

Please refer to the following sites.
Cisco Identify PSK - What is it, and how is it configured?
Implementing Cisco iPSK with ISE – Ripples in Harmony

References

8.5 Identity PSK Feature Deployment Guide - Cisco

Links

_Index_Cisco

AnalysisMan

Extreme Switch - How to ping IPv6 Link-Local address

Introduction

Symptoms

Cause

Resolution

Steps:

Example

References

Links

Extreme Switch - Troubleshooting BGP issue in EXOS

Verify the BGP neighbors

Verify that the session is really up

IPv6 peer example

Confirm the negotiated address-families

Inspect what you send to the peer

IPv6 equivalent

Inspect what you receive

Check the local BGP and IP routing tables

For IPv4 BGP

For IPv6 BGP

Typical culprits and quick fixes

Handy IPv6 configuration snippets

Advertise a local /48

Create an IPv6 eBGP peer

Display IPv6 routes

References

Links

IPv6 Tools Online for Network Engineers

IPv6 Subnet Calculator

IPv6 DNS Lookup

IPv6 Prefix Search in ISPs

IPv6 DNS Servers

Google

Cloudflare

Open DNS

IPv6 settings for your device

Test your IPv6 connectivity

References

Links

Extreme Networks SD-WAN Appliance Models

SD-WAN Appliance Specifications

SD-WAN Appliance for Branch Offices

SD-WAN Appliance for Data Center

! NOTE:

References

Links

Extreme Switch - How to check GBIC (SFP, SFP+) information in EXOS

Additional Commands

References

Links

SD-WAN Terminology for Extreme SD-WAN

TCP/IP Packet Format

Data Encapsulation

TCP Header - RFC 173

UDP Header - RFC 768

IP Header - RFC 791, 1349, 2474, 3168

IPv6 Header - RFC 2460 (IPv6 Spec)

References

Extreme Wireless - How to console into Extreme Cloud AP using a micro-USB cable

Introduction

Steps

Step 1: Gather Your Equipment

Step 2: Download the Required Driver

Step 3: Connect the Micro-USB Cable

Step 4: Access the AP’s Console

Step 5: Configure Your Extreme Cloud AP

Conclusion

References

Links

Cisco - How to enable SSH in Cisco IOS

Prerequisites

Step-by-Step Guide

1. Enter Global Configuration Mode

2. Set the Hostname and Domain Name

3. Generate RSA Key Pair

4. Enable SSH and Specify Its Version

5. Configure the VTY Lines for SSH Access

6. Enable Local Login and Exit VTY Configuration

8. Secure the Enable Mode